MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
TO: Board of Directors, Quorum Insurance Holdings Corp.
FROM: Calderwood & Harkness LLP (Elaine Forsythe, Responsible Partner; Natasha Forbes, Lead Associate)
DATE: December 1, 2025
RE: Comprehensive Governance Overhaul — Board Committee Charters, Delegation of Authority Matrix, Corporate Governance Guidelines, and Bylaw Amendments — Materials for Adoption at the December 11, 2025 Board Meeting
C&H Engagement No.: 1025-00005
This memorandum and all enclosed documents constitute a privileged and confidential attorney-client communication prepared by Calderwood & Harkness LLP at the direction of the General Counsel of Quorum Insurance Holdings Corp. This memorandum is intended solely for the use of the Board of Directors of Quorum Insurance Holdings Corp. and should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and the General Counsel. Distribution of this memorandum does not waive any applicable privilege, including the attorney-client privilege and the work-product doctrine.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
The purpose of this memorandum is to present to the Board of Directors of Quorum Insurance Holdings Corp. ("Quorum," "QIH," or the "Company") a comprehensive governance overhaul package for consideration and adoption at the Board's regularly scheduled meeting on December 11, 2025. The eleven-member Board is being asked to review, consider, and approve a suite of governance deliverables that, taken together, represent the most significant modernization of Quorum's governance framework since the Company's original committee charters and governance infrastructure were adopted in February 2016.
The governance overhaul package comprises seven interrelated categories of deliverables, each of which is discussed in detail in the sections that follow:
1. Restatement of Five Existing Board Committee Charters. The charters of the Audit Committee, the Compensation & Human Capital Committee, the Nominating & Corporate Governance Committee, the Risk Committee, and the Investment Committee have each been comprehensively reviewed, updated, and restated to reflect current regulatory requirements, evolving best practices, peer benchmarking insights, and the specific observations raised by the Company's independent auditor and institutional shareholders.
2. Adoption of a New Sixth Committee Charter — Technology & Cybersecurity Oversight Committee. In response to the growing significance of technology risk, cybersecurity, and digital transformation to the Company's operations and strategic direction, a new standing committee charter has been drafted for the Technology & Cybersecurity Oversight Committee, which will serve as the Board's sixth standing committee.
3. Revised Delegation of Authority Matrix — Parent/Holding-Company Level. The Delegation of Authority Matrix ("DOA Matrix") for Quorum Insurance Holdings Corp. at the parent and holding-company level has been comprehensively overhauled to update expenditure, commitment, and settlement authority thresholds that have not been systematically reviewed since 2017.
4. Model Subsidiary Delegation of Authority Matrix Template. A standardized model DOA matrix template has been developed for adoption by each of the Company's regulated insurance subsidiaries and operating subsidiaries, designed to ensure consistency and alignment between parent-level and subsidiary-level authority delegations.
5. Amended & Restated Corporate Governance Guidelines. The Company's Corporate Governance Guidelines have been amended and restated to incorporate board refreshment provisions, director overboarding limits, a majority voting standard for uncontested director elections, a formalized shareholder engagement protocol, and an annual board and committee self-evaluation process.
6. Conforming Amendments to the Bylaws. Conforming amendments to Articles III and IV of the Bylaws of Quorum Insurance Holdings Corp. have been prepared to reflect the addition of the sixth standing committee, to formalize committee appointment mechanics, and to cross-reference officer authority to the DOA Matrix.
7. Omnibus Board Resolution (and Alternative Written Consent). An Omnibus Board Resolution has been prepared for adoption at the December 11, 2025 meeting, authorizing the adoption of all foregoing items in a single comprehensive action. An alternative Written Consent form has also been prepared in the event that the in-person meeting cannot be held or a quorum is not achieved.
Recommendation. Calderwood & Harkness LLP recommends that the Board adopt the Omnibus Board Resolution in substantially the form enclosed as Document No. 19. We believe that the governance overhaul package, in its entirety, positions Quorum to meet current and emerging regulatory expectations, addresses the specific observations raised by the Company's independent auditor and institutional shareholders, aligns the Company's governance framework with prevailing best practices among publicly traded insurance holding companies, and provides a robust and scalable governance infrastructure for the Company's continued growth.
Anticipated Post-Adoption Actions. Upon adoption, the following post-adoption steps are anticipated:
• Public Filing: A voluntary disclosure via Form 8-K (Item 8.01 — Other Events) is targeted for filing with the Securities and Exchange Commission on December 15, 2025, together with the posting of all updated governance documents on the Company's investor relations website.
• State Insurance Regulatory Filings: Informational filings with the Connecticut Department of Insurance, the Texas Department of Insurance, and the Ohio Department of Insurance will be prepared and submitted for the Company's three domiciled insurance subsidiaries, in coordination with Broadleaf Insurance Regulatory Consultants, LLC.
• NYSE Compliance: The CEO certification of compliance with NYSE listing standards will be filed within 30 days of the adoption of the material governance changes, consistent with NYSE Listed Company Manual requirements.
II. BACKGROUND AND TRIGGERING EVENTS
A. Company Overview
Quorum Insurance Holdings Corp. ("Quorum" or "QIH") is a Delaware corporation publicly traded on the New York Stock Exchange under the ticker symbol QIHC. The Company's principal executive offices are located at 280 Asylum Street, Suite 2200, Hartford, Connecticut 06103. Quorum's Delaware registered agent is Capitol Registered Agents, Inc., located at 1209 Orange Street, Wilmington, Delaware 19801. The Company's Employer Identification Number is 27-4831956, and its Delaware File Number is 4927361.
Quorum is a diversified, multi-line insurance holding company with fintech subsidiaries. The Company was formed in 2009 through the combination of two regional property-casualty carriers, and has since grown both organically and through strategic acquisitions into a mid-large-cap public company with a national footprint. As of the end of fiscal year 2024, Quorum reported consolidated revenue of approximately $3.12 billion, total assets of approximately $18.7 billion, total invested assets of approximately $16.4 billion, and an approximate market capitalization of $4.8 billion (as of September 2025). The Company employs approximately 6,400 individuals across its parent and subsidiary operations.
