BigCommerce Holdings Inc

Evaluation of disclosure controls and procedures

We maintain disclosure controls and procedures (as defined in Rule 13a-15(e) or Rule 15d-15(e) under the Exchange Act) that are designed to ensure that information required to be disclosed in our reports under the Exchange Act is processed, recorded, summarized, and reported within the time periods specified in the SEC’s rules and forms and that such information is accumulated and communicated to management, including the Chief Executive Officer (principal executive officer) and Chief Financial Officer (principal financial officer), as appropriate, to allow for timely decisions regarding required disclosure.

In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives, and management is required to apply its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

As required by SEC Rule 13a-15(b), we carried out an evaluation, under the supervision and with the participation of management, including the Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of the disclosure controls and procedures as of December 31, 2023, the end of the period covered by this report. Based on this evaluation, management has concluded that our disclosure controls and procedures (as defined in Rules 13a 15(e) and 15(d) under the Exchange Act) were not effective as of December 31, 2023 because of control deficiencies in our information technology general controls (“ITGC’s”), resulting in the material weakness described below. Management’s assessment of the effectiveness of our disclosure controls and procedures is expressed at the level of reasonable assurance because management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives.

Management’s Annual Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rule 13a-15(f) or Rule 15(d)-15(f) under the Exchange Act. Our internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation.

Our management (under the supervision and with the participation of our principal executive officer and our principal financial officer assessed the effectiveness of our internal control over financial reporting as of December 31, 2023. In making this assessment, management used the criteria established in Internal Control – Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework) (the COSO criteria). Based on our assessment and those criteria, management concluded that, as of December 31, 2023, our internal controls over financial reporting were not effective due to the material weakness described below.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements will not be prevented or detected on a timely basis.

As part of our assessment of the effectiveness of our internal control over financial reporting as of December 31, 2023, management identified a material weakness related to information technology general controls that support our financial reporting process. Specifically, management determined that we did not maintain effective controls over (i) user access to ensure appropriate segregation of duties and adequately restrict user and privileged access to financial applications, programs and data to the appropriate personnel; (ii) program change management for financial applications to ensure that information technology (“IT”) program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately; and (iii) IT operations controls to ensure that critical interface jobs are monitored. As a result, our related IT dependent manual and application controls that rely upon the affected ITGC’s, or information coming from IT systems with affected ITGC’s were also deemed ineffective.

Notwithstanding the identified material weakness, management does not believe that the deficiencies had an adverse effect on our reported operating results or financial condition, and management has determined that the financial statements and other information included in this report and other periodic filings present fairly in all material respects our financial condition and results of operations at and for the periods presented.

The effectiveness of our internal control over financial reporting as of December 31, 2023 has been audited by Ernst & Young LLP, an independent registered public accounting firm, as stated in their report which is included elsewhere herein.

Remediation plan

Management’s renewed emphasis of designing and implementing improved processes and controls will involve but is not limited to the following:

•

completing an IT risk assessment over the systems relevant to our financial reporting processes;

•

revising existing IT entity level policies to better align to the requirements defined by the Sarbanes-Oxley Act;

•

reassessing the design of internal controls related to change management;

•

expanding to management and governance over IT system controls; and

•

implementing additional controls specific to applications that manage the process IT program changes and user access controls.

We are in the process of completing the remediation activities as of the date of this report and believe that upon completion, we will have strengthened our ITGCs to address and successfully remediate the identified material weakness. However, control weaknesses are not considered remediated until new internal controls have been operational for a period of time, are tested, and management concludes that these controls are operating effectively. We expect to complete the remediation activities as early as practicable in fiscal year 2024.

Our independent registered public accounting firm, Ernst & Young LLP, has issued an attestation report on the effectiveness of our internal control over financial reporting as of December 31, 2023, which is included in Item 8 of this Annual Report on Form 10-K.

Changes in internal control over financial reporting

Except for the material weakness discussed above, there have been no changes in our internal controls over financial reporting that occurred in the year ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal controls over financial reporting.