PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP
Attorneys at Law One Constitution Plaza, 38th Floor Hartford, Connecticut 06103
PRELIMINARY ASSESSMENT MEMORANDUM PHASE 1 — GAP ANALYSIS FINDINGS
MEMORANDUM
FROM: Marcus Delgado, Partner, and Carlos Espinoza, Associate — Calderwood & Harkness LLP
TO: Derek Mallory, General Counsel & Chief Compliance Officer, Quorum Insurance Holdings Corp.; Priya Venkatesh, Vice President, Regulatory Affairs, Quorum Insurance Holdings Corp.
DATE: October 3, 2025
RE: Phase 1 — Preliminary Assessment and Gap Analysis Findings: Market-Conduct Compliance Refresh
MATTER NO.: 1025-00002
COPIES: Catherine Bloom, Senior Counsel, Calderwood & Harkness LLP; Hannah Brinkley, Associate, Calderwood & Harkness LLP
This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product prepared in anticipation of litigation and regulatory proceedings. This document is intended solely for the use of the named recipients and should not be disclosed, disseminated, distributed, or copied to any person or entity without the prior written consent of Calderwood & Harkness LLP. Any inadvertent disclosure does not constitute a waiver of any applicable privilege or protection.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This memorandum summarizes the findings from the Phase 1 Assessment and Gap Analysis conducted by Calderwood & Harkness LLP ("C&H" or the "Firm") during the period August 19, 2025 through October 3, 2025, a total engagement period of approximately six and one-half weeks. The purpose of this memorandum is to provide Quorum Insurance Holdings Corp. ("QIH" or the "Company") with a comprehensive, privilege-protected assessment of the current state of market-conduct compliance across the Quorum enterprise, to identify and prioritize gaps requiring remediation, and to set forth recommendations for the immediate commencement of Phase 2 activities.
Engagement Context. C&H was retained on August 19, 2025, at the direction of the QIH Board of Directors' Audit & Compliance Committee (the "Committee"), chaired by independent director Margaret Aldworth. The Committee's engagement of C&H followed the August 12, 2025 Board action directing management to engage new outside counsel for purposes of conducting a comprehensive market-conduct compliance refresh. C&H replaced QIH's prior regulatory counsel, Hargrove & Sattler LLP, whose engagement concluded in June 2025. The decision to engage new outside counsel reflects the Committee's determination that the scope and severity of the compliance deficiencies identified through the recent multi-state examination and internal audit processes warranted fresh external perspective and a comprehensive remediation approach.
Scope of Review. The Phase 1 assessment encompassed a comprehensive market-conduct compliance gap analysis across all three of QIH's licensed insurance carrier subsidiaries:
• Quorum Indemnity Insurance Company ("QIIC") — NAIC No. 41927; domiciled in Connecticut; licensed in 28 states; personal auto, homeowners, and dwelling fire lines of business;
• Quorum Specialty Underwriters, Inc. ("QSU") — NAIC No. 53812; domiciled in Texas; licensed in 22 states; commercial general liability, professional liability (E&O), and cyber liability lines of business; and
• Quorum Life & Annuity Company ("QLA") — NAIC No. 67403; domiciled in Arizona; licensed in 19 states; term life, whole life, fixed annuity, and indexed annuity lines of business.
The assessment also extended to Pinnacle Bridge MGA, LLC ("Pinnacle Bridge"), QIH's fintech distribution platform, which is licensed in 34 states as a managing general agent and surplus lines broker. In total, our review covered 79 state-level carrier licenses (28 + 22 + 19 for the three carriers, reflecting 38 unique states after de-duplication), as well as Pinnacle Bridge's 34-state licensing portfolio.
Assessment Triggers. The Phase 1 assessment was prompted by four principal developments, each of which independently warranted the comprehensive review undertaken:
(a) A coordinated multi-state market-conduct examination of QIIC, initiated by the Connecticut Department of Insurance ("CTDOI") in September 2023, with the Florida Office of Insurance Regulation ("FL OIR") serving as lead examining state. The examination covered the period January 1, 2021 through December 31, 2023, and culminated in the issuance of a final examination report on May 12, 2025, containing 14 formal findings across three compliance domains.
(b) Internal Audit Report No. IA-2025-017, issued on August 4, 2025 by QIH Director of Internal Audit Neil Granger, which identified 23 control deficiencies across all three carrier subsidiaries and rated the overall market-conduct compliance program as "Needs Significant Improvement" — the second-lowest rating on QIH's five-tier internal audit assessment scale.
(c) Regulatory penalties totaling $455,000, comprising a $275,000 civil penalty assessed by CTDOI (paid by QIIC on July 15, 2025) and a $180,000 administrative fine assessed by FL OIR (due September 30, 2025), both arising from findings in the multi-state examination.
(d) A California Department of Insurance ("CDI") Order to Show Cause, issued June 18, 2025, regarding advertising violations involving non-filed digital advertisements containing rate comparisons distributed in California, with a hearing scheduled for October 14, 2025.
Top-Line Conclusion. Based on our comprehensive review, C&H has determined that significant and systemic gaps exist across all three compliance domains assessed — claims-handling timeliness, advertising review and filing, and consumer complaint response. These deficiencies are not isolated to any single subsidiary or operational function; rather, they reflect enterprise-wide control failures that manifest with varying degrees of severity across the Quorum organization. The most acute deficiencies are concentrated at QIIC, the largest carrier subsidiary by direct written premium, and within the Pinnacle Bridge MGA advertising workflow, where the absence of a centralized pre-publication review mechanism resulted in the placement of the substantial majority of non-compliant digital advertisements identified during the examination period.
Recommendation. We recommend the immediate commencement of Phase 2 (Remediation & Policy Drafting) on October 6, 2025, the first business day following the issuance of this memorandum, with priority attention directed to the areas identified herein. Particular urgency attaches to two near-term deadlines: the December 31, 2025 remediation deadline established under the FL OIR-accepted Corrective Action Plan, and the CDI hearing on October 14, 2025. In our assessment, the current pace of remediation activities is insufficient to achieve full compliance by the December 31, 2025 deadline absent a material acceleration of effort, and the CDI hearing will require the preparation and submission of mitigating evidence demonstrating affirmative remediation steps. The Phase 2 work plan set forth in Section XII of this memorandum is designed to address both of these time-critical requirements.