The Board of Directors consists of 11 directors. Of these, 8 are independent directors and 3 are management or otherwise non-independent directors. The positions of Board Chair and Chief Executive Officer are currently combined and held by Margaret A. Calloway. The Lead Independent Director is Arthur J. Pennington, who also serves as Chair of the Nominating & Corporate Governance Committee.
B. Subsidiary Structure
Quorum's operating structure consists of several regulated insurance subsidiaries and non-regulated operating subsidiaries, each of which is relevant to the governance overhaul for purposes of authority delegation, regulatory filing requirements, and charter coordination. The principal subsidiaries are as follows:
• Quorum Property & Casualty Insurance Company — A Connecticut-domiciled property and casualty insurance carrier and Quorum's flagship operating subsidiary. NAIC Company Code: 38472. President: Dexter W. Ng. This subsidiary writes the majority of the Company's personal and commercial lines premium volume and is subject to the regulatory oversight of the Connecticut Department of Insurance.
• Lone Star Specialty Insurance Company — A Texas-domiciled specialty lines insurance carrier. NAIC Company Code: 41359. Lone Star writes specialty casualty, professional liability, and excess/surplus lines business and is regulated by the Texas Department of Insurance. As discussed in greater detail in Section II.D below, Lone Star's claims-settlement authority practices were specifically identified as an area of concern in the Garrett & Whitfield management letter.
• Great Lakes Surety & Indemnity Co. — An Ohio-domiciled surety and specialty insurance carrier. NAIC Company Code: 29814. Great Lakes writes contract surety, commercial surety, and specialty indemnity business and is regulated by the Ohio Department of Insurance.
• Quorum MGA Services, LLC — A Delaware limited liability company operating as a managing general agent. Quorum MGA provides program administration and underwriting services for certain specialty programs on behalf of Quorum Property & Casualty and third-party carriers.
• Vantage Digital Insurance Solutions, Inc. — A Delaware corporation and the Company's fintech and insurtech subsidiary. President: Camille R. DuPont. Vantage Digital develops and deploys digital distribution platforms, data analytics tools, and AI-driven underwriting models. Ms. DuPont also serves as a management director on the QIH Board.
C. Legacy Governance Documentation
The Company's existing committee charters — covering the Audit Committee, the Compensation & Human Capital Committee, the Nominating & Corporate Governance Committee, the Risk Committee, and the Investment Committee — were originally adopted by the Board on February 12, 2016. Those original charters were drafted by Quorum's then-outside corporate counsel, Prescott, Henley & Gage LLP, under the direction of Marissa L. Tavares, a partner in PHG's Corporate Governance Group.
Since the original adoption, the charters have been amended on only two occasions. First, on March 20, 2019, targeted amendments were adopted to the charters of the Audit Committee and the Nominating & Corporate Governance Committee in response to certain SEC disclosure requirements. Second, on June 14, 2021, further targeted amendments were adopted to the Audit Committee charter (relating to non-audit service pre-approval procedures) and the Compensation & Human Capital Committee charter (which was renamed from "Compensation Committee" to "Compensation & Human Capital Committee" at that time, though, as discussed further below, substantive human-capital-management oversight responsibilities were not added). The Risk Committee and Investment Committee charters have never been amended since their original adoption in 2016.
The Company's Delegation of Authority Matrix was last comprehensively updated on October 6, 2017. The sole subsequent amendment was a narrow, targeted change to claims-payment authority thresholds adopted on April 22, 2020, in response to the increased frequency and severity of certain casualty claims. No comprehensive review or update of the DOA Matrix has been conducted in the intervening eight years.
Prescott, Henley & Gage LLP was not engaged for the current governance overhaul project. However, in the interests of continuity and historical context, Ms. Tavares of PHG was consulted informally by Calderwood & Harkness during the initial phase of the engagement to provide background on the drafting rationale and policy decisions underlying the original 2016 charters and the 2017 DOA Matrix.
D. Triggering Events
The decision to undertake a comprehensive governance overhaul was precipitated by a confluence of four triggering events occurring between March and July 2025, each of which independently highlighted the need for modernization and which, taken together, presented a compelling case for a holistic review of Quorum's governance infrastructure.
1. Garrett & Whitfield LLP Management Letter (March 14, 2025)
Quorum's independent registered public accounting firm, Garrett & Whitfield LLP, issued its management letter for the fiscal year 2024 audit on March 14, 2025. The management letter was prepared under the direction of Roland S. Brewer, the firm's Lead Engagement Partner for the Quorum engagement. While the management letter did not identify any material weaknesses or significant deficiencies in internal control over financial reporting, it did include three governance-related observations that are directly relevant to the current overhaul:
(i) Inconsistent Dollar Thresholds Between the Parent DOA Matrix and Subsidiary-Level Authorities. Garrett & Whitfield observed that the dollar thresholds in the parent-level DOA Matrix were not consistently aligned with the authority thresholds in effect at the subsidiary operating level. Specifically, the management letter noted instances where subsidiary-level management had been exercising spending and commitment authorities that did not reconcile to the parent-level DOA Matrix, creating a risk of unauthorized or inadequately supervised expenditures.
(ii) Absence of a Formal Technology & Information Security Committee Charter. The management letter observed that while the Board had been engaged in board-level discussions regarding cybersecurity oversight since at least 2023, and while certain technology-related oversight responsibilities were informally assumed by the Risk Committee, there was no formal committee charter establishing the scope, authority, and reporting requirements for technology and cybersecurity oversight. Garrett & Whitfield noted that the absence of a formal charter created a risk that oversight responsibilities in this area could fall through gaps between existing committees.
