VALVOLINE INC

Evaluation of Disclosure Controls and Procedures

Disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (“Exchange Act”)) are designed to ensure that information required to be disclosed in the reports that are filed or submitted under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the rules and forms of the Securities and Exchange Commission, and that such information is accumulated and communicated to Valvoline’s management, including the Chief Executive Officer (“CEO”) and Chief Financial Officer (“CFO”), to allow timely decisions regarding required disclosure. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives.

Valvoline’s CEO and CFO, with the assistance of management, have evaluated the effectiveness of the Company’s disclosure controls and procedures, as of the end of the period covered by this Quarterly Report on Form 10-Q (the “Evaluation Date”), and based upon such evaluation, have concluded that as of the Evaluation Date, the Company’s disclosure controls and procedures were not effective at the reasonable assurance level due to a material weakness in internal control over financial reporting as described below.

Notwithstanding the conclusion that disclosure controls and procedures were not effective as of March 31, 2025 due to the material weakness, management continued performing additional analyses and other procedures, including enhancing certain manual procedures and controls intended to ensure the condensed consolidated financial statements included in this Quarterly Report on Form 10-Q are fairly presented in all material respects. The material weakness did not result in any identified material misstatements in the current or prior period consolidated financial statements. Accordingly, the Company believes there are no material inaccuracies or omissions of material fact in its condensed consolidated financial statements included in this Quarterly Report on Form 10-Q and that such financial statements present fairly, in all material respects, the financial position, results of operations and cash flows as of and for each of the periods presented herein in accordance with U.S. GAAP.

Changes in Internal Control

During the quarter ended March 31, 2025, Valvoline implemented a new human resources information system (“HRIS”) to support its hire to retire business process and relevant classes of transactions. As a result of the HRIS implementation, Valvoline implemented new controls and modified certain pre-existing internal controls and information systems, as necessary. These modifications also concluded certain transition services between the Company and its former Global Products reportable segment, whereby new processes were implemented commensurate with the system go-live. Other than this implementation and the remediation efforts discussed below, there have been no significant changes in Valvoline’s internal control over financial reporting that occurred during the fiscal quarter ended March 31, 2025 that materially affected, or are reasonably likely to materially affect, Valvoline’s internal control over financial reporting.

Material Weakness in Internal Control over Financial Reporting

The sale of the former Global Products reportable segment on March 1, 2023 resulted in material changes in the Company’s internal control over financial reporting, including the implementation of a new enterprise resource planning system (“ERP”) on January 1, 2024. A material weakness in internal control over financial reporting was initially reported during the quarter ended March 31, 2024 due to the ERP implementation and the related ineffective information technology general controls (“ITGCs”) and design of certain business process controls. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis.

Specifically, the Company did not ensure adequate (a) user access controls for certain applications to ensure segregation of duties risks were addressed and that user and privileged access reviews were completed timely and sufficiently evidenced, (b) change management controls for certain applications, including sufficient documentation of effectiveness of underlying tools and evaluation of all potential risks, (c) evidence of the effectiveness of controls at its third party IT service organization hosting the ERP, and (d) design for certain business process controls (automated and manual), including those that are dependent on effective ITGCs. While significant progress has been made to address the control deficiencies and implement ITGC remedial procedures, as detailed further below, a material weakness continued to exist as of March 31, 2025.

Although management has performed procedures to gain comfort that the consolidated financial statements are fairly stated in all material respects, these control deficiencies aggregate to allow for the possibility that material misstatements could impact most financial statement accounts and disclosures that may not be prevented or detected. Accordingly, these control deficiencies aggregate within the control activities component of the Committee of Sponsoring Organizations of the Treadway Commission in the 2013 Internal Control - Integrated Framework and constitute a material weakness. The material weakness did not result in any identified material misstatements to the consolidated financial statements.

Remedial Measures

Management has been actively developing, executing, and enhancing its remedial efforts, which began during the quarter ended March 31, 2024 following the ERP implementation. The remedial efforts include the following:

•Established a plan to stabilize the ERP for the classes of transactions with inadequate initial system design, including the continued execution of manual control activities, analyses and procedures to address the periods of time with systematic deficiencies;

•Retained the support of an outside consulting firm to enhance management’s remediation design and implementation efforts, including project management, advice regarding best practices for documentation, design and execution of ITGCs and related transactional-level business process controls;

•Enhanced the design of access controls, including reviews of ERP privileged access and segregation of duties in user provisioning to increase the rigor of review and centrally retain supporting evidence, and enhanced the reviews and documentation retained to support reviews of segregation of duties conflicts and user access within certain other relevant applications;

•Designed and implemented new ITGCs and replaced tools that were in place to directly oversee access and change management for a key application that was previously managed by a third party in connection with the implementation of the HRIS;

•Improved the consistency of reviewing the appropriateness of changes to the ERP environment for proper authorization, testing, and implementation by deploying a change management tool in the prior year to centrally retain this evidence, and enhanced change management evidence and reviews for other relevant applications;

•Obtained and evaluated evidence of the continued operating effectiveness of controls for its ERP service organization as of and through the prior fiscal year end, which has been supplemented in fiscal 2025 with timely documented assessments that will continue to be executed on a quarterly basis;

•Conducted end-to-end business process walkthroughs to identify the points in the process for each significant class of transactions where risks of material misstatement exist to validate the design and operational effectiveness of responsive controls, including application controls, such as system configuration, reports, automated jobs and interfaces. Based on these procedures, management is supplementing its pre-existing review controls with certain preventative transaction-level controls, enhanced documentation of its control attributes, and completing current year walkthroughs to reassess design effectiveness of its relevant end-to-end business processes supported by the implementation of ITGC remediation.

Management believes completion of the foregoing efforts, which are in varying degrees of implementation, will result in the implementation of an appropriately designed control environment that addresses the material weakness. Following implementation of each of the measures outlined above, remediation will be considered complete upon management’s consistent execution and subsequent validation of operational effectiveness through sufficient testing. Management expects its efforts to be completed during fiscal 2025.