{"url_path":"/sec/ifbd/10-k/2026/item-15","section_key":"item-15","section_title":"Item 15 CONTROLS AND PROCEDURES**","topic":"sec","document":{"doc_type":"20-F/A","doc_date":"2026-06-12","source_url":"https://www.sec.gov/Archives/edgar/data/1815566/0001731122-26-000847-index.html","accession_number":"0001731122-26-000847","cik":"0001815566","ticker":"IFBD","issuer_name":"Infobird Co., Ltd","edgar_url":"https://www.sec.gov/Archives/edgar/data/1815566/0001731122-26-000847-index.html","primary_entity_key":"0001815566","primary_entity_name":"Infobird Co., Ltd"},"word_count":1216,"has_tables":true,"body_markdown":"**ITEM 15. CONTROLS AND PROCEDURES**\n\n \n\n**(a)****Evaluation of Disclosure Controls and Procedures**\n\n \n\nUnder the supervision and with\nthe participation of our management, including our chief executive officer and our chief financial officer, we carried out an evaluation\nof the effectiveness of our disclosure controls and procedures, which is defined in Rules 13a-15(e) and 15d-15(e) of the Exchange\nAct, as of the end of the period covered by this annual report. Based upon that evaluation, our management, with the participation of\nour chief executive officer and chief financial officer, has concluded that, due to the material weaknesses described below under “Management’s\nAnnual Report on Internal Control Over Financial Reporting”, as of the end of the period covered by this annual report, our disclosure\ncontrols and procedures were not effective in ensuring that the information required to be disclosed by us in this annual report is recorded,\nprocessed, summarized and reported to them for assessment, and required disclosure is made within the time period specified in the rules\nand forms of the SEC.\n\n \n\nAs a company with less than $1.235\nbillion in revenue for our last fiscal year, we qualify as an “emerging growth company” pursuant to the JOBS Act. An emerging\ngrowth company may take advantage of specified reduced reporting and other requirements that are otherwise applicable generally to public\ncompanies. These provisions include exemption from the auditor attestation requirement under Section 404 of the Sarbanes-Oxley Act of\n2002, in the assessment of the emerging growth company’s internal control over financial reporting. The JOBS Act also provides that\nan emerging growth company does not need to comply with any new or revised financial accounting standards until such date that a private\ncompany is otherwise required to comply with such new or revised accounting standards.\n\n \n\n**(b)****Management’s Annual Report on Internal Control over Financial Reporting**\n\n \n\nOur management is responsible\nfor establishing and maintaining adequate internal control over financial reporting. Internal control over financial reporting, as defined\nin Rules 13a-15(f) and 15d-15(f) of the Exchange Act, is a process designed by, or under the supervision of, our chief executive officer\nand our chief financial officer, and effected by our board of directors, management and other personnel, to provide reasonable assurance\nregarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with\ngenerally accepted accounting principles. Internal control over financial reporting includes those policies and procedures that:\n\n \n\n \n●\npertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of our assets;\n\n \n \n \n\n \n●\nprovide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that our receipts and expenditures are being made only in accordance with authorizations of our management and our board of directors; and\n\n \n \n \n\n \n●\nprovide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on our financial statements.\n\n \n\nInternal control over financial\nreporting cannot provide absolute assurance of achieving financial reporting objectives because of its inherent limitations. Internal\ncontrol over financial reporting is a process that involves human diligence and compliance and is subject to lapses in judgment and breakdowns\nresulting from human failures. Internal control over financial reporting can also be circumvented by collusion or improper override. Because\nof such limitations, there is a risk that material misstatements may not be prevented or detected on a timely basis by internal control\nover financial reporting. However, these inherent limitations are known features of the financial reporting process, and it is possible\nto design into the process safeguards to reduce, though not eliminate, this risk.\n\n \n\n116\n\n \n\n \n\nOur management assessed the effectiveness\nof our internal control over financial reporting as of December 31, 2025. In making its assessment, management used the criteria described\nin *Internal Control-Integrated Framework*(2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission\n(COSO). Based on its assessment, management has concluded that our internal control over financial reporting was ineffective as of December\n31, 2025 based on the material weaknesses described below. A “material weakness” is a deficiency, or a combination of deficiencies,\nin internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the company’s\nannual or interim financial statements will not be prevented or detected on a timely basis.\n\n \n\nIn the course of auditing our\nconsolidated financial statements for year ended December 31, 2025, seven material weaknesses were identified in our internal control\nover financial reporting, as defined in the standards established by the Public Company Accounting Oversight Board of the United States.\n\n \n\nThe material weaknesses identified\nrelate to (i) deficiencies in third party vendor management, (ii) deficiencies in backup management and recovery management, (iii) deficiencies\nin user accounts management, (iv) lack of segregation of duties and monitoring of privileged accounts, (v) deficiencies in monitoring\naccess to systems and data, (vi) deficiencies in password management and (vii) deficiencies in vulnerability assessment and patch management.\n\n \n\nWe are currently in the process\nof remediating the material weaknesses described above and we intend to continue implementing the following measures, among others, to\nremediate the material weaknesses. We plan to:\n\n \n\n \n1.\nprepare a systematic policies and procedures manual for our IT processes in order to develop enhanced risk assessment procedures and controls related to changes in IT systems;\n\n \n \n \n\n \n2.\nregularly conduct internal evaluation for IT-related departments and all IT staff;\n\n \n \n \n\n \n3.\nregularly conduct network security training for IT employees to provide employees with security awareness;\n\n \n \n \n\n \n4.\nestablish a qualification assessment procedure for third-party service providers;\n\n \n \n \n\n \n5.\nimprove demand analysis and detailed design/specification of new IT projects. All new IT projects undergo user acceptance testing and implementation approval;\n\n \n \n \n\n \n6.\nensure system and information security, strictly control the approval of system permissions and review them regularly, enforce password complexity policies, and regularly audit and analyze logs; and\n\n \n \n \n\n \n7.\nenforce and monitor IT standard procedures and safety management specifications.\n\n \n\nAs we were in the process of\nimplementing such remedial measures as of December 31, 2025, our management concluded that the material weaknesses had not been fully\nremediated and that such material weaknesses still existed.\n\n \n\nWe are fully committed to continuing\nto implement measures to remediate our material weaknesses and significant deficiencies in our internal control over financial reporting.\nHowever, we cannot assure you that we will remediate our material weaknesses and significant deficiencies in a timely manner. See above\nand “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business—If we fail to implement and maintain\nan effective system of internal control, we may be unable to accurately report our operating results, meet our reporting obligations or\nprevent fraud.”\n\n \n\n**(c)****Attestation Report of the Registered Public Accounting Firm**\n\n \n\nThis annual report does not include\nan attestation report of our independent registered public accounting firm due to an exemption established by the rules of the SEC for\nemerging growth companies.\n\n \n\n117\n\n \n\n \n\n**(d)****Changes in Internal Control Over Financial Reporting**\n\n \n\nOther than as described above,\nthere were no changes in our internal controls over financial reporting identified in connection with the evaluation required by Rules\n13a-15 or 15d-15 of the Exchange Act that occurred during the period covered by this annual report that has materially affected, or is\nreasonably likely to materially affect, our internal control over financial reporting."}