Karat Packaging Inc.

Evaluation of Disclosure Controls and Procedures

The Company's management, with the participation of its Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of its disclosure controls and procedures (as defined in the Securities Exchange Act of 1934, as amended (“Exchange Act”) Rules 13a-15(e) and 15d-15(e)) as of the end of the period covered by this Annual Report on Form 10-K. Based on this evaluation, the Company's Chief Executive Officer and Chief Financial Officer concluded that its disclosure controls and procedures were not effective at December 31, 2024, due to the material weakness described below.

Management’s Annual Report on Internal Control Over Financial Reporting

The Company's management, under the supervision and with the participation of its Chief Executive Officer and Chief Financial Officer and effected by its board of directors, is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rules 13(a)-15(f) and 15(d)-15(f) under the Exchange Act. The Company's internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Under the supervision and with the participation of the Company's Chief Executive Officer and Chief Financial Officer, management conducted an evaluation of the effectiveness of the Company's internal control over financial reporting as of December 31, 2024 using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in “Internal Control - Integrated Framework” (2013). Based on this assessment, management concluded that as of December 31, 2024, its internal control over financial reporting was not effective due to the material weakness described below. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.

Management determined that the Company has the following material weakness in its internal control over financial reporting at December 31, 2024:

Management did not design and maintain effective controls to ensure appropriate segregation of duties related to the creation, approval and subsequent modification of journal entries. This deficiency did not result in a material misstatement to the consolidated financial statements, however, it could result in a misstatement of substantially all account balances or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected.

Plan of Remediation of Material Weakness in Internal Control Over Financial Reporting

During the year ended December 31, 2024, management has redesigned its control over the journal entry creation and approval process, remediated gaps in the design of such internal control and performed operating effectiveness testing. However, additional time is required to demonstrate the control has operated effectively for a sufficient period of time. Management will consider the material weakness to be fully remediated once all relevant controls operate effectively for a sufficient period of time and management confirms their effectiveness through testing.

Management is committed to remediating the material weakness in a timely fashion and to making continuous improvements to the Company's internal control over financial reporting. Management will continually assess the effectiveness of the remediation efforts and may take additional measures to address control deficiencies or modify the remediation plan described above.

Remediation of Previously Identified Material Weaknesses

As reported in the 2023 Form 10-K, the Company previously identified and disclosed the following material weaknesses in its internal control over financial reporting for the year ended December 31, 2023:

Management did not maintain appropriately designed entity-level controls impacting the control environment, risk assessment procedures and monitoring activities to prevent or detect material misstatements to the consolidated financial statements. These deficiencies were attributed to: (i) lack of structure and responsibility, insufficient number of qualified resources and inadequate oversight and accountability over the performance of controls, including retention of control evidence, and (ii) ineffective identification and assessment of risks impacting internal control over financial reporting, and (iii) insufficient evaluation and determination as to whether the components of internal controls were present and functioning based upon evidence maintained for certain management review controls and activity level controls across substantially all financial statement areas.

This material weakness contributed to the following additional material weakness:

Management did not design and maintain effective controls over certain information technology ("IT") general controls for information systems that are relevant to the preparation of their financial statements. Specifically, management did not design and maintain (i) program change management controls to ensure that program and data changes are identified, tested, authorized and implemented appropriately, and (ii) user access controls to ensure appropriate segregation of duties and to adequately restrict user and privileged access to appropriate personnel.

As of December 31, 2024, management sufficiently completed its remediation of these material weaknesses with the exception of the segregation of duties, as discussed above, related to journal entry creation and approval process, by taking the following measures:

•Refined the design of entity-level controls impacting the control environment, risk assessment procedures and monitoring activities, including the implementation of controls and procedures to ensure adequate oversight and accountability over the performance of controls.

•Enhanced policies and procedures to improve Information Technology General Controls and the Company's overall IT environment, including enforcing newly or enhanced policies and controls around logical access and changes to significant IT systems.

•Updated and refined the COSO-based risk assessment to evaluate and identify risks impacting internal control over financial reporting.

•Implemented formal control activities to provide training and upskilling to key business process owners.

•Implemented and performed new control procedures to review all activities carried out and transactions completed by users with administrative rights (“privileged users”) within the Company’s ERP system.

•Enhanced control procedures around the monitoring and validating of information produced by the Company (“IPC”) supporting the performance of key controls including change management review procedures.

•Expanded user access review procedures to all key applications and relevant infrastructures that impact internal control over financial reporting.

•Enhanced user access control procedures by implementing additional review from the CFO for all new privileged users.

•Launched a new internally-developed management system which streamlined and centralized the workflow around user provisioning and deprovisioning and further expanded and enhanced deprovisioning review procedures.

•Enhanced control procedures around the completeness and accuracy of IPC used in supporting the performance of key controls. Restricted access to making changes to the IPC to only IT administrators, and enhanced the IT change management process to include changes to IPC.

•Implemented and expanded periodic review procedures of user rights and permissions across all key applications to assess segregation of duties.

Changes in Internal Control Over Financial Reporting

The implementation of the redesigned control over the journal entry creation and approval process as described above represents a change in our internal control over financial reporting that occurred during the quarter ended December 31, 2024 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply its judgment in evaluating the benefits of possible controls and procedures relative to their costs.