HILLS BANCORPORATION

Disclosure Controls and Procedures

As of the end of the period covered by this report, the Company carried out an evaluation under the supervision and with the participation of the Company’s management, including the Company’s Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of the Company’s disclosure controls and procedures (as defined in Rule 13a-15(e) and Rule 15d-15(e) under the Securities Exchange Act of 1934). In designing and evaluating the disclosure controls and procedures, management recognized that any controls and procedures, no matter how well designed and operated, provides only reasonable assurance of achieving the desired control objectives, and management necessarily was required to apply its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Based upon that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that, notwithstanding substantial progress as a result of the Company’s remediation efforts during 2025 to correct material weaknesses disclosed in the Company’s prior year Annual Report on Form 10-K (“2024 10-K”), as a result of the material weaknesses in internal control over financial reporting described below in “Management’s Report on Internal Control over Financial Reporting” the Company’s internal controls over financial reporting as of December 31, 2025, were not effective.

Management’s Report on Internal Control over Financial Reporting

The Company’s management is responsible for establishing and maintaining an adequate system of internal control over financial reporting (as defined in Rule 13a-15(f) and Rule 15d-15(f) under the Securities Exchange Act of 1934). Internal control over financial reporting of the Company includes those policies and procedures that: (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions of the Company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with U.S. generally accepted accounting principles, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the Company’s assets that could have a material effect on the Company’s consolidated financial statements. Important features of the Company’s system of internal control over financial reporting include the adoption and implementation of written policies and procedures, careful selection and training of financial management personnel, a continuing management commitment to the integrity of the system and through examinations by an internal audit function that coordinates its activities with the Company’s Independent Registered Public Accounting Firm.

All internal control systems, no matter how well designed, have inherent limitations, including the possibility of human error and the circumvention of overriding controls. Accordingly, even effective internal control can provide only reasonable assurance with respect to financial statement preparation. Further, because of changes in conditions, the effectiveness of internal control may vary over time.

The Company’s management conducted an evaluation of the effectiveness of the Company’s internal controls over financial reporting as of December 31, 2025. Management’s assessment is based on the criteria described in “Internal Control – Integrated Framework” issued in 2013 by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this assessment, the Company’s management concluded that the Company’s internal controls over financial reporting were not effective as of December 31, 2025. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the registrant’s annual or interim financial statements will not be prevented or detected on a timely basis. Material weaknesses were identified in the following areas:

•Management review and activity-level controls over the period-end financial reporting process and controls to ensure that i) period-end financial statements to be filed are correct, and ii) our independent auditor has completed its procedures prior to the filing of period end financial statements;

•The review, posting, and approval of manual journal entries;

•The identification and disclosure of related party transactions;

•Related to the allowance for credit losses on loans ("ACL"), the design of controls over the framework used to determine the qualitative component of the ACL and the review process to ensure qualitative adjustments are accurately determined and applied;

•Related to property and equipment, the design of controls over the determination of estimated useful lives and the timely identification and recording of dispositions of property and equipment; and

•Management lacks sufficient depth and structure in the oversight of the financial reporting function and insufficient staffing levels with specialized technical accounting and internal control expertise to effectively design controls and perform an adequate level of review over the period‑end financial reporting process.

Notwithstanding the material weaknesses, the Company’s management, including the CEO and CFO, has concluded that the consolidated financial statements, included in this Annual Report on Form 10-K, for the year ended December 31, 2025, fairly present, in all material respects, the Company's financial condition, results of operations and cash-flows for the periods presented in conformity with U.S. generally accepted accounting principles.

Attestation Report of the Registered Public Accounting Firm

Our independent auditor, Forvis Mazars, LLP, a registered public accounting firm, has issued its report on its audit of our internal control over financial reporting. Forvis Mazars, LLP’s attestation report contains an adverse opinion on the effectiveness of the Company’s internal control over financial reporting. This report appears on pages 58-59.

Reference is made to the Report of Independent Registered Public Accounting Firm included in this Annual Report.

Remediation Plan

Throughout 2025 the Company invested substantial resources in remedial measuresto strengthen its financial reporting controls and procedures as a result of the material weaknesses disclosed in its 2024 10-K and those disclosed above. These include (i) enhancing the design and documentation of key internal controls, (ii) strengthening management review controls, (iii) engagement of third parties with specialized accounting expertise, and (iv) retention of additional managerial resources with accounting and financial reporting experience and expertise. Management achieved substantial improvements to its financial reporting controls and procedures during 2025 as a result of these changes. Additionally, the Company’s Governance and Nominating Committee recruited, and the Board of Directors nominated for election to the Board of Directors at the 2026 Annual Meeting of Shareholders, an individual with prior public company auditing experience, including time as a partner with a major national accounting firm.

Ongoing Remediation and Outlook

The actions the Company is taking under its remediation plan are subject to ongoing management review and are also subject to Audit Committee oversight. Management remains committed to the full remediation of the identified material weaknesses and will continue to devote significant time, attention, training and resources to these efforts. Management expects to complete the remediation of these material weaknesses by December 31, 2026.

Each material weakness identified above cannot be considered remediated until the applicable remedial controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively.

Changes in Internal Control over Financial Reporting

Except as otherwise discussed above, there were no changes in our internal controls over financial reporting that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting, including any corrective actions with regard to the control deficiencies that led to the material weaknesses in the Company’s internal controls over financial reporting identified above.