CECO ENVIRONMENTAL CORP

Evaluation of Disclosure Controls and Procedures

Disclosure controls and procedures (as defined in Rule 13a-15(e) and 15d-15(e) under the Exchange Act) are controls and other procedures that are designed to provide reasonable assurance that information required to be disclosed in the reports that we file or submit under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and made known to our management, including our Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), as appropriate, to allow timely decisions regarding required disclosure.

In connection with the preparation of this Annual Report on Form 10-K, our management, with the participation of our CEO and CFO, carried out an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures as of December 31, 2025. Based on that evaluation, our management, including our CEO and CFO, concluded that our disclosure controls and procedures were not effective as of December 31, 2025, due to certain material weaknesses in our internal control over financial reporting, as further described below.

Notwithstanding the conclusion by our CEO and CFO that our disclosure controls and procedures as of December 31, 2025 were not effective, and notwithstanding the material weaknesses in our internal control over financial reporting described below, our management believes that the consolidated financial statements and related financial information included in this Annual Report on Form 10-K fairly present, in all material respects, our financial position, results of operations and cash flows as of the dates presented, and for the periods ended on such dates, in conformity with U.S. GAAP.

Management’s Report on Internal Control over Financial Reporting

Management of the Company is responsible for the preparation and accuracy of the financial statements and other information included in this report. Under the supervision and with the participation of management, including the Company’s CEO and CFO, the Company conducted an evaluation of the effectiveness of internal control over financial reporting as of December 31, 2025, based on the criteria set forth in Internal Control – Integrated Framework (2013) (the “Framework”) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”). Based on evaluation under these criteria, management determined, based upon the existence of the material weaknesses described below, that we did not maintain effective internal control over financial reporting as of December 31, 2025.

Management excluded from its assessment of internal control over financial reporting as of December 31, 2025 the internal control over financial reporting of Profire Energy, Inc. (“Profire”), which the Company acquired on January 3, 2025. Profire represents 8% of revenues of the consolidated financial statements for the year ended December 31, 2025. Management has excluded Profire from its assessment of the effectiveness of internal control over financial reporting as of December 31, 2025 because it was not practical for management to conduct an assessment of internal control over financial reporting in the period between the date the acquisition was completed and the date of management’s assessment. See a discussion of this in Note 14, Acquisitions.

Identification of Material Weaknesses

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

We have identified the following deficiencies in our control environment, control activities and monitoring activities that constitute material weaknesses, either individually or in the aggregate, as of December 31, 2025:

At the Verantis Environmental Solutions Group ("Verantis") business, which was acquired in December 2024, we did not appropriately integrate the entity into our established governance and control framework; did not retain sufficient resources with appropriate levels of knowledge, experience, and training to support accounting and financial reporting processes and control objectives at this business; failed to implement effective controls over the segregation of duties and certain information technology controls; and did not develop and perform ongoing evaluations to ascertain whether the components of internal control were present and functioning.

We did not consistently assess the proper level of completeness and accuracy of information used in the execution of controls related to balance sheet reconciliations.

These material weaknesses did not result in any material misstatement in our interim or audited financial statements or disclosures, and there were no changes required to any of our previously released interim or audited consolidated financial statements.

Deloitte & Touche LLP, our independent registered public accounting firm, has audited the effectiveness of our internal control over financial reporting as of December 31, 2025. Their report is included below under the heading “Report of Independent Registered Public Accounting Firm.”

Management’s Plan for Remediation of the Material Weaknesses

We are committed to maintaining strong internal control over financial reporting. Management, with the oversight of the Audit Committee of the Board of Directors, is taking comprehensive actions to remediate the material weaknesses described above. Our remediation plan includes the following:

•

We are updating control documentation, expanding education and training, and ensuring that controls are prepared and reviewed at the appropriate level of precision.

