FIRST BANCORP NC

Evaluation of Disclosure Controls and Procedures

As of the end of the period covered by this report, we carried out an evaluation, under the supervision and with the participation of our chief executive officer and chief financial officer, of the effectiveness of the design and operation of our disclosure controls and procedures, which are our controls and other procedures that are designed to ensure that information required to be disclosed in our periodic reports with the SEC is recorded, processed, summarized and reported within the required time periods. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed is communicated to our management to allow timely decisions regarding required disclosure. Based on the evaluation, our chief executive officer and chief financial officer concluded that, as of the evaluation date, due to the material weakness in the Company's internal control over financial reporting described below, the Company's disclosure controls and procedures were not effective as of December 31, 2023.

However, after giving full consideration to the material weakness described below, and based on a number of other factors, including the measures implemented prior to December 31, 2023 to remediate the material weakness in internal control over financial reporting and the performance of procedures by management designed to ensure that information required to be disclosed is communicated to our management to allow timely decisions regarding required disclosure, management has concluded that the consolidated financial statements included in this Report present fairly, in all material respects, the Company’s financial position, the results of its operations and its cash flows for each of the periods presented in conformity with GAAP and that disclosures to be made about material information required to be included in our periodic reports with the SEC were made timely and properly included in the Report.

Management’s Report On Internal Control Over Financial Reporting

Management of the Company is responsible for establishing and maintaining effective internal control over financial reporting. Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP.

Internal control over financial reporting cannot provide absolute assurance of achieving financial reporting objectives because of its inherent limitations. Internal control over financial reporting is a process that involves human diligence and compliance and is subject to lapses in judgment and breakdowns resulting from human failures. Internal control over financial reporting can also be circumvented by collusion or improper management override. Because of such limitations, there is a risk that material misstatements may not be prevented or detected on a timely basis by internal control over financial reporting. However, these inherent limitations are known features of the financial reporting process. Therefore, it is possible to design into the process safeguards to reduce, though not eliminate, this risk.

Management is also responsible for the preparation and fair presentation of the consolidated financial statements and other financial information contained in this report. The accompanying consolidated financial statements were prepared in conformity with GAAP and include, as necessary, best estimates and judgments by management.

Under the supervision and with the participation of management, including the principal executive officer and principal financial officer, the Company conducted an evaluation of the effectiveness of internal control over financial reporting based on the framework in Internal Control – Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013) (the "Framework"). Based on management’s evaluation under the Framework, management of the Company has concluded the Company's internal controls over financial reporting, as such term is defined in Rule 13a-15(f) promulgated under the Securities Exchange Act of 1934, was not effective as of December 31, 2023 because of the material weakness in internal control over financial reporting described below. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.

Management identified a material weakness related to information technology general controls in the area of user access management within an application supporting the Company’s accounting and reporting processes which resulted in certain segregation of duties conflicts. As such, certain of the Company’s manual business process controls dependent upon the information derived from this application were also ineffective.

Plan for Remediation of Material Weakness

The Company and its Board of Directors are committed to maintaining a strong internal control environment. During the fourth quarter of 2023, management identified a control deficiency that constituted a material weakness as of December 31, 2023. Management evaluated the material weakness described above and the following measures were implemented during the fourth quarter and in place prior to December 31, 2023:

•Privileged administrative access to the application was removed for finance department personnel.

•Additional control design enhancements were implemented for user access provisioning, modification, and removals from the application to ensure all access changes to the application are subject to formal documentation and approval.

In addition to the actions taken during the fourth quarter of 2023, management is continuing to implement a remediation plan to enhance the design of information technology general controls. Specifically, management will take the following additional measures to further ensure its controls and procedures are operating effectively:

•Ongoing monitoring of enhanced user provisioning controls.

•Evaluation of resources of finance department, and enhancement of resources and procedures as necessary to ensure proper segregation of duties within applications that support financial reporting processes.

While management has taken steps towards implementing remediation plans, several of which occurred prior to December 31, 2023, the material weakness will not be considered fully remediated until the controls have operated effectively, as evidenced through testing, for a sufficient amount of time.

BDO USA, P.C., an independent, registered public accounting firm, has audited the Company’s consolidated financial statements as of and for the year ended December 31, 2023, and audited the Company’s effectiveness of internal controls over financial reporting as of December 31, 2023, as stated in its reports, which are included in Item 8 hereof.

Changes in Internal Controls

Except as set forth above, there were no changes in our internal control over financial reporting that occurred during the three months ended December 31, 2023 that materially affected, or that are reasonably likely to materially affect our internal control over financial reporting