Karat Packaging Inc

Evaluation of Disclosure Controls and Procedures

The Company's management, with the participation of its Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of its disclosure controls and procedures (as defined in the Securities Exchange Act of 1934, as amended (“Exchange Act”) Rules 13a-15(e) and 15d-15(e)) as of the end of the period covered by this Annual Report on Form 10-K. Based on this evaluation, the Company's Chief Executive Officer and Chief Financial Officer concluded that its disclosure controls and procedures were not effective at December 31, 2023, due to the material weaknesses described below.

Management’s Annual Report on Internal Control Over Financial Reporting

The Company's management, under the supervision and with the participation of its Chief Executive Officer and Chief Financial Officer and effected by its board of directors, is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rules 13(a)-15(f) and 15(d)-15(f) under the Exchange Act. The Company's internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Under the supervision and with the participation of the Company's Chief Executive Officer and Chief Financial Officer, management conducted an evaluation of the effectiveness of the Company's internal control over financial reporting as of December 31, 2023 using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in “Internal Control - Integrated Framework” (2013). Based on this assessment, management concluded that as of December 31, 2023, its internal control over financial reporting was not effective due to the material weaknesses described below. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.

Management has determined that the Company has the following material weakness in its internal control over financial reporting at December 31, 2023:

Management did not maintain appropriately designed entity-level controls impacting the control environment, risk assessment procedures and monitoring activities to prevent or detect material misstatements to the consolidated financial statements. These deficiencies were attributed to: (i) lack of structure and responsibility, insufficient number of qualified resources and inadequate oversight and accountability over the performance of controls, including retention of control evidence, and (ii) ineffective identification and assessment of risks impacting internal control over financial reporting, and (iii) insufficient evaluation and determination as to whether the components of internal controls were present and functioning based upon evidence maintained for certain management review controls and activity level controls across substantially all financial statement areas. This material weakness did not result in any material misstatements of the Company’s financial statements or disclosures for any prior or current reporting periods, but did result in immaterial misclassification adjustments to net sales, cost of goods sold, selling expenses and general and administrative expenses with no impact on net income for the quarter and year ended December 31, 2023 and an immaterial adjustment to deposits as of December 31, 2023.

This material weakness contributed to the following additional material weakness:

Management did not design and maintain effective controls over certain information technology ("IT") general controls for information systems that are relevant to the preparation of their financial statements. Specifically, management did not design and maintain (i) program change management controls to ensure that program and data changes are identified, tested, authorized and implemented appropriately, and (ii) user access controls to ensure appropriate segregation of duties and to adequately restrict user and privileged access to appropriate personnel. These IT deficiencies did not result in a material misstatement to the financial statements.

Each of these material weaknesses could result in a misstatement of substantially all account balances or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected.

Plan of Remediation of Material Weaknesses in Internal Control Over Financial Reporting

As reported in the 2022 Form 10-K, we have engaged in remedial actions in response to the deficiencies discussed above. These efforts were on-going during 2022 and 2023 and will continue into 2024.

The following remedial actions were taken in the year ended December 31, 2022:

•Increased the number of personnel with the appropriate level of knowledge related to accounting transactions, accounting matters, and relevant systems, including the addition of a Chief Financial Officer and Controller.

•With the assistance from the third-party service provider, and under the supervision of the Company's Audit Committee, Chief Executive Officer and Chief Financial Officer, initiated the design and implementation of significant process transaction flows and key controls in the Company's overall IT environment.

The following remedial actions were taken in the year ended December 31, 2023:

•As part of management's risk assessment and evaluation of the design of key controls, management updated control objectives and refined control design and documentation, including such design and documentations as related to the appropriate segregation of duties and monitoring activities.

•Enhanced policies and procedures to improve Information Technology General Controls and the Company's overall IT environment. Examples of some of management's efforts include:

◦Adopted the policy and procedure to regularly review user's access rights relating to the Company's significant information technology systems;

◦Designed and started to perform review of users’ access rights to our significant information technology systems; and

◦Maintained and enforced certain procedures, controls and developed IT policies around change management.

