Ranpak Holdings Corp

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures that are designed to provide reasonable assurance that material information required to be disclosed in our reports that we file or submit under the Securities Exchange Act of 1934, as amended (the “Exchange Act”), is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including our Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), as appropriate, to allow timely decisions regarding required financial disclosure. In designing and evaluating the disclosure controls and procedures, management recognized that a control system, no matter how well designed and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within a company have been detected.

As of the end of the period covered by this report, we carried out an evaluation, under the supervision and with the participation of our management, including our CEO and CFO, of the effectiveness of the design and operation of our disclosure controls and procedures pursuant to Rule 13a-15 of the Exchange Act. Based upon that evaluation, our CEO and CFO concluded that our disclosure controls and procedures were not effective, due to the material weaknesses in internal control over financial reporting that are described in the 2023 10-K.

Notwithstanding such material weaknesses in internal control over financial reporting, our management, including our CEO and CFO, has concluded that our consolidated financial statements present fairly, in all material respects, our financial position, results of our operations and our cash flows for the periods presented in this Quarterly Report, in conformity with U.S. generally accepted accounting principles.

Remediation Plans

As previously described in Part II – Item 9A – Controls and Procedures of the 2023 10-K, we continue to implement a remediation plan to address the material weaknesses mentioned above. The deficiencies will not be considered remediated until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively.

The Company continues to make progress in its remediation of the material weaknesses described in the 2023 10-K. During the third quarter of fiscal 2024, management verified that changes were made to the design of certain controls that would be necessary for potential remediation. We assessed the design of these certain controls through detailed reviews of the process and related controls with process owners, who are responsible for implementing and monitoring our remediation plans. We have also taken the following actions, outlined below, in our effort to remediate our material weaknesses.

•Enhanced policies and procedures to improve our overall control environment and monitoring controls around timely evaluation and communication of internal control deficiencies to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

•Designed and implemented a continuous risk assessment process to identify and assess risks of material misstatement and ensure that the impacted financial reporting processes and related internal controls are properly designed and in place to respond to those risks in our financial reporting.

•Hired personnel for key positions within our technology, accounting, business operations and other support functions with appropriate qualified experience and ERP knowledge to enhance our risk assessment processes and internal control capabilities, allow for appropriate segregation of duties and change management, and provide appropriate oversight and reviews.

•Provided, and continue to provide, additional training and education programs for personnel responsible for the performance of key business processes throughout the Company to facilitate their understanding of the risks being addressed by the controls they are performing as well as educate them in the documentation requirements of the internal control framework.

•Enhanced user access provisioning and monitoring controls to enforce appropriate system access and segregation of duties as well as controls supporting change management.

Although we have taken these actions, we have not remediated our material weaknesses as of September 30, 2024. For Management to consider a material weakness remediated the related controls are required to operate effectively as anticipated for a minimum period and we may not be able to demonstrate through testing that these controls have been operating effectively for a sufficient period of time to achieve remediation. As the Company continues executing its remediation plan in 2024, changes to the timing of remediation activities and delays may be experienced that could delay when the material weakness is considered remediated.

Changes in Internal Control Over Financial Reporting

In response to the material weaknesses described in the 2023 10-K, the Company reviewed the design of its controls and began remediation activities to alleviate the noted control deficiencies. Other than these items, there was no change in the Company’s internal control over financial reporting that occurred during the quarter ended September 30, 2024, that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.