MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
FROM: Elaine Forsythe and Natasha Forbes Calderwood & Harkness LLP 1585 Broadway, 34th Floor New York, NY 10036
TO: Dennis R. Okonkwo General Counsel & Corporate Secretary Quorum Insurance Holdings Corp. 280 Asylum Street, Suite 2200 Hartford, CT 06103
CC: Ivan D. Pruett, Chief Compliance Officer Renata M. Vásquez, Chief Audit Executive Arthur J. Pennington, Lead Independent Director & Chair, Nominating & Corporate Governance Committee
October 3, 2025
RE: Peer Benchmarking Summary & Recommendations — Synthesis of Apex Proxy Advisors Governance Benchmarking Report and Calderwood & Harkness Legal Analysis
ENGAGEMENT NO.: 1025-00005
This memorandum is delivered concurrently with the Initial Gap Analysis Memoranda, though it synthesizes the Apex Proxy Advisors, Inc. governance benchmarking report delivered on June 30, 2025 with Calderwood & Harkness LLP's ("C&H") independent legal and governance analysis. This memorandum is protected by the attorney-client privilege and the work-product doctrine. Distribution is restricted to the addressee, the individuals copied above, and authorized members of the Board of Directors of Quorum Insurance Holdings Corp. ("Quorum," "QIH," or the "Company").
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to synthesize the governance benchmarking report delivered by Apex Proxy Advisors, Inc. ("Apex") — specifically, the report authored under the direction of Dana Durneval, Senior Vice President, Advisory Services — on June 30, 2025 (the "Apex Report") with C&H's independent legal and regulatory analysis, and to provide actionable, peer-informed recommendations for the comprehensive governance overhaul currently underway. This memorandum is intended to serve as the primary reference document for the Nominating & Corporate Governance Committee's October 17, 2025 workshop, and ultimately to inform the board resolutions anticipated for adoption at the December 11, 2025 board meeting.
The Apex Report benchmarked Quorum Insurance Holdings Corp. (NYSE: QIHC) against a carefully selected peer group of fourteen (14) publicly traded insurance holding companies (the "Peer Group"). The benchmarking analysis covered five principal governance dimensions: (i) board committee structure, (ii) committee charter content and currency, (iii) delegation-of-authority practices and dollar thresholds, (iv) corporate governance guideline provisions, and (v) shareholder engagement and board refreshment mechanisms. The Peer Group was selected on the basis of comparable market capitalization range, multi-line or specialty insurance operations, and similar regulatory profiles, including domicile in multiple U.S. states with active state-level insurance holding company regulatory regimes. The composition of the Peer Group is described in general terms in Appendix A hereto, consistent with Apex's confidentiality protocol.
This engagement, and the broader governance overhaul initiative, was precipitated by several converging developments:
• Garrett & Whitfield LLP Management Letter (March 14, 2025). The Company's independent auditors, Garrett & Whitfield LLP, issued a management letter in connection with the fiscal year 2024 audit identifying, among other matters, delegation-of-authority matrix ("DOA Matrix") gaps, inconsistencies between parent-level and subsidiary-level authority thresholds, and the absence of a formal Technology & Information Security Committee charter. The management letter characterized certain of these findings as control observations warranting prompt remediation.
• Veltrano Institutional Partners Shareholder Letter (June 18, 2025). Veltrano Institutional Partners, LP, the Company's largest institutional shareholder (holding approximately 8.3% of outstanding shares), submitted a letter from its Managing Partner, Terrence "Terry" Blackwood, urging the Board to undertake a comprehensive governance modernization initiative. The letter specifically identified committee charter currency, delegation-of-authority thresholds, and the absence of a majority voting standard as areas of concern.
• Westbrook Fiduciary Trust Company Informal Engagement. Westbrook Fiduciary Trust Company, the Company's second-largest institutional holder (approximately 5.7% of outstanding shares), through its Director of Corporate Governance, Elisa N. Fujimoto, informally expressed support for a comprehensive charter overhaul during routine engagement with the Company's investor relations team.
Overall Finding. Based on our synthesis of the Apex Report and C&H's independent legal and regulatory analysis, Quorum's governance documentation lags behind the majority of its peers in several critical dimensions. The deficiencies are not limited to any single area but span committee structure, charter currency, delegation thresholds, director governance policies, and shareholder engagement protocols. While Quorum's governance practices are not in violation of any minimum legal or listing requirements (with the possible exception of certain post-2024 NYSE amendments that require updated charter language), the Company's documentation has not kept pace with evolving market practice, regulatory expectations, or the Company's own growth trajectory. This gap creates both reputational risk with institutional shareholders and proxy advisory firms and operational risk arising from outdated and inconsistent authority delegations.
The following headline statistics frame the magnitude of the gap:
• Technology & Cybersecurity Oversight: 11 of 14 peers (78.6%) have adopted either a standalone technology/cybersecurity committee or embedded explicit cybersecurity oversight mandates in existing committee charters. Quorum has neither.
• DOA Matrix Currency: 12 of 14 peers (85.7%) have comprehensively updated their DOA matrices within the prior 24 months (i.e., since mid-2023). Quorum's DOA Matrix was last comprehensively updated on October 6, 2017 — over eight years ago — with only a narrow interim amendment to claims-payment thresholds on April 22, 2020.
• Charter Currency: 12 of 14 peers completed comprehensive charter restatements within the prior three years. Quorum's charters have not been comprehensively updated since their original adoption on February 12, 2016, with only piecemeal amendments in 2019 (Nominating & Corporate Governance Committee) and 2021 (Compensation & Human Capital Committee name change).