Additionally, the following remedial actions are currently in the process of being taken:

•Continue to evaluate the Company's needs for additional personnel and add, as needed, additional headcount primarily within the information technology department. Management continues to onboard individuals with the appropriate education, experience, certifications, and training.

•Continue to enhance policies and procedures to improve Information Technology General Controls and the Company's overall IT environment, including continue to enforce newly or enhanced policies and controls around user provisioning, access reviews and change management.

Management is committed to remediating the material weaknesses in a timely fashion and to making continuous improvements to the Company's internal control over financial reporting. Management believes the measures described above have strengthened the Company's internal control over financial reporting, Management will continually assess the effectiveness of the remediation efforts and may determine to take additional measures to address control deficiencies or modify the remediation plan described above.

Remediation of Previously Identified Material Weaknesses

We have previously identified and disclosed the following material weaknesses in our internal control over financial reporting for the year ended December 31, 2022:

•Management did not design and implement management review controls at a sufficient level of precision to detect a material misstatement across substantially all financial statement areas that include complex and judgmental areas of accounting and disclosure.

•Management did not design and maintain effective activity level controls over balances recorded within revenue and accounts receivable, including controls over (i) the approval of arrangements with customers and pricing changes, and (ii) the approval and matching of sales orders, shipping documents, and sales invoices in the revenue recognition process.

•Management did not design and maintain effective activity level controls over the balances recorded within inventory and cost of sales, including controls over (i) the year-end physical inventory counts and inventory count variances, and (ii) inventory costing and bill of material analysis.

•Management did not design and maintain effective activity level controls over the procurement process, including controls over (i) vendor master file changes, (ii) the approval and matching of purchase orders, invoices, and receiving documents, and (iii) authorization of vendor payments.

As of December 31, 2023, management sufficiently completed its remediation of these material weaknesses by taking the following measures:

•Increased the number of personnel with the appropriate level of knowledge related to accounting transactions, accounting matters, and relevant systems, including the addition of a Chief Financial Officer and Controller.

•Engaged a third-party service provider to assist management with the design and implementation of internal controls.

•Completed a risk assessment based on the criteria established by the Committee of Sponsoring Organizations of the Treadway Commission ("COSO") to identify internal control over financial reporting ("ICFR") risks and control objectives.

•With the assistance from the third-party service provider, and under the supervision of the Company's Audit Committee, Chief Executive Officer and Chief Financial Officer, designed and implemented significant process transaction flows and key controls in the Company's business processes, including revenue, inventory, and procurement.

•Improved the process of retaining and reviewing evidence of sales arrangements with customers including adopting a required retention period for applicable customer purchase orders and internal review of sales order.

•Held additional training for warehouse employees to appropriately perform and document the three-way match between sales orders, shipping documents, and sales invoices.

•Enhanced training programs for personnel that provide key information and perform key roles associated with ICFR. Management designed such training programs in order to improve the level of understanding of the design and proper implementation of controls by the control owners and to instruct such individuals on appropriate level of documentation practices for evidencing review, especially over the completeness and accuracy of underlying data and the precision level used in the review.

•Enhanced controls requiring inventory adjustments to be reviewed and approved by the appropriate level of management and to be appropriately recorded and inventory costing analysis to be appropriately reviewed.

•Adopted a Company-wide approval matrix that establishes clear guidelines on authority levels for all types of cash disbursement transactions.

•Established appropriate reporting lines within business processes, including the accounts payable department to ensure proper segregation of duties for and performance of controls and procedures including vendor master file changes and the three-way match between purchase orders, receiving documents, and vendor invoices.

•Updated and enhanced the standard operating procedures of year-end physical counts to ensure all inventory items are counted at all warehouses in a consistent manner.

•Updated objectives, processes and control design and documentation, including such design and documentation as related to the completeness and accuracy of underlying data and a sufficient precision level in management review controls to detect material misstatement across all financial statement areas.

Management has completed the documentation and review of the corrective actions described above, and concluded that the design and operation of our financial reporting processes and controls related to the corrective actions were effective and therefore that the related previously identified material weaknesses have been fully remediated as of December 31, 2023.

Changes in Internal Control Over Financial Reporting

There were no changes in our internal control over financial reporting that occurred during the quarter ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.