(iii) Claims-Settlement Authority Exceedance at Lone Star Specialty Insurance Company. Most significantly, the management letter identified that Lone Star Specialty Insurance Company had been operating with a per-claim settlement authority of $3.0 million — three times the $1.0 million per-claim threshold authorized by the QIH Board in the existing DOA Matrix. Garrett & Whitfield observed that this exceedance had not been documented or ratified by the Board and recommended that the Company reconcile subsidiary claims-settlement authorities with the parent DOA Matrix.
The Garrett & Whitfield management letter was presented to the Audit Committee at its regularly scheduled meeting on March 26, 2025, and was subsequently discussed by the full Board.
2. Veltrano Institutional Partners Shareholder Letter (June 18, 2025)
On June 18, 2025, Veltrano Institutional Partners, LP — Quorum's largest institutional shareholder, holding approximately 8.3% of outstanding shares — sent a letter to Lead Independent Director Arthur J. Pennington. The letter was signed by Terrence "Terry" Blackwood, Veltrano's Head of Corporate Governance & Stewardship. The Veltrano letter expressed the view that Quorum's governance documentation had not kept pace with the Company's growth and the evolving expectations of institutional shareholders and proxy advisory firms. Specifically, the letter urged the Board to undertake an enhanced governance documentation and disclosure effort, including the modernization of committee charters, the updating of authority delegation frameworks, and the adoption of governance practices consistent with leading public-company standards.
In addition to the Veltrano letter, Westbrook Fiduciary Trust Company — the Company's second-largest institutional shareholder, holding approximately 5.7% of outstanding shares — expressed informal support for a charter overhaul through engagement with Quorum's investor relations team. The Westbrook communication, conveyed by Elisa N. Fujimoto, Director of ESG & Governance at Westbrook, did not take the form of a formal written letter but was communicated through a series of discussions with the Company's investor relations personnel and subsequently relayed to Mr. Pennington and the General Counsel.
Together, the Veltrano and Westbrook communications represented input from holders of approximately 14.0% of Quorum's outstanding shares, lending significant shareholder weight to the case for a comprehensive governance review.
3. Apex Proxy Advisors Governance Benchmarking Report (June 30, 2025)
On June 30, 2025, Apex Proxy Advisors, Inc. delivered a governance benchmarking report to Quorum. The report was prepared under the direction of Dana Durneval, Senior Vice President, Advisory Services at Apex. The benchmarking report compared Quorum's governance framework against a peer group of 14 publicly traded insurance holding companies of comparable size, business mix, and market capitalization.
The benchmarking report yielded several key findings of direct relevance to the governance overhaul:
• Technology/Cybersecurity Committee Prevalence. Eleven of the 14 peer companies (78.6%) had adopted either a standalone technology or cybersecurity committee of the board or had added explicit cybersecurity and technology oversight responsibilities to the charter of an existing committee (most commonly the audit committee or the risk committee). Quorum was among the three peer companies that had not taken either step.
• DOA Matrix Currency. Twelve of the 14 peer companies (85.7%) had updated their delegation of authority matrices within the prior 24 months. Quorum's DOA Matrix, last comprehensively updated in October 2017, was the oldest among the peer group.
• NYSE Compliance Gaps. The report observed that Quorum's charter language on committee composition requirements did not reflect the 2024 amendments to NYSE Listed Company Manual Section 303A, which had introduced updated provisions regarding committee independence standards and charter content requirements. Several of Quorum's peers had already updated their charters to reflect these amendments.
• CEO Capital Expenditure Authority. The peer median CEO sole capital expenditure authority was $4.5 million, compared to Quorum's then-current threshold of $2.0 million.
The Apex benchmarking report was shared with the Nominating & Corporate Governance Committee and subsequently discussed by the full Board.
4. Board Authorization (July 22, 2025)
In light of the foregoing triggering events — the Garrett & Whitfield management letter observations, the institutional shareholder feedback from Veltrano and Westbrook, and the Apex benchmarking findings — the QIH Board, at its regularly scheduled meeting on July 22, 2025, authorized the commencement of a comprehensive governance overhaul project. The Board directed management to issue a request for proposals to qualified outside law firms for the engagement.
On August 15, 2025, Quorum issued an RFP to three law firms. Following a competitive review process conducted by General Counsel Dennis R. Okonkwo, with input from the Nominating & Corporate Governance Committee, Calderwood & Harkness LLP was selected and engaged effective September 5, 2025, pursuant to an engagement letter bearing Engagement No. 1025-00005.
III. ENGAGEMENT OVERVIEW AND WORKSTREAM SUMMARY
A. Scope of Engagement
The scope of Calderwood & Harkness's engagement, as defined in the September 5, 2025 engagement letter, encompasses seven distinct but interrelated workstreams:
Workstream 1: Review and restate all five existing board committee charters (Audit Committee; Compensation & Human Capital Committee; Nominating & Corporate Governance Committee; Risk Committee; Investment Committee), incorporating current regulatory requirements, NYSE listing-rule mandates, best-practice enhancements, peer benchmarking insights, and the specific observations and recommendations from Garrett & Whitfield, Veltrano Institutional Partners, and Apex Proxy Advisors.
Workstream 2: Draft a new charter for the Technology & Cybersecurity Oversight Committee, to be established as the Board's sixth standing committee, with appropriate scope, authority, composition requirements, and coordination protocols with existing committees.
Workstream 3: Overhaul the Delegation of Authority Matrix for the parent company (Quorum Insurance Holdings Corp.) and create a model subsidiary DOA matrix template for adoption by regulated and operating subsidiaries, ensuring consistency and alignment across the corporate structure.
Workstream 4: Prepare a comprehensive board memorandum and supporting materials for submission to the Board in advance of the December 11, 2025 meeting, summarizing all governance changes, providing legal analysis, and presenting materials in a format suitable for board review and action.
