What changed in this filing

/stocks — the workspaceLOADING

Item 9A. Controls and Procedures

2023-03-30 compared with 2022-04-08 · 62 added, 45 removed, 90 unchanged (54% of the section changed)

1 unchanged sentence

Evaluation of Disclosure Controls and Procedures

In connection with the preparation of this Annual Report, as of January 31, 2022, an evaluation was performed under the supervision and with the participation of our management, including the Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in 13a-15(e) and 15d-15(e) under the Exchange Act).

Based on that evaluation, our Chief Executive Officer and our Chief Financial Officer have concluded that, as of January 31, 2022, our disclosure controls and procedures were, in design and operation, not effective at a reasonable assurance level as a result of the material weakness described below.

Our Chief Executive Officer (“CEO”) and Chief Financial Officer (”CFO”) (“certifying officers”) have conducted an evaluation of the effectiveness of the design and operation of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the Exchange Act)) as of January 31, 2023 .

Our certifying officers concluded that, as a result of the material weaknesses in internal control over financial reporting as described below, our disclosure controls and procedures were not effective as of January 31, 2023 .

Management’s Report on Internal Control Over Financial Reporting

This Annual Report does not include a report of management’s assessment regarding internal control over financial reporting or an attestation report of our independent registered public accounting firm due to a transition period established by the rules of the SEC for newly public companies.

Material Weakness

As disclosed in our Quarterly Report on the Form 10-Q for the quarter ended October 31, 2021, we previously identified a material weakness in our internal control over financial reporting.

We have not properly designed internal controls over the preparation of our consolidated financial statements insofar as it relates to appropriately performing effective and timely review of the accounting for and disclosure of non-routine transactions.

Therefore, there was a risk that a potential material misstatement of the consolidated financial statements could occur without being prevented or detected on a timely basis.

Notwithstanding such material weakness in internal control over financial reporting, our Chief Executive Officer and Chief Financial Officer have concluded that our audited consolidated financial statements included in this Annual Report present fairly, in all material respects, our financial position, results of operations and cash flows for the periods presented in conformity with U.S.

This material weakness also did not result in a material misstatement in any previously issued consolidated financial statements.

Remediation Efforts and Status

We are currently in the process of remediating our material weakness and are taking the steps that we believe will address the underlying causes of the material weakness, including:

• We have enhanced the review processes around non-standard contracts.

• We have expanded our internal disclosure review processes to provide greater representation across various functions to ensure complete and timely identification of non-routine transactions.

• We have expanded accounting policies, procedures and processes related to our financial reporting.

• We have and will continue to implement additional training of finance, accounting and other Company personnel involved in the financial reporting process.

The material weakness will not be considered fully remediated until all aspects of the controls operate for a sufficient period of time to allow management to conclude that these controls are operating effectively.

We will monitor the effectiveness of our remediation plan and steps and will refine the remediation plan as appropriate.

We believe the actions described above will be sufficient to remediate the identified material weakness and strengthen our internal control over financial reporting.

However, our efforts to remediate this material weakness may not be effective or prevent any future material weakness or significant deficiency in our internal control over financial reporting.

Management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act).

The Company’s management, with participation of the CEO and CFO, under the oversight of our Board of Directors, evaluated the effectiveness of the Company’s internal control over financial reporting as of January 31, 2023 using the framework in Internal Control - Integrated Framework (2013), issued by the Committee of Sponsoring Organizations of the Treadway Commission.

Based on that evaluation, management concluded that the Company’s internal control over financial reporting was not effective as of January 31, 2023 due to the material weaknesses in internal control over financial reporting, described below.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

As of January 31, 2023 , management determined that material weaknesses exist due to a lack of policies and procedures related to the operation of control activities and inadequate communication of information to control owners and operators related to the objectives and responsibilities for internal control in a manner which supports the internal control environment at the Company.

As a result, the following material weaknesses exist:

• We did not design and maintain effective controls over certain information technology (“IT”) general controls for information systems that are relevant to the preparation of our consolidated financial statements.

In particular, we did not design and maintain effective (i) program change management controls to ensure that IT programs, data changes and migrations affecting financial IT applications and underlying records are identified, tested, authorized and implemented appropriately and (ii) user access controls to ensure appropriate segregation of duties, restricted user and privileged access to our financial applications, data and programs to the appropriate personnel.

