Ultra Clean Holdings Inc

Disclosure Controls and Procedures

Our management has evaluated, under the supervision and with the participation of our Chief Executive Officer and Chief Financial Officer, the effectiveness of our disclosure controls and procedures as of the end of the period covered by this report pursuant to Rule 13a-15(b) under the Securities Exchange Act of 1934 (the Exchange Act). Based on that evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of the end of the period covered by this report, our disclosure controls and procedures were not effective at the reasonable assurance level in ensuring that information required to be disclosed in our Exchange Act reports is (1) recorded, processed, summarized and reported in a timely manner, and (2) accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, due to the material weaknesses in internal control over financial reporting, described below, to allow timely decisions regarding required disclosure.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

In light of the material weaknesses described below, management performed additional analyses and other substantive procedures to ensure that our consolidated financial statements were prepared in accordance with accounting principles generally accepted in the United States of America (U.S. GAAP). Accordingly, management believes that the consolidated financial statements included in this Annual Report on Form 10-K fairly present, in all material respects, our financial position, results of operations, and cash flows as of and for the periods presented, in accordance with U.S. GAAP.

Management’s Report on Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting. Our internal control over financial reporting is a process designed under the supervision of our Chief Executive Officer and Chief Financial Officer to provide reasonable assurance regarding the reliability of financial reporting and the preparation of our financial statements for external reporting purposes in accordance with U.S. GAAP.

As of December 29, 2023, management conducted an assessment of the effectiveness of our internal control over financial reporting based on the framework established in Internal Control — Integrated Framework (2013)issued by the Committee of Sponsoring Organizations of the Treadway Commission. Our assessment excluded internal control over financial reporting at HIS Innovations Group (“HIS”), which was acquired on October 25, 2023 and whose financial statements constitute 3.3% and 0.4% of the Company’s consolidated total assets (excluding goodwill and intangible assets) and revenue, respectively, as of and for the year ended December 29, 2023. This exclusion was in accordance with Securities and Exchange Commission guidance that an assessment of a recently acquired business may be omitted in management’s report on internal controls over financial reporting in the year of acquisition. We will include this acquired entity in our assessment of the effectiveness of internal controls over financial reporting in the fiscal year 2024 annual management report, which will be the first annual management report following the first anniversary of the acquisition. Based on this assessment, management has determined that our internal control over financial reporting was not effective as of December 29, 2023 due to the material weaknesses described below.

•

The Company did not fully maintain components of the COSO framework, including elements of the control environment, risk assessment, control activities, and monitoring activities components, relating to: (i) sufficiency of processes related to identifying and analyzing risks to the achievement of objectives across the entity, (ii) sufficiency of competent personnel to analyze risk and develop internal control activities to support the achievement of the Company’s internal control objectives; and (iii) performing control activities in accordance with established policies in a timely manner.

These material weaknesses contributed to the following additional material weaknesses:

•

The Company did not design and maintain effective information technology (“IT”) general controls for certain information systems that are relevant to the preparation of its consolidated financial statements. Specifically, for certain of our Fluid Solutions operating subsidiaries in our Products segment which have not been migrated to our primary Enterprise Resource Planning (“ERP”) system, we did not design and maintain (a) program change management controls to ensure that IT program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized and implemented appropriately, and (b) user access controls to ensure appropriate segregation of duties that adequately restrict user and privileged access to its financial applications and data to appropriate company personnel. Our business process controls that are dependent on information and data produced by systems affected by the deficiencies in IT general controls and these business process controls were deemed ineffective because they could have been adversely impacted.

•

The Company did not design and maintain effective application controls over certain IT systems that are relevant to the preparation of its consolidated financial statements. Specifically, for certain other of our international operating subsidiaries in our Products segment which have not been migrated to our primary ERP system, although the IT general controls were tested and determined to be operating effectively, we did not design and maintain effective IT application controls or business process controls including, but not limited to appropriate segregation of duties. The business process controls were deemed ineffective because they could have allowed for certain personnel to have incompatible duties allowing for the creation, review, and processing of certain transactions without independent review and authorization which affects substantially all financial statement account balances and disclosures within such subsidiaries.

