Redwire Corp

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our principal executive officer and principal financial officer, has evaluated the effectiveness of our disclosure controls and procedures, which are designed to ensure that the information required to be disclosed in reports that we file or submit under the Securities Exchange Act of 1934, as amended, is recorded, processed, summarized and reported within the time periods specified in the SEC's rules and forms, including ensuring that such information is accumulated and communicated to management (including the principal executive officer and principal financial officer) as appropriate to allow timely decisions regarding required disclosure. Based on such evaluation, our principal executive officer and our principal financial officer have concluded that such disclosure controls and procedures were not effective as of December 31, 2023 due to the material weaknesses in internal control over financial reporting described below.

Management’s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rule 13a-15(f) and 15d-15(f) under the Exchange Act). Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external reporting purposes in accordance with accounting principles generally accepted in the U.S. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements.

Our management, with the participation of our principal executive officer and principal financial officer, conducted an assessment of the effectiveness of our internal control over financial reporting as of December 31, 2023. This assessment was based on the criteria set forth by the Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”). Based on this assessment, management concluded that our internal control over financial reporting was not effective as of December 31, 2023 because of the material weaknesses described below.

In accordance with Section 103 of the Jumpstart Our Business Startups (“JOBS”) Act, the Company is not required to comply with the requirement to provide an auditor’s report on Internal Controls over Financial Reporting under Section 404(b) of the Sarbanes-Oxley Act for as long as it qualifies as an emerging growth company.

Material Weaknesses in Internal Control over Financial Reporting

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements will not be prevented or detected on a timely basis.

In connection with the Company’s evaluation of internal control over financial reporting, the following material weaknesses have been identified:

•We did not maintain an effective control environment, as certain members of senior management failed to consistently message and set certain aspects of an appropriate tone at the top. Specifically, certain members of senior management failed to reinforce the need for compliance with certain of the Company’s accounting and finance policies and procedures, including reinforcement of appropriate communication.

•We have not consistently established appropriate authorities and responsibilities in pursuit of financial reporting objectives, as demonstrated by, among other things, insufficient segregation of duties in our finance and accounting functions.

•We did not design and maintain formal accounting policies, procedures and controls to achieve complete, accurate and timely financial accounting, reporting and disclosures, including controls over the preparation and review of business performance reviews, account reconciliations, journal entries and contract estimates used in determining the recognition of revenue.

These material weaknesses could result in misstatements of substantially all accounts and disclosures that could result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected.

In addition, we did not design and maintain effective information technology (“IT”) general controls for information systems that are relevant to the preparation of the consolidated financial statements. Specifically, we did not design and maintain:

•program change management controls to ensure that information technology program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized, and implemented appropriately;

•user access controls to ensure appropriate segregation of duties and that adequately restrict user and privileged access to financial applications, programs, and data to appropriate Company personnel;

•computer operations controls to ensure that critical batch jobs are monitored and data backups are authorized and monitored; and

•testing and approval controls for program development to ensure that new software development is aligned with business and IT requirements.

The IT deficiencies, when aggregated, could impact maintaining effective segregation of duties, as well as the effectiveness of IT-dependent controls (such as automated controls that address the risk of material misstatement of one or more assertions, along with the IT controls and underlying data that support the effectiveness of system-generated data and reports) that could result in misstatements potentially impacting all financial statement accounts and disclosures that would not be prevented or detected.

The material weaknesses above did not result in a material misstatement to the consolidated financial statements presented in this Annual Report on Form 10-K, nor in any restatements of consolidated financial statements previously reported by us.

Remediation Plans

We are in the process of implementing measures designed to improve our internal control over financial reporting and remediate the deficiencies that led to the material weaknesses, including tone at the top and other communications training, designing and implementing new control activities, and enhancing existing control activities.

•We engaged a third-party global consulting firm to accelerate the design of new controls or enhance existing controls to ensure timely and accurate financial reporting.