• Governance Guideline Provisions: The majority of peers have adopted mandatory retirement ages, tenure limits, overboarding policies, majority voting standards, and formalized self-evaluation processes. Quorum has adopted none of these provisions.
This memorandum presents specific, peer-informed recommendations for each of these areas, organized to facilitate the structured review process contemplated by the implementation timeline set forth in Section VIII.
II. Scope & Methodology
A. The Apex Proxy Advisors Benchmarking Report
The Apex Proxy Advisors governance benchmarking report was commissioned by Quorum's investor relations team during the second quarter of 2025, following the receipt of the Garrett & Whitfield management letter and in anticipation of the Veltrano shareholder engagement. The report was delivered on June 30, 2025. Apex Proxy Advisors, Inc., with principal offices at 450 Lexington Avenue, Suite 3100, New York, NY 10017, is retained as the Company's governance benchmarking consultant and has served in that capacity for Quorum since 2022, although no prior benchmarking study of comparable scope had previously been commissioned.
The Peer Group comprises fourteen (14) publicly traded insurance holding companies selected on the basis of the following criteria:
(i) Comparable market capitalization range, generally between $2.5 billion and $10.0 billion, encompassing the mid-cap segment of the insurance sector in which Quorum operates;
(ii) Multi-line or specialty insurance operations, including companies writing both commercial and personal lines and/or specialty lines such as excess and surplus, surety, and professional liability;
(iii) Similar regulatory profiles, including domicile or significant operations in multiple U.S. states with active insurance holding company regulatory regimes (including, but not limited to, Connecticut, Texas, Ohio, New York, Illinois, and Pennsylvania);
(iv) NYSE or Nasdaq listing, ensuring comparability of exchange listing governance requirements; and
(v) At least three years of public operating history as an independent, publicly traded entity, to ensure availability of mature governance documentation for analysis.
The data sources utilized by Apex in compiling the Peer Group analysis included the following:
• Definitive proxy statements (DEF 14A) filed with the Securities and Exchange Commission ("SEC") for the most recent fiscal year;
• Annual reports on Form 10-K for the most recent fiscal year;
• Corporate governance guidelines posted on company websites;
• Committee charters posted on company websites, including all amendments and restatements through the date of the report;
• Current reports on Form 8-K reporting governance changes;
• NYSE governance submissions and certifications; and
• Supplemental corporate governance disclosures, including ESG/sustainability reports and shareholder engagement policies, where publicly available.
The Apex Report is structured around five thematic modules: (1) Committee Structure & Composition, (2) Charter Content & Currency, (3) Delegation of Authority Practices, (4) Corporate Governance Guideline Provisions, and (5) Shareholder Engagement & Board Refreshment Mechanisms. Selected key extracts from the Apex Report are reproduced in Appendix C hereto, with Apex's permission.
B. Calderwood & Harkness Legal Overlay
C&H has independently analyzed the Apex findings against the applicable legal and regulatory frameworks to distinguish between governance "best practices" or "market norms" on the one hand and legally mandated minimum requirements on the other. Our analysis encompasses the following legal and regulatory sources:
• NYSE Listed Company Manual. Sections 303A.01 through 303A.14, including the 2024 amendments to Section 303A (the "2024 NYSE Amendments"), which updated director independence requirements and certain committee composition and charter content provisions. A summary of the 2024 NYSE Amendments relevant to Quorum is attached as Appendix D.
• Delaware General Corporation Law ("DGCL"). Sections 141(a) (management of the corporation by or under the direction of the board of directors) and 141(c) (authority of the board to delegate powers to committees), which establish the legal framework governing the delegation of board authority to committees and, by extension, to officers.
• SEC Rule 10D-1 and NYSE Rule 303A.14 (Clawback). The SEC's listing standards requiring adoption and administration of compensation recovery policies, which became effective in 2023 and which require, among other things, that the issuer's listing standards compliance be reflected in committee charter delegations.
• State Insurance Holding Company Act Requirements. Connecticut General Statutes § 38a-129 et seq. (CT Holding Company Act), Texas Insurance Code Chapter 823 (TX Holding Company Act), and Ohio Revised Code § 3901.32 et seq. (OH Holding Company Act), each of which impose governance and reporting obligations on insurance holding companies and their regulated subsidiaries operating in those respective states.
• SEC Cybersecurity Disclosure Rules. The SEC's cybersecurity risk management, strategy, governance, and incident disclosure rules (effective December 2023), which require, among other things, disclosure of the board's oversight of cybersecurity risks and management's role in assessing and managing those risks.
• Delaware Fiduciary Duty Jurisprudence. Relevant Caremark oversight liability principles and their evolving application to board-level monitoring obligations, particularly as applied to technology, cybersecurity, and enterprise risk management oversight responsibilities.
The combined analysis in this memorandum addresses both the "market practice" standard — i.e., what the majority of peers are doing — and the "legal minimum" standard — i.e., what applicable law and listing rules require — and distinguishes between the two throughout. Our recommendations are informed by both standards but are principally driven by market practice, as we believe that alignment with peer governance norms is a critical component of the Company's institutional shareholder engagement strategy and proxy advisory firm risk profile.
C. Quorum Profile for Comparison Purposes
For purposes of this benchmarking analysis, the following profile of Quorum Insurance Holdings Corp. serves as the baseline:
Corporate Structure and Listing:
• Quorum Insurance Holdings Corp. is a Delaware corporation, listed on the New York Stock Exchange under the ticker symbol "QIHC."
