1025-00003 · Delaware corp · Analysis & Memoranda

nyse-listing-rule-compliance-analysis.docx DOCUMENT Capital Markets

6 / 35 ← → ✕

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION

CALDERWOOD & HARKNESS LLP 1585 Broadway, 34th Floor New York, New York 10036

MEMORANDUM

This memorandum is prepared as part of the deliverables supporting our engagement and is delivered alongside or shortly after the Initial Gap Analysis Memorandum dated October 3, 2025, and in advance of the first charter drafts to be delivered on October 24, 2025. This memorandum is protected by the attorney-client privilege and the work-product doctrine and should not be disclosed to third parties without the prior written consent of Calderwood & Harkness LLP.

Right-click to update Table of Contents

I. Executive Summary

This memorandum provides a comprehensive analysis of Quorum Insurance Holdings Corp.'s ("Quorum," "QIH," or the "Company") current board committee structure and charter provisions as measured against the requirements of the New York Stock Exchange ("NYSE") Listed Company Manual Sections 303A.01 through 303A.14, including amendments to Section 303A adopted by the NYSE in 2024 (the "2024 Amendments"). The analysis is intended to serve as the analytical foundation for the comprehensive governance overhaul that Calderwood & Harkness LLP ("C&H" or the "Firm") has been engaged to develop and implement.

Quorum currently maintains five standing board committees, each operating under a written charter originally adopted on February 12, 2016. The charters were subject to targeted amendments on March 20, 2019 and June 14, 2021, but none of the five existing charters have been updated to reflect the 2024 Amendments to Section 303A or to incorporate the clawback-policy administration requirements necessitated by SEC Rule 10D-1 and NYSE Rule 303A.14.

Several events have prompted this engagement and the current analysis:

(a) The management letter issued by Garrett & Whitfield LLP (the Company's independent registered public accounting firm), dated March 14, 2025, in connection with the fiscal year 2024 audit, which identified the absence of a formal Technology & Information Security Committee charter despite board-level cybersecurity oversight discussions ongoing since 2023;

(b) The governance benchmarking report delivered by Apex Proxy Advisors, Inc. on June 30, 2025, which compared Quorum's governance framework against those of fourteen peer publicly traded insurance holding companies and identified multiple areas in which Quorum's charter language and governance structures lag behind peer practices;

(c) The shareholder letter from Veltrano Institutional Partners, LP, dated June 18, 2025, urging enhanced governance documentation and disclosure; and

(d) The Board's own recognition, reflected in the minutes of its July 17, 2025 meeting, that a comprehensive governance review was overdue.

This memorandum addresses the following subject areas: (a) director independence requirements under NYSE rules; (b) committee composition mandates for the three NYSE-required committees (Audit, Compensation, and Nominating/Corporate Governance); (c) charter content requirements applicable to each mandated committee; (d) annual self-evaluation provisions required under the NYSE rules; (e) clawback policy requirements under NYSE Rule 303A.14 and SEC Rule 10D-1; (f) the proposed new Technology & Cybersecurity Oversight Committee's alignment with listing standards and governance best practices; and (g) recommendations for remediation through restated charters, amended governance guidelines, and conforming bylaw amendments.

Overall Finding. While Quorum currently satisfies the fundamental structural requirements for committee independence and the requisite number of mandatory committees, several areas of non-compliance or lagging best-practice alignment exist in charter content, self-evaluation provisions, clawback policy administration, and composition-related disclosure language. These deficiencies, while not presenting an imminent risk of NYSE delisting or enforcement action, expose the Company to adverse proxy advisory recommendations, heightened shareholder scrutiny, and potential regulatory criticism. We recommend comprehensive remediation through the proposed restated charters, amended governance guidelines, and conforming bylaw amendments, all to be adopted at the December 11, 2025 board meeting via the proposed omnibus board resolution.

II. Background

A. Quorum's Corporate Profile

Quorum Insurance Holdings Corp. is a Delaware-incorporated, NYSE-listed (ticker: QIHC) multi-line insurance and financial technology holding company headquartered in Hartford, Connecticut. As of September 2025, the Company has an approximate market capitalization of $4.8 billion. For fiscal year 2024, Quorum reported consolidated annual revenue of $3.12 billion and total assets of $18.7 billion. The Company employs approximately 6,400 persons across its operating subsidiaries and corporate functions.

Quorum's subsidiary structure consists of three regulated insurance operating companies and two non-insurance subsidiaries:

• Quorum Property & Casualty Insurance Company — domiciled in Connecticut (NAIC No. 38472); the Company's largest operating subsidiary, writing commercial and personal lines property and casualty insurance;

• Lone Star Specialty Insurance Company — domiciled in Texas (NAIC No. 41359); a specialty lines carrier focused on excess and surplus lines business;

• Great Lakes Surety & Indemnity Co. — domiciled in Ohio (NAIC No. 29814); a surety bond and contract indemnity writer;

• Quorum MGA Services, LLC — a Delaware limited liability company operating as a managing general agent for the Company's insurance subsidiaries and select third-party carriers; and

• Vantage Digital Insurance Solutions, Inc. — a Delaware corporation serving as the Company's financial technology and insurtech subsidiary, developing digital distribution platforms, parametric insurance products, and embedded insurance solutions.

The Company's regulated insurance subsidiaries are subject to extensive oversight by their respective state insurance departments, and Quorum itself is registered as an insurance holding company in Connecticut, Texas, and Ohio. The interplay between state insurance regulatory requirements and NYSE listing standards is relevant to certain governance considerations discussed herein.

B. Current Board and Committee Structure

Quorum's Board of Directors (the "Board") currently consists of eleven directors, of whom eight are classified as independent under the NYSE Listed Company Manual standards and three are management or otherwise non-independent directors.

Non-Independent Directors:

• Margaret A. Calloway — Chair of the Board and Chief Executive Officer. Ms. Calloway serves in a dual Chair/CEO capacity, which is a governance arrangement requiring enhanced oversight structures, including the designation of a Lead Independent Director.

• Dexter W. Ng — President, Quorum Property & Casualty Insurance Company. Mr. Ng serves as the chief executive of Quorum's largest regulated insurance subsidiary and is therefore a management director.

• Camille R. DuPont — President, Vantage Digital Insurance Solutions, Inc. Ms. DuPont is the chief executive of Quorum's fintech subsidiary and is classified as a management director.

Independent Directors:

• Arthur J. Pennington — Lead Independent Director. Mr. Pennington was designated Lead Independent Director in connection with Ms. Calloway's assumption of the combined Chair/CEO role in 2019, consistent with NYSE governance expectations.

• Dr. Lilian Fong-Archer — Designated as the Audit Committee financial expert. Dr. Fong-Archer is a former Chief Financial Officer of Pinehurst Financial Group, Inc.

• Raymond T. Huerta — Chair of the Risk Committee. Mr. Huerta brings experience as a former Chief Risk Officer of a global reinsurance company.

• Claudia M. Severin — Chair of the Compensation & Human Capital Committee. Ms. Severin is the Chief Executive Officer of Broadpath Talent Advisors, LLC, a human capital consulting firm.

• Jonathan K. Whitmore — Chair of the Investment Committee. Mr. Whitmore is a former Chief Investment Officer of a major insurance company.

• Priya Narasimhan — Proposed Chair of the new Technology & Cybersecurity Oversight Committee. Ms. Narasimhan is the Chief Executive Officer of Tessera Fintech Corp.

• Victor L. Andrade — Mr. Andrade is a retired senior partner of a major accounting firm with deep expertise in insurance accounting and regulatory compliance.

• Susan B. Trautman — Ms. Trautman is a Managing Director at Ridgeview Capital Partners, a private investment firm.

The Board currently maintains five standing committees:

The Board has approved, in principle, the establishment of a sixth standing committee — the Technology & Cybersecurity Oversight Committee — with Priya Narasimhan serving as the proposed Chair. The charter for this committee is among the deliverables of this engagement.

C. Charter History and Prior Amendments

All five existing committee charters were originally adopted on February 12, 2016, by action of the Board. The charters were drafted by Prescott, Henley & Gage LLP, Quorum's historical outside corporate counsel (contact: Marissa L. Tavares, Partner). Prescott, Henley & Gage served as Quorum's primary outside corporate counsel from the Company's initial public offering in 2012 through the commencement of C&H's engagement in 2025.

The charters have been subject to two rounds of targeted amendments since their original adoption:

First Set of Amendments — March 20, 2019. Amendments were adopted to the Audit Committee charter and the Nominating & Corporate Governance Committee charter. The Audit Committee charter amendments addressed certain changes to the scope of the committee's oversight of the independent auditor relationship, and the Nominating & Corporate Governance Committee charter amendments updated the director nomination process to include an express reference to the Board's commitment to diversity in director candidates. Neither set of amendments was comprehensive in scope.

Second Set of Amendments — June 14, 2021. Amendments were adopted to the Audit Committee charter and the Compensation & Human Capital Committee charter. The Audit Committee charter amendments addressed certain technical updates to internal-controls oversight language to conform with then-current PCAOB guidance. The Compensation & Human Capital Committee charter amendments consisted primarily of a nomenclature change — adding "Human Capital" to the committee's name — but substantive human capital management ("HCM") oversight language was not incorporated into the charter's statement of responsibilities. The addition of "Human Capital" to the committee name without corresponding substantive provisions has been identified as a gap in the current analysis.

The Risk Committee and Investment Committee charters have not been amended since their original adoption on February 12, 2016.

Critically, no charter updates have been made following the 2024 Amendments to NYSE Section 303A. As discussed in Section IV below, the 2024 Amendments introduced several changes that require corresponding updates to charter language and governance practices.

D. Key Third-Party Inputs

Several third-party communications have informed this analysis and have contributed to the Board's decision to undertake a comprehensive governance overhaul:

Garrett & Whitfield LLP Management Letter (March 14, 2025). Roland S. Brewer, Lead Engagement Partner, issued a management letter in connection with the fiscal year 2024 audit that identified, among other observations, the absence of a formal Technology & Information Security Committee charter despite the fact that the Board has been conducting ad hoc cybersecurity oversight discussions since at least 2023. The management letter noted that the absence of a formal committee charter creates ambiguity regarding the allocation of cybersecurity oversight responsibilities among the Audit Committee, the Risk Committee, and the full Board, and that this ambiguity is inconsistent with the SEC's cybersecurity disclosure rules adopted in 2023 (requiring disclosure of the board's role in cybersecurity risk oversight).

Apex Proxy Advisors, Inc. Benchmarking Report (June 30, 2025). Dana Durneval, Senior Vice President, Advisory Services, delivered a comprehensive governance benchmarking report comparing Quorum's governance framework against those of fourteen peer publicly traded insurance holding companies. Key findings of the Apex report relevant to this analysis include: (a) eleven of the fourteen peer companies have adopted either a standalone technology/cybersecurity committee or have added explicit cybersecurity oversight language to the charter of their audit or risk committee; (b) Quorum's charter language does not reflect the 2024 Amendments to Section 303A, and Quorum was identified as one of only three of the fourteen peer companies that had not updated their charters following the 2024 Amendments; (c) twelve of the fourteen peer companies include enterprise risk management oversight responsibility in their audit committee charters; and (d) all fourteen peer companies have adopted self-evaluation provisions in the charters of their mandated committees, which Quorum has not.

Veltrano Institutional Partners, LP Shareholder Letter (June 18, 2025). Terrence "Terry" Blackwood, Managing Partner, submitted a letter to the Board urging enhanced governance documentation and disclosure. Veltrano holds approximately 8.3% of Quorum's outstanding shares, making it one of the Company's largest institutional shareholders. The letter expressed concern regarding the age of Quorum's committee charters, the absence of a formal technology oversight committee, and the lack of a shareholder engagement protocol. While the letter was constructive in tone, it indicated that Veltrano would consider withholding support for director nominees at the 2026 annual meeting if governance improvements were not implemented.

