Kyndryl Holdings Inc

Disclosure Controls and Procedures

The Company’s management evaluated, with the participation of the Chief Executive Officer and Chief Financial Officer, the effectiveness of the Company’s disclosure controls and procedures (as such term is defined in Rule 13a-15(e) of the Securities Exchange Act of 1934, as amended (the “Exchange Act”)) as of March 31, 2024, the end of the period covered by this report. Based on that evaluation, the Chief Executive Officer and Chief Financial Officer have concluded that the Company’s disclosure controls and procedures were not considered to be effective as of March 31, 2024 due to a material weakness in internal control over financial reporting (as such term is defined in Rule 12b-2 of the Exchange Act) in the area of our information technology general controls (“ITGCs”). The deficiencies in ITGCs were related to access and program development and change management controls associated with the Company’s large-scale migration in a compressed timeframe of its internal operating systems to a new enterprise resource planning system (“ERP”), which was required to replace the systems temporarily being made available to the Company by our former parent following our Spin-off. These control deficiencies did not result in a misstatement to the annual or interim consolidated financial statements previously filed or included in this Annual Report on Form 10-K.

Subsequent to the identification of the ITGC deficiencies and prior to the issuance of this Annual Report on Form 10-K, the Company performed a lookback review of the users making changes to relevant systems and conducted other supplemental procedures. As a result of these procedures we did not identify any material misstatements in our consolidated financial statements or disclosures in the fiscal year ended March 31, 2024.

Our management has concluded that the consolidated financial statements for the periods covered by and included in this Annual Report on Form 10-K fairly present, in all material respects, our financial position, results of operations and cash flows in conformity with GAAP.

Management’s Report on Internal Control over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rule 13a-15(f) of the Exchange Act). Our internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. Internal control over financial reporting includes those policies and procedures that:

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate due to changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Management, with the participation of the Chief Executive Officer and Chief Financial Officer, conducted an assessment of the effectiveness of our internal control over financial reporting as of March 31, 2024 based on the criteria set forth in Internal Control – Integrated Framework (“2013 Framework”) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”).

In connection with our assessment of the effectiveness of internal control over financial reporting, management identified certain control deficiencies associated with the Company’s new ERP environment in the area of ITGCs related to (i) user access and segregation of duty controls that restrict user and privileged access to appropriate personnel; (ii) program development and change management controls; and (iii) certain computer operations controls that, when aggregated, are considered to be a material weakness which is defined in Rule 12b-2 of the Exchange Act as a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis. Because of this, management has determined our internal control over financial reporting was not effective as of March 31, 2024. These control deficiencies did not result in a misstatement to the annual or interim consolidated financial statements previously filed or included in this Annual Report on Form 10-K.

Our consolidated financial statements included in this Annual Report on Form 10-K and the effectiveness of our internal control over financial reporting as of March 31, 2024 have been audited by PricewaterhouseCoopers LLP, an independent registered public accounting firm, as stated in their report included in this Annual Report on Form 10-K. See “Report of Independent Registered Public Accounting Firm” on page 50.

Remediation Plan

Management has evaluated the deficiencies described above and has developed and is implementing a remediation plan designed to strengthen our ITGC processes and controls associated with our new ERP environment. This plan includes but is not limited to (i) implementing and/or formalizing additional controls across our information technology environment, including user access and segregation of duty controls, program development and change management controls, and certain computer operations controls, and (ii) training of relevant personnel on the design and operation of any new or modified ITGCs. The remediation plan is subject to ongoing management review, as well as oversight by the Audit Committee of our Board of Directors.

The Company expects to complete the implementation of its remediation plan during fiscal year 2025. We believe our remediation plan will address the deficiencies described above; however, deficiencies will not be considered fully remediated until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. We will continue to monitor the design and effectiveness of these and other processes, procedures and controls and make further changes as appropriate.

Changes in Internal Control over Financial Reporting

Other than the deficiencies and remediation activities described above, there has been no change in the Company’s internal control over financial reporting (as such term is defined in Rule 13a-15(f) of the Exchange Act) that occurred during the Company’s last fiscal quarter ended March 31, 2024 that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.