{"url_path":"/sec/payd/10-k/2026/item-9a","section_key":"item-9a","section_title":"Item 9A Controls and Procedures**","topic":"sec","document":{"doc_type":"10-K","doc_date":"2026-03-31","source_url":"https://www.sec.gov/Archives/edgar/data/1017655/0001437749-26-010730-index.html","accession_number":"0001437749-26-010730","cik":"0001017655","ticker":"PAYD","issuer_name":"PAID INC","edgar_url":"https://www.sec.gov/Archives/edgar/data/1017655/0001437749-26-010730-index.html","primary_entity_key":"0001017655","primary_entity_name":"PAID INC"},"word_count":2141,"has_tables":true,"body_markdown":"**Item 9A. Controls and Procedures**\n\n \n\n**Evaluation of Disclosure Controls and Procedures**\n\n \n\nThe Company's management, including the Chief Executive Officer /Chief Financial Officer of the Company, as its principal financial officer has evaluated the effectiveness of the Company's “disclosure controls and procedures,” as such term is defined in Rule 13a-15(e) promulgated under the Securities Exchange Act of 1934, as amended (the “Exchange Act”).  Based upon this evaluation, the Chief Executive Officer/Chief Financial Officer has concluded that, as of December 31, 2025, the Company's disclosure controls and procedures were not effective, due to material weaknesses in internal control over financial reporting, for the purpose of ensuring that the information required to be disclosed in the reports that the Company files or submits under the Exchange Act with the Securities and Exchange Commission is recorded, processed, summarized and reported within the time period specified by the Securities and Exchange Commission's rules and forms, and is accumulated and communicated to the Company's management, including its principal executive/financial officer, as appropriate, to allow timely decisions regarding required disclosure.\n\n \n\nAs described in our accompanying *Management's Annual Report on Internal Control over Financial Reporting*, we have identified four remaining material weaknesses in internal controls over financial reporting. Because of these remaining material weaknesses, we concluded that, as of December 31, 2025 our internal control over financial reporting was not effective based on the criteria outlined in *Internal Control-Integrated Framework (2013)* issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”).\n\n \n\n15\n\n \n\n \n\nWe continued to review new procedures and controls in 2026 and have taken steps to remediate the material weaknesses at the entity and activity levels, and to review further our procedures and controls in 2025. In addition, we expect to continue improve our infrastructure, personnel and related processes in order to strengthen and materially affect our internal control over financial reporting.\n\n \n\nPrior to the complete remediation of these material weaknesses, there remains risk that the processes and procedures on which we currently rely will fail to be sufficiently effective, which could result in material misstatement of our financial position or results of operations and require a restatement. Moreover, because of the inherent limitations in all control systems, no evaluation of controls even where we conclude the controls are operating effectively can provide absolute assurance that all control issues, including instances of fraud, if any have been detected. These inherent limitations include the fact that judgments in decision-making can be faulty, and breakdowns can occur because of simple errors or mistakes. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people, or by management override of the controls. The design of any system of controls also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Over time, our control systems, as we develop them, may become inadequate because of changes in conditions, or the degree of compliance with the policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be immediately detected and could be material to our financial statements.\n\n \n\nThe certifications of our principal executive officer/principal financial officer required in accordance with Rule 13a-14(a) under the Exchange Act and Section 302 of the Sarbanes-Oxley Act of 2002 are attached as exhibits to this Annual Report on Form 10-K. The disclosures set forth in this Item 9A contain information concerning (i) the evaluation of our disclosure controls and procedures, and changes in internal control over financial reporting, referred to in paragraph 4 of the certifications, and (ii) material weaknesses in the design or operation of our internal control over financial reporting, referred to in paragraph 5 of the certifications. Those certifications should be read in conjunction with this Item 9A for a more complete understanding of the matters covered by the certifications.\n\n \n\n**Management's Annual Report on Internal Control over Financial Reporting**\n\n \n\nManagement is responsible for establishing and maintaining effective internal control over financial reporting of the Company. Internal control over financial reporting is a process designed by, or under the supervision of, our Chief Executive Officer/Chief Financial Officer and affected by our Board of Directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.\n\n \n\nOur internal control over financial reporting includes those policies and procedures that: (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect our transactions and dispositions of our assets; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of our assets that could have a material effect on the financial statements.\n\n \n\nA material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.\n\n \n\nManagement, with the participation of our principal executive officer/principal financial officer, is required to evaluate the effectiveness of our internal controls over financial reporting as of December 31, 2024 based on criteria established under the COSO integrated framework of internal controls. The COSO framework identifies five components of internal control and provides a basis for evaluating the effectiveness of internal controls. Management has concluded that our internal controls over financial reporting were not effective as of December 31, 2024 due to the following:\n\n \n\n \n\n1.\n\nEntity Level Controls\n\n \n\n \n\n-\n\nIneffective communication of information\n\n \n\n-\n\nIneffective monitoring of activities\n\n \n\n \n\n2.\n\nActivity Level Controls\n\n \n\n \n\n-\n\nLack of procedures and control documentation\n\n \n\n16\n\n \n\n \n\n \n\n-\n\nLack of documentation for cost of goods sold\n\n \n\n-\n\nLack of reconciliation of cash held in reserve\n\n \n\n-\n\nIneffective review of concessions provided to customers\n\n \n\n**1. Inadequate Entity Level Controls**         \n\n \n\n*Ineffective Communication of Information*\n\n \n\nInformation and communication systems support the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities. This component includes information technology controls which are specific activities performed by persons of systems designed to ensure that the business objective can be met, protect the business from fraud and collusion, and keep the corporate assets protected and safe.