Neurogene Inc

Evaluation of Disclosure Controls and Procedures

Under the supervision and with the participation of our principal executive officer and principal financial officer, our management conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures, as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, prior to the filing of this annual report on Form 10-K. Based on that evaluation, they have concluded that, as of the end of the period covered by this annual report on Form 10-K, our disclosure controls and procedures were, in design and operation, effective at a reasonable assurance level.

Previously Identified Material Weakness in Internal Control Over Financial Reporting

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

In August 2023, we discovered that we had been subjected to a business email compromise attack by a third party, resulting in a loss of $0.9 million dollars due to a diversion of payments to two fraudulent bank accounts. This email compromise attack highlighted a deficiency in our internal control over financial reporting, specifically in our controls relating to changes made to supplier payment information, which we determined amounted to a material weakness in our controls.

Following the discovery of this attack, we implemented steps to remediate the control deficiency, including increasing communication of and training around our controls relating to changes made to supplier information, emphasizing security awareness and the importance of exercising professional skepticism, and designing a process whereby supplier information changes were reviewed before releasing supplier payments.

Remediation of Prior Material Weakness

Through effective implementation of our remediation plan, we have strengthened our internal control environment and have addressed the material weaknesses that were identified in August 2023. Based on the evaluation of the effectiveness of our internal control over financial reporting discussed in the prior paragraph, our management determined that as of December 31, 2023, the identified material weakness has been remediated. However, completion of remediation does not provide assurance that our remediated controls will continue to operate properly or that our financial statements will be free from error.

Management’s Annual Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Rule 13a-15(f) under the Securities Exchange Act of 1934, as amended. Our management conducted an evaluation of the effectiveness of our internal control over financial reporting as of December 31, 2023 based on the 2013 framework in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on its evaluation under the framework in Internal Control-Integrated Framework, management concluded that our internal control over financial reporting was effective as of December 31, 2023.

Inherent Limitation on the Effectiveness of Internal Controls and Disclosure Controls

The effectiveness of any system of internal control over financial reporting and disclosure controls and procedures, including ours, is subject to inherent limitations, including the exercise of judgment in designing, implementing, operating, and evaluating the controls and procedures, and the inability to eliminate misconduct completely. Accordingly, any system of internal control over financial reporting and disclosure controls and procedures, including ours, no matter how well designed and operated, can only provide reasonable, not absolute assurances. In addition, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. We intend to continue to monitor and upgrade our internal controls as necessary or appropriate for our business, but cannot assure you that such improvements will be sufficient to provide us with effective internal control over financial reporting and disclosure controls and procedures.

Attestation Report of the Registered Public Accounting Firm

As a smaller reporting company and non-accelerated filer, as defined in the Exchange Act, we are exempt from the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act of 2002. As a result, our independent registered public accounting firm has not audited or issued an attestation report with respect to the effectiveness of our internal control over financial reporting as of December 31, 2023.

Changes in Internal Control Over Financial Reporting

There were no changes in our internal control over financial reporting during the three months ended December 31, 2023 that materially affected, or is reasonably likely to materially affect, our internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act), other than the internal controls implemented in connection with our remediation efforts described above.