Replimune Group, Inc. 10-Q

Item 4. Controls and Procedures. Evaluation of Disclosure Controls and Procedures The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, refers to controls and procedures that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that such information is accumulated and communicated to a company’s management, including its principal executive and principal financial officers, as appropriate to allow timely decisions regarding required disclosure. Under the supervision and with the participation of our management, including our Chief Executive Officer, Chief Financial Officer and Chief Accounting Officer, we conducted an evaluation of the effectiveness of our disclosure controls and procedures as of September 30, 2025. Based on this evaluation, our Chief Executive Officer, Chief Financial Officer and Chief Accounting Officer concluded that, as of September 30, 2025, our disclosure controls and procedures were ineffective due to material weaknesses in internal control over financial reporting as described below. In designing and evaluating our disclosure controls and procedures, management recognizes that disclosure controls and procedures, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the disclosure controls and procedures are met. Additionally, in designing disclosure controls and procedures, our management necessarily was required to apply its judgment in evaluating the cost-benefit relationship of possible disclosure controls and procedures. The design of any system of controls also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions; over time, controls may become inadequate because of changes in conditions, or the degree of compliance with policies or procedures may deteriorate. Because of the inherent limitations in a control system, misstatements due to error or fraud may occur and not be detected. Material Weakness During the audit of our consolidated financial statements as of and for the year ended March 31, 2025, we identified material weaknesses in our internal control over financial reporting whereby we did not design and maintain effective information technology (“IT”) general controls for information systems that are relevant to the preparation of our financial statements. Specifically, we did not design and maintain effective: (i) program change management controls to ensure that information technology program and data changes are identified, tested, authorized and implemented appropriately; (ii) user access controls to ensure appropriate segregation of duties and to adequately restrict user and privileged access to appropriate personnel; (iii) computer operations controls to ensure that processing and transfer of data, and data backups and recovery are monitored; and (iv) program development controls to ensure that new software development is tested, authorized and implemented appropriately. The material weaknesses identified did not result in any material misstatements in our interim condensed or annual consolidated financial statements or disclosures; however, they could result in misstatements impacting substantially all accounts or disclosures in the annual consolidated or interim condensed consolidated financial statements that would result in a material misstatement to the annual consolidated or interim consolidated financial statements that would not be prevented or detected. Our management concluded that the condensed consolidated financial statements included in this Quarterly Report on Form 10-Q present fairly, in all material respects, our financial position, results of operations, and cash flows for the periods presented in accordance with accounting principles generally accepted in the United States of America, or U.S. GAAP. Remediation activities Management, with the oversight of the audit committee of the board of directors, is committed to maintaining a strong internal control environment. In response to the material weaknesses noted above, we continue to develop remediation actions which include: •Designing and implementing controls over program change management and the review and update of user access rights and privileges. 40 Table of Contents •Designing and implementing controls to formalize roles and review responsibilities in order to formalize and implement controls over segregation of duties across key financial systems. •Designing and implementing computer operation and program development controls to ensure data integrity and that new software development is tested, authorized and implemented appropriately. We believe that these actions, when fully designed and implemented, will remediate the material weaknesses. However, the material weaknesses will not be considered fully remediated until management designs and implements effective controls that operate for a sufficient period of time and management has concluded, through testing, that these controls are effective. As we continue to evaluate operating effectiveness and monitor improvements to our internal control over financial reporting, we may take additional measures to address control deficiencies or modify the remediation plan described above. Changes in internal control over financial reporting There have been no changes in our internal control over financial reporting during the three months ended September 30, 2025 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting. 41 Table of Contents PART II — OTHER INFORMATION