Ranpak Holdings Corp

Disclosure Controls and Procedures

We maintain disclosure controls and procedures, as that term is defined in Rules 13a-15(e) and 15d-15(e) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Our management, including our chief executive officer (“CEO”) and chief financial officer (“CFO”),does not expect that our disclosure controls and procedures or our internal control over financial reporting will prevent all errors and all fraud due to the inherent limitations of internal controls. Because of such limitations, there is a risk that material misstatements will not be prevented or detected on a timely basis by internal control over financial reporting. However, these inherent limitations are known features of the financial reporting process. Therefore, it is possible to design into the process safeguards to reduce, though not eliminate, this risk.

Our management, under the supervision and with the participation of our CEO (our principal executive officer) and CFO (our principal financial officer), has evaluated the effectiveness of our disclosure controls and procedures as of December 31, 2023. Based on that evaluation, our CEO and CFO have each concluded that such disclosure controls and procedures were not effective as of December 31, 2023, because of material weaknesses in internal control over financial reporting described below.

Notwithstanding such material weaknesses in our internal control over financial reporting, our management, including our principal executive officer and principal financial officer, concluded that our consolidated financial statements in this Annual Report present fairly, in all material respects, our financial position, results of operations and cash flows for the periods presented, in conformity with U.S. generally accepted accounting principles.

Management’s Annual Report on Internal Control Over Financial Reporting

We maintain internal control over financial reporting, as that term is defined in Rules 13a-15(f) and 15d-15(f)) of the Exchange Act. Internal control over financial reporting is a process designed under the supervision of our CEO and our CFO and effected by our board of directors, management and other personnel to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

Management, under the supervision and with the participation of our CEO and CFO, and under the oversight of the Audit Committee, assessed the Company’s internal control over financial reporting as of December 31, 2023, based on criteria specified in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”). Based on our assessment, management, including our CEO and CFO, concluded that, as of December 31, 2023, our internal control over financial reporting was not effective because of the material weaknesses described below.

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of annual or interim financial statements will not be prevented or detected on a timely basis. Management identified the following material weaknesses in internal control over financial reporting as of December 31, 2023:

•

The Company had ineffective general information technology controls (“GITCs”) that support the consistent operation of the Company’s information technology (“IT”) systems, including its enterprise resource planning system which was implemented in January 2022. Therefore, automated process-level controls and manual controls dependent upon the accuracy and completeness of information derived from those IT systems were also ineffective because they could have been adversely impacted; and

•

The Company did not effectively design, implement, or operate process-level control activities related to its financial reporting processes.

Management concluded that these material weaknesses were primarily due to an ineffective control environment that resulted in ineffective risk assessment, information and communications and monitoring activities. Specifically:

•

The Company did not have a sufficient number of trained resources with expertise in and responsibility and accountability for the design, implementation, operation and documentation of internal control over financial reporting and IT systems.

•

The Company did not have an effective risk assessment process related to internal control over financial reporting that defined clear financial reporting objectives and evaluated risks, including risks resulting from changes in the external environment and business operations, at a sufficient level of detail to identify all relevant risks of material misstatement to the consolidated financial statements.

•

The Company did not have an effective information and communication process that identified and assessed the source of and controls necessary to ensure the reliability of information used in financial reporting and that communicates relevant information about roles and responsibilities for internal control over financial reporting.

•

The Company did not have effective monitoring activities to assess the operation of internal control over financial reporting, including the continued appropriateness of control design and level of documentation maintained to support control effectiveness.

The Company’s independent registered public accounting firm, KPMG LLP (“KPMG”), who audited the consolidated financial statements included in this Annual Report on Form 10-K, has issued an adverse opinion on the effectiveness of the Company’s internal control over financial reporting. KPMG’s report appears beginning on page 42 of this Annual Report on Form 10-K.

