Contract analysis

I. Executive Summary This memorandum identifies and analyzes gaps between the existing governance documents of Cascade Retail Holdings Inc. ("CRH" or the "Company") — specifically the Amended and Restated Bylaws last amended May 14, 2019 (the "2019 Bylaws," consisting of 38 sections across 8 articles) and the existing board committee charters — and current best practices, regulatory requirements, proxy advisory firm

II. Background A. Company Overview Cascade Retail Holdings Inc. is a Delaware corporation, incorporated on March 12, 2001, and publicly traded on the Nasdaq Stock Market under the ticker symbol "CRHI" (CIK: 0001387442). The Company is headquartered at 4800 Lakeview Blvd, Suite 1100, Bellevue, WA 98004. CRH operates as a multi-channel retail and e-commerce company specializing in specialty apparel, home goods, and out

III. Gap Analysis — Bylaws Provisions This Section III sets forth our detailed analysis of each identified gap in CRH's 2019 Bylaws, together with our specific recommendations for remediation. We have organized the analysis into seven subsections, each addressing a discrete bylaws topic. A. Director Voting Standard Current State. The 2019 Bylaws provide for plurality voting in all director elections, whether the elec

IV. Gap Analysis — Board Committee Charters This Section IV addresses each of CRH's existing board committee charters, as well as the need for a new standing Technology & Cybersecurity Committee, and identifies gaps relative to current regulatory requirements, best practices, and proxy advisory firm expectations. A. Audit Committee Charter Current State. The Audit Committee Charter was last revised in February 2020.

1. Cybersecurity Risk Oversight. The charter does not reflect the SEC's cybersecurity disclosure rules adopted in July 2023 (Final Rule: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure). These rules require public companies to disclose the board's oversight of risks from cybersecurity threats and management's role and expertise in assessing and managing material cybersecurity risks. The r

2. Caremark Compliance Oversight. In light of the Delaware Court of Chancery's decisions in In re McDonald's Corp. Stockholder Derivative Litigation (Del. Ch. 2023) and In re Harborview & Co. Derivative Litigation (Del. Ch. 2021), the Audit Committee charter should include enhanced Caremark-informed compliance oversight language. These decisions have reinforced that directors — and, in particular, committee members c

3. Whistleblower Procedures. The current charter references the committee's responsibility for establishing procedures for the receipt, retention, and treatment of complaints received by the Company regarding accounting, internal accounting controls, or auditing matters, consistent with the requirements of Section 301 of the Sarbanes-Oxley Act of 2002. However, the charter's treatment of this topic is brief and does

4. Nasdaq Listing Standards Alignment. The charter should be reviewed and, as necessary, updated for alignment with current Nasdaq listing rules. Nasdaq Rule 5605(c) sets forth requirements regarding the Audit Committee's composition, authority, and responsibilities, including: (a) the committee must be composed of at least three independent directors; (b) the committee must have a written charter that addresses the