Replimune Group, Inc.

Evaluation of disclosure controls and procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has performed an evaluation of the effectiveness of our disclosure controls and procedures (as defined in Rule 13a-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”)) as of the end of the period covered by this report, as required by

Rule 13a-15(b) under the Exchange Act. Based upon that evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of March 31, 2025, our disclosure controls and procedures were ineffective due to material weaknesses in internal control over financial reporting as described below.

Our management concluded that the consolidated financial statements included in this Annual Report on Form 10-K,present fairly, in all material respects, our financial position, results of operations, and cash flows for the periods presented in accordance with accounting principles generally accepted in the United States of America, or U.S. GAAP. Our Principal Executive Officer and Principal Financial Officer have certified that, based on each such officer’s knowledge, the financial statements, as well as the other financial information included in this Annual Report, fairly present in all material respects the financial condition, results of operations and cash flows of the Company as of, and for, the periods presented in this Annual Report.

Management’s report on internal control over financial reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting. Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has assessed the effectiveness of our internal control over financial reporting as of March 31, 2025. Our management’s assessment was based on the framework in “Internal Control — Integrated Framework (2013)” (“2013 framework”), issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”). Based on this assessment, our management concluded that, as of March 31, 2025, our internal control over financial reporting was ineffective based on the criteria in the 2013 framework issued by the COSO due to the existence of the material weaknesses described below.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the Company's annual or interim consolidated financial statements will not be prevented or detected on a timely basis.

In connection with the preparation of the consolidated financial statements for this Annual Report on Form 10-K, we identified material weaknesses in our internal control over financial reporting whereby we did not design and maintain effective information technology (“IT”) general controls for information systems that are relevant to the preparation of our financial statements. Specifically, we did not design and maintain effective: (i) program change management controls to ensure that information technology program and data changes are identified, tested, authorized and implemented appropriately; (ii) user access controls to ensure appropriate segregation of duties and to adequately restrict user and privileged access to appropriate personnel; (iii) computer operations controls to ensure that processing and transfer of data, and data backups and recovery are monitored; and (iv) program development controls to ensure that new software development is tested, authorized and implemented appropriately.

The material weaknesses identified above did not result in any material misstatements in our interim or annual consolidated financial statements or disclosures; however, they could result in misstatements impacting substantially all accounts or disclosures in the annual or interim consolidated financial statements that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected. Our management concluded that the consolidated financial statements included in this Annual Report on Form 10-K, present fairly, in all material respects, our financial position, results of operations, and cash flows for the periods presented in accordance with accounting principles generally accepted in the United States of America, or U.S. GAAP.

Management's Plan for Remediation of the Material Weakness

Management, with the oversight of the audit committee of the board of directors, is committed to maintaining a strong internal control environment. In response to the material weaknesses identified above, we have begun to develop remediation actions which include:

•Designing and implementing controls over program change management and the review and update of user access rights and privileges.

•Designing and implementing controls to formalize roles and review responsibilities in order to formalize and implement controls over segregation of duties across key financial systems.

•Designing and implementing computer operation and program development controls to ensure data integrity and that new software development is tested, authorized and implemented appropriately.

We believe that these actions, when fully designed and implemented, will remediate the material weaknesses. However, the material weaknesses will not be considered fully remediated until management designs and implements effective controls that operate for a sufficient period of time and management has concluded, through testing, that these controls are effective. As we continue to evaluate operating effectiveness and monitor improvements to our internal control over financial reporting, we may take additional measures to address control deficiencies or modify the remediation plan described above.

Changes in internal control over financial reporting

There have been no changes in our internal control over financial reporting during the fourth quarter of the fiscal year ended March 31, 2025 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.