•

The Company did not design and maintain effective controls to determine the valuation of inventories, including the write down of inventory to its estimated market value less costs to sell and the validation and approval of inventory costing.

•

The Company did not design effective controls necessary to validate the accuracy of certain data used within the operation of controls which affects substantially all financial statement account balances and disclosures.

•

The Company did not design and maintain effective controls related to the review of cash flow forecasts used in the valuation of certain assets and liabilities acquired in a business combination. Specifically, the control activities related to the review of the inputs and assumptions utilized to develop the cash flow forecasts used in the valuation of acquired intangible assets and contingent earn-out liabilities resulting from the HIS business combination were not designed at an appropriate level of precision.

The material weaknesses described above did not result in any changes to previously released annual or interim financial results. However, each of these material weaknesses created a reasonable possibility that a material misstatement to the consolidated financial statements would not be prevented or detected on a timely basis.

The effectiveness of the Company’s internal control over financial reporting as of December 29, 2023 has been audited by Moss Adams LLP, an independent registered public accounting firm, as stated in their report which appears in this Form 10-K.

Remediation Plans

We plan to implement measures to remediate these material weaknesses, including: (i) engaging an external advisor to assist with evaluating and documenting the design and operating effectiveness of internal controls and assist with the remediation of deficiencies, as necessary; (ii) designing and implementing incremental controls over segregation of duties; (iii) documenting and testing incremental process controls for certain international operating subsidiaries not yet migrated to our primary ERP; and (iv) adjusting internal control policies to expand documentation requirements associated with the precision of management’s procedures over cash flow forecasts utilized in the valuation of intangible assets and contingent consideration acquired in a business combination to ensure the accuracy of assumptions and methodologies applied in the forecasting process.

The Company is working to remediate the material weaknesses as efficiently and effectively as possible and remediation efforts could continue beyond the fiscal year ending December 27, 2024. At this time, we cannot provide an estimate of costs expected to be incurred in connection with this remediation plan; however, these remediation measures will be time consuming, will result in the incurrence of significant costs, and will place significant demands on our financial, IT, and operational resources.

Remediation of Previously Identified Material Weaknesses

As disclosed in our Annual Report on Form 10-K for the fiscal year ended December 30, 2022, we previously identified material weaknesses in our internal control over financial reporting related to information technology general controls (“ITGCs”) over user access within our primary ERP system, our primary revenue system for the Services segment, and related ERP access controls affecting the independent review of manual journal entry postings. Business process controls that depend on the affected information systems, or that depend on data or financial reports generated from the affected information systems to be accurate and complete, could have been adversely affected.

The Company completed the actions and measures designed to remediate the control deficiencies that had led to the material weaknesses, including:

•

Engaged an external advisor to assist with evaluating and documenting the design and operating effectiveness of ITGCs in our primary ERP system;

•

Ensured appropriate reviews have been conducted of elevated and restricted access in our primary ERP;

•

Enhanced training programs addressing ITGCs and policies, including educating control owners concerning the principles and requirements of each control, with a focus on those related to user access over IT systems impacting financial reporting;

•

Designed and implemented additional business process review controls over manual journal entry postings;

•

Designed and implemented additional business process controls over Services segment revenues;

•

Implemented an IT management review process and increased the frequency of testing plans to monitor ITGCs with a specific focus on systems supporting our financial reporting processes; and

•

Hired additional IT personnel with relevant compliance expertise to support the ongoing design and maintenance of effective ITGCs.

Management has completed its documentation, testing and evaluation of the newly designed and enhanced control activities and determined that, as of December 29, 2023, these control activities have been appropriately designed and implemented, and have operated effectively for a sufficient period of time to conclude that these previously identified material weaknesses have been remediated.

Changes in Internal Control Over Financial Reporting

Except for the remediation activities related to the material weaknesses in internal control over financial reporting described above, there were no changes in our internal control over financial reporting during the fiscal fourth quarter ended December 29, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.