Remediation Activities

With respect to the material weaknesses described above that were identified in 2022, management with oversight from the Audit Committee of the Board of Directors, has taken steps during 2023 and plans to continue those efforts in 2024 to remediate such material weaknesses and has invested considerable time and resources in improving the design, implementation and operation of our internal control over financial reporting. Despite these efforts, which are outlined below, the material weaknesses identified as of December 31, 2022 remain as of December 31, 2023.

•

We established a financial reporting project plan, which included frequent communications between our Audit Committee and senior management regarding the progression on remediation of our financial reporting and internal control environment.

•

We added additional resources and expanded our organizational chart in accounting, finance, and the information technology organizations, including hiring a Vice President (“VP”) of Finance of EMEA / APAC overseeing accounting, reporting, treasury, cash processing, and tax functions in the region and VP of Global Tax overseeing our global tax function. In addition, we hired a Senior Director of Enterprise Resource Planning (“ERP”) Applications to drive the implementation of GITCs and process improvements of our ERP system.

•

We continued to train our employees to reinforce the importance of a strong control environment and clearly communicate expectations to emphasize responsibilities and the technical requirements for internal controls.

•

We engaged third-party consultants to assist with process mapping and internal control design.

•

We implemented an enhanced risk assessment process to identify and assess risks of misstatement, including fraud risks, to ensure controls are designed and implemented to responds to those risks, and to identify and assess changes that could impact the system of internal controls. Those enhancements included, but were not limited to:

o

Improving entity wide risk assessment to enable the identification and assessment of relevant process risk points, IT systems and the information used in the operation of controls;

o

Designing and implementing automated and manual controls responsive to the process risk points identified

o

Developing a plan for conducting ongoing evaluations to monitor if the components of internal control are present and functioning.

•

We established a comprehensive GITC evaluation and monitoring program and invested in people and technology to address gaps in IT Systems Security controls, IT Systems Change Management controls, and IT Systems Batch/Program Monitoring controls which included design of controls to address gaps over our GITC’s for our ERP and certain other IT systems, which we plan to start implementing in first quarter of 2024.

•

We developed and implemented an internal control framework for our GITCs, including the controls around access to information systems and change management internal controls to information systems.

•

We established policies and procedures over the segregation of incompatible duties within our information technology systems and we implemented software used to govern ERP development processes.

•

During the fourth quarter of 2023, we implemented software used to enhance our internal control environment with regards to account reconciliations and the performance of monthly reviews of account balances across all our companies.

•

We developed accounting policies and procedures to assist our organization and assist our accounting and finance team in recording transactions appropriately.

In addition, we continue to:

•

Design and implement internal controls to ensure consistent application of our policies and procedures.

•

Develop and implement a framework to identify risks of material misstatement to our consolidated financial statements and are designing controls to mitigate those risks.

Throughout the process of design and implementation of internal control over financial reporting, we have utilized a third-party service provider to assist us in evaluating, designing, implementing and testing of our internal control over financial reporting. In addition, in the first quarter of 2024, to enhance our risk management process generally, we decided to outsource our internal audit function to that third party service provider.

We are committed to ensuring that our internal control over financial reporting is designed and operating effectively. Management believes the efforts taken to date to enhance the design and effectiveness of controls have been robust and have increased our overall ability to mitigate material financial risk. In fiscal 2024 we expect to continue our internal control over financial reporting remediation efforts, including the following:

•

Further developing the detailed remediation plan addressing the operation of process-level control activities, GITCs and staffing needs with appropriate executive sponsorship and with the assistance of third-party specialists, when necessary, to specifically address the material weaknesses related to the operating control environment and GITCs.

•

Enhancing policies and procedures to improve our overall control environment and monitoring controls around timely evaluation and communication of internal control deficiencies to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

•

Designing and implementing a continuous risk assessment process to identify and assess risks of material misstatement and ensure that the impacted financial reporting processes and related internal controls are properly designed and in place to respond to those risks in our financial reporting.

•

Continuing to recruit key positions within our technology, accounting, business operations and other support functions with appropriate qualified experience and ERP knowledge to enhance our risk assessment processes and internal control capabilities, allow for appropriate segregation of duties and change management, and provide appropriate oversight and reviews.