\n\n \n\n*Steps taken towards Remediation of Ineffective Communication of Information:*\n\n \n\n●\n\nThe Company has hired a CTO to oversee the IT environment and controls. Steps have been taken to implement backup and redundancies to reduce risk. Additional testing environments have been created along with adding new hires to create a stronger IT environment.\n\n●\n\nBusiness objectives are communicated throughout the company with the addition of a new President who will be in the Canadian office on a regular basis. Company town hall meetings and weekly senior management meeting have shown significant improvement in aligning the business objectives.\n\n \n\n*Ineffective Monitoring of Activities*\n\n \n\nMonitoring is a process that assesses the quality of internal control performance over time.\n\n \n\n*Steps taken towards Remediation of Ineffective Monitoring of Activities:*\n\n \n\n●\n\nAdditional internal controls regarding fraud and risk have been implemented using our merchant processing software. The Company continuously monitors these areas to mitigate any impacts of fraudulent behavior.\n\n●\n\nThe Company has automated reporting to monitor activity, members of senior management receive daily reporting on the revenue, margins and new customers visiting our site and using our services.\n\n \n\nThe Company believes improvements have been made to remediate its material weakness in the internal controls over financial reporting at the entity level but does not have the appropriate documentation to support its efforts. The Company also believes that further work is still required to develop appropriate controls in some aspects of entity level control to provide reasonable assurance that controls are designed in the most effective and efficient manner possible. While we believe these changes will be effective at mitigating the risk of material a error, there continues to be additional work required for us to conclude that all three of these control areas are operating effectively. As noted in the Management's Report on Internal Control over Financial Reporting, we consider each of these control areas within the entity level control to constitute a material weakness.\n\n \n\n17\n\n \n\n \n\nThe Company has taken significant steps to reduce risks associated with information technology controls and documentation. Our information technology department has implemented multi-factor authentication, segregated the duties between developers and performs periodic information technology risk assessments to strengthen our IT environment. We used cloud-based solutions, tokenization to remove the need to capture and site confidential financial data in addition to encryption to protect personal data.\n\n \n\n**2.**             **Inadequate Activity Level Controls**\n\n \n\n*Lack of Procedures and Control Documentation*\n\n \n\nThe Company lacks specific documentation relating to certain accounts, and financial closing, which in effect make these internal controls ineffective. The lack of documentation in internal controls relating to these accounts may affect the financial statements and will directly affect the nature and timing of other auditing procedures for certain activities.\n\n \n\n*Steps taken towards Remediation of Revenue Recognition:*\n\n \n\n●\n\nThe Company continues to evaluate the use of technology to automate reports that are used for financial reporting. Monthly reconciliations are performed to analyze the contract liabilities and technology has been improved to assist in reducing the risks associate with human errors.\n\n●\n\n \n\n*Steps taken towards Remediation of Financial Closing:*\n\n \n\n●\n\nThe Company has migrated the accounting software to cloud based technology. This will assist the finance team with additional segregation of duties and will allow the SVP of Finance more time to produce financial statements. Improvements in this area will continue through 2026.\n\n●\n\n \n\n*Steps taken towards Remediation of Cash held in Reserve:*\n\n \n\n●\n\nImprovements to the reconciliations for the cash held in reserve have been effective in reducing variances. Regular monthly reconciliations have been implemented to monitor for any significant changes.\n\n \n\nThe Company has made improvements to the activity level controls specifically with regard to the deficiencies with the financial close. In addition, further work is required to develop appropriate controls in the other aspects of activity level control to provide reasonable assurance that controls are designed in the most effective and efficient manner possible. Therefore, while we believe these changes are effective at mitigating risk of material error, there continues to be additional work required for us to conclude that this control area is operating effectively. Therefore, as noted in the Management's Report on Internal Control over Financial Reporting, we consider this control area within the activity level control to constitute a material weakness.\n\n \n\nA factor for our internal control deficiencies is the small size of the Company and the lack of a financial expert on the Audit Committee of the Board of Directors and other corporate governance controls.  As defined by the Public Company Accounting Oversight Board Auditing Standard No. 5, a material weakness is a significant control deficiency or a combination of significant control deficiencies that results in there being more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected.  Management continues to monitor and assess the controls to ensure compliance. \n\n \n\nAs a smaller reporting company, our independent registered public accounting firm is not required to issue a report on the Company's internal control over financial reporting as of December 31, 2025.\n\n \n\n18\n\n \n\n \n\n*Changes in Internal Control Over Financial Reporting*\n\n \n\nAs discussed in the Managements' Annual Report on Internal Control over Financial Reporting, the Company continues to make improvements to the entity and activity controls and expects to take further steps in 2026 to remediate the outlined deficiencies. The Company monitors all financial activity and has implemented automated tools to support the reconciliation process specific to financial reporting. The Company has added many new reconciliations to assist with the financial reporting. The CEO/CFO has worked with the SVP of Finance and management to identify areas of improvement and together they continue to implement cross training and redundancies to assist with internal controls. Departmental budgets have been established, and all transactions are reviewed monthly. The forecast is reviewed by the CFO on a regular basis and all members of Management contribute to the review. While we believe these improvements are effective at mitigating the risk of a material error, we have not yet concluded that they are operating effectively. There were several areas of improvement in our segregation of duties, financial closing, and information technology controls that have positively impacted our internal control over financial reporting for the fiscal year ended 2025."}