CLOROX CO DE

Disclosure Controls and Procedures

The Company’s management, with the participation of the Company’s chief executive officer and executive vice president – chief financial officer, evaluated the effectiveness of the Company’s disclosure controls and procedures as of the end of the period covered by this Report. Based on that evaluation, the chief executive officer and executive vice president – chief financial officer concluded that the Company’s disclosure controls and procedures, as of the end of the period covered by this Report, were effective such that the information required to be disclosed by the Company in reports filed under the Exchange Act is (i) recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms and (ii) accumulated and communicated to management, including the chief executive officer and chief financial officer, as appropriate to allow timely decisions regarding disclosure.

Management’s Report on Internal Control Over Financial Reporting

Management’s report on internal control over financial reporting is set forth in Exhibit 99.1, and is incorporated herein by reference. The Company’s independent registered public accounting firm, Ernst & Young, LLP, has audited the effectiveness of the Company’s internal control over financial reporting as of June 30, 2024. See “Report of Independent Registered Public Accounting Firm,” which appears in Exhibit 99.1.

Change in Internal Control Over Financial Reporting

No change in the Company’s internal control over financial reporting occurred during the fourth fiscal quarter of the fiscal year ended June 30, 2024, that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.

On Monday, August 14, 2023, the Company disclosed it had identified unauthorized activity on some of its Information Technology (IT) systems; see Note 3 in the consolidated financial statements in Exhibit 99.1. That activity began on Friday, August 11, 2023 and after becoming aware of it that evening, the Company immediately began taking steps to stop and remediate the activity. The Company also took certain systems offline and engaged third-party cybersecurity experts to support its investigation and recovery efforts. The Company implemented its business continuity plans, including manual ordering and processing procedures at a reduced rate of operations in order to continue servicing its customers. However, the incident resulted in wide-scale disruptions to the Company’s business operations throughout the remainder of the first fiscal quarter of the fiscal year ended June 30, 2024.

During the disruptions caused by the cyberattack, we deployed additional interim controls in response to taking certain systems offline during the period to maintain our internal control over financial reporting.

The Company is in the process of implementing a new enterprise resource planning (ERP) system along with a suite of other digital technologies. In the first quarter of fiscal year 2025, we will begin implementing the new ERP system. As this implementation occurs during fiscal years 2025 and 2026, the Company will change its processes and procedures which, in turn, could result in changes to its internal control over financial reporting. As such changes occur, the Company will evaluate quarterly whether such changes materially affect our internal control over financial reporting.