• Market capitalization: approximately $4.8 billion as of September 2025.
• Fiscal year 2024 consolidated revenue: $3.12 billion.
• Total assets: $18.7 billion. Total invested assets: $16.4 billion.
• Approximately 6,400 full-time employees across all operating subsidiaries.
Board Composition:
• Eleven (11) directors, of whom eight (8) are independent under NYSE standards and three (3) are management or non-independent directors.
• Lead Independent Director: Arthur J. Pennington (also serves as Chair, Nominating & Corporate Governance Committee).
• CEO: Margaret A. Calloway.
Current Standing Committee Structure (5 Committees):
• Audit Committee (Chair: Dr. Lilian Fong-Archer, audit committee financial expert)
• Compensation & Human Capital Committee (Chair: Claudia M. Severin)
• Nominating & Corporate Governance Committee (Chair: Arthur J. Pennington)
• Risk Committee (Chair: Raymond T. Huerta)
• Investment Committee (Chair: Jonathan K. Whitmore)
Regulated and Operating Subsidiaries:
• Quorum Property & Casualty Insurance Company (domiciled in CT, NAIC No. 38472)
• Lone Star Specialty Insurance Company (domiciled in TX, NAIC No. 41359)
• Great Lakes Surety & Indemnity Co. (domiciled in OH, NAIC No. 29814)
• Quorum MGA Services, LLC (organized in DE)
• Vantage Digital Insurance Solutions, Inc. (organized in DE)
Throughout this memorandum, references to "Quorum's current state" or similar formulations reflect the status of the Company's governance documentation as of the date hereof, prior to any amendments or restatements contemplated by the recommendations set forth herein.
III. Committee Structure Benchmarking
A. Number of Standing Committees
The Apex Report identifies the number of standing board committees maintained by each member of the Peer Group. The peer median is six (6) standing committees, with a range of five (5) to seven (7). Nine of fourteen peers (64.3%) maintain six or more standing committees. Five peers (35.7%) maintain exactly five standing committees.
Quorum's current committee structure consists of five (5) standing committees, placing it at the lower end of the peer range and below the peer median. The most common configuration among peers with six standing committees is the five "traditional" committees — Audit, Compensation, Nominating/Governance, Risk, and either Investment or Finance — supplemented by a sixth committee focused on technology, cybersecurity, or information security oversight. Among the two peers maintaining seven standing committees, the additional committees addressed compliance and executive sessions, respectively.
The number of standing committees is not merely a structural formality. A well-calibrated committee structure ensures that the board's oversight responsibilities are distributed among appropriately constituted subgroups with defined subject-matter expertise, clear charter mandates, and regular reporting cadences. As the complexity of the insurance industry and the regulatory environment has increased — particularly in the areas of technology, cybersecurity, data privacy, and artificial intelligence — the limitations of bundling these oversight responsibilities into existing committee charters (or leaving them without formal delegation) have become more pronounced.
B. Technology & Cybersecurity Oversight
Key Finding. Eleven of fourteen peers (78.6%) have adopted either a standalone technology/cybersecurity committee or have added explicit cybersecurity oversight mandates to the charter of the audit committee or the risk committee. The breakdown is as follows:
• Seven (7) peers maintain standalone technology and/or cybersecurity oversight committees (variously denominated as "Technology Committee," "Technology & Cybersecurity Committee," "Information Security Committee," or similar);
• Four (4) peers have embedded explicit technology and cybersecurity oversight provisions in the charters of existing committees, most commonly the audit committee (2 peers) or the risk committee (2 peers); and
• Three (3) peers have no formal technology or cybersecurity oversight at the committee-charter level, relying instead on full-board oversight or informal management reporting.
Quorum's Current State. Quorum does not maintain a standalone Technology & Cybersecurity Oversight Committee. None of Quorum's five existing committee charters contains explicit language delegating cybersecurity oversight responsibilities. While the Board has engaged in board-level discussions regarding cybersecurity risk since 2023, including periodic management presentations from the Company's Chief Information Security Officer, these discussions have not been formalized through a committee charter delegation or a standing agenda item in any committee's charter.
The absence of a formal technology and cybersecurity oversight structure was specifically identified as an observation in the Garrett & Whitfield LLP management letter dated March 14, 2025, which noted the absence of a "formal Technology & Information Security Committee charter or equivalent committee-level delegation addressing IT governance, cybersecurity program oversight, and data privacy risk management."
C&H Legal Analysis. Neither the NYSE Listed Company Manual nor the DGCL mandates a standalone cybersecurity or technology committee. The NYSE requires only three standing committees — audit, compensation, and nominating/governance — and imposes detailed charter requirements only for those three committees. However, several intersecting legal and regulatory developments create increasing pressure for formalized board-level cyber oversight structures:
First, the SEC's cybersecurity disclosure rules, which became effective in December 2023, require registrants to describe in their annual reports on Form 10-K "the board of directors' oversight of risks from cybersecurity threats" and "management's role in assessing and managing material risks from cybersecurity threats." Item 106(c) of Regulation S-K specifically requires disclosure of "[w]hether and which board committee or subcommittee is responsible for the oversight of risks from cybersecurity threats." The existence of a dedicated committee with a detailed charter provides a concrete, auditable basis for this disclosure, and the absence of any formal committee-level delegation may be perceived by investors and proxy advisory firms as a governance gap.