Westbrook Fiduciary Trust Company. Elisa N. Fujimoto, Senior Portfolio Manager, expressed support for a comprehensive charter overhaul through informal engagement with the Company's investor relations team. Westbrook holds approximately 5.7% of Quorum's outstanding shares. While Westbrook did not submit a formal letter, its views have been communicated to the Board and are consistent with the governance improvement objectives of this engagement.

III. Applicable NYSE Listed Company Manual Provisions

This section provides a detailed analysis of each relevant provision of the NYSE Listed Company Manual Section 303A and its application to Quorum's current governance structure. For each provision, we identify Quorum's current compliance status and any gaps requiring remediation.

A. Section 303A.01 — Independent Directors

Requirement. Section 303A.01 requires that listed companies have a majority of independent directors on their boards. This is the most fundamental structural requirement of the NYSE corporate governance listing standards and is intended to ensure that the board maintains sufficient independence from management to exercise effective oversight.

Quorum Status. Quorum's Board currently consists of eleven directors, of whom eight (72.7%) are classified as independent under the NYSE independence standards. This exceeds the majority requirement by a comfortable margin. The three management directors — Margaret A. Calloway (Chair & CEO), Dexter W. Ng (President, Quorum P&C), and Camille R. DuPont (President, Vantage Digital) — constitute 27.3% of the Board, well within the permissible range.

Compliance Determination: Compliant.

We note that Arthur J. Pennington serves as Lead Independent Director, a role that is consistent with NYSE governance expectations for companies in which the same individual serves as both Chair and Chief Executive Officer. While the NYSE does not formally mandate a Lead Independent Director, commentary to Section 303A.01 strongly encourages the designation of a presiding director or lead independent director to chair executive sessions of independent directors. Ms. Calloway has held the combined Chair/CEO role since 2019, and Mr. Pennington's designation as Lead Independent Director at that time was a sound governance practice.

B. Section 303A.02 — Definition of Independence; Director Independence Tests

Requirement. Section 303A.02 establishes the definition of "independent director" for purposes of the NYSE listing standards and sets forth specific tests for determining whether a director qualifies as independent. A director qualifies as independent only if the board affirmatively determines that the director has no material relationship with the listed company, either directly or as a partner, shareholder, or officer of an organization that has a relationship with the company. The NYSE identifies several categories of relationships that preclude a determination of independence for specified periods, commonly referred to as the "bright-line" tests.

Detailed Independence Analysis. We have analyzed the independence of each of the eight directors classified as independent by the Board, applying both the bright-line tests and a broader assessment of material relationships. Our analysis is summarized below.

Arthur J. Pennington (Lead Independent Director). Mr. Pennington is a retired executive with no current employment or consulting relationship with Quorum or any of its subsidiaries. He has no family member who is employed by the Company. He has not received any compensation from Quorum other than director fees and equity compensation for board service. No disqualifying relationship exists. Independence confirmed.

Dr. Lilian Fong-Archer. Dr. Fong-Archer is a former Chief Financial Officer of Pinehurst Financial Group, Inc. She retired from that position in 2014, more than ten years prior to the current analysis period. There is no commercial, consulting, or employment relationship between Dr. Fong-Archer and Quorum. Pinehurst Financial Group is not a counterparty to any material transaction with Quorum. No disqualifying relationship exists. Independence confirmed.

Raymond T. Huerta. Mr. Huerta is a retired Chief Risk Officer of a global reinsurance company. His former employer does not have a material commercial relationship with Quorum. He has no family member employed by the Company. He has not received any compensation from Quorum other than director fees and equity compensation. No disqualifying relationship exists. Independence confirmed.

Claudia M. Severin. Ms. Severin is the Chief Executive Officer of Broadpath Talent Advisors, LLC, a human capital and talent management consulting firm. We have specifically confirmed that Broadpath Talent Advisors has not provided any consulting services to Quorum or any of its subsidiaries. There is no compensation consulting relationship between Broadpath and the Company. If Broadpath were to provide consulting services to Quorum in the future, this could create a disqualifying relationship under the enhanced independence standards applicable to compensation committee members under Section 303A.02(a)(ii). We recommend that any future engagement of Broadpath or any entity controlled by Ms. Severin be subject to prior review by the Nominating & Corporate Governance Committee to ensure that independence is not impaired. No disqualifying relationship currently exists. Independence confirmed.

Jonathan K. Whitmore. Mr. Whitmore is a retired Chief Investment Officer with no current employment or consulting relationship with Quorum. He does not serve on the board of any entity with which Quorum has a material commercial relationship. No disqualifying relationship exists. Independence confirmed.

Priya Narasimhan. Ms. Narasimhan is the Chief Executive Officer of Tessera Fintech Corp., a financial technology company. We have specifically confirmed that Tessera Fintech Corp. does not have any commercial relationship with Quorum or any of its subsidiaries, including Vantage Digital Insurance Solutions, Inc. Given the overlapping fintech and insurtech space in which both Tessera and Vantage Digital operate, we recommend ongoing monitoring of any potential commercial relationships that could develop. As of the date of this memorandum, no disqualifying relationship exists. Independence confirmed.

Victor L. Andrade. Mr. Andrade is a retired senior partner of a major accounting firm. His former firm does not serve as Quorum's independent auditor (that role is held by Garrett & Whitfield LLP), and Mr. Andrade has been retired for more than five years. No disqualifying relationship exists. Independence confirmed.

Susan B. Trautman. Ms. Trautman is a Managing Director at Ridgeview Capital Partners, a private investment firm. We have specifically confirmed that Ridgeview Capital Partners does not have any advisory, lending, or other financial relationship with Quorum or any of its subsidiaries. Ridgeview Capital Partners is distinct from Veltrano Institutional Partners, LP (the shareholder that submitted the June 18, 2025 letter), and there is no affiliation between the two entities despite the similarity in names. No disqualifying relationship exists. Independence confirmed.

Management Directors. The three management directors — Margaret A. Calloway, Dexter W. Ng, and Camille R. DuPont — are properly classified as non-independent by virtue of their employment relationships with the Company or its subsidiaries. Each holds a senior executive position that constitutes a disqualifying employment relationship under the bright-line tests.

Compliance Determination: Compliant. All eight directors classified as independent satisfy the independence tests under Section 303A.02, and all directors serving on the Audit, Compensation, and Nominating/Corporate Governance Committees have been confirmed as independent. No director currently serving on any mandated committee has any disqualifying relationship.

C. Section 303A.04 — Nominating/Corporate Governance Committee

Requirement. Section 303A.04 requires that listed companies maintain a Nominating/Corporate Governance Committee composed entirely of independent directors and that the committee operate under a written charter. Section 303A.04(b) specifies mandatory charter content, which must include provisions addressing: (i) the identification and selection of director candidates, including criteria for selecting nominees and policies regarding the consideration of diversity; (ii) the development and recommendation to the board of corporate governance guidelines applicable to the company; and (iii) oversight of the evaluation of the board and management.

Quorum Status. The Nominating & Corporate Governance Committee is chaired by Arthur J. Pennington (independent) and is composed entirely of independent directors. This satisfies the composition requirement of Section 303A.04.

Compliance Determination — Composition: Compliant.

Charter Content Analysis. The current Nominating & Corporate Governance Committee charter was last amended on March 20, 2019. Our review has identified the following gaps relative to the requirements of Section 303A.04(b) and current best practices:

(i) Self-Evaluation Oversight. Section 303A.04(b)(iii) requires that the charter include a provision addressing the committee's responsibility for oversight of the evaluation of the board and management. The current charter does not include a self-evaluation oversight provision. This is a compliance gap, not merely a best-practice deficiency. The restated charter must include an express provision establishing the Nominating & Corporate Governance Committee's responsibility for overseeing the annual self-evaluation process for the full board and all standing committees.

(ii) Director Skills Matrix. The current charter does not require the development or maintenance of a director skills matrix identifying the competencies, experiences, and attributes desired in board members. While not explicitly mandated by Section 303A.04, the use of a skills matrix is a widely adopted best practice — all fourteen of Quorum's peer companies identified in the Apex benchmarking report maintain and disclose a skills matrix. The restated charter should include a requirement for the committee to develop and annually review a director skills matrix.

(iii) ESG/Sustainability Oversight. The current charter does not include any reference to the committee's role in overseeing environmental, social, and governance ("ESG") or sustainability matters. The Apex benchmarking report flagged this as a notable omission, noting that ten of the fourteen peer companies have assigned ESG oversight responsibility to either the Nominating/Corporate Governance Committee or a dedicated sustainability committee. The restated charter should include a provision establishing the committee's responsibility for oversight of ESG and sustainability governance.

(iv) Shareholder Engagement Protocol. The current charter does not include any protocol or framework for director-shareholder engagement on governance matters. Given the governance concerns expressed by Veltrano Institutional Partners (8.3% holder) and the informal engagement by Westbrook Fiduciary Trust Company (5.7% holder), and in light of the proposed Amended & Restated Corporate Governance Guidelines (which will include a shareholder engagement protocol), the restated charter should establish the committee's responsibility for overseeing the shareholder engagement protocol.

(v) Board Refreshment Policies. The current charter does not address board refreshment, including director tenure limits or mandatory retirement age. The proposed Amended & Restated Corporate Governance Guidelines will include a mandatory retirement age of 75 and a 15-year tenure limit for independent directors. The restated charter should include the committee's responsibility for monitoring compliance with these policies and making recommendations regarding board refreshment.

Compliance Determination — Charter Content: Partially Compliant. The absence of the self-evaluation oversight provision represents a specific gap against Section 303A.04(b)(iii). The remaining items, while significant governance best-practice gaps, are not strict violations of the NYSE rule. All identified gaps will be addressed in the proposed restated charter.

D. Section 303A.05 — Compensation Committee

Requirement. Section 303A.05 requires that listed companies maintain a Compensation Committee composed entirely of independent directors and that the committee operate under a written charter. In addition to the general independence standards of Section 303A.02, compensation committee members are subject to enhanced independence requirements under Section 303A.02(a)(ii), which require the board to consider all factors specifically relevant to determining whether a director has a relationship to the company that is material to that director's ability to be independent from management in connection with the duties of a compensation committee member, including the source of compensation of such director (including any consulting, advisory, or other compensatory fee paid by the company to such director) and whether such director is affiliated with the company, a subsidiary of the company, or an affiliate of a subsidiary of the company.

Section 303A.05(b) specifies mandatory charter content: (i) the committee's purposes and responsibilities, which at minimum must be to have direct responsibility for the review and approval of corporate goals and objectives relevant to CEO compensation, evaluation of CEO performance in light of those goals, and, either as a committee or together with the other independent directors, determination of CEO compensation; (ii) the committee's authority to retain and terminate compensation consultants, independent legal counsel, and other advisors, with sole authority to do so without requiring further board approval; (iii) the company's obligation to provide appropriate funding, as determined by the committee, for payment of reasonable compensation to any advisor retained by the committee; and (iv) an annual performance evaluation of the committee.

Quorum Status. The Compensation & Human Capital Committee is chaired by Claudia M. Severin (independent) and is composed entirely of independent directors. Enhanced independence for all members has been confirmed, as discussed in Section III.B above. The composition requirement is satisfied.

Compliance Determination — Composition: Compliant.