II. METHODOLOGY AND SCOPE OF REVIEW
A. Documents and Data Reviewed
Over the course of the Phase 1 assessment, C&H reviewed an extensive body of documents, data, and regulatory materials. The principal categories of documents and data reviewed are set forth below, although this summary is not exhaustive of every document or data point considered during the engagement.
Regulatory Examination Materials. We reviewed the FL OIR final examination report, issued May 12, 2025, covering the examination period January 1, 2021 through December 31, 2023. This report constituted the primary regulatory document driving the assessment, as it contained all 14 formal findings that form the basis for the Corrective Action Plan obligations. We also reviewed the QIIC Corrective Action Plan as submitted to FL OIR on July 1, 2025, and FL OIR's letter of acceptance with modifications dated July 28, 2025. The modifications imposed by FL OIR in its acceptance letter established the December 31, 2025 remediation deadline and imposed certain additional reporting requirements not contemplated in the original submission.
Penalty and Enforcement Documentation. We reviewed the CTDOI penalty order and all associated correspondence relating to the $275,000 civil penalty, including the Consent Order executed by QIIC and filed with CTDOI. We also reviewed the FL OIR administrative fine documentation establishing the $180,000 fine obligation, including the Notice of Intent to Impose Fine and all responsive correspondence. Additionally, we reviewed the CDI Order to Show Cause dated June 18, 2025, together with the underlying investigative file materials made available by CDI, which detail the specific California advertising violations at issue.
Internal Audit Materials. We reviewed Internal Audit Report No. IA-2025-017, issued August 4, 2025 by Director of Internal Audit Neil Granger and his team. This report identified 23 control deficiencies across all three carrier subsidiaries and rated the overall market-conduct compliance program as "Needs Significant Improvement." We also reviewed the supporting workpapers, testing schedules, and management response documentation underlying the report.
Existing Compliance Documentation. We reviewed the existing market-conduct compliance manuals for each of QIIC, QSU, and QLA, as well as the claims-handling procedures, advertising review protocols, and complaint logs maintained by each subsidiary. This review revealed significant inconsistencies in policy documentation across the three carriers, as discussed in greater detail in Section V.
External Consultant Reports. We reviewed the statistical claims-file sampling data and complaint-ratio benchmarking reports prepared by Ridgeline Consulting Group, LLC ("Ridgeline"), under the direction of Sandra Whitfield, Managing Director. Ridgeline was engaged by QIH in March 2025 to conduct an independent statistical analysis of claims processing performance and consumer complaint metrics. We also reviewed, to the extent relevant to claims reserves and complaint accruals, certain annual statutory audit workpapers prepared by Voss Kendrick & Associates, CPA, PLLC, under the supervision of Frank Castellano, Engagement Partner.
Pinnacle Bridge MGA Documentation. We reviewed Pinnacle Bridge MGA, LLC advertising placement records, media buy documentation, and internal approval workflows (to the extent any existed) for the period March 2022 through the present. We also reviewed the MGA agreements between Pinnacle Bridge and each of QIIC and QSU.
Regulatory Standards and State Law. We reviewed the NAIC Market Regulation ("D") Committee standards and protocols applicable to market-conduct examinations, as well as state-specific statutes and regulations for all 38 unique states in which the Quorum carrier subsidiaries are licensed. The results of the state-by-state regulatory analysis were compiled into a comprehensive State-by-State Regulatory Requirements Matrix prepared by Hannah Brinkley, which is attached hereto as Appendix A.
B. Interviews Conducted
In addition to the documentary review, C&H conducted a series of interviews with key personnel at QIH and its subsidiaries, as well as with external consultants. These interviews were conducted in person at QIH's Hartford headquarters and via videoconference between August 25, 2025 and September 19, 2025. All interviews were conducted under the protection of the attorney-client privilege, and interviewees were informed at the outset of each session that C&H was acting as outside counsel to QIH and that the interviews were being conducted for the purpose of rendering legal advice.
The following individuals were interviewed:
• Derek Mallory, General Counsel & Chief Compliance Officer, QIH — interviewed August 25, 2025 and September 12, 2025 (two sessions);
• Priya Venkatesh, Vice President, Regulatory Affairs, QIH — interviewed August 26, 2025;
• Thomas Raeburn, Senior Vice President, Claims Operations, QIH — interviewed August 28, 2025 and September 5, 2025 (two sessions);
• Lena Fujimoto, Director, Market Conduct & Consumer Affairs, QIH — interviewed August 29, 2025 and September 10, 2025 (two sessions);
• Neil Granger, Director of Internal Audit, QIH — interviewed September 2, 2025;
• Sandra Whitfield, Managing Director, Ridgeline Consulting Group, LLC — interviewed September 8, 2025;
• Selected claims supervisors, marketing managers, and customer service team leads across QIIC, QSU, and QLA — group and individual interviews conducted between September 9, 2025 and September 19, 2025 (seven sessions total).
The interviews provided critical context for interpreting the documentary record, particularly with respect to the root causes underlying the identified compliance deficiencies. The candid observations of operational personnel regarding staffing constraints, technology limitations, and workflow inefficiencies were instrumental in shaping our remediation recommendations.
C. Analytical Framework
The Phase 1 assessment was structured around a three-domain analytical framework, reflecting the three principal areas of market-conduct compliance at issue:
(1) Claims-Handling Timeliness — encompassing the full lifecycle of claims processing, from initial acknowledgment through investigation, determination, and payment, measured against state-specific statutory and regulatory requirements;
(2) Advertising Compliance — encompassing the creation, review, approval, filing, and publication of all advertising and marketing materials, including digital advertisements, across all distribution channels and all subsidiaries and affiliates; and
(3) Consumer Complaint Response — encompassing the intake, logging, acknowledgment, investigation, resolution, and regulatory reporting of consumer complaints received through all channels.
Within each domain, our analysis employed the following methodologies:
State-by-State Comparison. Current practices at each subsidiary were compared against the statutory and regulatory requirements in each of the 38 unique states in which the Quorum carriers are licensed. This comparison was conducted on a granular, provision-level basis, utilizing the State-by-State Regulatory Requirements Matrix (Appendix A) as the reference standard.