Workstream 5: Draft conforming amendments to Quorum's Corporate Governance Guidelines and Bylaws to reflect the governance changes adopted through the committee charters and DOA Matrix.
Workstream 6: Provide a Delaware law analysis of board delegation authority under Sections 141(a) and 141(c) of the Delaware General Corporation Law, addressing the permissibility and limitations of the proposed delegations.
Workstream 7: Advise on NYSE listing-rule compliance for committee composition and charter content, including analysis of the 2024 amendments to Section 303A of the NYSE Listed Company Manual.
B. Engagement Team
The Calderwood & Harkness engagement team for this matter consists of the following attorneys:
• Elaine Forsythe, Responsible Partner — Ms. Forsythe is a partner in Calderwood & Harkness's Corporate Governance & Board Advisory Practice and serves as the responsible partner for this engagement. Ms. Forsythe has more than 25 years of experience advising public-company boards on governance matters, committee charters, delegation frameworks, and regulatory compliance.
• Howard Bellamy, Billing Partner — Mr. Bellamy is a partner in Calderwood & Harkness's Corporate Practice and serves as the billing partner for this engagement.
• Natasha Forbes, Lead Associate — Ms. Forbes is a senior associate in Calderwood & Harkness's Corporate Governance & Board Advisory Practice and serves as the lead associate on this engagement. Ms. Forbes has led the day-to-day drafting, research, and coordination activities across all seven workstreams.
• Eric Johannsen, Working Associate — Mr. Johannsen is an associate in Calderwood & Harkness's Corporate Practice and has provided research and drafting support on the Delaware law analysis and the NYSE compliance review.
C. Key Quorum Contacts
Calderwood & Harkness has coordinated with the following Quorum personnel throughout the engagement:
• Dennis R. Okonkwo, General Counsel & Corporate Secretary — Mr. Okonkwo has served as the primary point of contact for the engagement, providing direction on Company priorities, coordinating internal review and feedback, and facilitating access to existing governance documents and historical materials.
• Patricia Sung-Hee Lam, Chief Financial Officer — Ms. Lam has provided input on DOA Matrix thresholds related to capital expenditures, investment transactions, and financial authorities.
• Ivan D. Pruett, Chief Compliance Officer — Mr. Pruett has coordinated with Calderwood & Harkness and Broadleaf Insurance Regulatory Consultants on state insurance regulatory filing requirements and compliance implications.
• Renata M. Vásquez, Chief Audit Executive — Ms. Vásquez has provided input on the coordination protocols between the Audit Committee and other committees, and has facilitated the review of the Garrett & Whitfield management letter observations.
D. Timeline of Engagement Activities
The following timeline summarizes the key milestones and activities of the engagement from commencement through the anticipated closing date:
E. Coordination with Other Advisors
Calderwood & Harkness has coordinated with the following external advisors in connection with the governance overhaul:
• Broadleaf Insurance Regulatory Consultants, LLC — Harold J. Emmerich, Managing Director. Broadleaf is advising Quorum's compliance team, under the direction of Chief Compliance Officer Ivan D. Pruett, on the state insurance regulatory implications of the revised authority delegations for the domiciliary regulators of the Company's three regulated insurance subsidiaries (the Connecticut Department of Insurance, the Texas Department of Insurance, and the Ohio Department of Insurance). Broadleaf's analysis of applicable holding company act filing requirements is summarized in the enclosed Insurance Regulatory Implications Memorandum (Document No. 25) and in Section IX of this memorandum.
• Apex Proxy Advisors, Inc. — The governance benchmarking report delivered by Apex on June 30, 2025 formed the analytical foundation for the peer comparison analysis that informed many of the specific changes to committee charters, DOA Matrix thresholds, and governance guidelines. Calderwood & Harkness reviewed the Apex report in detail and has referenced its findings throughout the enclosed materials where relevant.
• Prescott, Henley & Gage LLP — As noted above, Marissa L. Tavares of PHG, who served as the lead drafter of Quorum's original 2016 charters and governance infrastructure, was consulted informally on historical context and drafting rationale during the initial phase of the engagement. PHG was not formally engaged for the current overhaul and has not reviewed or approved the enclosed deliverables.
IV. RESTATED COMMITTEE CHARTERS — SUMMARY OF KEY CHANGES
This section summarizes the key substantive changes to each of the five restated committee charters and the key provisions of the new Technology & Cybersecurity Oversight Committee charter. Full execution versions and redline comparisons of each charter are enclosed as Documents No. 1 through 11 in the enclosed package. The Board is encouraged to review the redline versions in conjunction with this summary to appreciate the full scope of the changes.
In addition to the committee-specific changes discussed below, the following cross-cutting changes have been made to all five restated charters:
• Updated boilerplate provisions regarding committee authority, access to records, and engagement of advisors
• Standardized language for committee composition, quorum, and meeting procedures
• Addition of an annual self-evaluation provision to each charter (discussed further in the committee-specific summaries below)
• Conforming references to the newly established Technology & Cybersecurity Oversight Committee, where coordination is appropriate
• Updated NYSE and SEC regulatory references to reflect current rule numbering and the 2024 amendments to the NYSE Listed Company Manual
A. Audit Committee Charter
Current Chair: Dr. Lilian Fong-Archer (independent; designated as the Audit Committee financial expert within the meaning of Item 407(d)(5) of Regulation S-K and the NYSE listing standards)
History: Originally adopted February 12, 2016; amended March 20, 2019 (SEC disclosure requirements) and June 14, 2021 (non-audit service pre-approval procedures). The restated charter represents the first comprehensive restatement since adoption.