Charter Content Analysis. The current Compensation & Human Capital Committee charter was last amended on June 14, 2021. Our review has identified the following gaps:

(i) Independent Advisor Retention Authority. Section 303A.05(b)(ii) requires that the charter establish the committee's sole authority to retain and terminate compensation consultants, legal counsel, and other advisors, without requiring further board approval. The current charter contains language requiring the committee to obtain further board approval before retaining an outside compensation consultant. This is a direct compliance gap. The restated charter must establish the committee's sole authority to retain and terminate advisors without board approval.

(ii) Human Capital Management Oversight Language. In 2021, the committee's name was amended to add "Human Capital," but no substantive HCM oversight language was incorporated into the charter. This creates an inconsistency between the committee's name and its stated responsibilities. The restated charter should include substantive provisions addressing the committee's oversight of human capital management, including workforce composition, talent development, diversity and inclusion initiatives, employee engagement, pay equity, and succession planning.

(iii) Annual Self-Evaluation Provision. Section 303A.05(b)(iv) requires the charter to include an annual performance evaluation of the committee. The current charter does not contain this provision. This is a compliance gap. The restated charter must include an annual self-evaluation requirement.

(iv) Funding Authority. Section 303A.05(b)(iii) requires the charter to include a provision establishing the company's obligation to provide appropriate funding for compensation of any advisor retained by the committee. The current charter does not explicitly state this obligation. While the committee has in practice been able to engage advisors, the absence of an express funding authority provision is a compliance gap. The restated charter must include an explicit funding authority provision.

Compliance Determination — Charter Content: Partially Compliant. Three specific compliance gaps have been identified: (a) the requirement for further board approval of consultant retention, which is inconsistent with the sole authority mandate of Section 303A.05(b)(ii); (b) the absence of an annual self-evaluation provision required by Section 303A.05(b)(iv); and (c) the absence of an explicit funding authority provision required by Section 303A.05(b)(iii). All identified gaps will be addressed in the proposed restated charter.

E. Section 303A.06 — Audit Committee

Requirement. Section 303A.06, read in conjunction with SEC Rule 10A-3 (which the NYSE listing standards incorporate by reference), establishes the composition requirements for the Audit Committee. The committee must have a minimum of three members, all of whom must be independent under both the NYSE independence standards and the heightened independence standards of Rule 10A-3. Each member must be "financially literate" as determined by the board in its business judgment, and at least one member must have "accounting or related financial management expertise" — again, as determined by the board. The SEC has also adopted the concept of an "audit committee financial expert" under Item 407(d)(5) of Regulation S-K, which requires disclosure of whether the audit committee includes at least one member who qualifies as a financial expert and, if so, the identity and qualifications of that member.

Additional independence requirements applicable to audit committee members: no member of the Audit Committee may receive any compensatory fee from the company other than (i) director's fees (which may include fees paid in cash, stock, stock options, or other in-kind consideration ordinarily available to directors) and (ii) fixed amounts of compensation under a retirement plan for prior service (provided that such compensation is not contingent in any way on continued service). No audit committee member may be an "affiliated person" of the company or any subsidiary of the company.

Quorum Status. The Audit Committee is chaired by Dr. Lilian Fong-Archer (independent) and consists of three or more independent members. Dr. Fong-Archer has been designated by the Board as the audit committee financial expert.

Dr. Fong-Archer's Financial Expert Qualifications. Dr. Fong-Archer's qualification as an audit committee financial expert under both the NYSE financial literacy and SEC financial expert definitions is supported by the following:

• Education: Ph.D. in Finance, Wharton School of the University of Pennsylvania; MBA, Columbia Business School; CPA (inactive license, New York).

• Professional Experience: Dr. Fong-Archer served as Chief Financial Officer of Pinehurst Financial Group, Inc. (a publicly traded diversified financial services company) from 2005 to 2014, during which time she was responsible for all financial reporting, treasury operations, and regulatory capital compliance. Prior to that role, she served as Vice President of Finance and Controller at Pinehurst from 2001 to 2005.

• Understanding of GAAP: Through her extensive experience as a CFO of a publicly traded company, Dr. Fong-Archer possesses a thorough understanding of generally accepted accounting principles ("GAAP") and financial statements, including the application of such principles in connection with the accounting for estimates, accruals, and reserves.

• Internal Controls Experience: Dr. Fong-Archer has direct experience with the preparation, auditing, analysis, and evaluation of financial statements of a complexity and breadth comparable to those of Quorum, and has experience with internal accounting controls and procedures for financial reporting.

• Audit Committee Experience: Dr. Fong-Archer has served on the audit committees of three publicly traded companies (in addition to Quorum) since her retirement from Pinehurst in 2014, providing her with substantial experience in audit committee functions, including the selection and oversight of independent auditors and the review of financial statements.

Dr. Fong-Archer satisfies the definition of "audit committee financial expert" under Item 407(d)(5)(ii) of Regulation S-K and the NYSE's "accounting or related financial management expertise" standard under Section 303A.06.

No member of the Audit Committee receives any compensatory fee from the Company other than director's fees, and no member is an affiliated person of the Company or any subsidiary. The heightened independence requirements of SEC Rule 10A-3 are satisfied.

Compliance Determination — Composition: Compliant.

F. Section 303A.07 — Audit Committee Charter Requirements

Requirement. Section 303A.07 imposes detailed charter content mandates for the Audit Committee. Section 303A.07(b) requires that the charter must address, at a minimum:

(i) the purpose of the committee, which is to assist board oversight of: (a) the integrity of the company's financial statements, (b) the company's compliance with legal and regulatory requirements, (c) the independent auditor's qualifications and independence, and (d) the performance of the company's internal audit function and independent auditors;

(ii) the duties and responsibilities of the committee regarding the engagement, retention, compensation, and oversight of the work of the independent auditor, including sole authority to appoint or replace the independent auditor, which must report directly to the committee;

(iii) complaint-handling procedures for the receipt, retention, and treatment of complaints received by the company regarding accounting, internal accounting controls, or auditing matters, and for the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters;

(iv) the authority of the committee to engage independent counsel and other advisors as it determines necessary to carry out its duties; and

(v) appropriate funding, as determined by the committee, for payment of (a) compensation to the independent auditor, (b) compensation to any advisors engaged by the committee, and (c) ordinary administrative expenses of the committee.

Additionally, Section 303A.07(c) provides that the charter must require the committee to, at minimum: (i) review and discuss annual and quarterly financial statements with management, (ii) discuss the company's financial press releases and financial guidance provided to analysts and rating agencies, (iii) discuss risk assessment and risk management policies, (iv) meet separately and periodically with management, internal auditors, and the independent auditor, (v) review with the independent auditor any audit problems or difficulties, and (vi) set clear hiring policies for employees or former employees of the independent auditor.

Section 303A.07(b)(iii)(F) also requires that the charter include a provision for an annual performance evaluation of the committee.

Quorum Status — Charter Content Analysis. The current Audit Committee charter was last amended on June 14, 2021. Our review has identified the following gaps:

(i) Enterprise Risk Management Oversight. The current charter does not include an explicit provision establishing the Audit Committee's role in enterprise risk management ("ERM") oversight. While Section 303A.07(c)(iii) requires discussion of risk assessment and risk management policies, the current charter's treatment of this responsibility is limited to a brief reference to "reviewing with management the company's financial risk exposures." The Apex benchmarking report found that twelve of the fourteen peer companies include more comprehensive ERM oversight responsibility in their audit committee charters. Moreover, the current charter does not include any coordination protocol with the Risk Committee (chaired by Raymond T. Huerta), creating potential ambiguity in the allocation of risk oversight responsibilities between the two committees. The restated charter should include a more comprehensive ERM oversight provision and a clear coordination protocol with the Risk Committee.

(ii) Clawback Policy Administration. The current charter does not include any reference to the administration or oversight of the Company's clawback policy adopted pursuant to SEC Rule 10D-1 and NYSE Rule 303A.14. This is a significant gap given the Audit Committee's role in financial statement oversight and its relationship with the independent auditor. The restated charter must include explicit provisions for clawback policy administration and oversight. This issue is discussed in detail in Section VII below.

(iii) Annual Self-Evaluation Provision. Section 303A.07(b)(iii)(F) requires that the charter include a provision for an annual performance evaluation of the committee. The current charter does not contain this provision. This is a compliance gap that must be addressed in the restated charter.

(iv) Cybersecurity-Related Financial Reporting Risks. The current charter does not reference the committee's role in oversight of cybersecurity-related financial reporting risks. Given the SEC's cybersecurity disclosure rules adopted in 2023, which require disclosure regarding the board's role in cybersecurity risk oversight, and the materiality of cybersecurity risks to the Company's insurance operations and fintech subsidiary, the restated charter should include a provision addressing the committee's oversight of cybersecurity-related financial reporting and disclosure matters. A coordination protocol with the proposed Technology & Cybersecurity Oversight Committee should also be included.

(v) Coordination with Risk Committee. As noted above, the current charter does not include any coordination protocol with the Risk Committee. Given the overlapping nature of certain risk oversight responsibilities, a formalized coordination protocol is a governance best practice that should be incorporated into the restated charters of both committees.

Compliance Determination — Charter Content: Partially Compliant. The absence of the annual self-evaluation provision represents a specific compliance gap against Section 303A.07(b)(iii)(F). The absence of clawback policy administration language, while technically a gap under Section 303A.14 rather than Section 303A.07, is most appropriately addressed through the Audit Committee charter. The remaining items are significant best-practice gaps that should be remedied.

G. Section 303A.09 — Corporate Governance Guidelines

Requirement. Section 303A.09 requires that listed companies adopt and disclose a set of corporate governance guidelines addressing certain specified topics, including: director qualification standards, director responsibilities, director access to management and independent advisors, director compensation, director orientation and continuing education, management succession, and an annual performance evaluation of the board.

Quorum Status. Quorum currently maintains corporate governance guidelines that are in effect and have been posted on the Company's investor relations website. However, the current guidelines have not been comprehensively updated since their original adoption, and they do not address several topics that have become standard governance practices or that are necessary to comply with the 2024 Amendments.

The following key amendments are proposed in the Amended & Restated Corporate Governance Guidelines, which are being developed as part of this engagement:

(i) Mandatory Retirement Age. The proposed guidelines establish a mandatory retirement age of 75 for independent directors. Upon reaching age 75, a director will not be eligible for nomination for an additional term at the next annual meeting of shareholders. The Nominating & Corporate Governance Committee will have authority to grant a one-year extension in extraordinary circumstances.

(ii) Tenure Limit. The proposed guidelines establish a 15-year tenure limit for independent directors. An independent director who has served on the Board for fifteen consecutive years will not be eligible for nomination for an additional term, subject to a one-year extension authority vested in the Nominating & Corporate Governance Committee.

(iii) Overboarding Policy. The proposed guidelines establish the following limits on outside board service: independent directors may serve on a maximum of four total public-company boards (including Quorum); the CEO may serve on a maximum of two total public-company boards (including Quorum). Directors will be required to notify the Nominating & Corporate Governance Committee prior to accepting an invitation to serve on another public-company board.

(iv) Majority Voting Standard. The proposed guidelines will adopt a majority voting standard for uncontested director elections, replacing the current plurality voting standard. Under the majority voting standard, a director nominee in an uncontested election will be required to receive a majority of the votes cast in order to be elected. An incumbent director who fails to receive a majority of the votes cast will be required to tender his or her resignation to the Board, and the Nominating & Corporate Governance Committee will recommend to the Board whether to accept or reject the resignation.

(v) Shareholder Engagement Protocol. The proposed guidelines establish a formal shareholder engagement protocol under which the Lead Independent Director and the Chair of the Nominating & Corporate Governance Committee will be available for engagement with holders of three percent (3%) or more of the Company's outstanding shares on governance matters upon request.