Second, evolving Caremark monitoring obligations under Delaware law impose on directors a duty to implement and maintain reasonable information and reporting systems. While the Delaware courts have not mandated any particular committee structure, the Chancellor and Vice Chancellor have looked to the existence (or absence) of formalized oversight structures — including committee charters and reporting protocols — in evaluating the adequacy of a board's monitoring efforts. In the context of cybersecurity, where a significant breach could give rise to material financial losses, regulatory penalties, and derivative litigation, a formalized committee structure provides a documented record of the board's good-faith oversight.
Third, the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law (Model 668), adopted in whole or in part by a growing number of states, contemplates board-level oversight of insurance entity information security programs. While Connecticut, Texas, and Ohio have not yet adopted Model 668 in full, the trend toward adoption is clear, and the existence of a formalized board-level oversight structure will facilitate compliance as these requirements are enacted.
Recommendation. Establish a new Technology & Cybersecurity Oversight Committee as the sixth standing committee of the QIH Board. The proposed structure is as follows:
• Composition: Minimum of three (3) independent directors, at least one of whom shall have demonstrated cybersecurity or technology expertise (as determined by the Nominating & Corporate Governance Committee based on the member's professional experience, education, or certifications).
• Proposed Chair: Priya Narasimhan, an independent director who currently serves as Chief Executive Officer of Tessera Fintech Corp. and possesses substantial technology industry expertise.
• Proposed Initial Members: Priya Narasimhan (Chair), Victor L. Andrade (independent director), and Camille R. DuPont (President, Vantage Digital Insurance Solutions, Inc.) as a management director serving in a non-voting advisory capacity. The inclusion of Ms. DuPont as a non-voting advisory member is designed to ensure that the committee benefits from management's operational perspective on the Company's technology and digital initiatives while maintaining the committee's independent character.
• Key Oversight Areas: The committee's charter should encompass oversight of the Company's cybersecurity program, enterprise IT strategy, data privacy compliance, insurtech initiatives (including those undertaken through Vantage Digital Insurance Solutions, Inc.), artificial intelligence governance, third-party technology risk (including cloud computing and vendor management), and incident response preparedness and testing.
• Reporting and Coordination: The committee should report to the full Board on a quarterly basis and should maintain formal coordination protocols with both the Risk Committee (to ensure integration of technology risk into the enterprise risk management framework) and the Audit Committee (to address internal controls over financial reporting that depend on IT systems and to coordinate on any cybersecurity-related audit findings).
C. Risk Committee Practices
Thirteen of fourteen peers (92.9%) maintain a standalone risk committee, with only one peer combining risk oversight with audit committee responsibilities. Among the thirteen peers with standalone risk committees, ten (71.4%) include explicit insurance-specific risk categories in the risk committee charter. These insurance-specific categories typically encompass reserving risk, reinsurance counterparty risk, catastrophe exposure management, underwriting risk appetite, and regulatory capital adequacy. The remaining three peers with standalone risk committees address these insurance-specific risks through management-level reporting to the committee rather than through explicit charter mandate.
In addition, nine of fourteen peers (64.3%) have adopted a formal coordination protocol between the risk committee and the audit committee, typically addressing overlapping areas such as internal controls related to risk management, risk-related financial reporting, and shared access to internal audit resources.
Quorum's Current State. The Company's Risk Committee Charter was adopted on February 12, 2016 and has never been substantively amended. The charter, in its current form, addresses the committee's oversight of "enterprise risk management" in general terms but does not reference any insurance-specific risk categories. It does not address coordination with the Audit Committee or any other standing committee. The Risk Committee is currently chaired by Raymond T. Huerta.
The absence of insurance-specific risk categories from the Risk Committee Charter is notable given the Company's operating profile as a multi-line insurance holding company with regulated insurance subsidiaries in three states. The current charter language is generic and could apply to any publicly traded company, regardless of industry. Insurance-specific risk categories — including reserving adequacy, reinsurance program structure and counterparty credit risk, natural catastrophe and man-made catastrophe exposure, underwriting appetite and pricing discipline, and regulatory capital requirements — are among the most significant risks facing the Company and its regulated subsidiaries, and the Risk Committee Charter should reflect this.
Recommendation. Comprehensively restate the Risk Committee Charter to include the following:
(i) Explicit enumeration of insurance-specific risk categories, including but not limited to loss reserving adequacy, reinsurance program structure and counterparty credit risk, catastrophe exposure management (both natural and man-made), underwriting risk appetite, pricing discipline, and regulatory capital adequacy;
(ii) A formal inter-committee coordination protocol with the Audit Committee, addressing overlapping areas such as risk-related financial reporting, internal controls over risk management processes, and shared access to internal audit resources; and
(iii) A formal inter-committee coordination protocol with the proposed Technology & Cybersecurity Oversight Committee, addressing the integration of technology and cybersecurity risks into the enterprise risk management framework.
D. Audit Committee Practices
The Apex Report examined audit committee charter content across the Peer Group in three specific areas that C&H has identified as material gaps in Quorum's current charter: enterprise risk management ("ERM") oversight, clawback policy administration, and annual committee self-evaluation.
ERM Oversight. All fourteen peers (100%) include ERM oversight responsibility in the audit committee charter or address ERM through a coordinated delegation between the audit committee and the risk committee. The most common approach — adopted by ten of fourteen peers — is a shared responsibility model in which the risk committee maintains primary ERM oversight authority and the audit committee has a secondary role focused on the adequacy of the ERM framework and the integrity of risk-related financial reporting. Four peers assign primary ERM oversight to the audit committee alone.