Key Changes:
Addition of Explicit Enterprise Risk Management Oversight Responsibility. The 2016 charter, as amended in 2019 and 2021, did not include any reference to enterprise risk management ("ERM") framework oversight. While the Risk Committee has historically carried the primary ERM oversight responsibility, the Audit Committee's role in overseeing the integrity of financial reporting and internal controls necessarily intersects with the Company's broader ERM framework. The restated charter assigns the Audit Committee the responsibility to discuss, at least annually, the Company's ERM policies and practices with management and the Chief Audit Executive, Renata M. Vásquez, with particular attention to financial-reporting-related risks, internal controls, and fraud risks. This addition aligns with the practice of 10 of the 14 peer companies identified in the Apex benchmarking report that assign some degree of ERM oversight to the audit committee, either exclusively or in coordination with a risk committee.
Clawback-Policy Administration. The restated charter adds language required by SEC Rule 10D-1 (adopted in October 2022, effective January 2023) and NYSE Rule 303A.14 for the Audit Committee to oversee the administration of the Company's compensation recovery (clawback) policy, including the determination of whether recovery of erroneously awarded compensation is required in connection with any financial restatement. This provision was entirely absent from the prior charter. While the Company adopted a clawback policy in compliance with Rule 10D-1 in December 2023, oversight responsibility for the policy was never formally assigned to any committee in the charter documents. The restated charter corrects this omission and assigns primary oversight to the Audit Committee, with reporting to the Compensation & Human Capital Committee on individual recovery determinations.
Annual Self-Evaluation Provision. The restated charter adds a formalized requirement for the Audit Committee to conduct an annual self-assessment of its performance, the adequacy of the charter, and the effectiveness of the committee's oversight activities. The prior charter contained no self-evaluation mechanism whatsoever. The self-evaluation process will be coordinated with the overarching board and committee self-evaluation process established in the Amended & Restated Corporate Governance Guidelines (discussed in Section VI below) and overseen by the Nominating & Corporate Governance Committee.
Coordination Protocol with the Risk Committee. The restated charter establishes a formal coordination mechanism between the Audit Committee and the Risk Committee, designed to avoid gaps and overlaps in the two committees' respective oversight responsibilities. The coordination protocol requires that the chairs of the Audit Committee and the Risk Committee convene joint sessions at least semi-annually, with the participation of the Chief Audit Executive and the Chief Risk Officer, to review areas of shared oversight responsibility and to coordinate reporting to the full Board. This provision reflects the recognition that, for a multi-line insurance holding company, the boundaries between financial-reporting risk (traditionally within the Audit Committee's purview) and operational and insurance-specific risk (traditionally within the Risk Committee's purview) are not always clearly delineated. The coordination protocol is intended to ensure comprehensive coverage without duplication of effort.
Updated Independence and Financial-Expert Qualifications. The charter language regarding committee member independence requirements and the designation of the audit committee financial expert has been updated to reflect the 2024 amendments to NYSE Listed Company Manual Section 303A. The prior charter language referenced the pre-2024 version of the listing standards. The updated language confirms that all Audit Committee members must satisfy the heightened independence requirements of Section 303A.07 and that at least one member must be an "audit committee financial expert" as defined in Item 407(d)(5)(ii) of Regulation S-K.
Reference to Coordination with the Technology & Cybersecurity Oversight Committee. A new provision has been added establishing a coordination protocol between the Audit Committee and the newly established Technology & Cybersecurity Oversight Committee on matters relating to cybersecurity-related financial reporting risks, including the financial impact of cybersecurity incidents, the adequacy of cybersecurity-related internal controls, and compliance with the SEC's cybersecurity disclosure requirements under Item 1.05 of Form 8-K and Item 106 of Regulation S-K.
B. Compensation & Human Capital Committee Charter
Current Chair: Claudia M. Severin (independent; CEO of Broadpath Talent Advisors, LLC)
History: Originally adopted February 12, 2016 as the "Compensation Committee Charter"; amended June 14, 2021 to rename the committee as the "Compensation & Human Capital Committee" and to make minor conforming changes. The restated charter represents the first comprehensive restatement.
Key Changes:
Independent Consultant Retention Authority. The prior charter contained a provision requiring the committee to obtain further Board approval before retaining independent compensation consultants, legal counsel, or other advisors. This requirement was inconsistent with NYSE listing standards, which mandate that the compensation committee have sole authority to retain and terminate advisors, and which require the committee to be directly responsible for the appointment, compensation, and oversight of such advisors. The restated charter corrects this inconsistency by granting the Compensation & Human Capital Committee sole authority to retain and terminate independent compensation consultants, legal counsel, and other advisors without additional Board approval, and to approve the compensation and other terms of engagement for such advisors. The restated charter also incorporates the independence assessment factors set forth in NYSE Rule 303A.05(c)(iv) that the committee must consider before engaging any advisor.
Substantive Human-Capital-Management Oversight. When the committee was renamed in June 2021 to add "Human Capital" to its title, no substantive oversight responsibilities related to human capital management were added to the charter. The 2021 amendment was, in effect, a naming change without corresponding substance. The restated charter now includes explicit responsibilities for the committee's oversight of:
• Workforce strategy and planning, including the alignment of workforce composition with the Company's strategic objectives
• Diversity, equity, and inclusion ("DEI") programs, metrics, and reporting
• Talent development and retention programs, including leadership development and high-potential identification
• Succession planning for the CEO and other senior executive officers
• Employee engagement, culture, and workplace environment
• Workforce-related risks, including labor market competition, attrition trends, and regulatory developments affecting employment practices
These additions reflect the growing expectation among institutional investors, proxy advisory firms, and regulators that compensation committees with human-capital mandates exercise meaningful oversight over workforce-related matters, rather than treating the human-capital component as merely nominal.
Annual Self-Evaluation Provision. Added, consistent with the cross-cutting self-evaluation requirement described above.
Pay Equity and Pay-Versus-Performance. The restated charter adds new provisions addressing the committee's oversight responsibilities regarding (a) the Company's pay equity analysis, including the review of annual pay equity studies and the consideration of any remedial actions recommended by management, and (b) the SEC's pay-versus-performance disclosure requirements under Item 402(v) of Regulation S-K, including the committee's role in reviewing and approving the Company's pay-versus-performance tabular disclosure and related narrative.