(vi) Formalized Self-Evaluation Process. The proposed guidelines include a formalized annual board and committee self-evaluation process, with results reviewed by the Nominating & Corporate Governance Committee and reported to the full Board.

These amendments align with the content expectations of Section 303A.09 and with the peer best practices identified in the Apex benchmarking report.

Compliance Determination: Compliant (with the current guidelines), but significant updates are warranted to align with current best practices and the 2024 Amendments.

H. Section 303A.10 — Code of Business Conduct and Ethics

Requirement. Section 303A.10 requires that listed companies adopt and disclose a code of business conduct and ethics for directors, officers, and employees, addressing certain specified topics including conflicts of interest, corporate opportunities, confidentiality, fair dealing, protection and proper use of company assets, compliance with laws, rules, and regulations, and encouraging the reporting of any illegal or unethical behavior.

Quorum Status. Quorum maintains a Code of Business Conduct and Ethics that complies with the requirements of Section 303A.10. Our review of the code does not identify any specific deficiencies requiring immediate remediation. However, we note that the governance overhaul contemplated by this engagement — particularly the adoption of new committee charters, amended governance guidelines, and updated clawback policies — may warrant a conforming review of the Code to ensure consistency across governance documents.

We also note that if the Code of Ethics applicable to the Company's principal executive officer and principal financial officer is materially amended in connection with this governance overhaul, a Form 8-K filing under Item 5.05 would be required. If the amendments are limited to conforming updates that do not constitute a material amendment to the Code of Ethics, an Item 8.01 voluntary disclosure in the Form 8-K filing for the overall governance overhaul may be appropriate.

Compliance Determination: Compliant. Conforming review recommended.

I. Section 303A.12 — CEO Certification

Requirement. Section 303A.12 requires that the CEO of each listed company certify annually to the NYSE that she or he is not aware of any violation by the company of the NYSE corporate governance listing standards, qualifying the certification to the extent necessary to indicate any material qualifications. The certification must be filed with the NYSE promptly after any change to the company's governance. In addition, the CEO must promptly notify the NYSE in writing after any executive officer of the listed company becomes aware of any non-compliance with any applicable provisions of Section 303A.

Implications for Current Project. Following the adoption of the comprehensive governance overhaul package at the December 11, 2025 board meeting, Margaret A. Calloway, Chair and CEO, will be required to file an updated certification with the NYSE confirming compliance with the corporate governance listing standards as reflected in the restated charters, amended governance guidelines, and other governance documents. This certification must be filed within thirty days of the governance changes taking effect — that is, by approximately January 10, 2026.

We recommend that C&H prepare a draft certification for Ms. Calloway's review in advance of the December 11, 2025 board meeting, so that the certification can be promptly filed following adoption.

Compliance Determination: Currently Compliant. Post-adoption certification will be required.

J. Section 303A.13 — Website and Public Filing Requirements

Requirement. Section 303A.13 requires that listed companies make their committee charters available on or through the company's website. Specifically, companies must post the charters of each of the mandated committees (Audit, Compensation, and Nominating/Corporate Governance), as well as the company's corporate governance guidelines, on the company's website. The NYSE expects that updated charters will be posted within a reasonable time following adoption.

Quorum Status. Quorum's current committee charters are posted on the Company's investor relations website at www.quoruminsurance.com/investors/governance. Following adoption of the restated charters at the December 11, 2025 board meeting, updated charters must be posted within five business days — i.e., by December 18, 2025.

In addition, the Company anticipates filing a Current Report on Form 8-K on or about December 15, 2025, disclosing the adoption of the governance overhaul package, including the restated committee charters, the Amended & Restated Corporate Governance Guidelines, and the establishment of the Technology & Cybersecurity Oversight Committee.

Compliance Determination: Compliant. Post-adoption actions are required and have been incorporated into the project timeline (see Appendix C).

IV. Analysis of the 2024 Amendments to Section 303A

In 2024, the NYSE adopted amendments to Section 303A of the Listed Company Manual (the "2024 Amendments"). These amendments updated several provisions governing board and committee composition, charter content requirements, and corporate governance disclosure practices. The 2024 Amendments reflect the NYSE's effort to align its listing standards with evolving regulatory expectations and governance best practices.

Quorum's current charter language does not reflect the 2024 Amendments. This gap was identified both in C&H's Initial Gap Analysis Memorandum of October 3, 2025, and in the Apex Proxy Advisors benchmarking report of June 30, 2025. The Apex report further noted that Quorum was one of only three of the fourteen peer companies that had not updated their charters following the 2024 Amendments, placing the Company in the bottom quartile of peer governance compliance.

Below, we provide a category-by-category analysis of how each 2024 Amendment affects Quorum's existing charters and governance guidelines, along with specific remediation measures proposed in the restated charters and amended governance guidelines.

Enhanced Independence Considerations. The 2024 Amendments reinforced the requirement for boards to conduct a thorough, fact-specific analysis of director independence, with particular emphasis on indirect relationships that may not be captured by the bright-line tests. The amendments emphasize that boards should consider all relevant relationships, including those involving entities affiliated with the director, when making independence determinations. Quorum's current governance guidelines do not include a formalized process for the Board's annual independence determination beyond the bright-line test analysis. The proposed Amended & Restated Corporate Governance Guidelines include a formalized annual independence review process, with the Nominating & Corporate Governance Committee conducting a comprehensive relationship review for each independent director and making a recommendation to the full Board.

Committee Charter Content Updates. The 2024 Amendments clarified and, in certain respects, expanded the charter content requirements for mandated committees. The amendments emphasized the importance of explicit provisions regarding the committee's authority to retain independent advisors and the company's obligation to provide funding for such advisors. While these requirements existed in substance prior to the 2024 Amendments, the updated language provides greater specificity. Quorum's existing charters, particularly the Compensation & Human Capital Committee charter (which conditions consultant retention on further board approval), are not aligned with the clarified requirements.

Self-Evaluation Process. The 2024 Amendments reinforced the requirement for annual committee self-evaluations and emphasized the role of the Nominating/Corporate Governance Committee in overseeing the evaluation process for the full board and all committees. As noted throughout this memorandum, the annual self-evaluation provision is absent from all five of Quorum's existing committee charters — a compliance gap that is now further underscored by the 2024 Amendments.

Disclosure Practices. The 2024 Amendments encouraged enhanced disclosure regarding governance practices, including committee composition, director qualifications, and the rationale for governance structures. While many of these disclosures are already addressed in the Company's annual proxy statement, the restated charters and amended governance guidelines will provide a stronger foundation for the disclosure practices expected under the updated standards.

Specific Remediation Measures. Each of the proposed restated charters and the Amended & Restated Corporate Governance Guidelines has been drafted (or will be drafted) to specifically address the 2024 Amendments. The following cross-references identify where each 2024 Amendment is addressed in the proposed governance documents:

The proposed governance overhaul will bring Quorum into full compliance with the 2024 Amendments and align the Company with the governance practices adopted by the majority of its peer companies.

V. Analysis of the Proposed Technology & Cybersecurity Oversight Committee

A. NYSE Requirements for Non-Mandated Committees

The NYSE Listed Company Manual mandates that listed companies maintain three standing board committees: an Audit Committee, a Compensation Committee, and a Nominating/Corporate Governance Committee. The establishment of additional committees — including the Risk Committee and Investment Committee that Quorum has maintained since 2016, and the proposed Technology & Cybersecurity Oversight Committee — is entirely within the Board's discretion and is not mandated by NYSE rules.

However, while the NYSE does not impose specific content mandates on the charters of non-mandated committees, any committee established by the Board should have a written charter that is consistent with good governance practices, the Company's certificate of incorporation and bylaws, and applicable Delaware law. We recommend that the charter of the Technology & Cybersecurity Oversight Committee be drafted to comply with the general standards applied to NYSE-required committees, even though strict compliance with those standards is not technically required. This approach ensures consistency across all committee charters, reduces the risk of governance gaps, and demonstrates to shareholders and proxy advisors that the Company applies equivalent rigor to all board-level oversight structures.

Under Delaware General Corporation Law Section 141(c), the Board has broad authority to establish committees of the board and to delegate authority to such committees, subject to certain limitations (e.g., committees may not approve mergers, recommend amendments to the certificate of incorporation, or adopt or repeal bylaws). The establishment of a Technology & Cybersecurity Oversight Committee and the delegation of cybersecurity and technology oversight authority to that committee are well within the Board's powers under Delaware law.

B. Proposed Composition

The proposed composition of the Technology & Cybersecurity Oversight Committee is as follows:

• Priya Narasimhan (Chair) — Independent director; CEO of Tessera Fintech Corp.; significant expertise in financial technology, cybersecurity, and digital transformation.

• Victor L. Andrade — Independent director; retired senior partner of a major accounting firm; expertise in technology risk assessment and controls within the context of financial statement audits.

• Camille R. DuPont — Management director (non-voting advisory member); President of Vantage Digital Insurance Solutions, Inc.; deep expertise in insurtech, digital distribution platforms, and technology strategy.

The proposed charter for the Technology & Cybersecurity Oversight Committee establishes a minimum composition requirement of three independent directors, with at least one member possessing cybersecurity or technology expertise as determined by the Board.

Composition Analysis. The current proposed composition includes only two independent voting members (Narasimhan and Andrade), with DuPont serving as a non-voting advisory member. DuPont's advisory role is permissible under Delaware law and is consistent with peer practices — several of the peer companies identified in the Apex benchmarking report include management directors as non-voting advisory or ex officio members of their technology committees, leveraging management expertise without compromising committee independence.

However, the Board will need to appoint at least one additional independent director to the committee in order to satisfy the charter's own minimum requirement of three independent directors. We recommend that the Board identify a suitable candidate from among the existing independent directors or, if the Board determines that additional expertise is needed, consider expanding the Board to include a new independent director with cybersecurity or technology qualifications. Based on our review of the current Board's qualifications, Susan B. Trautman may be a suitable candidate for the third independent director seat, given her experience in technology-focused private equity investing at Ridgeview Capital Partners, though the Board should make this determination based on its assessment of the directors' respective expertise and availability.

C. Peer Benchmarking

The Apex Proxy Advisors benchmarking report provides valuable context for the Board's decision to establish a standalone Technology & Cybersecurity Oversight Committee. Of the fourteen peer companies analyzed:

• Eight (57%) have established a standalone technology, cybersecurity, or information security committee of the board;

• Three (21%) have added explicit cybersecurity oversight language to their existing audit committee or risk committee charters without establishing a standalone committee;

• Three (22%), including Quorum, have neither a standalone committee nor explicit charter language addressing cybersecurity oversight.

Quorum's approach — establishing a standalone committee with defined coordination protocols to both the Risk Committee and the Audit Committee — is consistent with the majority peer approach and represents a meaningful governance enhancement. The Garrett & Whitfield management letter's specific identification of this gap as an audit observation further supports the Board's decision.

D. Charter Content Alignment

The proposed charter for the Technology & Cybersecurity Oversight Committee has been designed to address the following oversight areas:

• Cybersecurity Program. Oversight of the Company's cybersecurity program, including strategy, policies, risk assessments, threat landscape monitoring, incident response preparedness, and compliance with applicable cybersecurity laws and regulations.

• Information Technology Strategy. Oversight of the Company's information technology strategy, including infrastructure modernization, cloud migration, and digital transformation initiatives.

• Data Privacy. Oversight of the Company's data privacy program, including compliance with applicable data protection laws (including state insurance data security regulations and emerging federal privacy frameworks).

• Insurtech Initiatives. Oversight of the Company's insurtech initiatives through Vantage Digital Insurance Solutions, Inc., including parametric insurance products, embedded insurance platforms, and digital distribution strategies.

