1025-00003 · Delaware corp · Charters/Execution Versions

restated-charter-risk-committee.docx DOCUMENT Capital Markets

17 / 35 ← → ✕

Contract analysis Extract to table

AMENDED AND RESTATED CHARTER OF THE RISK COMMITTEE OF THE BOARD OF DIRECTORS OF QUORUM INSURANCE HOLDINGS CORP.

Adopted by the Board of Directors on December 11, 2025

This Amended and Restated Charter supersedes the Charter of the Risk Committee originally adopted on February 12, 2016.

EXECUTION VERSION

Right-click to update Table of Contents

ARTICLE I — PURPOSE

The Board of Directors (the "Board") of Quorum Insurance Holdings Corp., a Delaware corporation (the "Company" or "QIH"; NYSE: QIHC), hereby establishes and sets forth this Amended and Restated Charter (this "Charter") of the Risk Committee of the Board (the "Committee").

The Committee is established pursuant to Article III, Section 3.3 of the Amended and Restated Bylaws of the Company (as amended from time to time, the "Bylaws") and Section 141(c) of the Delaware General Corporation Law (the "DGCL"), which authorizes the Board to designate one or more committees of the Board and to delegate to such committees such authority as the Board deems appropriate, subject to limitations set forth in the DGCL.

The primary purpose of the Committee is to assist the Board in its oversight of the Company's enterprise-wide risk management framework (the "ERM" or the "ERM Framework"), including the identification, assessment, monitoring, and mitigation of material risks facing the Company and its subsidiaries. The Committee shall serve as the principal Board-level body responsible for ensuring that the Company maintains a comprehensive, effective, and appropriately resourced approach to enterprise risk management, consistent with the Company's strategic objectives, regulatory obligations, and the expectations of its shareholders, policyholders, and other stakeholders.

The Company operates as a multi-line insurance holding company with regulated insurance subsidiaries domiciled in multiple jurisdictions, including: (i) Quorum Property & Casualty Insurance Company, domiciled in the State of Connecticut (NAIC Company Code 38472); (ii) Lone Star Specialty Insurance Company, domiciled in the State of Texas (NAIC Company Code 41359); and (iii) Great Lakes Surety & Indemnity Co., domiciled in the State of Ohio (NAIC Company Code 29814). In addition, the Company operates a managing general agent, Quorum MGA Services, LLC, and a financial technology subsidiary, Vantage Digital Insurance Solutions, Inc. By virtue of these operations, the Company faces risks that are unique to the insurance and financial services industries, including but not limited to underwriting risk, reserving risk, reinsurance risk, catastrophe risk, investment risk, regulatory and compliance risk, operational risk, and emerging risks related to climate change, social inflation, cyber aggregation, and technological disruption. The Committee's oversight responsibilities are designed to address this distinctive risk profile.

The Committee's role is one of oversight. The management of the Company, including the Chief Risk Officer (or equivalent senior officer), the Chief Compliance Officer, the Chief Audit Executive, and the presidents and officers of the Company's subsidiaries, is responsible for the day-to-day identification, assessment, management, and mitigation of risk. The Committee does not itself manage risk on behalf of the Company, but rather oversees and evaluates the processes, policies, and frameworks that management employs in discharging its risk management responsibilities.

Nothing in this Charter is intended to alter or diminish the responsibilities of any other standing committee of the Board, including the Audit Committee, the Compensation & Human Capital Committee, the Nominating & Corporate Governance Committee, the Investment Committee, or the Technology & Cybersecurity Oversight Committee. Each such committee retains its respective responsibilities as set forth in its own charter, and this Charter is intended to complement — not supersede — those responsibilities. Where oversight responsibilities overlap or intersect, the Committee shall coordinate with the relevant committee or committees in the manner described in Article VI of this Charter.

ARTICLE II — COMPOSITION

Section 2.1 — Number of Members

The Committee shall consist of no fewer than three (3) members of the Board. The members of the Committee shall be appointed by the Board annually at the first Board meeting following the annual meeting of shareholders of the Company, and each member shall serve until such member's successor is duly appointed and qualified, or until such member's earlier resignation, removal, or cessation of service as a director of the Company. The Board may, in its discretion, appoint additional members to the Committee at any time, provided that the Committee shall at all times consist of no fewer than three (3) members. The appointment and removal of members of the Committee shall be conducted in conformity with Bylaws Article III, Section 3.4, as revised in connection with the Company's comprehensive governance overhaul to reflect updated committee-appointment mechanics.