C. Nominating & Corporate Governance Committee Charter
Current Chair: Arthur J. Pennington (Lead Independent Director)
History: Originally adopted February 12, 2016; amended March 20, 2019 (SEC disclosure requirements). The restated charter represents the first comprehensive restatement.
Key Changes:
ESG/Sustainability Oversight. The prior charter did not address environmental, social, and governance ("ESG") matters or sustainability in any respect. The restated charter assigns the Nominating & Corporate Governance Committee responsibility for oversight of the Company's ESG strategy, sustainability reporting, and related public disclosures, including the Company's annual sustainability report, climate-related disclosures, and any voluntary or mandatory ESG frameworks adopted by the Company (such as the Sustainability Accounting Standards Board / ISSB standards for the insurance industry). This assignment reflects the prevailing practice among the peer group, where ESG oversight is most commonly assigned to the nominating/governance committee (9 of 14 peers) or to a standalone sustainability committee (2 of 14 peers).
Director Skills-Matrix Requirement. The restated charter adds a new provision requiring the committee to develop, maintain, and annually update a board skills and experience matrix. The matrix is intended to identify the specific skills, experiences, backgrounds, and qualifications represented on the Board and to guide the committee's director nomination and succession planning activities. The skills matrix will be used to identify gaps in the Board's collective expertise and to inform the committee's search criteria for new director candidates. The committee is further required to present the updated skills matrix to the full Board at least annually and to consider the matrix in connection with committee assignment recommendations.
Shareholder-Engagement Protocol. Responsive to the June 18, 2025 shareholder letter from Veltrano Institutional Partners and the informal feedback from Westbrook Fiduciary Trust Company, the restated charter establishes a formalized shareholder-engagement protocol. Under this protocol, the Lead Independent Director (currently Arthur J. Pennington) and the Chair of the Nominating & Corporate Governance Committee (currently the same individual) will be available for direct engagement with holders of 3% or more of outstanding shares upon reasonable request. The protocol establishes procedures for scheduling engagement meetings, preparing for such meetings (including the involvement of the General Counsel and investor relations), and reporting the substance of engagement discussions to the full Board. This provision is further reflected in the Amended & Restated Corporate Governance Guidelines, as discussed in Section VI below.
Board-Refreshment Provisions. The restated charter incorporates the new mandatory retirement age of 75 and the 15-year tenure limit for independent directors, both of which are also reflected in the Amended & Restated Corporate Governance Guidelines. These provisions are designed to promote board refreshment and the infusion of new perspectives while preserving institutional knowledge. The committee is assigned responsibility for administering these provisions, including the evaluation of any requests for waiver or extension in exceptional circumstances, and for developing a director succession pipeline that anticipates upcoming retirements and term expirations.
Annual Self-Evaluation Provision. Added, consistent with the cross-cutting self-evaluation requirement described above. As the committee with overarching governance oversight responsibility, the Nominating & Corporate Governance Committee is additionally assigned responsibility for overseeing the annual self-evaluation process for the full Board and all standing committees.
D. Risk Committee Charter
Current Chair: Raymond T. Huerta (independent; retired state insurance commissioner)
History: Originally adopted February 12, 2016; never subsequently amended. The restated charter represents the first substantive update since the charter's original adoption nearly ten years ago.
Key Changes:
Insurance-Specific Risk Categories. The original 2016 charter contained generic risk oversight language that could have applied to any public company in any industry. It did not reference insurance-specific risk categories or the unique risk profile of a multi-line insurance holding company. The restated charter adds explicit oversight responsibility for the following insurance-specific risk categories:
• Reserving risk: Oversight of the adequacy and integrity of the Company's loss and loss adjustment expense reserves, including review of actuarial analyses and reserve development trends
• Reinsurance risk: Oversight of the Company's reinsurance program, including ceded reinsurance arrangements, reinsurer credit quality, and reinsurance recoverability
• Catastrophe exposure: Oversight of the Company's catastrophe risk management, including probable maximum loss analyses, catastrophe modeling, and aggregate catastrophe exposure limits
• Underwriting risk: Oversight of underwriting guidelines, risk appetite, and the alignment of underwriting practices with the Company's risk tolerance framework
• Regulatory and compliance risk: Oversight of risks arising from the regulatory environment applicable to the Company's insurance operations, including state insurance regulatory requirements, market conduct, and rate and form compliance
These additions reflect the view, shared by Calderwood & Harkness and confirmed in the Apex benchmarking report, that a Risk Committee charter for a publicly traded insurance holding company should specifically address the risk categories that are unique to the insurance business and that represent the Company's most significant risk exposures.
Coordination Protocol with the Audit Committee. As discussed in Section IV.A above, the restated charter establishes a formal coordination mechanism between the Risk Committee and the Audit Committee, including joint sessions at least semi-annually, to ensure comprehensive coverage of the Company's risk landscape without gaps or overlaps.
Coordination Protocol with the Technology & Cybersecurity Oversight Committee. A new protocol has been added for information sharing and coordinated oversight between the Risk Committee and the newly established Technology & Cybersecurity Oversight Committee on technology-related operational risks. This protocol includes specific provisions for cybersecurity incident escalation, under which the Technology & Cybersecurity Oversight Committee is required to promptly inform the Risk Committee of any cybersecurity incident or threat that meets specified severity thresholds, and the two committees are required to coordinate their oversight of the Company's incident response activities.
Emerging Risk Identification. The restated charter adds a new provision for the systematic identification and evaluation of emerging risks — that is, risks that are not yet fully manifested but that could have a material impact on the Company's operations, financial condition, or strategic direction if they materialize. The provision specifically references climate-related risks (including physical and transition risks) and geopolitical risks as categories of emerging risk that warrant ongoing monitoring. The committee is tasked with receiving at least annual reports from management on the Company's emerging risk assessment and with reporting its findings and recommendations to the full Board.