The ineffective design and operation of IT general controls resulted in the ineffective operation of automated controls and manual controls using reports and information from the impacted information systems used in financial reporting processes,

• We did not retain sufficient contemporaneous documentation to demonstrate the operation of controls over manual journal entries,

• We did not retain sufficient contemporaneous documentation to demonstrate the operation of review controls over stock-based compensation at a sufficient level of precision and such controls relied on reports and information adversely impacted by the IT general control deficiencies, and

• As previously reported, we did not design and maintain effective and timely review procedures over the accounting for and disclosure of non-routine transactions.

This material weakness has not been remediated, as the new controls designed rely on reports and information adversely impacted by the IT general control deficiencies.

The aforementioned material weaknesses did not result in a material misstatement to our annual or interim financial statements, however, the deficiencies, when aggregated, could result in misstatements potentially impacting all financial statement accounts and disclosures that would not be prevented or detected.

Therefore, we concluded that the deficiencies represent material weaknesses in the Company’s internal control over financial reporting and our internal control over financial reporting was not effective as of January 31, 2023 .

Our independent registered public accounting firm, KPMG LLP, who audited the consolidated financial statements included in this Annual Report on Form 10-K, issued an adverse opinion on the effectiveness of the Company’s internal control over financial reporting.

KPMG LLP’s report appears in Item 8 of this Annual Report on Form 10-K.

Remediation Plan for Material Weaknesses

During the year ended January 31, 2023, we commenced implementing of the following steps intended to remediate our material weaknesses:

• Strengthening IT governance and designing IT general controls including program change management, restricting user access to our internal systems used for financial reporting and enhancing the retention of contemporaneous documentation of reviews over IT general controls,

• Enhancing the review of manual journal entries, including outlining policies and procedures to strengthen retention of contemporaneous documentation and supervisory reviews by management,

• Enhancing the precision of controls around the review of equity transactions, including the review of underlying source data and outlining policies and procedures to strengthen the retention of contemporaneous documentation of control reviews,

• Enhancing the review process around non-standard contracts and expanding our internal disclosure review processes to provide greater representation across various functions to ensure timely identification and review of non-routine transactions, and

• Developing and deploying training programs regarding the operation and importance of internal controls.

We believe the actions described above, once fully implemented and tested, will be sufficient to remediate the identified material weaknesses and strengthen our internal controls.

However, our efforts to remediate these material weaknesses may not be effective or prevent any future material weakness or significant deficiency in our internal control over financial reporting.

These material weaknesses will not be considered remediated until the applicable remedial controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively.

Changes in Internal Control over Financial Reporting

Other than the material weakness and remediation efforts described above, there were no changes to our internal control over financial reporting identified in connection with the evaluation required by rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2022 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

There were no changes to our internal control over financial reporting identified in connection with the evaluation required by rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the quarter ended January 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

Our disclosure controls and procedures and internal controls over financials reporting are designed to provide reasonable assurance of achieving their desired objectives.

Our disclosure controls and procedures and internal controls over financial reporting are designed to provide reasonable assurance of achieving their desired objectives.

Management does not expect, however, that our disclosure controls and procedures or our internal controls over financial reporting will prevent or detect all errors and fraud.

Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met.

Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within the company have been detected.

Further, no evaluation of controls can provide absolute assurance that

misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within the company have been detected.

OTHER INFORMATION

31 unchanged sentences

10-Q 001-40895 3.2 12/7/2021

3.2 Restated Bylaws of GitLab Inc.

10-Q 001-40895 3.3 12/7/21

3.2 Amended and Restated Bylaws of GitLab Inc.

8-K 001-40895 3.1 12/15/2022

4.1 Form of Class A Common Stock Certificate of GitLab Inc.

S-1/A 333-259602 4.1 10/12/2021

4.2 Amended and Restated Investors’ Rights Agreement among GitLab Inc.

and certain holders of its capital stock, dated September 10, 2019.