Clawback Policy Administration. Fourteen of fourteen peers (100%) have incorporated clawback-policy administration language in the audit committee charter following the adoption of SEC Rule 10D-1 and NYSE Rule 303A.14. This language typically assigns to the audit committee (or, in some cases, the compensation committee) the responsibility for administering the company's compensation recovery policy, including the determination of whether a restatement triggers recovery obligations, the calculation of recovery amounts, and the oversight of recovery procedures. The near-universal adoption of this provision reflects the fact that it is, in practical effect, a listing standard requirement: NYSE-listed companies are required to adopt a compensation recovery policy, and the administration of that policy must be assigned to a committee of independent directors.
Annual Self-Evaluation. Thirteen of fourteen peers (92.9%) include in the audit committee charter a provision requiring an annual self-evaluation of the committee's performance, typically in the form of an annual assessment of the committee's composition, charter compliance, and effectiveness in fulfilling its oversight responsibilities.
Quorum's Current State. Quorum's Audit Committee Charter, currently chaired by Dr. Lilian Fong-Archer (who serves as the committee's audit committee financial expert), is missing all three provisions: ERM oversight, clawback-policy administration, and annual self-evaluation. The charter was originally adopted on February 12, 2016 and has not been amended. The omission of clawback-policy administration language is particularly notable given that the Company adopted a Compensation Recovery Policy in October 2023 in compliance with NYSE listing standards, but the administration of that policy was not formally assigned to any committee through a charter amendment.
Recommendation. The restated Audit Committee Charter should include the following additions:
(i) ERM oversight coordination language, establishing the Audit Committee's role in the shared ERM oversight model in coordination with the Risk Committee, with the Audit Committee focusing on the adequacy and integrity of the ERM framework and risk-related financial reporting;
(ii) Clawback-policy administration responsibilities, assigning to the Audit Committee (or, alternatively, the Compensation & Human Capital Committee, subject to Board preference) the authority and responsibility for administering the Company's Compensation Recovery Policy adopted pursuant to SEC Rule 10D-1 and NYSE Rule 303A.14; and
(iii) An annual self-evaluation provision, requiring the committee to conduct an annual assessment of its composition, charter compliance, and effectiveness, with the results reported to the Board through the Nominating & Corporate Governance Committee.
E. Compensation & Human Capital Committee Practices
Independent Consultant Retention Authority. Twelve of fourteen peers (85.7%) grant the compensation committee explicit authority in its charter to retain independent compensation consultants, legal counsel, and other advisors without further board approval, consistent with NYSE requirements under Section 303A.05 of the Listed Company Manual. This provision is not merely a governance best practice but reflects a listing standard expectation: NYSE Section 303A.05(c)(iv) requires that compensation committee charters provide the committee with sole authority to retain and terminate compensation consultants, independent legal counsel, and other advisors.
Substantive HCM Oversight. Among the ten peers that have adopted the "Human Capital" nomenclature for their compensation committees, ten of ten (100%) have also added substantive human-capital-management oversight language to the committee charter. This language typically encompasses oversight of workforce strategy, diversity, equity, and inclusion ("DEI") programs, talent development and succession planning (for below-CEO positions), employee engagement, and workplace culture.
Quorum's Current State. Quorum added "Human Capital" to the committee's name in a charter amendment dated June 14, 2021 (changing the committee name from "Compensation Committee" to "Compensation & Human Capital Committee"), but did not add any substantive HCM oversight language at that time. The amendment was limited to the name change and did not expand the committee's charter mandate. The charter does not include explicit independent consultant retention authority, although the committee has engaged independent compensation consultants on an ad hoc basis. The Compensation & Human Capital Committee is currently chaired by Claudia M. Severin.
Recommendation. The restated Compensation & Human Capital Committee Charter should include the following:
(i) Explicit independent consultant retention authority, providing the committee with sole authority to retain and terminate compensation consultants, independent legal counsel, and other advisors, consistent with NYSE Section 303A.05(c)(iv);
(ii) Substantive HCM oversight language, encompassing oversight of workforce strategy, DEI programs, talent development and retention, succession planning (below CEO level), employee engagement, and workplace culture; and
(iii) An annual self-evaluation provision consistent with peer practice.
F. Nominating & Corporate Governance Committee Practices
ESG/Sustainability Oversight. Thirteen of fourteen peers (92.9%) address ESG or sustainability oversight in the nominating and governance committee charter. The scope of ESG/sustainability oversight varies, but typically includes oversight of the company's ESG strategy, sustainability reporting, and coordination with management on ESG-related shareholder engagement. Some peers assign ESG oversight to a different committee (e.g., a standalone sustainability committee), but the overwhelming market practice for companies without a standalone ESG committee is to assign this oversight to the nominating and governance committee.
Director Skills Matrix. Eleven of fourteen peers (78.6%) require, through the nominating and governance committee charter or the corporate governance guidelines, that the board maintain a director skills matrix identifying the core competencies and experiences represented on the board. The skills matrix is typically used by the committee in evaluating director nominees and in identifying gaps in the board's collective skill set.
Shareholder Engagement Protocol. Ten of fourteen peers (71.4%) include a formal shareholder-engagement protocol in the nominating and governance committee charter, typically referencing the committee's role in overseeing shareholder engagement on governance matters and designating the lead independent director and/or the nominating and governance committee chair as available for direct engagement with significant shareholders above a specified ownership threshold (typically 3% to 5% of outstanding shares).
Quorum's Current State. Quorum's Nominating & Corporate Governance Committee Charter, chaired by Arthur J. Pennington and last amended on March 20, 2019, does not address ESG or sustainability oversight, does not require a director skills matrix, and does not reference shareholder engagement. The 2019 amendment addressed only a technical update to the committee's authority to approve director nominations and did not expand the committee's substantive mandate. This charter gap is particularly salient given the governance modernization concerns raised by Veltrano Institutional Partners and the informal engagement with Westbrook Fiduciary Trust Company.