Benchmarking Against Industry Standards. Complaint ratio data for each subsidiary was benchmarked against NAIC-published complaint ratios and industry medians, utilizing data compiled by Ridgeline Consulting Group. Claims-processing timeliness data was similarly benchmarked against industry performance standards.
Cross-Referencing of Findings. The 14 formal findings in the FL OIR examination report were cross-referenced against the 23 control deficiencies identified in Internal Audit Report No. IA-2025-017 to identify (a) deficiencies that overlapped between the two reports, confirming their significance, and (b) incremental deficiencies identified by Internal Audit but not surfaced by the examination, which may present additional compliance risk.
Risk Prioritization. Each identified gap was assessed using a risk-prioritization matrix that scored deficiencies along two dimensions: (i) severity of the compliance gap, measured by the degree of deviation from regulatory requirements and the potential magnitude of associated penalties, and (ii) likelihood of near-term regulatory action, informed by known examination schedules, pending enforcement proceedings, and historical enforcement patterns of the relevant regulators. The detailed scoring is set forth in the Risk Prioritization Matrix attached as Appendix F.
III. BACKGROUND: QUORUM CORPORATE AND OPERATIONAL PROFILE
To provide context for the findings set forth in this memorandum, we briefly summarize the corporate structure and operational profile of QIH and its relevant subsidiaries.
Quorum Insurance Holdings Corp. QIH is a Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. The Company is headquartered at 280 Asylum Street, Suite 1400, Hartford, Connecticut 06103, and operates from approximately 14 offices nationwide. QIH is led by Chief Executive Officer Vivian Trask and employs approximately 6,200 individuals across its holding company and subsidiary operations. As of August 2025, QIH's market capitalization was approximately $2.8 billion. For the fiscal year ended December 31, 2024, QIH reported consolidated revenue of $4.92 billion, consolidated net income of $318 million, and consolidated annual gross written premium ("GWP") of $4.16 billion.
QIH conducts its insurance operations through three wholly-owned licensed carrier subsidiaries and one managing general agent platform, described below.
Quorum Indemnity Insurance Company ("QIIC"). QIIC is the Company's largest carrier subsidiary by premium volume. QIIC is assigned NAIC company number 41927 and is domiciled in Connecticut, with its principal office located at 280 Asylum Street, Suite 1400, Hartford, CT 06103 (EIN: 06-2193847). QIIC is licensed to transact insurance in 28 states and writes personal automobile, homeowners, and dwelling fire lines of business. For the fiscal year ended December 31, 2024, QIIC reported direct written premium ("DWP") of $2.14 billion, representing approximately 51.4% of QIH's consolidated GWP. QIIC is the subsidiary that was the subject of the coordinated multi-state market-conduct examination described in Section IV of this memorandum.
Quorum Specialty Underwriters, Inc. ("QSU"). QSU is a Texas-domiciled specialty carrier assigned NAIC company number 53812. Its principal office is located at 2600 Pearl Street, Suite 900, Dallas, Texas 75201 (EIN: 75-4281936). QSU is licensed in 22 states and writes commercial general liability, professional liability (errors and omissions), and cyber liability lines of business. For the fiscal year ended December 31, 2024, QSU reported DWP of $1.38 billion, representing approximately 33.2% of QIH's consolidated GWP.
Quorum Life & Annuity Company ("QLA"). QLA is an Arizona-domiciled life insurance company assigned NAIC company number 67403. Its principal office is located at 4720 East Camelback Road, Suite 310, Scottsdale, Arizona 85251 (EIN: 86-3729154). QLA is licensed in 19 states and writes term life, whole life, fixed annuity, and indexed annuity products. For the fiscal year ended December 31, 2024, QLA reported DWP of $640 million, representing approximately 15.4% of QIH's consolidated GWP.
The aggregate DWP of the three carrier subsidiaries — $2.14 billion (QIIC) + $1.38 billion (QSU) + $640 million (QLA) — totals $4.16 billion, consistent with the consolidated GWP figure reported by QIH.
Pinnacle Bridge MGA, LLC ("Pinnacle Bridge"). Pinnacle Bridge serves as Quorum's fintech distribution platform, functioning as a managing general agent that underwrites and binds policies on behalf of QIIC and QSU. Pinnacle Bridge's principal office is co-located with QIH at 280 Asylum Street, Suite 1400, Hartford, CT 06103 (EIN: 06-5184729). Pinnacle Bridge is licensed in 34 states as a managing general agent and surplus lines broker. For the fiscal year ended December 31, 2024, Pinnacle Bridge managed a premium volume of approximately $890 million, which represents a subset of the premiums reported by QIIC and QSU. Pinnacle Bridge does not distribute QLA products. Pinnacle Bridge's role in the advertising compliance deficiencies identified during the Phase 1 assessment is discussed in detail in Section VI.
Compliance Department. QIH maintains a centralized Compliance Department with an annual budget (2025) of $12.4 million. The Compliance Department is led by Derek Mallory in his dual capacity as General Counsel and Chief Compliance Officer, with Priya Venkatesh (VP, Regulatory Affairs) and Lena Fujimoto (Director, Market Conduct & Consumer Affairs) serving as the primary operational compliance leaders. As discussed in this memorandum, C&H's assessment has identified structural and resourcing shortcomings within the Compliance Department that have contributed to the deficiencies at issue.
IV. SUMMARY OF FL OIR EXAMINATION FINDINGS
A. Overview. In September 2023, the CTDOI, acting in its capacity as domestic regulator for QIIC, initiated a coordinated multi-state market-conduct examination of QIIC under the auspices of the NAIC Market Regulation protocols. Pursuant to those protocols, FL OIR was designated as the lead examining state and assumed primary responsibility for conducting the examination and issuing the final report.
The examination covered QIIC's market-conduct activities during the period January 1, 2021 through December 31, 2023 — a three-year examination period. The examination focused on three principal areas: claims-handling timeliness, advertising and marketing compliance, and consumer complaint response procedures.
The FL OIR final examination report was issued on May 12, 2025, following an extended drafting and comment period. The report contains 14 formal findings distributed across the three areas of examination focus. The findings represent the examiners' conclusions that QIIC's practices deviated from applicable statutory and regulatory requirements in the identified respects.
