Natural Grocers by Vitamin Cottage, Inc.

Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting, as defined in Rule 13a-15(f) promulgated under the Exchange Act. Internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and preparation of consolidated financial statements for external purposes in accordance with GAAP. Our internal control over financial reporting includes those policies and procedures that:

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

We have assessed the effectiveness of our internal control over financial reporting as of September 30, 2025 using the criteria described in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on our assessment of the design and related testing of the internal control over financial reporting, management concluded that, as of September 30, 2025, we maintained effective internal control over financial reporting.

Our independent registered public accounting firm, KPMG LLP, audited the effectiveness of our internal control over financial reporting. KPMG LLP’s attestation report is included in “Item 8. Financial Statements and Supplementary Data” of this Form 10-K.

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting during the quarter ended September 30, 2025 that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our principal executive officers and principal financial and accounting officer, evaluated the effectiveness of our disclosure controls and procedures pursuant to Rule 13a-15 under the Exchange Act as of the end of the period covered by this Form 10-K. In designing and evaluating the disclosure controls and procedures, management recognized that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply its judgment in evaluating the benefits of possible controls and procedures relative to their costs.

Based on that evaluation, our principal executive officers and principal financial and accounting officer concluded that our disclosure controls and procedures were effective at a reasonable assurance level as of September 30, 2025.