Gitlab Inc

Evaluation of Disclosure Controls and Procedures

Our Chief Executive Officer (“CEO”) and Chief Financial Officer (”CFO”) (“certifying officers”) have conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the Exchange Act)) as of January 31, 2024. Our certifying officers concluded that, as a result of the material weakness in internal control over financial reporting as described below, our disclosure controls and procedures were not effective as of January 31, 2024.

Management’s Report on Internal Control Over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act). The Company’s management, with participation of the CEO and CFO, under the oversight of our board of directors, evaluated the effectiveness of the Company’s internal control over financial reporting as of January 31, 2024 using the framework in Internal Control - Integrated Framework (2013), issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on that evaluation, management concluded that the Company’s internal control over financial reporting was not effective as of January 31, 2024 due to the material weakness in internal control over financial reporting, described below.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. As of January 31, 2024, management determined that a material weakness exists due to a lack of policies and procedures related to the operation of control activities and inadequate communication of information to control owners and operators related to the objectives and responsibilities for internal control in a manner which supports the internal control environment at the Company. As a result, the following material weakness exists:

•We did not design and maintain effective controls over certain information technology (“IT”) general controls for information systems used in the financial reporting processes related to revenue. In particular, we did not design and maintain effective (i) program change management controls to ensure that IT programs, data changes and migrations affecting financial IT applications and underlying records are identified, tested, authorized and implemented appropriately and (ii) user access controls to ensure appropriate segregation of duties, restricted user and privileged access to our financial applications, data and programs to the appropriate personnel. The ineffective design and operation of IT general controls resulted in the ineffective operation of automated controls and manual controls using reports and information from the impacted information systems used in the financial reporting processes related to revenue.

The aforementioned material weakness did not result in a material misstatement to our annual or interim financial statements, however the deficiency could result in misstatements potentially impacting the financial reporting processes related to revenue and related disclosures that would not be prevented or detected. Therefore, we concluded that the deficiency represents a material weakness in the Company’s internal control over financial reporting and our internal control over financial reporting was not effective as of January 31, 2024.

Our independent registered public accounting firm, KPMG LLP, who audited the consolidated financial statements included in this Annual Report on Form 10-K, issued an adverse opinion on the effectiveness of the Company’s internal control over financial reporting. KPMG LLP’s report appears in Item 8 of this Annual Report on Form 10-K.

Remediation Plan for Un-Remediated Material Weakness

During the year ended January 31, 2024, we commenced implementing the following steps intended to remediate our material weakness:

•Strengthening IT governance and designing IT general controls related to certain revenue systems, including program change management, restricting user access to our internal systems used for financial reporting and enhancing the retention of contemporaneous documentation of reviews over IT general controls, and

•Developing and deploying training programs regarding the operation and importance of internal controls.

We believe the actions described above, once fully implemented and tested, will be sufficient to remediate the identified material weakness and strengthen our internal controls. However, our efforts to remediate this material weakness may not be effective or prevent any future material weakness or significant deficiency in our internal control over financial reporting. This material weakness will not be considered remediated until the applicable remedial controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively.

Remediation of Previously Disclosed Material Weaknesses

As previously disclosed, in connection with the audit of our consolidated financial statements as of and for the fiscal year ended January 31, 2023, we identified the following material weaknesses in our internal control over financial reporting:

•We did not retain sufficient contemporaneous documentation to demonstrate the operation of controls over manual journal entries,

•We did not retain sufficient contemporaneous documentation to demonstrate the operation of review controls over stock-based compensation at a sufficient level of precision and such controls relied on reports and information adversely impacted by IT general control deficiencies, and

•We did not design and maintain effective and timely review procedures over the accounting for and disclosure of non-routine transactions.

During the fiscal year ended January 31, 2024, management, under the oversight of the board of directors, implemented measures designed to remediate the January 31, 2023 material weaknesses described above. The remediation actions included:

•Enhancing the review of manual journal entries, including outlining policies and procedures to strengthen retention of contemporaneous documentation and supervisory reviews by management,

•Enhancing the precision of controls around the review of equity transactions, including the review of underlying source data and outlining policies and procedures to strengthen the retention of contemporaneous documentation of control reviews,

•Enhancing the review process around non-standard contracts and expanding our internal disclosure review processes to provide greater representation across various functions to ensure timely identification and review of non-routine transactions, and

•Developing and deploying training programs regarding the operation and importance of internal controls.

We have tested and evaluated the implementation of these new and revised processes and internal controls to ascertain whether they are designed and operating effectively to provide reasonable assurance that they will prevent or detect a material error in our consolidated financial statements and have concluded that these material weaknesses have been remediated as of January 31, 2024.

Additionally, during the fiscal year ended January 31, 2023, we identified and disclosed the following material weakness in our internal control over financial reporting:

•We did not design and maintain effective controls over certain information technology (“IT”) general controls for information systems that are relevant to the preparation of our consolidated financial statements. In particular, we did not design and maintain effective (i) program change management controls to ensure that IT programs, data changes and migrations affecting financial IT applications and underlying records are identified, tested, authorized and implemented appropriately and (ii) user access controls to ensure appropriate segregation of duties, restricted user and privileged access to our financial applications, data and programs to the appropriate personnel. The ineffective design and operation of IT general controls resulted in the ineffective operation of automated controls and manual controls using reports and information from the impacted information systems used in financial reporting processes.

During the fiscal year ended January 31, 2024, management, under the oversight of the board of directors, implemented additional measures designed to remediate the January 31, 2023 material weakness described above, including strengthening IT governance and designing IT general controls generally, and enhancing the retention of contemporaneous documentation of reviews over IT general controls. Through the implementation of these additional IT controls, the pervasive IT general controls weakness described above has been narrowed to the general controls for information systems used in the financial reporting processes related to revenue.

Changes in Internal Control over Financial Reporting

Other than the material weaknesses and remediation efforts described above, there were no changes to our internal control over financial reporting identified in connection with the evaluation required by rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2024 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

Our disclosure controls and procedures and internal controls over financial reporting are designed to provide reasonable assurance of achieving their desired objectives. Management does not expect, however, that our disclosure controls and procedures or our internal controls over financial reporting will prevent or detect all errors and fraud. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within the company have been detected.