• Artificial intelligence Gover

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
CALDERWOOD & HARKNESS LLP 1585 Broadway, 34th Floor New York, New York 10036
MEMORANDUM
This memorandum is prepared as part of the deliverables supporting our engagement and is delivered alongside or shortly after the Initial Gap Analysis Memorandum dated October 3, 2025, and in advance of the first charter drafts to be delivered on October 24, 2025. This memorandum is protected by the attorney-client privilege and the work-product doctrine and should not be disclosed to third parties without the prior written consent of Calderwood & Harkness LLP.
Right-click to update Table of Contents
I. Executive Summary
This memorandum provides a comprehensive analysis of Quorum Insurance Holdings Corp.'s ("Quorum," "QIH," or the "Company") current board committee structure and charter provisions as measured against the requirements of the New York Stock Exchange ("NYSE") Listed Company Manual Sections 303A.01 through 303A.14, including amendments to Section 303A adopted by the NYSE in 2024 (the "2024 Amendments"). The analysis is intended to serve as the analytical foundation for the comprehensive governance overhaul that Calderwood & Harkness LLP ("C&H" or the "Firm") has been engaged to develop and implement.
Quorum currently maintains five standing board committees, each operating under a written charter originally adopted on February 12, 2016. The charters were subject to targeted amendments on March 20, 2019 and June 14, 2021, but none of the five existing charters have been updated to reflect the 2024 Amendments to Section 303A or to incorporate the clawback-policy administration requirements necessitated by SEC Rule 10D-1 and NYSE Rule 303A.14.
Several events have prompted this engagement and the current analysis:
(a) The management letter issued by Garrett & Whitfield LLP (the Company's independent registered public accounting firm), dated March 14, 2025, in connection with the fiscal year 2024 audit, which identified the absence of a formal Technology & Information Security Committee charter despite board-level cybersecurity oversight discussions ongoing since 2023;
(b) The governance benchmarking report delivered by Apex Proxy Advisors, Inc. on June 30, 2025, which compared Quorum's governance framework against those of fourteen peer publicly traded insurance holding companies and identified multiple areas in which Quorum's charter language and governance structures lag behind peer practices;
(c) The shareholder letter from Veltrano Institutional Partners, LP, dated June 18, 2025, urging enhanced governance documentation and disclosure; and
(d) The Board's own recognition, reflected in the minutes of its July 17, 2025 meeting, that a comprehensive governance review was overdue.
This memorandum addresses the following subject areas: (a) director independence requirements under NYSE rules; (b) committee composition mandates for the three NYSE-required committees (Audit, Compensation, and Nominating/Corporate Governance); (c) charter content requirements applicable to each mandated committee; (d) annual self-evaluation provisions required under the NYSE rules; (e) clawback policy requirements under NYSE Rule 303A.14 and SEC Rule 10D-1; (f) the proposed new Technology & Cybersecurity Oversight Committee's alignment with listing standards and governance best practices; and (g) recommendations for remediation through restated charters, amended governance guidelines, and conforming bylaw amendments.
Overall Finding. While Quorum currently satisfies the fundamental structural requirements for committee independence and the requisite number of mandatory committees, several areas of non-compliance or lagging best-practice alignment exist in charter content, self-evaluation provisions, clawback policy administration, and composition-related disclosure language. These deficiencies, while not presenting an imminent risk of NYSE delisting or enforcement action, expose the Company to adverse proxy advisory recommendations, heightened shareholder scrutiny, and potential regulatory criticism. We recommend comprehensive remediation through the proposed restated charters, amended governance guidelines, and conforming bylaw amendments, all to be adopted at the December 11, 2025 board meeting via the proposed omnibus board resolution.
II. Background
A. Quorum's Corporate Profile
Quorum Insurance Holdings Corp. is a Delaware-incorporated, NYSE-listed (ticker: QIHC) multi-line insurance and financial technology holding company headquartered in Hartford, Connecticut. As of September 2025, the Company has an approximate market capitalization of $4.8 billion. For fiscal year 2024, Quorum reported consolidated annual revenue of $3.12 billion and total assets of $18.7 billion. The Company employs approximately 6,400 persons across its operating subsidiaries and corporate functions.
Quorum's subsidiary structure consists of three regulated insurance operating companies and two non-insurance subsidiaries:
• Quorum Property & Casualty Insurance Company — domiciled in Connecticut (NAIC No. 38472); the Company's largest operating subsidiary, writing commercial and personal lines property and casualty insurance;
• Lone Star Specialty Insurance Company — domiciled in Texas (NAIC No. 41359); a specialty lines carrier focused on excess and surplus lines business;
• Great Lakes Surety & Indemnity Co. — domiciled in Ohio (NAIC No. 29814); a surety bond and contract indemnity writer;
• Quorum MGA Services, LLC — a Delaware limited liability company operating as a managing general agent for the Company's insurance subsidiaries and select third-party carriers; and
• Vantage Digital Insurance Solutions, Inc. — a Delaware corporation serving as the Company's financial technology and insurtech subsidiary, developing digital distribution platforms, parametric insurance products, and embedded insurance solutions.
The Company's regulated insurance subsidiaries are subject to extensive oversight by their respective state insurance departments, and Quorum itself is registered as an insurance holding company in Connecticut, Texas, and Ohio. The interplay between state insurance regulatory requirements and NYSE listing standards is relevant to certain governance considerations discussed herein.
B. Current Board and Committee Structure
Quorum's Board of Directors (the "Board") currently consists of eleven directors, of whom eight are classified as independent under the NYSE Listed Company Manual standards and three are management or otherwise non-independent directors.
Non-Independent Directors:
• Margaret A. Calloway — Chair of the Board and Chief Executive Officer. Ms. Calloway serves in a dual Chair/CEO capacity, which is a governance arrangement requiring enhanced oversight structures, including the designation of a Lead Independent Director.
• Dexter W. Ng — President, Quorum Property & Casualty Insurance Company. Mr. Ng serves as the chief executive of Quorum's largest regulated insurance subsidiary and is therefore a management director.
• Camille R. DuPont — President, Vantage Digital Insurance Solutions, Inc. Ms. DuPont is the chief executive of Quorum's fintech subsidiary and is classified as a management director.
Independent Directors:
• Arthur J. Pennington — Lead Independent Director. Mr. Pennington was designated Lead Independent Director in connection with Ms. Calloway's assumption of the combined Chair/CEO role in 2019, consistent with NYSE governance expectations.
• Dr. Lilian Fong-Archer — Designated as the Audit Committee financial expert. Dr. Fong-Archer is a former Chief Financial Officer of Pinehurst Financial Group, Inc.
• Raymond T. Huerta — Chair of the Risk Committee. Mr. Huerta brings experience as a former Chief Risk Officer of a global reinsurance company.
• Claudia M. Severin — Chair of the Compensation & Human Capital Committee. Ms. Severin is the Chief Executive Officer of Broadpath Talent Advisors, LLC, a human capital consulting firm.
• Jonathan K. Whitmore — Chair of the Investment Committee. Mr. Whitmore is a former Chief Investment Officer of a major insurance company.
• Priya Narasimhan — Proposed Chair of the new Technology & Cybersecurity Oversight Committee. Ms. Narasimhan is the Chief Executive Officer of Tessera Fintech Corp.
• Victor L. Andrade — Mr. Andrade is a retired senior partner of a major accounting firm with deep expertise in insurance accounting and regulatory compliance.
• Susan B. Trautman — Ms. Trautman is a Managing Director at Ridgeview Capital Partners, a private investment firm.
The Board currently maintains five standing committees:
The Board has approved, in principle, the establishment of a sixth standing committee — the Technology & Cybersecurity Oversight Committee — with Priya Narasimhan serving as the proposed Chair. The charter for this committee is among the deliverables of this engagement.
C. Charter History and Prior Amendments
All five existing committee charters were originally adopted on February 12, 2016, by action of the Board. The charters were drafted by Prescott, Henley & Gage LLP, Quorum's historical outside corporate counsel (contact: Marissa L. Tavares, Partner). Prescott, Henley & Gage served as Quorum's primary outside corporate counsel from the Company's initial public offering in 2012 through the commencement of C&H's engagement in 2025.
The charters have been subject to two rounds of targeted amendments since their original adoption:
First Set of Amendments — March 20, 2019. Amendments were adopted to the Audit Committee charter and the Nominating & Corporate Governance Committee charter. The Audit Committee charter amendments addressed certain changes to the scope of the committee's oversight of the independent auditor relationship, and the Nominating & Corporate Governance Committee charter amendments updated the director nomination process to include an express reference to the Board's commitment to diversity in director candidates. Neither set of amendments was comprehensive in scope.
Second Set of Amendments — June 14, 2021. Amendments were adopted to the Audit Committee charter and the Compensation & Human Capital Committee charter. The Audit Committee charter amendments addressed certain technical updates to internal-controls oversight language to conform with then-current PCAOB guidance. The Compensation & Human Capital Committee charter amendments consisted primarily of a nomenclature change — adding "Human Capital" to the committee's name — but substantive human capital management ("HCM") oversight language was not incorporated into the charter's statement of responsibilities. The addition of "Human Capital" to the committee name without corresponding substantive provisions has been identified as a gap in the current analysis.
The Risk Committee and Investment Committee charters have not been amended since their original adoption on February 12, 2016.
Critically, no charter updates have been made following the 2024 Amendments to NYSE Section 303A. As discussed in Section IV below, the 2024 Amendments introduced several changes that require corresponding updates to charter language and governance practices.
D. Key Third-Party Inputs
Several third-party communications have informed this analysis and have contributed to the Board's decision to undertake a comprehensive governance overhaul:
Garrett & Whitfield LLP Management Letter (March 14, 2025). Roland S. Brewer, Lead Engagement Partner, issued a management letter in connection with the fiscal year 2024 audit that identified, among other observations, the absence of a formal Technology & Information Security Committee charter despite the fact that the Board has been conducting ad hoc cybersecurity oversight discussions since at least 2023. The management letter noted that the absence of a formal committee charter creates ambiguity regarding the allocation of cybersecurity oversight responsibilities among the Audit Committee, the Risk Committee, and the full Board, and that this ambiguity is inconsistent with the SEC's cybersecurity disclosure rules adopted in 2023 (requiring disclosure of the board's role in cybersecurity risk oversight).
Apex Proxy Advisors, Inc. Benchmarking Report (June 30, 2025). Dana Durneval, Senior Vice President, Advisory Services, delivered a comprehensive governance benchmarking report comparing Quorum's governance framework against those of fourteen peer publicly traded insurance holding companies. Key findings of the Apex report relevant to this analysis include: (a) eleven of the fourteen peer companies have adopted either a standalone technology/cybersecurity committee or have added explicit cybersecurity oversight language to the charter of their audit or risk committee; (b) Quorum's charter language does not reflect the 2024 Amendments to Section 303A, and Quorum was identified as one of only three of the fourteen peer companies that had not updated their charters following the 2024 Amendments; (c) twelve of the fourteen peer companies include enterprise risk management oversight responsibility in their audit committee charters; and (d) all fourteen peer companies have adopted self-evaluation provisions in the charters of their mandated committees, which Quorum has not.
Veltrano Institutional Partners, LP Shareholder Letter (June 18, 2025). Terrence "Terry" Blackwood, Managing Partner, submitted a letter to the Board urging enhanced governance documentation and disclosure. Veltrano holds approximately 8.3% of Quorum's outstanding shares, making it one of the Company's largest institutional shareholders. The letter expressed concern regarding the age of Quorum's committee charters, the absence of a formal technology oversight committee, and the lack of a shareholder engagement protocol. While the letter was constructive in tone, it indicated that Veltrano would consider withholding support for director nominees at the 2026 annual meeting if governance improvements were not implemented.
Westbrook Fiduciary Trust Company. Elisa N. Fujimoto, Senior Portfolio Manager, expressed support for a comprehensive charter overhaul through informal engagement with the Company's investor relations team. Westbrook holds approximately 5.7% of Quorum's outstanding shares. While Westbrook did not submit a formal letter, its views have been communicated to the Board and are consistent with the governance improvement objectives of this engagement.
III. Applicable NYSE Listed Company Manual Provisions
This section provides a detailed analysis of each relevant provision of the NYSE Listed Company Manual Section 303A and its application to Quorum's current governance structure. For each provision, we identify Quorum's current compliance status and any gaps requiring remediation.
A. Section 303A.01 — Independent Directors