•

We have hired and will continue to hire accounting and finance personnel with the requisite skills and expertise to perform control activities related to the financial close process. We will continue to augment our internal resources by engaging external consultants with technical experience in accounting, financial reporting, and internal controls, until we add sufficient in-house skills to our staff.

•

We will continue to focus on enhancing our information technology controls, specifically the assessment and integration of such controls at newly acquired entities.

•

With the guidance and participation of our internal audit function, we will develop an enhanced monitoring program to (1) evaluate and assess whether controls are present and functioning in a timely manner and (2) hold individuals accountable for their internal control responsibilities.

The material weaknesses will not be considered remediated until the controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. We believe the above measures will remediate the control deficiencies identified and strengthen our internal control over financial reporting. As we continue to evaluate and work to remediate the control deficiencies that gave rise to the material weaknesses, we may determine that additional measures or time are required to address the control deficiencies or that we need to modify or otherwise adjust the remediation measures described above. We will continue to assess the effectiveness of our remediation efforts in connection with our evaluation of our internal control over financial reporting.

Changes in Internal Control Over Financial Reporting

Except for the identification of the material weaknesses above, there were no changes during the quarter ended December 31, 2025 in our internal control over financial reporting that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Inherent Limitations on Effectiveness of Controls

The Company’s management, including its CEO and CFO, does not expect that its disclosure controls and procedures or its internal control over financial reporting will prevent or detect all errors and all fraud. A control system, no matter how well-designed and operated, can provide only reasonable, not absolute, assurance that the control system’s objectives will be met. The design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Further, because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, have been detected. The design of any system of controls is based in part on certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Projections of any evaluation of the effectiveness of controls to future periods are subject to risks. Over time, controls may become inadequate because of changes in conditions or deterioration in the degree of compliance with policies or procedures.

To the shareholders and the Board of Directors of CECO Environmental Corp.

Opinion on Internal Control over Financial Reporting

We have audited the internal control over financial reporting of CECO Environmental Corp and subsidiaries (the “Company”) as December 31, 2025, based on criteria established in Internal Control — Integrated Framework (2013)issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In our opinion, because of the effect of the material weaknesses identified below on the achievement of objectives of the control criteria, the Company has not maintained effective internal control over financial reporting as of December 31, 2025, based on criteria established in Internal Control — Integrated Framework (2013) issued by COSO.

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated financial statements as of and for the fiscal year ended December 31, 2025, of the Company and our report dated March 2, 2026, expressed an unqualified opinion on those financial statements.

As described in Management’s Report on Internal Control Over Financial Reporting, management excluded from its assessment the internal control over financial reporting of the Profire Energy, Inc. business, which was acquired on January 2, 2025, and whose financial statements constitute 8% of revenues of the consolidated financial statements for the year ended December 31, 2025. Accordingly, our audit did not include the internal control over financial reporting for the Profire Energy, Inc. business.

The Company’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

Definition and Limitations of Internal Control over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Material Weaknesses

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis.

The following material weaknesses have been identified in the Company’s control environment, control activities, and monitoring activities and included in management’s assessment:

The Company identified material weaknesses at the Verantis Environmental Solutions Group (Verantis) component, which was acquired in December 2024, as the Company did not appropriately integrate the entity into their established governance and control framework; did not retain sufficient resources with appropriate levels of knowledge, experience, and training to support accounting and financial reporting processes and control objectives at this business; failed to implement effective controls over the segregation of duties and certain information technology controls; and did not develop and perform ongoing evaluations to ascertain whether the components of internal control were present and functioning.

Additionally, the Company did not consistently assess the proper level of completeness and accuracy of information used in the execution of controls related to balance sheet reconciliations.

These material weaknesses were considered in determining the nature, timing, and extent of audit tests applied in our audit of the consolidated financial statements as of and for the fiscal year ended December 31, 2025, of the Company, and this report does not affect our report on such financial statements.

/s/ DELOITTE & TOUCHE LLP

March 2, 2026