HILLS BANCORPORATION

Disclosure Controls and Procedures

As of the end of the period covered by this report, the Company carried out an evaluation under the supervision and with the participation of the Company’s management, including the Company’s Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of the Company’s disclosure controls and procedures (as defined in Rule 13a-15(e) and Rule 15d-15(e) under the Securities Exchange Act of 1934). Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that the Company’s disclosure controls and procedures are effective.

Management’s Report on Internal Control over Financial Reporting

The Company’s management is responsible for establishing and maintaining an adequate system of internal control over financial reporting (as defined in Rule 13a-15(f) and Rule 15d-15(f) under the Securities Exchange Act of 1934). Internal control over financial reporting of the Company includes those policies and procedures that: (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions of the Company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the Company’s assets that could have a material effect on the Company’s consolidated financial statements. Important features of the Company’s system of internal control over financial reporting include the adoption and implementation of written policies and procedures, careful selection and training of financial management personnel, a continuing management commitment to the integrity of the system and through examinations by an internal audit function that coordinates its activities with the Company’s Independent Registered Public Accounting Firm.

All internal control systems, no matter how well designed, have inherent limitations, including the possibility of human error and the circumvention of overriding controls. Accordingly, even effective internal control can provide only reasonable assurance with respect to financial statement preparation. Further, because of changes in conditions, the effectiveness of internal control may vary over time.

The Company’s management conducted an evaluation of the effectiveness of the Company’s internal controls over financial reporting as of December 31, 2023. Management’s assessment is based on the criteria described in “Internal Control – Integrated Framework” issued in 2013 by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this assessment, the Company’s management concluded that the Company maintained effective internal control over financial reporting as of December 31, 2023.

Attestation Report of the Registered Public Accounting Firm

The Company’s independent registered public accounting firm that audited the consolidated financial statements included in this annual report, has issued a report on the Company’s internal control over financial reporting as of December 31, 2023. Reference is made to the Report of Independent Registered Public Accounting Firm included in this Annual Report.

Changes in Internal Control over Financial Reporting

There was no change in the Company’s internal control over financial reporting during the most recently completed fiscal quarter that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.