Dutch Bros Inc

Evaluation of Effectiveness of Disclosure Controls and Procedures

Based on an evaluation of the effectiveness of the Company’s disclosure controls and procedures, as defined in Rule 13(a)-15(e) of the Securities Exchange Act of 1934, as amended (the Exchange Act), as of December 31, 2023, the Company’s Chief Executive Officer (principal executive officer) and Chief Financial Officer (principal financial officer) have concluded that, as of the end of the period covered by this Form 10-K, the Company’s disclosure controls and procedures were effective at the reasonable assurance level.

A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Because of inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues, if any, within an organization have been detected. Accordingly, our disclosure controls and procedures are designed to provide reasonable, not absolute, assurance that the objectives of our disclosure control system are met.

Changes in Internal Control over Financial Reporting

Except for the changes in connection with Company’s implementation of the remediation plans described below, there have been no changes during the quarter ended December 31, 2023 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Management’s Report on Internal Control over Financial Reporting

Management, including our principal executive officer and principal financial officer, is responsible for establishing and maintaining adequate internal control over financial reporting and for the assessment of the effectiveness of internal control over financial reporting as defined in Rule 13a-15(f) and 15d-15(f) under the Exchange Act. Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external reporting purposes in accordance with U.S. GAAP and those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of our company’s assets; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that our company’s receipts and expenditures are being made in accordance with appropriate authorizations; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of assets that could have a material effect on our consolidated financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation.

As previously described in Part II, Item 9A of the Company’s Annual Report on Form 10-K for the year ended December 31, 2022, management concluded that the Company’s internal control over financial reporting was not effective because of the effect of the material weaknesses described below.

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements will not be prevented or detected on a timely basis.

Management identified the following deficiencies in our internal control over financial reporting for the year ended December 31, 2022:

•We did not have effective controls over change management of system configurations in two IT environments. As a result, process level automated controls that are dependent on the affected IT environments were ineffective because they could have been adversely impacted.

•We did not have effectively designed controls over the accounting for breakage estimates related to our Dutch Rewards loyalty program.

These control deficiencies were the result of our risk assessment not identifying controls to address system changes, as well as changes in the timing of the expiration of points collected through our Dutch Rewards loyalty program.

During 2023, we implemented our previously disclosed remediation plan that included the following:

▪Purchased and implemented a software tool designed to facilitate the logging of system changes.

▪Reviewed the organizational structure supporting systems administration and began implementing recommendations arising from this review to help ensure that we have the necessary expertise and experience to oversee system change management protocols and controls.

▪Launched a review of system change control design with the assistance of third-party consultants and began implementing recommendations arising from this review to help ensure that all system changes to configurations within the IT environments are logged and approved.

•Designed and implemented reconciliation and review controls to ensure that the accounting for breakage is complete and accurate.

During the fourth quarter of 2023, we completed our testing of the operating effectiveness of the implemented controls and found them to be effective. As a result, we have concluded that the material weaknesses have been remediated as of December 31, 2023.

Management, under the supervision of our principal executive officer and principal financial officer, assessed the effectiveness of our internal control over financial reporting as of December 31, 2023, based on the framework established in Internal Control — Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Based upon this evaluation, our management concluded that our internal control over financial reporting was effective as of December 31, 2023.

The effectiveness of our internal control over financial reporting as of December 31, 2023 has been audited by KPMG LLP, an independent registered public accounting firm, as stated in their report which is included in Item 8 of this Form 10-K.