The examination universe for claims files consisted of approximately 12,400 QIIC claims files falling within the examination period. The FL OIR examination team selected a statistical sample of 625 files for detailed review, representing a sample rate of approximately 5.04% (625 ÷ 12,400). Of the 625 sampled files, 74 files (11.8%) were found to contain one or more deficiencies, an error rate that the examiners characterized as materially exceeding acceptable thresholds and as indicative of systemic rather than isolated compliance failures.
The subsections that follow summarize the findings within each of the three examination domains.
B. Claims-Handling Timeliness Findings (6 Findings)
The examination report identified six formal findings related to claims-handling timeliness. These findings constitute the largest single category of deficiencies and, in our assessment, represent the most significant systemic compliance failure identified during the Phase 1 review.
Acknowledgment Delays. The examiners determined that QIIC's average claims acknowledgment time during the examination period was 18.7 business days — the period measured from the date of initial claim submission to the date on which QIIC transmitted a written acknowledgment to the claimant. This average far exceeds the statutory maximums applicable in QIIC's licensed states, which range from 10 business days (in the most stringent jurisdictions, including New York, Florida, and Connecticut) to 15 business days (in states with more permissive requirements). The 18.7-business-day average means that QIIC was, on average, non-compliant with the acknowledgment requirements in even the most permissive jurisdictions.
Investigation Commencement Delays. Relatedly, the examiners found systemic delays in the commencement of claims investigations following acknowledgment. In multiple sampled files, the period between acknowledgment and the initiation of meaningful investigation activity exceeded the timeframes required by applicable state statutes. This finding suggests that the acknowledgment delays identified above were not merely clerical in nature but reflected deeper operational bottlenecks in the claims-handling workflow.
Claims Determination Delays. The examination report also identified delays in the issuance of final claims determinations — that is, the decisions to pay, deny, or otherwise resolve claims. In several states, statutes require that claims determinations be made within specified timeframes following the completion of the investigation, and QIIC's performance fell short of these requirements in a material number of sampled files.
Prompt-Pay Compliance. The examiners assessed QIIC's compliance with state prompt-pay statutes, which require that approved claims be paid within specified periods following the claims determination. QIIC's timely claims payment rate for 2024 — the most recent full year for which data was available at the time of our assessment — was 74.2%, measured as the percentage of claims paid within the applicable statutory prompt-pay windows. This rate falls substantially below QIIC's internal performance target of 95% and, more critically, falls below acceptable regulatory thresholds in at least 12 of QIIC's licensed states.
NYDFS Regulation 64 Deficiencies. The examination report specifically flagged QIIC's failure to comply with the prompt-pay requirements established by the New York Department of Financial Services ("NYDFS") under Insurance Regulation 64 (11 NYCRR Part 216). Regulation 64 imposes among the most stringent claims-handling timeliness requirements in the nation, and QIIC's current performance metrics present significant compliance exposure in New York, as discussed further in Section IX.D of this memorandum.
Root Causes. Based on our review of the examination findings and our interviews with Thomas Raeburn (SVP, Claims Operations) and claims supervisory personnel, we have identified the following root causes for the claims-handling timeliness deficiencies:
(i) Insufficient staffing ratios. The claims operations function is understaffed relative to the volume of claims processed, resulting in excessive caseloads for individual adjusters and supervisors. Mr. Raeburn acknowledged during his interviews that the claims department has operated below its budgeted headcount for at least the past 18 months.
(ii) Legacy systems limitations. QIIC's claims management system lacks automated deadline-tracking functionality. Adjusters are expected to manually monitor statutory deadlines on a claim-by-claim basis, a practice that is inherently error-prone at scale. The system does not generate automated alerts when statutory deadlines are approaching or have been missed.
(iii) Inadequate supervisory review protocols. The existing supervisory review framework does not incorporate systematic timeliness checks. Supervisory reviews focus primarily on reserving accuracy and coverage determinations, with limited attention to compliance with state-specific timeliness requirements.
Mr. Raeburn candidly acknowledged these staffing and systems deficiencies during his interviews with our team, and expressed his view that the claims operations function requires both additional personnel and technology investment to achieve and maintain compliance.
C. Advertising and Marketing Findings (5 Findings)
The examination report identified five formal findings related to advertising and marketing compliance. These findings revealed a pattern of non-compliant advertising activity spanning an extended period and implicating both QIIC's internal marketing function and Pinnacle Bridge MGA's independent marketing activities.
Non-Compliant Digital Advertisements. The examiners identified a total of 43 unique non-compliant digital advertising creatives that were published and distributed during the examination period. These advertisements appeared across multiple digital advertising platforms, including Severin Industries (search and display network), Meta (Kestrel Services Inc. and Northpoint Services Inc.), and various programmatic display advertising channels. The states in which the non-compliant advertisements were identified as having been distributed include Florida, California, Illinois, and Ohio.
Nature of Violations. The non-compliant advertisements included, among other deficiencies, unapproved or non-filed rate comparisons — that is, advertisements containing comparisons of QIIC's insurance rates to those of competitors that had not been reviewed by the compliance function and had not been filed with state regulators as required under applicable advertising filing statutes. Several of the advertisements also contained claims and representations that, in the examiners' view, were misleading or lacked adequate substantiation.
Duration of Non-Compliance. The period during which non-compliant advertisements were in circulation extended from approximately March 2022 through November 2024, a span of approximately 32 months. This extended duration significantly amplifies the severity of the advertising findings, as it demonstrates that the underlying control failures persisted over multiple years without detection or correction.
Pinnacle Bridge MGA Attribution. Of the 43 non-compliant advertising creatives identified, 31 (representing 72.1% of the total) were placed by Pinnacle Bridge MGA's in-house marketing team without being routed through QIIC's advertising compliance review process. The remaining 12 advertisements were placed directly by QIIC's marketing department but lacked the required state-specific filings. The disproportionate attribution of non-compliant advertisements to Pinnacle Bridge underscores the significance of the MGA advertising-workflow gap discussed in Section VI.
