VAALCO ENERGY INC /DE/

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures that are designed to provide reasonable assurance that information required to be disclosed by us in the reports we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our principal executive officer (“CEO”) and principal financial officer (“CFO”), to allow timely decisions regarding required disclosure. In designing and evaluating our disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives, and management was required to apply its judgment in evaluating and implementing possible controls and procedures. Management, including our CEO and CFO, has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) as of the end of the period covered by this Annual Report on Form 10-K. Based on this evaluation, our CEO and CFO have concluded that the Company’s disclosure controls and procedures were not effective as of December 31, 2024 due to the material weaknesses in our internal control over financial reporting described below.

Management’s Annual Report on Internal Control Over Financial Reporting

Our management, including our CEO and CFO, is responsible for establishing and maintaining adequate internal control over financial reporting, as that term is defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act. Internal control over financial reporting is a process designed under the supervision of our CEO and our CFO, overseen by our Board of Directors and Audit Committee, and effected by management and other personnel to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes using the framework in Internal Control – Integrated Framework (2013), issued by the Committee of Sponsoring Organizations of the Treadway Commission (the “COSO framework”). Such internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of annual or interim financial statements will not be prevented or detected on a timely basis. The Company’s management, with participation of the CEO and CFO, under the oversight of our Board of Directors, evaluated the effectiveness of the Company’s internal control over financial reporting as of December 31, 2024 using the COSO framework. Based on that evaluation, our management concluded that the Company’s internal control over financial reporting was not effective as of December 31, 2024 due to the material weaknesses in internal control over financial reporting described below. Management identified the following material weaknesses in internal control over financial reporting as of December 31, 2024.

•The Company had ineffective general information technology controls (“GITCs”) that support the consistent operation of the Company’s information technology (“IT”) systems, specific to its procure-to-pay system. As a result, automated process-level controls and manual controls dependent upon the accuracy and completeness of information derived from that IT system were also ineffective because they could have been adversely impacted; and

•The Company did not effectively design, implement, or operate process-level control activities related to its financial reporting process, specific to its procure-to-pay process.

Management concluded that these material weaknesses were primarily due to an ineffective control environment that resulted in ineffective risk assessment:

•The Company did not have a sufficient number of trained resources with expertise in and responsibility and accountability for the design, implementation, operation and documentation of internal control over financial reporting and IT systems.

•The Company did not have an effective risk assessment process as we did not adequately assess and manage the risks to our operations following the implementation of the procure-to-pay system, which affected our financial reporting, and we did not establish effective internal control over the procurement process, including risks resulting from the reliance on a third-party service provider, or changes in the external environment and business operations, at a sufficient level of detail to identify all relevant risks of material misstatement to the consolidated financial statements and design and implement internal controls that responded to those risks.

The material weaknesses identified did not result in any misstatements in the consolidated financial statements or disclosures for any interim periods during or for the annual period ended December 31, 2024; however, a reasonable possibility exists that material misstatements in the Company’s financial statements will not be prevented or detected on a timely basis.

The Company’s independent registered public accounting firm, KPMG LLP (“KPMG”), who audited the consolidated financial statements included in this Annual Report on Form 10-K, has issued an adverse opinion on the effectiveness of the Company’s internal control over financial reporting. KPMG’s report appears beginning on page F-5 of this Annual Report on Form 10-K.

As previously disclosed, on April 30, 2024, we completed the acquisition of Svenska, which is operated under its own set of internal controls. We are currently integrating this acquisition into our control environment. In executing this integration, we are analyzing, evaluating and, where appropriate, making changes in controls and procedures in a manner commensurate with the size, complexity and scale of operations subsequent to the acquisition. We expect to complete the Svenska integration in fiscal year 2025. SEC guidance permits management to omit an assessment of an acquired business’s internal control over financial reporting from management’s assessment of internal control over financial reporting for a period not to exceed one year from date of acquisition. Consequently, we excluded Svenska from our assessment of internal control over financial reporting as of December 31, 2024. Svenska accounted for 20% of our consolidated total assets at December 31, 2024 and 20% of our consolidated operating revenue for the year ended December 31, 2024.

Remediation Activities

We have strengthened our internal control over financial reporting for our year-end closing and reporting process and are committed to ensuring that our controls continue to mature and operate effectively. Our Board of Directors and management have prioritized the implementation of a remediation plan, taking the necessary actions to address the root causes that contributed to our material weaknesses and other deficiencies identified and to establish and maintain effective internal control over financial reporting. The following actions and plans have been undertaken or are being undertaken:

•We continued to hire and train our employees to reinforce the importance of a strong control environment and clearly communicate expectations to emphasize responsibilities and the technical requirements for internal controls.

•We continued to enhance the design of existing control activities and implemented additional process-level control activities, including related GITCs.

•We enhanced user access provisioning and monitoring controls for certain IT systems to enforce appropriate system access as well as controls supporting change management.

We are committed to ensuring that our internal control over financial reporting is designed and operating effectively. Management believes the efforts taken to date to enhance the design and effectiveness of controls have been robust and have increased our overall ability to mitigate material financial risk. In fiscal year 2025 we expect to continue to enhance our internal control over financial reporting, including the following:

•Continuing to recruit key positions within our technology, accounting, business operations and other support functions with appropriate qualified experience and IT knowledge to enhance our risk assessment processes and internal control capabilities, allow for appropriate change management, and provide appropriate oversight and reviews.

•Designing and implementing a continuous risk assessment process to identify and assess risks of material misstatement and ensure that the impacted financial reporting processes and related internal controls are properly designed and in place to respond to those risks in our financial reporting.

•Working to establish a comprehensive GITC risk evaluation process and invest in people and technology to address gaps in IT Systems Security controls, IT Systems Change Management controls, and IT Systems Batch/Program Monitoring controls, including design of controls to address gaps over our GITC’s for our procure-to-pay system, which we plan to start implementing in first quarter of 2025.

Although we intend to complete the remediation process as promptly as possible, we cannot at this time estimate how long it will take to remediate the material weaknesses described above. We may discover additional material weaknesses that require additional time and resources to remediate, and we may decide to take additional measures to address the material weaknesses or modify the remediation steps described above.

In addition, while certain of the activities described above have continued to enhance our internal control over financial reporting, certain of these newly designed controls have not operated effectively for a sufficient period of time to be able to conclude on effectiveness. We remain committed to continue investing significant time and resources and taking actions to remediate the material weaknesses in our internal control over financial reporting as we work to further enhance our control environment. Until these material weaknesses are remediated, we plan to continue to perform additional analyses and other procedures to ensure that our consolidated financial statements are prepared in accordance with U.S. GAAP.

Changes in Internal Control over Financial Reporting

Other than the material weaknesses discussed above, no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) occurred during the quarter ended December 31, 2024 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.