Recommendation. The restated Nominating & Corporate Governance Committee Charter should include the following:
(i) ESG/sustainability oversight provisions, assigning to the committee oversight of the Company's ESG strategy, sustainability reporting, and coordination with management on ESG-related disclosures and shareholder engagement;
(ii) A director skills-matrix requirement, directing the committee to maintain and periodically update a skills matrix identifying the core competencies, experiences, and attributes represented on the Board, and to use the matrix in evaluating director nominees and identifying gaps in the Board's collective capabilities; and
(iii) A shareholder-engagement protocol, providing that the Lead Independent Director and the Nominating & Corporate Governance Committee Chair shall be available for engagement with holders of three percent (3%) or more of the Company's outstanding shares on governance matters, with appropriate advance notice and coordination with the Company's investor relations team.
G. Investment Committee Practices
Eight of fourteen peers (57.1%) maintain a standalone investment committee, while the remaining six delegate investment oversight to the full board, the risk committee, or a combined finance committee. Among the eight peers with standalone investment committees, the median single-issuer exposure delegation threshold is $75 million, with a range of $50 million to $125 million.
Quorum's Current State. Quorum's Investment Committee Charter was adopted on February 12, 2016 and has never been amended. The charter is currently chaired by Jonathan K. Whitmore. The charter sets the committee's single-issuer exposure delegation threshold at $50 million and authorizes aggregate portfolio rebalancing authority of $250 million. These thresholds were established based on the Company's invested asset base as of 2016, when total invested assets were approximately $11.2 billion. As of the most recent reporting period, total invested assets have grown to $16.4 billion, representing a 46.4% increase. The thresholds have not been adjusted to reflect this growth, with the result that the committee's delegation authority has, in relative terms, contracted as the portfolio has expanded.
Additionally, five of eight peers (62.5%) with investment committees include ESG integration in investment strategy provisions in the investment committee charter, reflecting the growing importance of ESG considerations in insurance company investment management and the increasing regulatory and stakeholder expectations regarding responsible investment practices.
Recommendation. The restated Investment Committee Charter should include the following:
(i) An increase in the single-issuer exposure delegation threshold from $50 million to $75 million, aligned with the peer median and proportional to the growth in total invested assets;
(ii) ESG integration in investment strategy provisions, directing the committee to oversee the incorporation of ESG factors into the Company's investment decision-making processes and to receive periodic reporting from management on ESG-related investment risks and opportunities; and
(iii) A coordination protocol with the Risk Committee, addressing the integration of investment risk (including credit risk, interest rate risk, and concentration risk) into the enterprise risk management framework.
IV. Delegation of Authority Matrix Benchmarking
A. Currency and Update Frequency
Key Finding. Twelve of fourteen peers (85.7%) have comprehensively updated their DOA matrices within the prior 24 months — that is, since approximately mid-2023. The prevailing peer best practice is an annual review of delegation thresholds, with adjustments as warranted by inflation, business growth, changes in organizational structure, and regulatory developments. Several peers have adopted formal governance calendar provisions requiring annual DOA Matrix review, typically conducted by the audit committee or the nominating and governance committee in consultation with management.
Quorum's Current State. Quorum's DOA Matrix was last comprehensively updated on October 6, 2017 — over eight years ago. The only interim modification was a targeted amendment dated April 22, 2020, which adjusted claims-payment thresholds in response to the COVID-19 pandemic and the resulting increase in claims volume and severity. No other thresholds were adjusted at that time, and no comprehensive review was conducted.
The Garrett & Whitfield LLP management letter dated March 14, 2025 identified two specific concerns related to the DOA Matrix:
First, the management letter identified "inconsistent dollar thresholds between the parent-level DOA Matrix and subsidiary-level authorities," noting that the parent DOA Matrix references subsidiary-level delegations that are not formally documented or that conflict with the thresholds set forth in the parent matrix.
Second, the management letter noted that claims-settlement authorities for Lone Star Specialty Insurance Company exceeded the thresholds approved by the QIH Board without documented ratification. Specifically, Lone Star Specialty was operating with a subsidiary CEO per-claim authority of $3.0 million, whereas the parent DOA Matrix authorized a subsidiary CEO per-claim authority of only $1.0 million. No board resolution or formal delegation document was identified authorizing the higher threshold.
These findings underscore the operational risks that arise from an outdated and inconsistently maintained delegation framework. The DOA Matrix is not merely a governance formality; it is the primary instrument by which the Board delegates its statutory authority under DGCL § 141(a) to officers and committee structures. An outdated or internally inconsistent matrix creates risks of unauthorized transactions, audit findings, regulatory inquiries, and, in the event of a loss, questions regarding the Board's discharge of its oversight obligations.
The sections below present threshold-by-threshold benchmarking data and recommendations for each of the twelve authority categories in the DOA Matrix. A consolidated summary table is set forth in Appendix B, Table 2.
B. Capital Expenditure Thresholds
Quorum's current CEO sole authority threshold of $2.0 million was established in 2017 and has not been adjusted for inflation or business growth. The Consumer Price Index has increased approximately 28.6% between October 2017 and September 2025, which alone would justify an inflation-adjusted threshold of approximately $2.57 million. When business growth is also factored in — total assets have increased from $14.1 billion (2017) to $18.7 billion (2024), a 32.6% increase — the case for a more substantial adjustment is compelling.