Requirement. Section 303A.01 requires that listed companies have a majority of independent directors on their boards. This is the most fundamental structural requirement of the NYSE corporate governance listing standards and is intended to ensure that the board maintains sufficient independence from management to exercise effective oversight.
Quorum Status. Quorum's Board currently consists of eleven directors, of whom eight (72.7%) are classified as independent under the NYSE independence standards. This exceeds the majority requirement by a comfortable margin. The three management directors — Margaret A. Calloway (Chair & CEO), Dexter W. Ng (President, Quorum P&C), and Camille R. DuPont (President, Vantage Digital) — constitute 27.3% of the Board, well within the permissible range.
Compliance Determination: Compliant.
We note that Arthur J. Pennington serves as Lead Independent Director, a role that is consistent with NYSE governance expectations for companies in which the same individual serves as both Chair and Chief Executive Officer. While the NYSE does not formally mandate a Lead Independent Director, commentary to Section 303A.01 strongly encourages the designation of a presiding director or lead independent director to chair executive sessions of independent directors. Ms. Calloway has held the combined Chair/CEO role since 2019, and Mr. Pennington's designation as Lead Independent Director at that time was a sound governance practice.
B. Section 303A.02 — Definition of Independence; Director Independence Tests
Requirement. Section 303A.02 establishes the definition of "independent director" for purposes of the NYSE listing standards and sets forth specific tests for determining whether a director qualifies as independent. A director qualifies as independent only if the board affirmatively determines that the director has no material relationship with the listed company, either directly or as a partner, shareholder, or officer of an organization that has a relationship with the company. The NYSE identifies several categories of relationships that preclude a determination of independence for specified periods, commonly referred to as the "bright-line" tests.
Detailed Independence Analysis. We have analyzed the independence of each of the eight directors classified as independent by the Board, applying both the bright-line tests and a broader assessment of material relationships. Our analysis is summarized below.
Arthur J. Pennington (Lead Independent Director). Mr. Pennington is a retired executive with no current employment or consulting relationship with Quorum or any of its subsidiaries. He has no family member who is employed by the Company. He has not received any compensation from Quorum other than director fees and equity compensation for board service. No disqualifying relationship exists. Independence confirmed.
Dr. Lilian Fong-Archer. Dr. Fong-Archer is a former Chief Financial Officer of Pinehurst Financial Group, Inc. She retired from that position in 2014, more than ten years prior to the current analysis period. There is no commercial, consulting, or employment relationship between Dr. Fong-Archer and Quorum. Pinehurst Financial Group is not a counterparty to any material transaction with Quorum. No disqualifying relationship exists. Independence confirmed.
Raymond T. Huerta. Mr. Huerta is a retired Chief Risk Officer of a global reinsurance company. His former employer does not have a material commercial relationship with Quorum. He has no family member employed by the Company. He has not received any compensation from Quorum other than director fees and equity compensation. No disqualifying relationship exists. Independence confirmed.
Claudia M. Severin. Ms. Severin is the Chief Executive Officer of Broadpath Talent Advisors, LLC, a human capital and talent management consulting firm. We have specifically confirmed that Broadpath Talent Advisors has not provided any consulting services to Quorum or any of its subsidiaries. There is no compensation consulting relationship between Broadpath and the Company. If Broadpath were to provide consulting services to Quorum in the future, this could create a disqualifying relationship under the enhanced independence standards applicable to compensation committee members under Section 303A.02(a)(ii). We recommend that any future engagement of Broadpath or any entity controlled by Ms. Severin be subject to prior review by the Nominating & Corporate Governance Committee to ensure that independence is not impaired. No disqualifying relationship currently exists. Independence confirmed.
Jonathan K. Whitmore. Mr. Whitmore is a retired Chief Investment Officer with no current employment or consulting relationship with Quorum. He does not serve on the board of any entity with which Quorum has a material commercial relationship. No disqualifying relationship exists. Independence confirmed.
Priya Narasimhan. Ms. Narasimhan is the Chief Executive Officer of Tessera Fintech Corp., a financial technology company. We have specifically confirmed that Tessera Fintech Corp. does not have any commercial relationship with Quorum or any of its subsidiaries, including Vantage Digital Insurance Solutions, Inc. Given the overlapping fintech and insurtech space in which both Tessera and Vantage Digital operate, we recommend ongoing monitoring of any potential commercial relationships that could develop. As of the date of this memorandum, no disqualifying relationship exists. Independence confirmed.
Victor L. Andrade. Mr. Andrade is a retired senior partner of a major accounting firm. His former firm does not serve as Quorum's independent auditor (that role is held by Garrett & Whitfield LLP), and Mr. Andrade has been retired for more than five years. No disqualifying relationship exists. Independence confirmed.
Susan B. Trautman. Ms. Trautman is a Managing Director at Ridgeview Capital Partners, a private investment firm. We have specifically confirmed that Ridgeview Capital Partners does not have any advisory, lending, or other financial relationship with Quorum or any of its subsidiaries. Ridgeview Capital Partners is distinct from Veltrano Institutional Partners, LP (the shareholder that submitted the June 18, 2025 letter), and there is no affiliation between the two entities despite the similarity in names. No disqualifying relationship exists. Independence confirmed.
Management Directors. The three management directors — Margaret A. Calloway, Dexter W. Ng, and Camille R. DuPont — are properly classified as non-independent by virtue of their employment relationships with the Company or its subsidiaries. Each holds a senior executive position that constitutes a disqualifying employment relationship under the bright-line tests.
Compliance Determination: Compliant. All eight directors classified as independent satisfy the independence tests under Section 303A.02, and all directors serving on the Audit, Compensation, and Nominating/Corporate Governance Committees have been confirmed as independent. No director currently serving on any mandated committee has any disqualifying relationship.
C. Section 303A.04 — Nominating/Corporate Governance Committee
Requirement. Section 303A.04 requires that listed companies maintain a Nominating/Corporate Governance Committee composed entirely of independent directors and that the committee operate under a written charter. Section 303A.04(b) specifies mandatory charter content, which must include provisions addressing: (i) the identification and selection of director candidates, including criteria for selecting nominees and policies regarding the consideration of diversity; (ii) the development and recommendation to the board of corporate governance guidelines applicable to the company; and (iii) oversight of the evaluation of the board and management.
Quorum Status. The Nominating & Corporate Governance Committee is chaired by Arthur J. Pennington (independent) and is composed entirely of independent directors. This satisfies the composition requirement of Section 303A.04.
Compliance Determination — Composition: Compliant.
Charter Content Analysis. The current Nominating & Corporate Governance Committee charter was last amended on March 20, 2019. Our review has identified the following gaps relative to the requirements of Section 303A.04(b) and current best practices:
(i) Self-Evaluation Oversight. Section 303A.04(b)(iii) requires that the charter include a provision addressing the committee's responsibility for oversight of the evaluation of the board and management. The current charter does not include a self-evaluation oversight provision. This is a compliance gap, not merely a best-practice deficiency. The restated charter must include an express provision establishing the Nominating & Corporate Governance Committee's responsibility for overseeing the annual self-evaluation process for the full board and all standing committees.
(ii) Director Skills Matrix. The current charter does not require the development or maintenance of a director skills matrix identifying the competencies, experiences, and attributes desired in board members. While not explicitly mandated by Section 303A.04, the use of a skills matrix is a widely adopted best practice — all fourteen of Quorum's peer companies identified in the Apex benchmarking report maintain and disclose a skills matrix. The restated charter should include a requirement for the committee to develop and annually review a director skills matrix.
(iii) ESG/Sustainability Oversight. The current charter does not include any reference to the committee's role in overseeing environmental, social, and governance ("ESG") or sustainability matters. The Apex benchmarking report flagged this as a notable omission, noting that ten of the fourteen peer companies have assigned ESG oversight responsibility to either the Nominating/Corporate Governance Committee or a dedicated sustainability committee. The restated charter should include a provision establishing the committee's responsibility for oversight of ESG and sustainability governance.
(iv) Shareholder Engagement Protocol. The current charter does not include any protocol or framework for director-shareholder engagement on governance matters. Given the governance concerns expressed by Veltrano Institutional Partners (8.3% holder) and the informal engagement by Westbrook Fiduciary Trust Company (5.7% holder), and in light of the proposed Amended & Restated Corporate Governance Guidelines (which will include a shareholder engagement protocol), the restated charter should establish the committee's responsibility for overseeing the shareholder engagement protocol.
(v) Board Refreshment Policies. The current charter does not address board refreshment, including director tenure limits or mandatory retirement age. The proposed Amended & Restated Corporate Governance Guidelines will include a mandatory retirement age of 75 and a 15-year tenure limit for independent directors. The restated charter should include the committee's responsibility for monitoring compliance with these policies and making recommendations regarding board refreshment.
Compliance Determination — Charter Content: Partially Compliant. The absence of the self-evaluation oversight provision represents a specific gap against Section 303A.04(b)(iii). The remaining items, while significant governance best-practice gaps, are not strict violations of the NYSE rule. All identified gaps will be addressed in the proposed restated charter.
D. Section 303A.05 — Compensation Committee
Requirement. Section 303A.05 requires that listed companies maintain a Compensation Committee composed entirely of independent directors and that the committee operate under a written charter. In addition to the general independence standards of Section 303A.02, compensation committee members are subject to enhanced independence requirements under Section 303A.02(a)(ii), which require the board to consider all factors specifically relevant to determining whether a director has a relationship to the company that is material to that director's ability to be independent from management in connection with the duties of a compensation committee member, including the source of compensation of such director (including any consulting, advisory, or other compensatory fee paid by the company to such director) and whether such director is affiliated with the company, a subsidiary of the company, or an affiliate of a subsidiary of the company.
Section 303A.05(b) specifies mandatory charter content: (i) the committee's purposes and responsibilities, which at minimum must be to have direct responsibility for the review and approval of corporate goals and objectives relevant to CEO compensation, evaluation of CEO performance in light of those goals, and, either as a committee or together with the other independent directors, determination of CEO compensation; (ii) the committee's authority to retain and terminate compensation consultants, independent legal counsel, and other advisors, with sole authority to do so without requiring further board approval; (iii) the company's obligation to provide appropriate funding, as determined by the committee, for payment of reasonable compensation to any advisor retained by the committee; and (iv) an annual performance evaluation of the committee.
Quorum Status. The Compensation & Human Capital Committee is chaired by Claudia M. Severin (independent) and is composed entirely of independent directors. Enhanced independence for all members has been confirmed, as discussed in Section III.B above. The composition requirement is satisfied.
Compliance Determination — Composition: Compliant.
Charter Content Analysis. The current Compensation & Human Capital Committee charter was last amended on June 14, 2021. Our review has identified the following gaps:
(i) Independent Advisor Retention Authority. Section 303A.05(b)(ii) requires that the charter establish the committee's sole authority to retain and terminate compensation consultants, legal counsel, and other advisors, without requiring further board approval. The current charter contains language requiring the committee to obtain further board approval before retaining an outside compensation consultant. This is a direct compliance gap. The restated charter must establish the committee's sole authority to retain and terminate advisors without board approval.
(ii) Human Capital Management Oversight Language. In 2021, the committee's name was amended to add "Human Capital," but no substantive HCM oversight language was incorporated into the charter. This creates an inconsistency between the committee's name and its stated responsibilities. The restated charter should include substantive provisions addressing the committee's oversight of human capital management, including workforce composition, talent development, diversity and inclusion initiatives, employee engagement, pay equity, and succession planning.
