Cipher Mining Inc

Limitations on Effectiveness of Controls and Procedures

In designing and evaluating our disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply judgment in evaluating the benefits of possible controls and procedures relative to their costs.

Evaluation of Disclosure Controls and Procedures

We conducted an evaluation of the effectiveness of our “disclosure controls and procedures” (“Disclosure Controls”), as defined by Rules 13a-15(e) and 15d-15(e) of the Exchange Act, as of December 31, 2023, the end of the period covered by this Annual Report. The Disclosure Controls evaluation was done under the supervision and with the participation of management, including our Chief Executive Officer and Chief Financial Officer, with the goal being that the information required to be disclosed by us in reports filed under the Exchange Act is (i) recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms and (ii) accumulated and communicated to our management, including our principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding disclosure. There are inherent limitations to the effectiveness of any system of disclosure controls and procedures. Accordingly, even effective disclosure controls and procedures can only provide reasonable assurance of achieving their control objectives. Based upon this evaluation, our Chief Executive Officer and Chief Financial Officer concluded that, our disclosure controls and procedures were not effective at the reasonable assurance level as of December 31, 2023.

Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act. Our management is also required to assess and report on the effectiveness of our internal control over financial reporting in accordance with Section 404 of the Sarbanes-Oxley Act of 2002 (“Section 404”). Our internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes of accounting principles generally accepted in the United States.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting.

Our management, with the participation of our principal executive officer and principal financial officer, assessed the effectiveness of our internal control over financial reporting as of December 31, 2023. In making this assessment, we used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control - Integrated Framework in the 2013 COSO framework. Based on this evaluation, management identified a weakness in internal control over financial reporting related to Information Technology General Controls (“ITGC”). Specifically, the Company did not design and/or implement user access controls to ensure appropriate segregation of duties or program change management controls for certain financially relevant systems impacting the Company’s processes around revenue recognition and digital assets to ensure that IT program and data changes affecting the Company’s (i) financial IT applications, (ii) digital currency mining equipment, and (iii) underlying accounting records, are identified, tested, authorized and implemented appropriately to validate that data produced by its relevant IT system(s) were complete and accurate. Automated process-level controls and manual controls that are dependent upon the information derived from such financially relevant systems were also determined to be ineffective as a result of such deficiency. In addition, the Company has not effectively designed a manual key control to detect material misstatements in revenue.

The material weakness described above did not result in a material misstatement to the Company’s previously issued consolidated financial statements, nor in the consolidated financial statements included in this Annual Report.

Remediation

As noted above, during management’s assessment of internal controls over financial reporting (“ICFR”) a material weakness was identified related to certain ITGCs over user access, segregation of duties and change management controls.

As management is responsible for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, we understand the importance of developing a resolution plan aligned with management and overseen by the Audit Committee of our Board of Directors. Since the material weakness was identified, management has been implementing and continues to implement measures designed to ensure that control deficiencies contributing to the material weakness are remediated, such that these controls are designed, implemented, and operating effectively. Our remediation plan includes the following:

•

Enhance our remediation efforts by continuing to devote resources in 2024 in key financial reporting and information technology areas, including hiring additional employees.

•

Continue to utilize an external third-party internal audit and SOX 404 implementation firm to work to improve the Company’s controls related to our material weaknesses, specifically relating to user access and change management surrounding the Company’s IT systems and applications.

•

Continue to implement new processes and controls and engage external resources when required in connection with remediating this material weakness, such that these controls are designed, implemented, and operating effectively.

•

Continue to formalize our policies and processes over including those over outside service providers with a specific focus on enhancing design and documentation related to (i) developing and communicating additional policies and procedures to govern the areas of IT change management and user access processes and related control activities and (ii) develop robust processes to validate data received from third-parties and relied upon to generate financial statements is complete and accurate.

We recognize that the material weaknesses in our internal control over financial reporting will not be considered remediated until the remediate controls operate for a sufficient period of time and can be tested and concluded by management to be designed and operating effectively. Because our remediation efforts involve our outsource service providers, we cannot provide any assurance that these remediation efforts will be successful or that our internal control over financial reporting will be effective as a result of these efforts.

We continue to evaluate and work to improve our internal control over financial reporting related to the identified material weaknesses and management may determine to take additional measures to address control deficiencies or determine to modify the remediation plan described above. In addition, we report the progress and status of the above remediation efforts to the Audit Committee on a periodic basis.

Changes in Internal Control Over Financial Reporting

Other than what is disclosed above there were no changes in the Company’s internal control over financial reporting during the quarter ended December 31, 2023 that have materially affected, or are reasonably likely to affect, our internal control over financial reporting.