MITEK SYSTEMS INC

Disclosure Controls and Procedures

We maintain disclosure controls and procedures, as such term is defined in Rules 13a-15(e) and 15d-15(e) of the Exchange Act of 1934, as amended (the “Exchange Act”), that are designed to provide reasonable assurance that information required to be disclosed by us in the reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC rules and forms, and that such information is accumulated and communicated to our management, including our principal executive officer and principal financial officer, as appropriate, to allow timely decisions regarding required financial disclosures.

Under the supervision and with the participation of our management, including our principal executive officer and principal financial officer, we conducted an evaluation of our disclosure controls and procedures as of the end of the period covered by this Form 10-Q pursuant to Exchange Act Rules 13a-15(b) and 15d-15(b). In making this assessment, management used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control – Integrated Framework (2013). We recognize that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Our principal executive officer and principal financial officer concluded that our disclosure controls and procedures were not effective as June 30, 2025 due to the previously reported material weaknesses at September 30, 2024, that continued to exist.

Notwithstanding the identified material weaknesses, management believes the condensed consolidated financial statements included in this Form 10-Q present fairly, in all material respects, the Company’s financial position, results of operations and cash flows as of and for the periods presented, in accordance with generally accepted accounting principles in the United States of America (“U.S. GAAP”).

Remediation of Previously Reported Material Weaknesses in Internal Control Over Financial Reporting

As previously reported in our 2024 Annual Report, the Company identified material weaknesses which continued to exist as of June 30, 2025 related to the following:

•Management did not maintain effective controls related to the financial statement close process to ensure the completeness and accuracy of certain amounts and disclosures, specifically related to balance sheet account reconciliations and the Company’s review and preparation of the consolidation and financial statements.

•Management did not design and maintain effective controls to ensure proper revenue recognition, including the accounting review of customer contracts.

•Management did not perform sufficient risk assessment procedures in order to design and implement effective controls, including consideration of improper segregation of duties, for substantially all of the Company's financial statement areas.

•Management did not design or maintain controls to verify the completeness and accuracy of information used by control owners in the operation of controls across substantially all of the Company’s financial statement areas.

•Management did not maintain sufficient evidence of the operation of certain management review controls and activity level controls across substantially all of the Company's financial statement areas.

Remediation Plan, and ongoing Remediation Efforts for Existing Material Weaknesses in Internal Control over Financial Reporting

With respect to the material weaknesses mentioned above, we have designed and continue to implement a plan to address these material weaknesses in internal control over financial reporting. We have devoted and intend to continue to devote significant time and resources to enhance the design and implementation of our existing controls and procedures and to create new complementary and compensating controls as needed.

The material weaknesses remediated as of September 30, 2024 are, in some respects, prerequisites to the steps required to fully remediate the remaining material weaknesses. Ensuring we have a robust and comprehensive risk assessment process, as well as ensuring effective information technology general controls are critical to ensuring we can fully remediate the remaining material weaknesses.

We have enhanced the execution of financial statement close controls as follows:

•Implemented standard templates and processes to ensure consistency across all legal entities;

•Deployed a close management tool in fiscal year 2025 to ensure completeness and accuracy of all reconciliations and procedures; and

•Conducted training sessions with control owners to emphasize the necessary steps to achieve compliance with the Sarbanes-Oxley Act of 2002 and to reinforce a strong tone at the top and control owner accountability.

With respect to segregation of duties controls, completeness and accuracy of information controls and management review controls, we have further enhanced the execution of these controls as follows:

•Designed, implemented and tested new user roles to mitigate systemic system issues; and

•Documented completeness and accuracy of all inputs, and information produced by the entity.

•Performed risk assessment procedures, including identifying in-scope systems and processes and relevant segregation of duties risks, to ensure controls are designed and implemented to address our financial statement risk areas.

With respect to revenue recognition controls, we are further enhancing revenue recognition controls as follows:

•Created cross functional working groups to help ensure all key contract terms are identified and accurately input into our information systems;

•Identifying and implementing systems for order-to-cash management and billing to eliminate reliance on manual processes and spreadsheets; and

•Designed and implemented a new monthly process to verify completeness of revenue recognized each quarter.

The Company is committed to remediating the material weaknesses and continues to make progress, each quarter, to that effort. The actions the Company has taken are subject to ongoing senior management review, as well as oversight from the Company’s Audit Committee. When fully implemented and operational, the Company believes the measures described above will remediate the underlying causes of the control deficiencies that gave rise to the material weaknesses and strengthen the Company’s internal control over financial reporting. These remediation efforts are in process as of the fiscal quarter ended June 30, 2025. The Company will not be able to fully remediate these material weaknesses until these steps have been completed and have been operating effectively for a sufficient period of time. The Company may also identify additional measures that may be required to remediate the material weaknesses in the Company’s internal control over financial reporting, necessitating further action.

Changes in Internal Control over Financial Reporting

The Company has implemented processes and procedures to remediate the material weaknesses noted above. Except as described above, there have been no changes in the Company’s internal control over financial reporting during the quarter ended June 30, 2025 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.