(iii) Annual Self-Evaluation Provision. Section 303A.05(b)(iv) requires the charter to include an annual performance evaluation of the committee. The current charter does not contain this provision. This is a compliance gap. The restated charter must include an annual self-evaluation requirement.
(iv) Funding Authority. Section 303A.05(b)(iii) requires the charter to include a provision establishing the company's obligation to provide appropriate funding for compensation of any advisor retained by the committee. The current charter does not explicitly state this obligation. While the committee has in practice been able to engage advisors, the absence of an express funding authority provision is a compliance gap. The restated charter must include an explicit funding authority provision.
Compliance Determination — Charter Content: Partially Compliant. Three specific compliance gaps have been identified: (a) the requirement for further board approval of consultant retention, which is inconsistent with the sole authority mandate of Section 303A.05(b)(ii); (b) the absence of an annual self-evaluation provision required by Section 303A.05(b)(iv); and (c) the absence of an explicit funding authority provision required by Section 303A.05(b)(iii). All identified gaps will be addressed in the proposed restated charter.
E. Section 303A.06 — Audit Committee
Requirement. Section 303A.06, read in conjunction with SEC Rule 10A-3 (which the NYSE listing standards incorporate by reference), establishes the composition requirements for the Audit Committee. The committee must have a minimum of three members, all of whom must be independent under both the NYSE independence standards and the heightened independence standards of Rule 10A-3. Each member must be "financially literate" as determined by the board in its business judgment, and at least one member must have "accounting or related financial management expertise" — again, as determined by the board. The SEC has also adopted the concept of an "audit committee financial expert" under Item 407(d)(5) of Regulation S-K, which requires disclosure of whether the audit committee includes at least one member who qualifies as a financial expert and, if so, the identity and qualifications of that member.
Additional independence requirements applicable to audit committee members: no member of the Audit Committee may receive any compensatory fee from the company other than (i) director's fees (which may include fees paid in cash, stock, stock options, or other in-kind consideration ordinarily available to directors) and (ii) fixed amounts of compensation under a retirement plan for prior service (provided that such compensation is not contingent in any way on continued service). No audit committee member may be an "affiliated person" of the company or any subsidiary of the company.
Quorum Status. The Audit Committee is chaired by Dr. Lilian Fong-Archer (independent) and consists of three or more independent members. Dr. Fong-Archer has been designated by the Board as the audit committee financial expert.
Dr. Fong-Archer's Financial Expert Qualifications. Dr. Fong-Archer's qualification as an audit committee financial expert under both the NYSE financial literacy and SEC financial expert definitions is supported by the following:
• Education: Ph.D. in Finance, Wharton School of the University of Pennsylvania; MBA, Columbia Business School; CPA (inactive license, New York).
• Professional Experience: Dr. Fong-Archer served as Chief Financial Officer of Pinehurst Financial Group, Inc. (a publicly traded diversified financial services company) from 2005 to 2014, during which time she was responsible for all financial reporting, treasury operations, and regulatory capital compliance. Prior to that role, she served as Vice President of Finance and Controller at Pinehurst from 2001 to 2005.
• Understanding of GAAP: Through her extensive experience as a CFO of a publicly traded company, Dr. Fong-Archer possesses a thorough understanding of generally accepted accounting principles ("GAAP") and financial statements, including the application of such principles in connection with the accounting for estimates, accruals, and reserves.
• Internal Controls Experience: Dr. Fong-Archer has direct experience with the preparation, auditing, analysis, and evaluation of financial statements of a complexity and breadth comparable to those of Quorum, and has experience with internal accounting controls and procedures for financial reporting.
• Audit Committee Experience: Dr. Fong-Archer has served on the audit committees of three publicly traded companies (in addition to Quorum) since her retirement from Pinehurst in 2014, providing her with substantial experience in audit committee functions, including the selection and oversight of independent auditors and the review of financial statements.
Dr. Fong-Archer satisfies the definition of "audit committee financial expert" under Item 407(d)(5)(ii) of Regulation S-K and the NYSE's "accounting or related financial management expertise" standard under Section 303A.06.
No member of the Audit Committee receives any compensatory fee from the Company other than director's fees, and no member is an affiliated person of the Company or any subsidiary. The heightened independence requirements of SEC Rule 10A-3 are satisfied.
Compliance Determination — Composition: Compliant.
F. Section 303A.07 — Audit Committee Charter Requirements
Requirement. Section 303A.07 imposes detailed charter content mandates for the Audit Committee. Section 303A.07(b) requires that the charter must address, at a minimum:
(i) the purpose of the committee, which is to assist board oversight of: (a) the integrity of the company's financial statements, (b) the company's compliance with legal and regulatory requirements, (c) the independent auditor's qualifications and independence, and (d) the performance of the company's internal audit function and independent auditors;
(ii) the duties and responsibilities of the committee regarding the engagement, retention, compensation, and oversight of the work of the independent auditor, including sole authority to appoint or replace the independent auditor, which must report directly to the committee;
(iii) complaint-handling procedures for the receipt, retention, and treatment of complaints received by the company regarding accounting, internal accounting controls, or auditing matters, and for the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters;
(iv) the authority of the committee to engage independent counsel and other advisors as it determines necessary to carry out its duties; and
(v) appropriate funding, as determined by the committee, for payment of (a) compensation to the independent auditor, (b) compensation to any advisors engaged by the committee, and (c) ordinary administrative expenses of the committee.
Additionally, Section 303A.07(c) provides that the charter must require the committee to, at minimum: (i) review and discuss annual and quarterly financial statements with management, (ii) discuss the company's financial press releases and financial guidance provided to analysts and rating agencies, (iii) discuss risk assessment and risk management policies, (iv) meet separately and periodically with management, internal auditors, and the independent auditor, (v) review with the independent auditor any audit problems or difficulties, and (vi) set clear hiring policies for employees or former employees of the independent auditor.
Section 303A.07(b)(iii)(F) also requires that the charter include a provision for an annual performance evaluation of the committee.
Quorum Status — Charter Content Analysis. The current Audit Committee charter was last amended on June 14, 2021. Our review has identified the following gaps:
(i) Enterprise Risk Management Oversight. The current charter does not include an explicit provision establishing the Audit Committee's role in enterprise risk management ("ERM") oversight. While Section 303A.07(c)(iii) requires discussion of risk assessment and risk management policies, the current charter's treatment of this responsibility is limited to a brief reference to "reviewing with management the company's financial risk exposures." The Apex benchmarking report found that twelve of the fourteen peer companies include more comprehensive ERM oversight responsibility in their audit committee charters. Moreover, the current charter does not include any coordination protocol with the Risk Committee (chaired by Raymond T. Huerta), creating potential ambiguity in the allocation of risk oversight responsibilities between the two committees. The restated charter should include a more comprehensive ERM oversight provision and a clear coordination protocol with the Risk Committee.
(ii) Clawback Policy Administration. The current charter does not include any reference to the administration or oversight of the Company's clawback policy adopted pursuant to SEC Rule 10D-1 and NYSE Rule 303A.14. This is a significant gap given the Audit Committee's role in financial statement oversight and its relationship with the independent auditor. The restated charter must include explicit provisions for clawback policy administration and oversight. This issue is discussed in detail in Section VII below.
(iii) Annual Self-Evaluation Provision. Section 303A.07(b)(iii)(F) requires that the charter include a provision for an annual performance evaluation of the committee. The current charter does not contain this provision. This is a compliance gap that must be addressed in the restated charter.
(iv) Cybersecurity-Related Financial Reporting Risks. The current charter does not reference the committee's role in oversight of cybersecurity-related financial reporting risks. Given the SEC's cybersecurity disclosure rules adopted in 2023, which require disclosure regarding the board's role in cybersecurity risk oversight, and the materiality of cybersecurity risks to the Company's insurance operations and fintech subsidiary, the restated charter should include a provision addressing the committee's oversight of cybersecurity-related financial reporting and disclosure matters. A coordination protocol with the proposed Technology & Cybersecurity Oversight Committee should also be included.
(v) Coordination with Risk Committee. As noted above, the current charter does not include any coordination protocol with the Risk Committee. Given the overlapping nature of certain risk oversight responsibilities, a formalized coordination protocol is a governance best practice that should be incorporated into the restated charters of both committees.
Compliance Determination — Charter Content: Partially Compliant. The absence of the annual self-evaluation provision represents a specific compliance gap against Section 303A.07(b)(iii)(F). The absence of clawback policy administration language, while technically a gap under Section 303A.14 rather than Section 303A.07, is most appropriately addressed through the Audit Committee charter. The remaining items are significant best-practice gaps that should be remedied.
G. Section 303A.09 — Corporate Governance Guidelines
Requirement. Section 303A.09 requires that listed companies adopt and disclose a set of corporate governance guidelines addressing certain specified topics, including: director qualification standards, director responsibilities, director access to management and independent advisors, director compensation, director orientation and continuing education, management succession, and an annual performance evaluation of the board.
Quorum Status. Quorum currently maintains corporate governance guidelines that are in effect and have been posted on the Company's investor relations website. However, the current guidelines have not been comprehensively updated since their original adoption, and they do not address several topics that have become standard governance practices or that are necessary to comply with the 2024 Amendments.
The following key amendments are proposed in the Amended & Restated Corporate Governance Guidelines, which are being developed as part of this engagement:
(i) Mandatory Retirement Age. The proposed guidelines establish a mandatory retirement age of 75 for independent directors. Upon reaching age 75, a director will not be eligible for nomination for an additional term at the next annual meeting of shareholders. The Nominating & Corporate Governance Committee will have authority to grant a one-year extension in extraordinary circumstances.
(ii) Tenure Limit. The proposed guidelines establish a 15-year tenure limit for independent directors. An independent director who has served on the Board for fifteen consecutive years will not be eligible for nomination for an additional term, subject to a one-year extension authority vested in the Nominating & Corporate Governance Committee.
(iii) Overboarding Policy. The proposed guidelines establish the following limits on outside board service: independent directors may serve on a maximum of four total public-company boards (including Quorum); the CEO may serve on a maximum of two total public-company boards (including Quorum). Directors will be required to notify the Nominating & Corporate Governance Committee prior to accepting an invitation to serve on another public-company board.
(iv) Majority Voting Standard. The proposed guidelines will adopt a majority voting standard for uncontested director elections, replacing the current plurality voting standard. Under the majority voting standard, a director nominee in an uncontested election will be required to receive a majority of the votes cast in order to be elected. An incumbent director who fails to receive a majority of the votes cast will be required to tender his or her resignation to the Board, and the Nominating & Corporate Governance Committee will recommend to the Board whether to accept or reject the resignation.
(v) Shareholder Engagement Protocol. The proposed guidelines establish a formal shareholder engagement protocol under which the Lead Independent Director and the Chair of the Nominating & Corporate Governance Committee will be available for engagement with holders of three percent (3%) or more of the Company's outstanding shares on governance matters upon request.
(vi) Formalized Self-Evaluation Process. The proposed guidelines include a formalized annual board and committee self-evaluation process, with results reviewed by the Nominating & Corporate Governance Committee and reported to the full Board.
These amendments align with the content expectations of Section 303A.09 and with the peer best practices identified in the Apex benchmarking report.
Compliance Determination: Compliant (with the current guidelines), but significant updates are warranted to align with current best practices and the 2024 Amendments.
H. Section 303A.10 — Code of Business Conduct and Ethics
