Replimune Group, Inc.

Evaluation of disclosure controls and procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has performed an evaluation of the effectiveness of our disclosure controls and procedures (as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934, as amended, or the Exchange Act) as of the end of the period covered by this report, as required by Rule 13a-15(b) under the Exchange Act. Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of March 31, 2026, our disclosure controls and procedures were effective at the reasonable assurance level.

Our management concluded that the consolidated financial statements included in this Annual Report on Form 10-K, present fairly, in all material respects, our financial position, results of operations, and cash flows for the periods presented in accordance with accounting principles generally accepted in the United States of America, or U.S. GAAP. Our Chief Executive Officer and Chief Financial Officer have certified that, based on each such officer’s knowledge, the financial statements, as well as the other financial information included in this Annual Report, fairly present in all material respects the financial condition, results of operations and cash flows of the Company as of, and for, the periods presented in this Annual Report.

Management’s report on internal control over financial reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting. Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:

(i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of our assets;

(ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and

(iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on our financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Management of the Company has assessed the effectiveness of the Company’s internal control over financial reporting as of March 31, 2026. In making its assessment of internal control over financial reporting, management used the criteria established in Internal Control — Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission, or COSO. Based on this evaluation, management concluded that our internal control over financial reporting was effective as of March 31, 2026.

This annual report does not include an audit report of the Company’s registered public accounting firm regarding internal control over financial reporting. Management’s report was not subject to audit by the Company’s registered public accounting firm pursuant to rules of the Securities and Exchange Commission that permit the Company to provide only management’s report in this Annual Report on Form 10-K.

Remediation of material weakness

As of March 31, 2026, we have remediated the previously reported material weaknesses concerning the design and maintenance of information technology, or IT, general controls for information systems that are relevant to the preparation of our financial statements. Specifically, we did not design and maintain effective: (i) program change management controls to ensure that information technology program and data changes are identified, tested, authorized and implemented appropriately; (ii) user access controls to ensure appropriate segregation of duties and to adequately restrict user and privileged access to appropriate personnel; (iii) computer operations controls to ensure that processing and transfer of data, and data backups and recovery are monitored; and (iv) program development controls to ensure that new software development is tested, authorized and implemented appropriately.

In response to the identified material weaknesses, we took a number of actions to improve our internal control over financial reporting during the year ended March 31, 2026, including the following:

•Engaging an external advisor to assist with documenting and testing the design and operating effectiveness of internal controls over financial reporting and assist with the remediation efforts, as necessary;

•Redesigned, enhanced, and implemented certain general IT controls, including controls over the provisioning and monitoring of user access rights for certain systems;

•Designed and implemented controls to formalize roles and review responsibilities over segregation of duties across key financial systems; and

•Designed and implemented program change management computer operations and program development controls.

Management has since completed implementation of all of the remedial measures, as well as testing the design and operating effectiveness of the applicable remediated controls in the last two quarters of fiscal year 2026.

Changes in internal control over financial reporting

There have been no changes in our internal control over financial reporting during the fourth quarter of the fiscal year ended March 31, 2026 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.