CDI Enforcement. The California-specific advertising violations identified in the examination have given rise to a separate enforcement action by CDI. On June 18, 2025, CDI issued an Order to Show Cause directed to QIIC, requiring the company to demonstrate why additional penalties should not be imposed under the California Insurance Code for the distribution of non-filed digital advertisements containing rate comparisons in California. A hearing on the Order to Show Cause is scheduled for October 14, 2025, as discussed in Section IX.C.
Root Causes. Our investigation has identified the following root causes for the advertising compliance deficiencies:
(i) Absence of a centralized advertising review workflow. There is no enterprise-wide advertising review process that encompasses the marketing activities of all Quorum entities, including Pinnacle Bridge MGA. QIIC maintains a limited advertising review protocol, but it is not designed to capture materials originated outside of QIIC's own marketing department.
(ii) No formal gating mechanism. There is no technical or procedural "gate" that prevents the publication of advertising materials that have not been reviewed and approved by the compliance function. Marketing personnel at both QIIC and Pinnacle Bridge are able to publish digital advertisements without obtaining prior compliance clearance.
(iii) Absence of state-specific filing tracking. There is no systematic process for tracking which digital advertising creatives require filing in which states, or for confirming that required filings have been made prior to publication. This gap is particularly acute for digital advertising formats, which may be distributed across multiple state jurisdictions simultaneously.
D. Complaint-Handling Findings (3 Findings)
The examination report identified three formal findings related to consumer complaint handling. While fewer in number than the claims-handling and advertising findings, the complaint-handling deficiencies are significant because they implicate QIIC's responsiveness to its policyholders and its compliance with state-mandated consumer protection requirements.
Failure to Meet Response Deadlines. The examiners identified failures to log and respond to consumer complaints within statutory deadlines in three states. The specific states and the nature of the deadline violations are detailed in the examination report and the corresponding CAP milestones set forth in Appendix B.
Intake Documentation Deficiencies. The examination revealed deficiencies in complaint intake documentation, escalation procedures, and regulatory reporting. In multiple instances, complaints received by QIIC were not documented in accordance with applicable requirements, and the escalation of certain complaints to supervisory and regulatory-affairs personnel was either delayed or omitted entirely.
Complaint Log Gaps. The examiners identified instances in which consumer complaints were not logged in QIIC's centralized complaint management system for periods exceeding 30 days after receipt. These logging delays made it impossible for supervisory personnel to monitor complaint status and response timelines, and resulted in missed regulatory reporting obligations in certain states.
Root Causes. Our investigation identified the following root causes:
(i) Decentralized complaint intake. Consumer complaints are received through multiple channels — telephone, email, web portal, social media platforms, and direct communications from state regulators — but there is no unified logging protocol that ensures all complaints are captured in a single, centralized system within a defined timeframe. The absence of a unified intake process creates opportunities for complaints to be lost, duplicated, or delayed in logging.
(ii) Insufficient staffing. The Market Conduct & Consumer Affairs function under Lena Fujimoto's direction is understaffed relative to the volume of complaints received. The 2,847 complaints filed against all Quorum subsidiaries in 2024 represent a substantial workload, and Ms. Fujimoto's team lacks the personnel necessary to ensure timely intake, investigation, and resolution of all complaints within statutory deadlines.
V. SUBSIDIARY-SPECIFIC GAP ANALYSIS
A. Quorum Indemnity Insurance Company (QIIC)
1. Claims-Handling Timeliness. QIIC is licensed in 28 states, all of which were reviewed as part of the Phase 1 assessment. Compliance gaps in claims-handling timeliness were identified in the substantial majority of these states. The deficiencies are pervasive and systemic, rather than isolated to particular jurisdictions or lines of business.
As noted in Section IV.B, QIIC's average claims acknowledgment time of 18.7 business days significantly exceeds the 10-business-day acknowledgment requirement applicable in the most stringent states, including New York, Florida, and Connecticut — three of QIIC's highest-volume jurisdictions. Even in states with more permissive 15-business-day requirements, the 18.7-day average reflects non-compliance on average. This means that while some individual claims may be acknowledged within statutory timeframes, the overall population of claims exhibits a systemic pattern of delay.
QIIC's timely claims payment rate of 74.2% is materially below the Company's internal performance target of 95% and falls below acceptable regulatory thresholds in at least 12 of QIIC's licensed states. The gap between the 74.2% actual rate and the 95% target — a shortfall of 20.8 percentage points — indicates a pervasive failure in the claims payment pipeline that cannot be attributed to a small number of outlier claims. Rather, approximately one in four claims is being paid outside the applicable statutory prompt-pay window, a rate of non-compliance that we consider highly likely to result in enforcement action if not promptly remediated.
The NYDFS Regulation 64 compliance deficiencies are of particular concern. NYDFS maintains an aggressive enforcement posture with respect to prompt-pay requirements, and QIIC's current performance metrics in New York would almost certainly not withstand a targeted examination. As discussed in Section IX.D, we anticipate that NYDFS may conduct such an examination as early as Q1 2026, and preparation for that examination is included as a High Priority item in the Risk Prioritization Matrix.
2. Advertising Compliance. QIIC has specific advertising findings in four states: Florida, California, Illinois, and Ohio. As detailed in Section IV.C, a total of 43 non-compliant digital advertising creatives were identified, of which 31 (72.1%) were placed by Pinnacle Bridge MGA's in-house marketing team and the remaining 12 were placed directly by QIIC's marketing department.
Our review of QIIC's existing advertising review policy revealed that the policy does not extend to marketing activities conducted by Pinnacle Bridge. The policy governs only advertisements originated by QIIC's own marketing department, leaving a significant gap in compliance coverage for the substantial volume of advertising placed through the MGA channel. This gap is structural in nature and cannot be remediated through enhanced enforcement of the existing policy; rather, a new, enterprise-wide advertising review framework is required.
Furthermore, QIIC lacks a formalized state-filing checklist or tracking system for digital advertisements. The existing advertising review process, to the extent it functions at all, is oriented toward traditional media formats (print, broadcast) and does not adequately address the unique compliance challenges presented by digital advertising, including the ability to target advertisements to specific geographic markets across state lines and the rapid pace of digital ad creation and deployment.