Requirement. Section 303A.10 requires that listed companies adopt and disclose a code of business conduct and ethics for directors, officers, and employees, addressing certain specified topics including conflicts of interest, corporate opportunities, confidentiality, fair dealing, protection and proper use of company assets, compliance with laws, rules, and regulations, and encouraging the reporting of any illegal or unethical behavior.
Quorum Status. Quorum maintains a Code of Business Conduct and Ethics that complies with the requirements of Section 303A.10. Our review of the code does not identify any specific deficiencies requiring immediate remediation. However, we note that the governance overhaul contemplated by this engagement — particularly the adoption of new committee charters, amended governance guidelines, and updated clawback policies — may warrant a conforming review of the Code to ensure consistency across governance documents.
We also note that if the Code of Ethics applicable to the Company's principal executive officer and principal financial officer is materially amended in connection with this governance overhaul, a Form 8-K filing under Item 5.05 would be required. If the amendments are limited to conforming updates that do not constitute a material amendment to the Code of Ethics, an Item 8.01 voluntary disclosure in the Form 8-K filing for the overall governance overhaul may be appropriate.
Compliance Determination: Compliant. Conforming review recommended.
I. Section 303A.12 — CEO Certification
Requirement. Section 303A.12 requires that the CEO of each listed company certify annually to the NYSE that she or he is not aware of any violation by the company of the NYSE corporate governance listing standards, qualifying the certification to the extent necessary to indicate any material qualifications. The certification must be filed with the NYSE promptly after any change to the company's governance. In addition, the CEO must promptly notify the NYSE in writing after any executive officer of the listed company becomes aware of any non-compliance with any applicable provisions of Section 303A.
Implications for Current Project. Following the adoption of the comprehensive governance overhaul package at the December 11, 2025 board meeting, Margaret A. Calloway, Chair and CEO, will be required to file an updated certification with the NYSE confirming compliance with the corporate governance listing standards as reflected in the restated charters, amended governance guidelines, and other governance documents. This certification must be filed within thirty days of the governance changes taking effect — that is, by approximately January 10, 2026.
We recommend that C&H prepare a draft certification for Ms. Calloway's review in advance of the December 11, 2025 board meeting, so that the certification can be promptly filed following adoption.
Compliance Determination: Currently Compliant. Post-adoption certification will be required.
J. Section 303A.13 — Website and Public Filing Requirements
Requirement. Section 303A.13 requires that listed companies make their committee charters available on or through the company's website. Specifically, companies must post the charters of each of the mandated committees (Audit, Compensation, and Nominating/Corporate Governance), as well as the company's corporate governance guidelines, on the company's website. The NYSE expects that updated charters will be posted within a reasonable time following adoption.
Quorum Status. Quorum's current committee charters are posted on the Company's investor relations website at www.quoruminsurance.com/investors/governance. Following adoption of the restated charters at the December 11, 2025 board meeting, updated charters must be posted within five business days — i.e., by December 18, 2025.
In addition, the Company anticipates filing a Current Report on Form 8-K on or about December 15, 2025, disclosing the adoption of the governance overhaul package, including the restated committee charters, the Amended & Restated Corporate Governance Guidelines, and the establishment of the Technology & Cybersecurity Oversight Committee.
Compliance Determination: Compliant. Post-adoption actions are required and have been incorporated into the project timeline (see Appendix C).
IV. Analysis of the 2024 Amendments to Section 303A
In 2024, the NYSE adopted amendments to Section 303A of the Listed Company Manual (the "2024 Amendments"). These amendments updated several provisions governing board and committee composition, charter content requirements, and corporate governance disclosure practices. The 2024 Amendments reflect the NYSE's effort to align its listing standards with evolving regulatory expectations and governance best practices.
Quorum's current charter language does not reflect the 2024 Amendments. This gap was identified both in C&H's Initial Gap Analysis Memorandum of October 3, 2025, and in the Apex Proxy Advisors benchmarking report of June 30, 2025. The Apex report further noted that Quorum was one of only three of the fourteen peer companies that had not updated their charters following the 2024 Amendments, placing the Company in the bottom quartile of peer governance compliance.
Below, we provide a category-by-category analysis of how each 2024 Amendment affects Quorum's existing charters and governance guidelines, along with specific remediation measures proposed in the restated charters and amended governance guidelines.
Enhanced Independence Considerations. The 2024 Amendments reinforced the requirement for boards to conduct a thorough, fact-specific analysis of director independence, with particular emphasis on indirect relationships that may not be captured by the bright-line tests. The amendments emphasize that boards should consider all relevant relationships, including those involving entities affiliated with the director, when making independence determinations. Quorum's current governance guidelines do not include a formalized process for the Board's annual independence determination beyond the bright-line test analysis. The proposed Amended & Restated Corporate Governance Guidelines include a formalized annual independence review process, with the Nominating & Corporate Governance Committee conducting a comprehensive relationship review for each independent director and making a recommendation to the full Board.
Committee Charter Content Updates. The 2024 Amendments clarified and, in certain respects, expanded the charter content requirements for mandated committees. The amendments emphasized the importance of explicit provisions regarding the committee's authority to retain independent advisors and the company's obligation to provide funding for such advisors. While these requirements existed in substance prior to the 2024 Amendments, the updated language provides greater specificity. Quorum's existing charters, particularly the Compensation & Human Capital Committee charter (which conditions consultant retention on further board approval), are not aligned with the clarified requirements.
Self-Evaluation Process. The 2024 Amendments reinforced the requirement for annual committee self-evaluations and emphasized the role of the Nominating/Corporate Governance Committee in overseeing the evaluation process for the full board and all committees. As noted throughout this memorandum, the annual self-evaluation provision is absent from all five of Quorum's existing committee charters — a compliance gap that is now further underscored by the 2024 Amendments.
Disclosure Practices. The 2024 Amendments encouraged enhanced disclosure regarding governance practices, including committee composition, director qualifications, and the rationale for governance structures. While many of these disclosures are already addressed in the Company's annual proxy statement, the restated charters and amended governance guidelines will provide a stronger foundation for the disclosure practices expected under the updated standards.
Specific Remediation Measures. Each of the proposed restated charters and the Amended & Restated Corporate Governance Guidelines has been drafted (or will be drafted) to specifically address the 2024 Amendments. The following cross-references identify where each 2024 Amendment is addressed in the proposed governance documents:
The proposed governance overhaul will bring Quorum into full compliance with the 2024 Amendments and align the Company with the governance practices adopted by the majority of its peer companies.
V. Analysis of the Proposed Technology & Cybersecurity Oversight Committee
A. NYSE Requirements for Non-Mandated Committees
The NYSE Listed Company Manual mandates that listed companies maintain three standing board committees: an Audit Committee, a Compensation Committee, and a Nominating/Corporate Governance Committee. The establishment of additional committees — including the Risk Committee and Investment Committee that Quorum has maintained since 2016, and the proposed Technology & Cybersecurity Oversight Committee — is entirely within the Board's discretion and is not mandated by NYSE rules.
However, while the NYSE does not impose specific content mandates on the charters of non-mandated committees, any committee established by the Board should have a written charter that is consistent with good governance practices, the Company's certificate of incorporation and bylaws, and applicable Delaware law. We recommend that the charter of the Technology & Cybersecurity Oversight Committee be drafted to comply with the general standards applied to NYSE-required committees, even though strict compliance with those standards is not technically required. This approach ensures consistency across all committee charters, reduces the risk of governance gaps, and demonstrates to shareholders and proxy advisors that the Company applies equivalent rigor to all board-level oversight structures.
Under Delaware General Corporation Law Section 141(c), the Board has broad authority to establish committees of the board and to delegate authority to such committees, subject to certain limitations (e.g., committees may not approve mergers, recommend amendments to the certificate of incorporation, or adopt or repeal bylaws). The establishment of a Technology & Cybersecurity Oversight Committee and the delegation of cybersecurity and technology oversight authority to that committee are well within the Board's powers under Delaware law.
B. Proposed Composition
The proposed composition of the Technology & Cybersecurity Oversight Committee is as follows:
• Priya Narasimhan (Chair) — Independent director; CEO of Tessera Fintech Corp.; significant expertise in financial technology, cybersecurity, and digital transformation.
• Victor L. Andrade — Independent director; retired senior partner of a major accounting firm; expertise in technology risk assessment and controls within the context of financial statement audits.
• Camille R. DuPont — Management director (non-voting advisory member); President of Vantage Digital Insurance Solutions, Inc.; deep expertise in insurtech, digital distribution platforms, and technology strategy.
The proposed charter for the Technology & Cybersecurity Oversight Committee establishes a minimum composition requirement of three independent directors, with at least one member possessing cybersecurity or technology expertise as determined by the Board.
Composition Analysis. The current proposed composition includes only two independent voting members (Narasimhan and Andrade), with DuPont serving as a non-voting advisory member. DuPont's advisory role is permissible under Delaware law and is consistent with peer practices — several of the peer companies identified in the Apex benchmarking report include management directors as non-voting advisory or ex officio members of their technology committees, leveraging management expertise without compromising committee independence.
However, the Board will need to appoint at least one additional independent director to the committee in order to satisfy the charter's own minimum requirement of three independent directors. We recommend that the Board identify a suitable candidate from among the existing independent directors or, if the Board determines that additional expertise is needed, consider expanding the Board to include a new independent director with cybersecurity or technology qualifications. Based on our review of the current Board's qualifications, Susan B. Trautman may be a suitable candidate for the third independent director seat, given her experience in technology-focused private equity investing at Ridgeview Capital Partners, though the Board should make this determination based on its assessment of the directors' respective expertise and availability.
C. Peer Benchmarking
The Apex Proxy Advisors benchmarking report provides valuable context for the Board's decision to establish a standalone Technology & Cybersecurity Oversight Committee. Of the fourteen peer companies analyzed:
• Eight (57%) have established a standalone technology, cybersecurity, or information security committee of the board;
• Three (21%) have added explicit cybersecurity oversight language to their existing audit committee or risk committee charters without establishing a standalone committee;
• Three (22%), including Quorum, have neither a standalone committee nor explicit charter language addressing cybersecurity oversight.
Quorum's approach — establishing a standalone committee with defined coordination protocols to both the Risk Committee and the Audit Committee — is consistent with the majority peer approach and represents a meaningful governance enhancement. The Garrett & Whitfield management letter's specific identification of this gap as an audit observation further supports the Board's decision.
D. Charter Content Alignment
The proposed charter for the Technology & Cybersecurity Oversight Committee has been designed to address the following oversight areas:
• Cybersecurity Program. Oversight of the Company's cybersecurity program, including strategy, policies, risk assessments, threat landscape monitoring, incident response preparedness, and compliance with applicable cybersecurity laws and regulations.
• Information Technology Strategy. Oversight of the Company's information technology strategy, including infrastructure modernization, cloud migration, and digital transformation initiatives.
• Data Privacy. Oversight of the Company's data privacy program, including compliance with applicable data protection laws (including state insurance data security regulations and emerging federal privacy frameworks).
• Insurtech Initiatives. Oversight of the Company's insurtech initiatives through Vantage Digital Insurance Solutions, Inc., including parametric insurance products, embedded insurance platforms, and digital distribution strategies.
• Artificial intelligence Gover

PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION

MEMORANDUM

Record

Parties

Dates

Amounts