•

Providing additional training and education programs for personnel responsible for the performance of key business processes throughout the Company to facilitate their understanding of the risks being addressed by the controls they are performing as well as educate them in the documentation requirements of the internal control framework.

•

Enhancing user access provisioning and monitoring controls to enforce appropriate system access and segregation of duties as well as controls supporting change management.

Although we intend to complete the remediation process as promptly as possible, we cannot at this time estimate how long it will take to remediate the material weaknesses described above. We may discover additional material weaknesses that require additional time and resources to remediate, and we may decide to take additional measures to address the material weaknesses or modify the remediation steps described above.

In addition, while certain of the activities described above have continued to enhance our internal control over financial reporting, certain of these newly designed controls have not operated effectively for a sufficient period of time to be able to conclude on effectiveness. We remain committed to continue investing significant time and resources and taking actions to remediate the material weaknesses in our internal control over financial reporting as we work to further enhance our control environment. Until these weaknesses are remediated, we plan to continue to perform additional analyses and other procedures to ensure that our consolidated financial statements are prepared in accordance with U.S. GAAP.

Changes in Internal Control over Financial Reporting

The Company is in the process of implementing changes to its internal control over financial reporting to remediate the material weaknesses described above. The implementation of these measures began in the first quarter of 2023 and will continue during 2024. Except for these changes, which are summarized above, there has been no change in the Company’s internal control over financial reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the quarter ended December 31, 2023, that has materially affected, or is reasonably likely to materially affect, its internal control over financial reporting.

Report of Independent Registered Public Accounting Firm

Opinion on Internal Control Over Financial Reporting

We have audited Ranpak Holdings Corp. and subsidiaries' (the Company) internal control over financial reporting as of December 31, 2023, based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. In our opinion, because of the effect of the material weaknesses, described below, on the achievement of the objectives of the control criteria, the Company has not maintained effective internal control over financial reporting as of December 31, 2023, based on criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated balance sheets of the Company as of December 31, 2023 and 2022, the related consolidated statements of operations and comprehensive income (loss), changes in shareholders’ equity, and cash flows for each of the years then ended, and the related notes (collectively, the consolidated financial statements), and our report dated March 14, 2024 expressed an unqualified opinion on those consolidated financial statements.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis. The material weaknesses discussed below have been identified and included in management’s assessment.

•

The Company had ineffective general information technology controls (GITCs) that support the consistent operation of all of its information technology (IT) systems, including its enterprise resource planning system which was implemented in January 2022. Therefore, automated process-level controls and manual controls dependent upon the accuracy and completeness of information derived from those IT systems were also ineffective because they could have been adversely impacted; and

•

The Company did not effectively design, implement or operate process-level control activities related to its financial reporting processes.

These material weaknesses were primarily due to an ineffective control environment that resulted in ineffective risk assessment, information and communications and monitoring activities. Specifically:

•

The Company did not have a sufficient number of trained resources with expertise in and responsibility and accountability for the design, implementation, operation and documentation of internal control over financial reporting and IT systems.

•

The Company did not have an effective risk assessment process related to internal control over financial reporting that defined clear financial reporting objectives and evaluated risks, including risks resulting from changes in the external environment and business operations, at a sufficient level of detail to identify all relevant risks of material misstatement to the consolidated financial statements.

•

The Company did not have an effective information and communication process that identified and assessed the source of and controls necessary to ensure the reliability of information used in financial reporting and that communicates relevant information about roles and responsibilities for internal control over financial reporting.

•

The Company did not have effective monitoring activities to assess the operation of internal control over financial reporting, including the continued appropriateness of control design and level of documentation maintained to support control effectiveness.

The material weaknesses were considered in determining the nature, timing, and extent of audit tests applied in our audit of the 2023 consolidated financial statements, and this report does not affect our report on those consolidated financial statements.

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management's Annual Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audit also included performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

Definition and Limitations of Internal Control Over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

/s/ KPMG LLP

March 14, 2024