3. Consumer Complaint Response. QIIC's 2024 complaint ratio of 1.47 complaints per 1,000 policies in force is 79.3% above the NAIC median of 0.82 complaints per 1,000 policies (calculated as 1.47 ÷ 0.82 = 1.793, or 179.3% of the median). This is the highest complaint ratio among the three Quorum carrier subsidiaries and places QIIC well above industry benchmarks.
In 2024, a total of 2,847 consumer complaints were filed against all Quorum subsidiaries. QIIC represents the largest share of these complaints, consistent with its status as the largest subsidiary by premium volume and policy count. The elevated complaint ratio is not solely a function of premium growth; rather, our analysis indicates that complaint volumes have increased at a rate disproportionate to premium and policy-count growth, suggesting deterioration in underlying service quality or policyholder satisfaction.
The logging and response failures documented in the FL OIR examination were identified in three states, but our assessment suggests that similar deficiencies likely exist in additional jurisdictions. The decentralized complaint intake structure and insufficient staffing that give rise to these failures are enterprise-wide conditions, not state-specific anomalies.
4. Overall Assessment. QIIC presents the highest concentration of compliance risk among the Quorum carrier subsidiaries. This assessment is based on several converging factors: QIIC is the largest subsidiary by DWP ($2.14 billion), maintains the most extensive geographic footprint (28 licensed states), was the specific subject of the FL OIR examination, has the highest complaint ratio (79.3% above median), and is the subsidiary most directly implicated in the Pinnacle Bridge advertising-workflow deficiency. Remediation efforts in Phase 2 should be prioritized at QIIC, with subsequent extension to QSU and QLA.
B. Quorum Specialty Underwriters, Inc. (QSU)
1. Claims-Handling Timeliness. All 22 states in which QSU is licensed were reviewed as part of the Phase 1 assessment. While QSU was not the subject of the FL OIR examination — that examination was limited to QIIC — our independent review identified similar, though less severe, timeliness gaps in QSU's claims-handling operations.
Commercial lines claims, which constitute the entirety of QSU's book of business, inherently involve longer investigation periods than personal lines claims due to the complexity of liability determinations and the scope of commercial loss events. We have accounted for these differences in our analysis and have applied the appropriate state-specific statutory timeframes for commercial lines. Even with these adjustments, acknowledgment delays were noted in several states, and the overall timeliness performance, while superior to QIIC's, does not meet the standards required by applicable law in all jurisdictions.
The structural root causes identified at QIIC — staffing constraints, legacy systems limitations, and inadequate supervisory review protocols — are present at QSU as well, as both subsidiaries share certain operational infrastructure and management reporting lines within QIH's claims operations function.
2. Advertising Compliance. QSU shares advertising compliance risk with QIIC through the Pinnacle Bridge MGA channel. Pinnacle Bridge underwrites and binds policies on behalf of both QIIC and QSU, and certain of the 43 non-compliant digital advertisements identified during the examination period included references to QSU products — specifically, commercial general liability and cyber liability offerings. To the extent that these advertisements were distributed in states where QSU is licensed, QSU bears regulatory exposure independent of QIIC.
The need for a centralized advertising review process encompassing Pinnacle Bridge therefore extends with equal force to QSU's product advertising. The current absence of such a process exposes QSU to the same advertising compliance risks that have already materialized in enforcement actions against QIIC.
3. Consumer Complaint Response. QSU's 2024 complaint ratio of 0.93 complaints per 1,000 policies is 13.4% above the NAIC median of 0.82 (calculated as 0.93 ÷ 0.82 = 1.134, or 113.4% of the median). While this ratio is lower than those of QIIC and QLA, it nevertheless exceeds the industry benchmark and indicates room for improvement.
From a procedural standpoint, the complaint logging gaps identified at QIIC are mirrored at QSU. The same decentralized intake structure and shared complaint management system serve both subsidiaries, meaning that the procedural deficiencies identified in the FL OIR examination with respect to QIIC are inherent to the enterprise-wide complaint-handling infrastructure and affect QSU equally.
4. Overall Assessment. QSU presents a moderate level of compliance risk. The deficiencies identified at QSU are structural and procedural in nature, and they closely mirror the patterns observed at QIIC. This congruence strongly suggests that the underlying control failures are enterprise-level rather than subsidiary-specific, a conclusion that has important implications for the design of the Phase 2 remediation program. Remediating these deficiencies at QIIC alone, without extending reforms to QSU, would leave the enterprise exposed to the same risks in a different subsidiary.
C. Quorum Life & Annuity Company (QLA)
1. Claims-Handling Timeliness. All 19 states in which QLA is licensed were reviewed as part of the Phase 1 assessment. Life insurance and annuity claims processing is subject to different statutory frameworks than the property and casualty lines written by QIIC and QSU. The relevant timeframes typically govern the processing of death benefit claims and annuity surrender requests, among other transactions.
Our review identified gaps primarily in the processing of death benefit claims and annuity surrender processing. While the timeliness issues at QLA are less acute than those identified at QIIC's personal lines operations, they are nonetheless present and require remediation in several states. The sensitive nature of life insurance and annuity products — which often involve beneficiaries in vulnerable circumstances — amplifies the regulatory and reputational significance of even modest processing delays.
2. Advertising Compliance. QLA's advertising compliance risk profile differs from that of QIIC and QSU in one important respect: Pinnacle Bridge MGA does not distribute QLA products. Accordingly, QLA is not exposed to the MGA advertising-workflow gap that is the most significant driver of advertising compliance risk for the other two carrier subsidiaries.
However, our review revealed that QLA's internal advertising review process lacks formalized state-filing procedures comparable to those required for life and annuity advertising materials. Several states in which QLA is licensed require prior approval of life insurance and annuity advertising materials before they may be used, and QLA's current process does not consistently ensure that such approvals are obtained. This represents a moderate risk of non-compliance, particularly in states with active advertising review programs.
3. Consumer Complaint Response. QLA's 2024 complaint ratio of 1.12 complaints per 1,000 policies is 36.6% above the NAIC median of 0.82 (calculated as 1.12 ÷ 0.82 = 1.366, or 136.6% of the median). This ratio is concerning in light of the nature of QLA's products. Life insurance and annuity complaints often involve emotionally charged circumstances — death benefit claims, retirement income disputes, and policyholder allegations of misrepresentation in the sale of annuity products. Regulators, particularly ADIFI (the Arizona Department of Insurance and Financial Institutions, QLA's domestic regulator), tend to scrutinize complaint patterns in these product lines with heightened attention.