Annual Self-Evaluation Provision. Added, consistent with the cross-cutting self-evaluation requirement described above.
E. Investment Committee Charter
Current Chair: Jonathan K. Whitmore (independent; former Chief Investment Officer of Highgate Asset Management)
History: Originally adopted February 12, 2016; never subsequently amended. The restated charter represents the first substantive update since the charter's original adoption.
Key Changes:
Updated Delegation Thresholds. The investment-related delegation thresholds in the charter have been updated to reflect the significant growth in the Company's invested asset portfolio since 2016. Total invested assets have grown from $11.2 billion at the time of the charter's original adoption to $16.4 billion as of the end of fiscal year 2024, representing a 46.4% increase (calculated as ($16.4 billion − $11.2 billion) ÷ $11.2 billion = 46.4%). Specifically:
• The single-issuer exposure threshold — the maximum investment in any single issuer that may be made without full Board approval — has been increased from $50 million to $75 million.
• The aggregate portfolio rebalancing authority — the maximum aggregate value of portfolio rebalancing transactions that the Investment Committee may authorize between regular Board meetings — has been increased proportionally from $250 million.
These threshold adjustments are designed to right-size the delegation framework to the current scale of the portfolio while maintaining appropriate Board oversight of the most significant investment decisions.
ESG Integration in Investment Strategy. The restated charter adds a new provision for the integration of environmental, social, and governance factors into the Company's investment decision-making and portfolio management processes. This provision does not mandate specific ESG-related investment outcomes but rather establishes the committee's responsibility to oversee management's consideration of ESG factors as part of the investment analysis and risk assessment process, consistent with the Company's fiduciary obligations and investment policy statement.
Reporting Coordination with the Risk Committee. The restated charter adds a new provision for coordinated reporting between the Investment Committee and the Risk Committee on investment-related risks, including credit risk, market risk, interest rate risk, and liquidity risk. This provision recognizes that the Company's investment portfolio — at $16.4 billion — represents the single largest component of the consolidated balance sheet and that investment-related risks are a critical element of the Company's overall risk profile.
Annual Self-Evaluation Provision. Added, consistent with the cross-cutting self-evaluation requirement described above.
Periodic Threshold Review. A new provision has been added requiring the Investment Committee to review, and if appropriate recommend adjustment of, delegation thresholds at least every three years or upon any material change in portfolio size (defined as a change of 15% or more in total invested assets). This provision is designed to prevent the kind of threshold stagnation that characterized the prior charter, under which thresholds remained unchanged for nearly a decade despite substantial portfolio growth.
F. Technology & Cybersecurity Oversight Committee Charter (New — Sixth Standing Committee)
Proposed Chair: Priya Narasimhan (independent; CEO of Tessera Fintech Corp.)
Proposed Initial Members: Priya Narasimhan (Chair), Victor L. Andrade (independent), Camille R. DuPont (management director; non-voting advisory member)
The Technology & Cybersecurity Oversight Committee charter is a new document, prepared from the ground up by Calderwood & Harkness in consultation with the Nominating & Corporate Governance Committee, the Risk Committee, management (including General Counsel Okonkwo and CCO Pruett), and Ms. Narasimhan as proposed committee chair. The charter establishes the scope, authority, composition, meeting cadence, and reporting requirements for the Board's sixth standing committee.
Key Provisions:
Composition. The charter requires a minimum of three independent directors. At least one member of the committee must possess cybersecurity or technology expertise, defined in the charter as professional experience in information technology management, cybersecurity risk management, software engineering, data science, or digital technology strategy at a senior leadership level, or relevant professional certifications (such as CISSP, CISM, or CRISC). The proposed chair, Priya Narasimhan, satisfies this expertise requirement through her role as CEO of Tessera Fintech Corp. and her prior experience in technology executive roles.
Camille R. DuPont's Role. As President of Vantage Digital Insurance Solutions, Inc. — the Company's fintech subsidiary — and a management director on the QIH Board, Ms. DuPont possesses operational knowledge and technology expertise that would be highly valuable to the committee. However, as a management director, Ms. DuPont is not independent within the meaning of the NYSE listing standards. To balance the value of Ms. DuPont's operational insight with the importance of preserving committee independence, Ms. DuPont will serve as a non-voting advisory member of the committee. In this capacity, Ms. DuPont will be invited to attend all committee meetings, will participate in discussions, and will provide operational perspective and expertise, but will not count toward the committee's quorum and will not have a vote on any committee action.
Oversight Areas. The committee's oversight responsibilities encompass the following areas:
• Cybersecurity program, including the Company's cybersecurity strategy, policies, and procedures, and alignment with recognized frameworks (particularly the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF)
• Information technology strategy and digital transformation, including the Company's technology roadmap, infrastructure modernization initiatives, and cloud migration strategy
• Data privacy and data governance, including compliance with applicable data protection laws and regulations and the Company's data governance framework
• Insurtech initiatives and innovation pipeline, including oversight of Vantage Digital's product development activities and the Company's broader digital innovation strategy
• Artificial intelligence governance and responsible AI use, including the Company's policies and practices for the development, deployment, and monitoring of AI and machine learning models, with particular attention to underwriting and claims applications
• Third-party technology risk and vendor management, including oversight of the Company's technology vendor risk assessment and management processes
• Incident response planning and execution, including review and approval of the Company's cybersecurity incident response plan and oversight of incident response activities for significant cybersecurity events
Meeting Cadence and Reporting. The committee is required to meet at least quarterly, and more frequently as circumstances require. The committee will provide quarterly reports to the full Board summarizing its oversight activities, significant findings, and any recommendations. The committee will maintain regular coordination with both the Risk Committee and the Audit Committee through the coordination protocols established in those committees' restated charters.