Recommendation. We recommend increasing the CEO sole authority threshold to $5.0 million, which is slightly above the peer median of $4.5 million but well within the peer range and reflects both inflation adjustment and the Company's growth trajectory since 2017. The CEO + CFO joint authority threshold should be increased to $15.0 million, consistent with the peer median, with Board approval required for capital expenditures exceeding $15.0 million.
C. Claims Settlement Thresholds
As noted above, the Garrett & Whitfield management letter identified that Lone Star Specialty Insurance Company was operating with a subsidiary CEO per-claim authority of $3.0 million — three times the $1.0 million threshold authorized by the parent DOA Matrix — without documented Board ratification. This finding illustrates both the staleness of the current thresholds and the absence of formal subsidiary-level DOA alignment procedures.
Recommendation. We recommend increasing the subsidiary CEO per-claim threshold to $2.5 million, aligned with the peer median. The parent CEO threshold should be increased to $10.0 million per claim, with Board or Risk Committee approval required for claims settlements exceeding $10.0 million. Critically, the restated DOA Matrix should include a requirement that all subsidiary-level claims-settlement thresholds be formally documented and ratified by the QIH Board, with any deviation from the authorized thresholds requiring prior Board or Risk Committee approval.
D. Reinsurance Treaty Thresholds
Quorum's current CEO reinsurance treaty authority of $25.0 million per treaty is significantly below the peer median of $50.0 million. Given the importance of reinsurance purchasing to the Company's capital management strategy and the frequency of treaty placements, this threshold creates unnecessary bottlenecks in the reinsurance purchasing process.
Recommendation. Increase the CEO reinsurance treaty authority to $50.0 million per treaty, aligned with the peer median. Treaties exceeding $50.0 million should require Board or Risk Committee approval.
E. Technology / IT Spending Thresholds
Ten of fourteen peers (71.4%) maintain a separate technology/IT spending category in the DOA Matrix, distinct from general capital expenditures. The creation of a separate technology/IT category reflects the growing significance of technology investments in insurance operations — including core policy administration systems, claims management platforms, digital distribution capabilities, data analytics infrastructure, and cybersecurity tools — and the recognition that technology projects have unique risk profiles, implementation timelines, and governance considerations that warrant differentiated authority levels and oversight.
Quorum's Current State. Quorum does not maintain a separate technology/IT spending category in its DOA Matrix. All technology-related expenditures are bundled within the general capital expenditure category, making it difficult for management and the Board to track, authorize, and monitor technology investments as a distinct category.
Recommendation. Create a new technology/IT spending category in the restated DOA Matrix, with CEO authority of up to $3.0 million per project, aligned with the peer median. Projects exceeding $3.0 million should require approval of the proposed Technology & Cybersecurity Oversight Committee (or, if that committee has not yet been established, the full Board). This category should encompass all technology-related expenditures, including hardware, software, implementation services, and ongoing maintenance contracts for systems with a total contract value exceeding the threshold.
F. Vendor Contract Thresholds
Quorum's current CEO vendor contract authority of $3.0 million in annual contract value is below the peer median of $5.0 million. The Company's growth since 2017, combined with general cost inflation in professional services, technology, and insurance operations, has rendered this threshold increasingly constraining.
Recommendation. Increase the CEO vendor contract authority to $5.0 million in annual contract value, aligned with the peer median.
G. Investment Transaction Thresholds (Single-Issuer)
As discussed in Section III.G above, the $50.0 million single-issuer exposure threshold was established in 2016 when total invested assets were $11.2 billion. Total invested assets have since grown to $16.4 billion, a 46.4% increase. The current threshold, expressed as a percentage of total invested assets, has effectively declined from approximately 0.45% (2016) to approximately 0.30% (2024). The peer median of $75.0 million would restore the threshold to approximately 0.46% of current invested assets, consistent with the original proportional calibration.
Recommendation. Increase the Investment Committee single-issuer exposure threshold to $75.0 million, aligned with the peer median and proportional to the growth in total invested assets.
H. M&A / Strategic Transaction Thresholds
Quorum's current Board approval threshold of $10.0 million for M&A and strategic transactions is the lowest in the Peer Group and significantly below the peer median of $25.0 million. This threshold limits management's ability to pursue smaller strategic opportunities — such as book-of-business acquisitions, program administrator acquisitions, and strategic technology investments — without full Board approval, creating timing delays that may impair the Company's competitiveness in the market for these transactions.
Recommendation. Increase the Board approval threshold to $25.0 million for M&A and strategic transactions, aligned with the peer median. C&H's Delaware law memorandum, to be delivered on November 18, 2025, will provide a detailed analysis of the fiduciary duty implications of this increase under DGCL §§ 141(a) and 141(c), including a discussion of the Board's continuing oversight obligations with respect to management-level transactions and the appropriate information and reporting mechanisms to ensure that the Board remains informed of significant strategic transactions below the approval threshold.
I. Litigation Settlement Thresholds
Quorum's current General Counsel sole authority threshold of $500,000 for litigation settlements is at the bottom of the peer range and half the peer median. Given the Company's litigation profile — which includes insurance coverage disputes, policyholder claims, and regulatory proceedings across three regulated subsidiaries — the current threshold requires GC-level escalation and CEO involvement in a high volume of routine settlements, diverting management attention from higher-priority matters.
Recommendation. Increase the GC sole authority threshold to $1.0 million, the CEO + GC joint authority to $5.0 million, and the Board/Audit Committee threshold to settlements exceeding $5.0 million, each aligned with the peer median.