QLA exhibits the same logging and response-time gaps identified across the enterprise. The shared complaint management infrastructure means that QLA's complaint-handling is subject to the same procedural deficiencies, and the remediation of these deficiencies at the enterprise level will necessarily benefit QLA.
4. Overall Assessment. QLA presents moderate-to-elevated compliance risk. The 36.6%-above-median complaint ratio is the primary driver of this risk assessment, particularly given the sensitivity of life insurance and annuity products and the potential for regulatory scrutiny from QLA's domestic regulator, ADIFI. While QLA's advertising risk is lower than that of the other subsidiaries due to the absence of Pinnacle Bridge distribution, the internal advertising review process still requires strengthening. Claims-handling timeliness remediation, while less urgent than at QIIC, should be included in the Phase 2 work plan.
VI. PINNACLE BRIDGE MGA, LLC — SPECIFIC FINDINGS
Pinnacle Bridge MGA, LLC warrants separate and detailed treatment in this memorandum due to its central role in the advertising compliance deficiencies identified during the Phase 1 assessment and its significance as a distribution channel for a substantial portion of Quorum's managed premium volume.
Operational Role. Pinnacle Bridge operates as Quorum's fintech distribution platform, functioning as a managing general agent that underwrites and binds insurance policies on behalf of QIIC and QSU. In this capacity, Pinnacle Bridge exercises delegated underwriting authority under MGA agreements with each of the two carriers. For the fiscal year ended December 31, 2024, Pinnacle Bridge managed a premium volume of approximately $890 million, representing a meaningful subset of the combined DWP of QIIC and QSU. Pinnacle Bridge is licensed in 34 states as a managing general agent and surplus lines broker and maintains its own in-house marketing team.
Central Finding. The most significant finding relating to Pinnacle Bridge is that 31 of the 43 non-compliant digital advertisements identified during the FL OIR examination — 72.1% of the total — were placed by Pinnacle Bridge's in-house marketing team without being routed through QIIC's advertising compliance review process. This finding is critical because it demonstrates that the majority of the advertising non-compliance at issue did not originate from the carrier's own marketing department but rather from a delegated distribution channel that was operating outside the carrier's compliance oversight framework.
Absence of Pre-Publication Review Protocol. Our review confirmed that no written protocol currently requires Pinnacle Bridge marketing personnel to submit advertising materials for compliance review prior to publication. Pinnacle Bridge's marketing team operates with substantial autonomy in the creation and placement of digital advertising, and there is no formalized checkpoint at which proposed advertisements are reviewed for compliance with state-specific content requirements, filing obligations, or truthfulness standards. This absence of a pre-publication review mechanism represents a fundamental control gap that enabled the sustained placement of non-compliant advertisements over a period of approximately 32 months (March 2022 through November 2024).
MGA Agreement Deficiency. Our review of the MGA agreements between Pinnacle Bridge and each of QIIC and QSU revealed that these agreements do not contain specific advertising compliance covenants or pre-publication review obligations. While the agreements include general representations regarding compliance with applicable law, they do not impose specific obligations on Pinnacle Bridge with respect to the submission of advertising materials for carrier-level compliance review prior to publication. This contractual gap is a contributing cause of the advertising compliance failure, as it left the carriers without a contractual mechanism to require Pinnacle Bridge's participation in the advertising review process.
Recommendations. In light of these findings, Phase 2 must include the following Pinnacle Bridge-specific remediation measures:
(a) Amendment of MGA Agreements. The MGA agreements between Pinnacle Bridge and each of QIIC and QSU must be amended to incorporate mandatory advertising compliance covenants, including a requirement that all advertising materials originated by Pinnacle Bridge be submitted for carrier-level compliance review and approval prior to publication, together with appropriate remedies for non-compliance with these covenants.
(b) Pinnacle Bridge Advertising SOP. A specific standard operating procedure governing the advertising review and approval process for Pinnacle Bridge-originated materials must be developed and implemented, aligned with the enterprise-wide advertising review framework to be established under Phase 2.
(c) Pinnacle Bridge Training Module. The Phase 3 training program must include a dedicated module for the approximately 85 marketing full-time equivalents (FTEs) at Pinnacle Bridge, addressing the specific compliance requirements applicable to MGA-originated advertising, the new pre-publication review process, and the consequences of non-compliance.
VII. CROSS-REFERENCE: INTERNAL AUDIT REPORT NO. IA-2025-017
Internal Audit Report No. IA-2025-017 was issued on August 4, 2025 by Neil Granger, Director of Internal Audit, following an independent assessment of QIH's market-conduct compliance program. The report identified 23 control deficiencies across all three carrier subsidiaries and rated the overall market-conduct compliance program as "Needs Significant Improvement" — the second-lowest rating on QIH's five-tier internal audit rating scale (which, in descending order, comprises: Effective, Needs Minor Improvement, Needs Improvement, Needs Significant Improvement, and Unsatisfactory).
The issuance of the "Needs Significant Improvement" rating is itself a significant finding. This rating indicates that Internal Audit has concluded that the market-conduct compliance program contains pervasive deficiencies that, if not remediated, present a substantial risk of regulatory action, financial loss, or reputational harm. The rating is one level above "Unsatisfactory," the lowest possible rating, which would indicate a program that is fundamentally non-functional.
Mapping of Internal Audit and FL OIR Findings. As part of our Phase 1 analysis, we conducted a detailed mapping exercise to compare the 23 control deficiencies identified by Internal Audit against the 14 formal findings contained in the FL OIR examination report. This mapping exercise, the results of which are set forth in Appendix C, yielded the following conclusions:
• Approximately 10 of the 23 Internal Audit deficiencies directly overlap with or amplify findings contained in the FL OIR examination report. These overlapping deficiencies relate to claims-handling timeliness, advertising review procedures, and complaint response timelines — the same three domains assessed in the examination. The fact that Internal Audit independently identified deficiencies consistent with the examination findings lends additional weight to the conclusion that these deficiencies are systemic and pervasive.