Rationale for Standalone Committee. The decision to establish a standalone Technology & Cybersecurity Oversight Committee, rather than to add technology and cybersecurity oversight responsibilities to an existing committee charter, was informed by several considerations. First, as noted above, 11 of the 14 peer companies in the Apex benchmarking study had already adopted a standalone technology/cyber committee or added explicit cyber oversight to an existing committee charter. Second, Garrett & Whitfield specifically noted the absence of a formal technology committee charter as an observation in its March 14, 2025 management letter. Third, the breadth and complexity of the oversight areas encompassed by the proposed charter — spanning cybersecurity, IT strategy, data governance, AI governance, and insurtech — would place a significant additional burden on any existing committee, particularly the Risk Committee and the Audit Committee, which already carry substantial oversight responsibilities. Fourth, the establishment of a dedicated committee signals to regulators, shareholders, and other stakeholders the Board's commitment to robust technology and cybersecurity governance, which is increasingly important in the insurance and fintech sectors in which the Company operates.
V. REVISED DELEGATION OF AUTHORITY MATRIX
A. Overview of Revisions
The existing Delegation of Authority Matrix for Quorum Insurance Holdings Corp. at the parent and holding-company level was last comprehensively updated on October 6, 2017. In the eight years since that comprehensive update, the sole amendment was a narrow, targeted change to claims-payment authority thresholds adopted on April 22, 2020. No systematic review of the full range of delegation thresholds has been conducted during that period, notwithstanding significant changes in the Company's scale, business mix, competitive environment, cost structure, and the regulatory landscape.
Calderwood & Harkness's gap analysis, delivered on October 3, 2025, identified multiple categories in which the existing thresholds had not kept pace with business growth, inflation, and evolving peer practices. The analysis was informed by the Apex benchmarking data, internal interviews with Quorum management (including the CFO, General Counsel, CCO, and Chief Audit Executive), and a review of publicly available governance disclosures of the 14 peer companies in the benchmarking group.
The gap analysis confirmed the Apex finding that 12 of the 14 peer companies had updated their DOA matrices within the prior 24 months. Quorum's DOA Matrix was the oldest among the peer group by a significant margin.
The gap analysis also confirmed and elaborated on the observation from the Garrett & Whitfield management letter regarding Lone Star Specialty Insurance Company's claims-settlement authority practices. Specifically, the gap analysis found that Lone Star had been operating with a per-claim settlement authority of $3.0 million — three times the $1.0 million authorized threshold set forth in the existing DOA Matrix — without documented Board ratification. This discrepancy appears to have developed gradually as Lone Star's specialty casualty and professional liability claims portfolio grew in size and complexity, and as individual claim values increased. The revised DOA Matrix and the model subsidiary DOA template have both been designed to address this gap by (a) increasing the per-claim subsidiary CEO authority to $2.5 million to accommodate the current business volume, (b) establishing clear escalation protocols for claims above the subsidiary threshold, and (c) requiring annual recertification of subsidiary-level authority thresholds.
B. Summary of Threshold Changes — Parent Level
The following table summarizes the proposed threshold changes for each major authority category at the parent/holding-company level. The full execution version of the revised DOA Matrix is enclosed as Document No. 12, and a detailed comparison of current versus proposed thresholds is enclosed as Document No. 14.
It should be noted that the threshold increases set forth above do not represent a reduction in Board oversight, but rather a recalibration of the points at which Board or committee-level approval is required to reflect the Company's current scale, cost structure, and competitive environment. The Board retains ultimate authority over all matters and may at any time reduce or modify any delegation threshold.
C. Technology/IT Spending — New Standalone Category
Under the 2017 DOA Matrix, technology and IT spending was bundled within the general capital expenditures category. This bundling was a reasonable approach in 2017, when the Company's technology spending was relatively modest and was primarily focused on infrastructure maintenance and incremental systems upgrades.
Since 2017, however, the Company's technology spending profile has changed dramatically. The acquisition and development of Vantage Digital Insurance Solutions, Inc., the Company's growing investment in digital distribution platforms, data analytics, AI-driven underwriting tools, and cloud infrastructure, and the increasing importance of cybersecurity investments have all contributed to a significant increase in both the volume and strategic significance of technology spending. Bundling technology spending within the general capital expenditure category no longer provides the Board with the visibility or control mechanisms appropriate for this increasingly important category of investment.
The revised DOA Matrix therefore creates a distinct Technology/IT spending category with the following authority tiers:
• CEO sole authority: ≤ $3.0M per project
• CEO + CFO joint authority: > $3.0M – $8.0M per project
• Board/Technology & Cybersecurity Oversight Committee approval: > $8.0M per project
The assignment of Board-level approval authority for technology spending above $8.0M per project to the Technology & Cybersecurity Oversight Committee (rather than to the full Board for all amounts above the CEO + CFO threshold) is designed to leverage the technology expertise of the committee's members while ensuring that the most significant technology investments receive dedicated board-level scrutiny.
D. Model Subsidiary DOA Matrix Template
The enclosed model subsidiary DOA matrix template (Document No. 13) has been designed for adoption, with appropriate customization, by each of the Company's regulated insurance subsidiaries (Quorum Property & Casualty Insurance Company, Lone Star Specialty Insurance Company, and Great Lakes Surety & Indemnity Co.) and operating subsidiaries (Quorum MGA Services, LLC and Vantage Digital Insurance Solutions, Inc.).
The template is structured to address the inconsistency between parent and subsidiary-level authorities identified in both the Garrett & Whitfield management letter and the Calderwood & Harkness gap analysis. Key features of the template include:
• Placeholder thresholds calibrated to subsidiary scale. The template includes suggested threshold ranges for each authority category, calibrated to the size and business volume of each subsidiary. These placeholder thresholds are intended as starting points; each subsidiary is expected to customize the thresholds based on its specific circumstances, subject to the requirement that no subsidiary-level threshold may exceed the corresponding parent-level threshold without express Board or committee approval.