Mirum Pharmaceuticals Inc

Evaluation of Disclosure Controls and Procedures

Our management, with the participation and supervision of our Chief Executive Officer and our Chief Financial Officer (our principal executive officer and principal financial officer, respectively), have evaluated our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act) as of the end of the period covered by this Annual Report. Based on that evaluation, our Chief Executive Officer and our Chief Financial Officer have concluded that, due to the material weaknesses described below, as of December 31, 2023, our disclosure controls and procedures were not effective to provide reasonable assurance that information we are required to disclose in reports that we file or submit under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in SEC rules and forms, and that such information is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosure.

Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as defined in Exchange Act Rules 13a-15(f) and 15d-15(f). We maintain internal control over financial reporting designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

Internal control over financial reporting cannot provide absolute assurance of achieving financial reporting objectives because of its inherent limitations. Internal control over financial reporting is a process that involves human diligence and compliance and is subject to lapses in judgment and breakdowns resulting from human failures. Internal control over financial reporting also can be circumvented by collusion or improper management override. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within the Company have been detected. Because of such limitations, there is a risk that material misstatements may not be prevented or detected on a timely basis by internal control over financial reporting. However, these inherent limitations are known features of the financial reporting process. Therefore, it is possible to design into the process safeguards to reduce, though not eliminate, this risk.

Under the supervision and with the participation of our Chief Executive Officer and our Chief Financial Officer, our management conducted an evaluation of the effectiveness of our internal control over financial reporting based on the criteria set forth in “Internal Control—Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework). Based on this assessment, due to the material weaknesses described below, our management concluded that our internal control over financial reporting was not effective at the reasonable assurance level as of December 31, 2023. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis. We identified the following material weaknesses in our internal controls over financial reporting as of December 31, 2023:

•

The Company did not design and maintain effective controls over the existence and valuation of inventory, specifically, the controls over existence of inventory located at third parties and the net realizable value assessment of on-hand inventory and future purchases under firm commitments. The Company’s controls were not designed with sufficient level of precision and the level of evidence of reviews performed was insufficient.

•

The Company did not design and maintain sufficiently precise management review controls to evaluate prospective financial information used to determine the fair value of developed technology and did not maintain evidence related to the management review performed. Furthermore, the Company did not design and maintain effective management review controls to identify and assess firm purchase commitments related to the acquisition.

The material weaknesses identified above did not result in any material misstatements to our financial statements or disclosures, and there were no changes to previously filed Annual Reports on Form 10-K or Quarterly Reports on Form 10-Q. Notwithstanding our material weaknesses, we have concluded that the financial statements and other financial information included in this Annual Report fairly present in all material respects our financial condition, results of operations and cash flows for the periods presented in conformity with accounting principles generally accepted in the United States.

The effectiveness of our internal control over financial reporting as of December 31, 2023 has been audited by Ernst & Young LLP, an independent registered public accounting firm, as stated in its report which is included in Item 8 of this Annual Report on Form 10-K.

The scope of management’s assessment of the effectiveness of internal control over financial reporting excluded the Bile Acid Portfolio Acquisition, which we acquired in an asset purchase on August 31, 2023 and is included in our consolidated financial statements as of and for the year ended December 31, 2023. The Bile Acid Portfolio Acquisition represented approximately 6% of total assets (excluding intangible assets) and 20% of total revenues, each as reflected in our consolidated financial statements as of and for the year ended December 31, 2023.

Remediation Plan for Material Weaknesses

Management is actively engaged in the planning for, and implementation of, remediation efforts to address the material weaknesses. The remediation plan includes adding controls to ensure timely accounting evaluation of firm commitments for inventory purchases and employee training related to internal control over financial reporting specifically focused on data used in the operation of management review controls and the execution of management review controls with an appropriate level of precision and documentation. The remediation actions will be monitored by the Audit Committee of our Board of Directors. The elements of our remediation plan can only be accomplished over time, and we can offer no assurance on the timing of our implementation of these initiatives or that these initiatives will ultimately have the intended effects.

Changes in Internal Control over Financial Reporting

There have been no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the quarter ended December 31, 2023 that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting. Our plans for remediating the material weaknesses, described above, will constitute changes in our internal control over financial reporting, prospectively, when such remediation plans are effectively implemented.