• The remaining 13 Internal Audit deficiencies represent incremental gaps not surfaced by the FL OIR examination. These incremental deficiencies fall into several categories, including:
(i) Governance structure deficiencies — including unclear reporting lines, insufficiently defined roles and responsibilities for market-conduct compliance, and inadequate Board-level reporting on compliance program performance;
(ii) Management reporting deficiencies — including the absence of regular management dashboards or key performance indicators for market-conduct compliance metrics;
(iii) Technology controls — including the claims management system limitations noted in Section IV.B, as well as deficiencies in complaint management system access controls and audit trail functionality;
(iv) Record retention — including inconsistent application of document retention policies across the three carrier subsidiaries, creating risk of inability to produce records in future examinations; and
(v) Training deficiencies — including the absence of a recurring, mandatory market-conduct compliance training program for claims adjusters, marketing personnel, and customer service representatives.
Alignment with C&H Assessment. Internal Audit's recommendations align substantively with the conclusions reached in our Phase 1 assessment. In particular, Internal Audit's recommendations regarding the need for a unified compliance manual applicable across all three carriers, a centralized advertising review process, and enhanced claims-management system controls are fully consistent with the remediation priorities identified by C&H.
Note on Data Availability. It bears noting that Internal Audit did not have access to the Ridgeline Consulting Group benchmarking data at the time its report was issued. The Ridgeline data, which provides the complaint-ratio benchmarking analysis discussed in Section VIII, was made available to C&H during the Phase 1 assessment period. Our analysis integrates both the Internal Audit findings and the Ridgeline data, providing a more complete picture of the compliance landscape than either data set alone would afford.
VIII. COMPLAINT RATIO BENCHMARKING ANALYSIS
A central component of the Phase 1 assessment was a detailed benchmarking analysis of complaint ratios across all three Quorum carrier subsidiaries, utilizing data compiled by Ridgeline Consulting Group, LLC, under the direction of Sandra Whitfield, Managing Director, as well as publicly available data published by the NAIC.
Methodology. Complaint ratios were calculated as the number of confirmed consumer complaints filed with state insurance regulators per 1,000 policies in force, the standard metric used by the NAIC and state regulators for comparative purposes. The NAIC publishes median complaint ratios by line of business, against which individual company performance can be benchmarked. A complaint ratio above the median indicates that a company is receiving a higher volume of complaints relative to its policy count than the typical insurer in its line of business, and complaint ratios significantly above the median are commonly used by regulators as a screening criterion for initiating market-conduct examinations.
Results. The complaint ratios for each Quorum carrier subsidiary, benchmarked against the NAIC median, are as follows:
All three Quorum carrier subsidiaries exceed the NAIC median complaint ratio. QIIC's ratio is the most significantly elevated at 79.3% above the median, placing it well within the range that regulators commonly consider indicative of market-conduct concerns warranting examination. QLA's ratio, at 36.6% above the median, is also notably elevated, particularly in light of the sensitive nature of life insurance and annuity products. QSU's ratio, at 13.4% above the median, is the least elevated but still exceeds the industry benchmark.
Aggregate Complaint Volume. In 2024, a total of 2,847 consumer complaints were filed against all Quorum subsidiaries with state insurance regulators. This aggregate figure reflects the combined complaint volumes across all three carriers and all licensed states.
Trend Analysis. Complaint volumes have increased on a year-over-year basis for each of the past three years, correlating with growth in DWP and, in particular, with the expansion of Pinnacle Bridge's distribution volume. The year-over-year increase is not fully explained by premium growth alone; rather, the complaint rate per unit of premium has also increased, suggesting that the growth in distribution volume has outpaced the Company's ability to maintain service quality and compliance standards.
Key Complaint Categories. The complaints filed against Quorum subsidiaries in 2024 were concentrated in the following categories, listed in approximate order of frequency:
• Claims processing delays;
• Claims denials (disputes over coverage determinations);
• Policy cancellation and non-renewal disputes;
• Advertising misrepresentation.
The predominance of claims-related complaints is consistent with the claims-handling timeliness deficiencies identified in the FL OIR examination and throughout this memorandum. The presence of advertising misrepresentation as a complaint category further corroborates the advertising compliance findings.
Regulatory Implications. QIIC's complaint ratio of 1.47 is likely to attract heightened regulatory attention in future examinations. Many state regulators use complaint ratios as a primary screening tool for identifying companies for targeted or comprehensive market-conduct examinations, and a ratio nearly 80% above the median significantly elevates the probability of examination initiation. Additionally, QLA's ratio of 1.12 is likely to prompt inquiry from its domestic regulator, ADIFI, which monitors complaint patterns for Arizona-domiciled life and annuity carriers as a matter of routine supervisory practice.
IX. REGULATORY LANDSCAPE AND PENDING ACTIONS
A. FL OIR — Corrective Action Plan Status
Following the issuance of the FL OIR final examination report on May 12, 2025, QIIC submitted a Corrective Action Plan ("CAP") to FL OIR on July 1, 2025. The CAP set forth QIIC's proposed remediation steps for addressing each of the 14 formal findings in the examination report, along with proposed implementation timelines and responsible parties.
On July 28, 2025, FL OIR issued a letter accepting the CAP with modifications. The modifications imposed by FL OIR included, among other things, the establishment of a firm remediation deadline of December 31, 2025, by which date QIIC must achieve full compliance with all remediation measures and submit a written compliance certification to FL OIR. The modifications also imposed additional reporting requirements, including quarterly progress reports due on the first business day of each calendar quarter.
The $180,000 administrative fine assessed by FL OIR in connection with the examination findings is due September 30, 2025. As of the date of this memorandum, we understand that payment arrangements are in process but have not been confirmed; confirmation of timely payment is an immediate action item identified in Section XIV.
FL OIR is anticipated to conduct a follow-up examination in Q4 2025 to verify QIIC's compliance with the CAP remediation milestones. The timing of this follow-up examination — which may occur before the December 31, 2025 remediation deadline — underscores the urgency of accelerating remediation activities. It is essential that QIIC be able to demonstrate substantial and measurable progress toward compliance at the time of any follow-up examination, even if full remediation has not yet been achieved.
Cartwright & Eddings, P.A.,