J. Charitable / Political Contribution Thresholds
Recommendation. Increase the CEO charitable/political contribution authority to $250,000 per commitment, aligned with the peer median.
K. Officer Hiring (Base Salary) Thresholds
Quorum's current CEO hiring authority of $350,000 base salary was established in 2017 and has not been adjusted. Given wage inflation in the insurance and financial services industries, a $350,000 threshold captures a significant number of mid-level officer hires that would not typically require Compensation Committee review at peer companies.
Recommendation. Increase the CEO officer hiring authority to $500,000 base salary, with Compensation Committee approval required for officer hires with a base salary exceeding $500,000. This threshold is aligned with the peer median and reflects current market compensation levels for senior officers in the insurance industry.
L. Subsidiary-Level DOA Consistency
Key Finding. Eleven of fourteen peers (78.6%) maintain a formal model subsidiary DOA matrix template ensuring consistency and documented alignment between parent-level and subsidiary-level authority levels. The model subsidiary DOA template is typically adopted by each regulated subsidiary's board of directors and cross-references the parent-level DOA Matrix to ensure that subsidiary-level authorities do not exceed parent-level delegations without documented ratification.
Quorum's Current State. Quorum currently has no model subsidiary DOA template. Subsidiary-level authorities operate on an informal basis, without a standardized template or formal cross-reference to the parent DOA Matrix. As documented in the Garrett & Whitfield management letter, this has resulted in inconsistencies — most notably the Lone Star Specialty claims-settlement threshold discrepancy — that create operational, audit, and regulatory risk.
The absence of a formal subsidiary DOA framework is particularly problematic given that three of Quorum's five operating subsidiaries are state-regulated insurance companies. State insurance holding company act regulators — including the Connecticut Insurance Department, the Texas Department of Insurance, and the Ohio Department of Insurance and Financial Services — have the authority to examine the governance and management practices of regulated subsidiaries, including authority delegation practices. An undocumented or inconsistent delegation framework could attract regulatory scrutiny in the context of a holding company examination.
Recommendation. Create a model subsidiary DOA matrix template for adoption by each of the Company's regulated subsidiaries (Quorum Property & Casualty Insurance Company, Lone Star Specialty Insurance Company, and Great Lakes Surety & Indemnity Co.) and operating subsidiaries (Quorum MGA Services, LLC and Vantage Digital Insurance Solutions, Inc.). The model template should:
(i) Establish subsidiary-level thresholds calibrated to the scale and risk profile of each subsidiary;
(ii) Cross-reference each subsidiary-level threshold to the corresponding parent-level threshold in the QIH DOA Matrix;
(iii) Prohibit subsidiary-level thresholds from exceeding parent-level thresholds without documented ratification by the QIH Board;
(iv) Require annual review of subsidiary-level thresholds concurrent with the annual review of the parent DOA Matrix; and
(v) Require formal adoption of the subsidiary DOA matrix by the board of directors (or sole member, as applicable) of each subsidiary entity.
V. Corporate Governance Guidelines Benchmarking
A. Board Refreshment Provisions
Mandatory Retirement Age. Twelve of fourteen peers (85.7%) have adopted a mandatory retirement age for directors. The median retirement age among those twelve peers is 75, with a range of 72 to 77. The most common approach is to provide that a director who has attained the specified age by the date of the annual meeting of shareholders shall not be nominated for re-election, with the nominating and governance committee retaining discretion to grant a one-year waiver in extraordinary circumstances.
Director Tenure Limits. Eight of fourteen peers (57.1%) have adopted director tenure limits for independent directors, expressed as a maximum number of years of continuous service. The median tenure limit among those eight peers is 15 years for independent directors. Tenure limits are less common for management directors, who typically serve at the pleasure of the board.
Quorum's Current State. Quorum currently has neither a mandatory retirement age nor a tenure limit for any director. The absence of these provisions is inconsistent with the majority of peer practices and may be perceived by institutional shareholders and proxy advisory firms as reflecting a lack of commitment to board refreshment and independence. The Veltrano Institutional Partners letter of June 18, 2025, while not specifically citing retirement age or tenure limits, urged "governance modernization" in terms that implicitly encompass board refreshment mechanisms.
Recommendation. Adopt a mandatory retirement age of 75, consistent with the peer median, and a 15-year tenure limit for independent directors, also consistent with the peer median, to be incorporated in the Amended & Restated Corporate Governance Guidelines. The retirement age and tenure limit provisions should include a narrow waiver mechanism permitting the Nominating & Corporate Governance Committee to extend an independent director's service by up to one year in exceptional circumstances, subject to disclosure in the Company's next proxy statement.
B. Director Overboarding Policies
Thirteen of fourteen peers (92.9%) have adopted overboarding policies that limit the number of public-company boards on which directors may serve. The peer median for independent directors is a maximum of four (4) total public-company boards, including the issuer. For sitting CEOs who serve as directors, the peer median is a maximum of two (2) total public-company boards, including the issuer. These policies reflect the growing recognition — shared by major proxy advisory firms including ISS and Tarrant Partners LLC — that directors who serve on an excessive number of boards may be unable to devote adequate time and attention to each board, particularly in times of crisis.
Quorum's Current State. Quorum currently has no formal overboarding policy. The Company's existing Corporate Governance Guidelines are silent on the number of public-company boards on which directors may serve. While the Board has informally considered overboarding concerns during the director nomination process, the absence of a formal policy leaves the Company vulnerable to criticism from proxy advisory firms and institutional shareholders.