•We have established an ethics program which requires training and certification for all employees as well as enhances awareness of our whistleblower avenues.

•We will continue to conduct training and document our processes and procedures, including accounting policies, and implement a comprehensive financial closing process checklist with additional layers of reviews. We are also in the process of standardizing controls, processes and policies across the Company to ensure consistent application including controls over the preparation and review of business performance reviews, account reconciliations, journal entries and contract estimates used in determining the recognition of revenue.

•We are in the process of performing an assessment of all IT systems that provide data for financial reporting purposes and consolidating systems where appropriate. As part of this assessment, we will be designing, implementing and documenting IT general controls.

We are working to remediate the material weaknesses as efficiently and effectively as possible and expect full remediation will likely go beyond December 31, 2024. At this time, we cannot provide an estimate of costs expected to be incurred in connection with implementing this remediation plan; however, these remediation measures will be time consuming, will result in the Company incurring additional costs, and will place additional demands on our financial and operational resources.

If we are unable to successfully remediate existing or any future material weaknesses in our internal control over financial reporting, the accuracy and timing of our financial reporting may be adversely affected, investors may lose confidence in our financial reporting, and/or we could become subject to litigation or investigations by the New York Stock Exchange (“NYSE”), the SEC or other regulatory authorities.

Remediation of Material Weaknesses in Internal Control over Financial Reporting

Management previously identified certain material weaknesses in the Company’s internal control over financial reporting, described as follows:

•We did not design and maintain an effective risk assessment process at a precise enough level to identify new and evolving risks of material misstatement in the consolidated financial statements. Specifically, changes to existing controls or the implementation of new controls have not been sufficient to respond to changes to the risks of material misstatement to financial reporting.

•We had an insufficient complement of resources with an appropriate level of accounting knowledge, experience and training commensurate with our structure and financial reporting requirements to appropriately analyze, record and disclose accounting matters timely and accurately, and establish effective processes and internal controls.

•We did not design and maintain effective controls to address the identification of and accounting for certain non-routine, unusual or complex transactions, including the proper application of U.S. GAAP to such transactions. Specifically, we did not design and maintain effective controls to account for purchase business combinations and the valuation of goodwill and long- lived assets, including the appropriate review of the assumptions, data and models used in the forecasted cash flows, to determine the fair value.

Management has taken the necessary steps to identify and implement changes to the Company’s internal controls over financial reporting to remediate the control deficiencies described above that led to the material weaknesses. The Company has performed the following remediation efforts to address the material weaknesses:

•We have hired personnel with accounting expertise that has enhanced our accounting and financial reporting team to perform and analyze the risk assessment and identify new and evolving risks of material misstatement in the consolidated financial statements as well as appropriately analyze, record and disclose accounting matters timely and accurately. We have also provided and continue to provide formalized trainings and communication to educate our accounting, finance and program management functions on the importance and key concepts of effective internal controls.

•We have designed and executed a precise risk assessment process to consider financial statement risk elements at the financial statement line-item level utilizing both qualitative and quantitative factors.

•We have performed a linkage from the financial statement risk elements to the relevant processes and systems/applications considering significant processes.

•We have considered the macro risk environment and associated it to disclosures and published risk factors.

•We have reviewed the COSO 2013 framework to document and enhance entity-level controls.

•We have designed and implemented specific controls around non-routine, unusual or complex transactions, including the proper application of U.S. GAAP to such transactions. The specific controls include a sufficiently precise review of assumptions, data and models used to determine the appropriate accounting treatment and related fair value, as applicable.

These actions resulted in an improved internal control environment that was in place for a sufficient period of time to allow for the Company to conclude that these material weaknesses have been fully remediated as of December 31, 2023.

Changes in Internal Control over Financial Reporting

We have remediated certain material weaknesses relating to our internal controls over financial reporting as described above. There have been no other changes in internal control over financial reporting during the three months ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.