S-1 333-259602 4.2 10/12/21

4.2 Form of Class B Common Stock Warrant

1 unchanged sentence

4.3 Description of Registrant’s Securities

10-K 001-40895 4.4 4/8/2022

10.1† Form of Indemnification Agreement between GitLab Inc.

and each of its directors and executive officers.

and each of directors and executive officers

S-1 333-259602 10.1 9/17/2021

4 unchanged sentences

2021 Equity Incentive Plan and related form agreements

S-1 333-259602 10.3 10/4/21

S-1/A 333.259602 10.3 10/4/2021

10.4† GitLab Inc.

2021 Employee Stock Purchase Plan

S-1 333-259602 10.4 9/17/21

10-Q 001-40895 10.4 6/7/2022

10.5† Form of Offer Letter between GitLab Inc.

1 unchanged sentence

S-1/A 333-259602 10.5 10/4/2021

21.1 List of Subsidiaries of GitLab Inc.

10.6†‡ Form of Global Performance Stock Unit Award Agreement

10-Q 001-40895 10.6 9/7/2022

10.7† Service Continuation Agreement between the Registrant and Eric Johnson

10-Q 001-40895 10.7 12/6/2022

21.1 List of Subsidiaries

23.1 Consent of KPMG LLP, independent registered public accounting firm

24.1 Power of Attorney.

Reference is made to the signature page hereto.

31.1 Certification of Principal Executive Officer pursuant to Rules 13a-14(a) and 15d-14(a) under the Securities Exchange Act of 1934, as adopted pursuant to Section 302 of the Sarbanes-Oxley Act of 2002.

12 unchanged sentences

† Indicates management contract or compensatory plan.

* The certifications furnished in Exhibits 32.1 and 32.2 hereto are deemed to accompany this Annual R eport on Form 10-K an d are not deemed “filed” for purposes of Section 18 of the Exchange Act, or otherwise subject to the liability of that section, nor shall they be deemed incorporated by reference into any filing under the Securities Act or the Exchange Act, irrespective of any general incorporation language contained in such filing.

‡ Registrant has omitted schedules and exhibits pursuant to Item 601(a)(5) of Regulation S-K.

The Registrant agrees to furnish supplementally a copy of the omitted schedules and exhibits to the SEC upon request.

* The certifications furnished in Exhibits 32.1 and 32.2 hereto are deemed to accompany this Annual Report on Form 10-K and are not deemed “filed” for purposes of Section 18 of the Exchange Act, or otherwise subject to the liability of that section, nor shall they be deemed incorporated by reference into any filing under the Securities Act or the Exchange Act, irrespective of any general incorporation language contained in such filing.

FORM 10-K SUMMARY

Pursuant to the requirements of the Securities Exchange Act of 1934, the re gistrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.

April 8, 2022

March 30, 2023

/s/ Sytse Sijbrandij

1 unchanged sentence

Chief Executive Officer

April 8, 2022

March 30, 2023

/s/ Brian Robins

Chief Financial Officer

March 30, 2023

/s/ Dale Brown

Principal Accounting Officer

POWER OF ATTORNEY

2 unchanged sentences

Name Title Date

/s/ Sytse Sijbrandij Director and Chief Executive Officer April 8, 2022

/s/ Sytse Sijbrandij Director and Chief Executive Officer March 30, 2023

Sytse Sijbrandij (principal executive officer)

/s/ Brian Robins Chief Financial Officer April 8, 2022

/s/ Brian Robins Chief Financial Officer March 30, 2023

Brian Robins (principal financial officer)

/s/ Dale Brown Principal Accounting Officer April 8, 2022

/s/ Dale Brown Principal Accounting Officer March 30, 2023

Dale Brown (principal accounting officer)

/s/ Sundeep Bedi Director April 8, 2022

/s/ Karen Blasing Director April 8, 2022

/s/ Sundeep Bedi Director March 30, 2023

/s/ Karen Blasing Director March 30, 2023

Karen Blasing

/s/ Sue Bostrom Director April 8, 2022

/s/ Matthew Jacobson Director April 8, 2022

/s/ Sue Bostrom Director March 30, 2023

/s/ Matthew Jacobson Director March 30, 2023

Matthew Jacobson

/s/ Merline Saintil Director April 8, 2022

/s/ Mark Porter Director March 30, 2023

/s/ Merline Saintil Director March 30, 2023

Merline Saintil

/s/ Godfrey Sullivan Director April 8, 2022

/s/ Godfrey Sullivan Director March 30, 2023

Godfrey Sullivan

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 9A. Controls and Procedures