Section 2.2 — Independence

Each member of the Committee shall be "independent" as that term is defined under the New York Stock Exchange ("NYSE") Listed Company Manual Section 303A, including as amended through the 2024 amendments to Section 303A relating to independence standards for board committee members. In determining independence, the Board shall consider all relevant facts and circumstances, including but not limited to any material relationships between the director and the Company or its subsidiaries, affiliates, or significant counterparties. No member of the Committee may be an employee of the Company or any of its subsidiaries or affiliates, and no member may have any relationship with the Company that would impair such member's ability to exercise independent judgment in carrying out the Committee's responsibilities.

Section 2.3 — Qualifications

At least one (1) member of the Committee shall have experience in risk management, insurance regulation, actuarial science, or a related discipline, as determined by the Board in its business judgment. The Board shall endeavor to appoint members who collectively possess sufficient expertise, experience, and diversity of perspective to understand and oversee the Company's risk profile, including, without limitation, insurance underwriting risk, investment risk, operational risk, regulatory and compliance risk, and emerging risks. The Board recognizes that the Company's multi-line insurance operations and its fintech and managing general agency activities require Committee members who are able to evaluate complex and interrelated risk factors across a range of disciplines and business lines.

Section 2.4 — Chairperson

The Board shall designate one independent member of the Committee as the Chairperson of the Committee (the "Chairperson"). As of the date of adoption of this Charter, the Chairperson is Raymond T. Huerta. In the event that the Chairperson is absent from or unable to participate in any meeting of the Committee, the members present at such meeting shall elect a temporary chairperson for such meeting by majority vote of the members present.

The duties of the Chairperson shall include: (a) establishing the agenda for each meeting of the Committee, in consultation with the Chief Risk Officer (or equivalent senior officer) and the General Counsel & Corporate Secretary; (b) presiding over meetings of the Committee; (c) reporting to the full Board on the activities, findings, and recommendations of the Committee; and (d) serving as the principal liaison between the Committee and management on risk-related matters and between the Committee and other standing committees of the Board on matters of overlapping responsibility.

Section 2.5 — Removal and Vacancies

Any member of the Committee may be removed or replaced by the Board at any time, with or without cause, by action of the Board. Vacancies on the Committee, whether resulting from removal, resignation, death, incapacity, or increase in the number of Committee members, shall be filled by the Board. Any member appointed to fill a vacancy shall serve for the remainder of the term of the predecessor member (or, in the case of a vacancy resulting from an increase in the size of the Committee, until the next annual appointment of the Committee following the annual meeting of shareholders), or until such member's earlier resignation, removal, or cessation of service as a director.

ARTICLE III — MEETINGS AND PROCEDURES

Section 3.1 — Frequency

The Committee shall meet at least four (4) times per year, on a quarterly basis, and more frequently as circumstances require. The Chairperson shall have the authority to call additional meetings of the Committee at any time. Special meetings of the Committee may also be called by any two (2) members of the Committee, by the Chair of the Board & Chief Executive Officer (Margaret A. Calloway), by the General Counsel & Corporate Secretary (Dennis R. Okonkwo), or by the Chief Compliance Officer (Ivan D. Pruett). Meetings may be held in person, by telephone conference, by video conference, or by any other means of communication by which all members participating in the meeting can hear one another, in accordance with the DGCL and the Bylaws.

Section 3.2 — Quorum and Voting

A majority of the members of the Committee then serving shall constitute a quorum for the transaction of business at any meeting of the Committee. Actions of the Committee shall be taken by a majority vote of the members present at a meeting at which a quorum is present. Each member of the Committee shall have one vote. In the event of a tie, the matter shall be referred to the full Board for consideration.

The Committee may act by unanimous written consent in lieu of a meeting, in accordance with DGCL § 141(c) and the applicable provisions of the Bylaws. Any action taken by unanimous written consent shall have the same force and effect as if taken at a duly convened meeting.

Section 3.3 — Attendance by Non-Members

The Committee may invite members of management and other persons to attend all or any portion of any meeting of the Committee in a non-voting capacity, as the Chairperson deems appropriate. Persons who may be invited to attend include, without limitation, the Chief Executive Officer, the Chief Financial Officer (Patricia Sung-Hee Lam), the Chief Compliance Officer (Ivan D. Pruett), the Chief Audit Executive (Renata M. Vásquez), the Chief Risk Officer (or equivalent senior officer), presidents of regulated insurance subsidiaries, representatives of the Company's appointed actuaries, external advisors (including risk management consultants, actuarial firms, regulatory consultants, and outside legal counsel), and any other officers, employees, or advisors whose participation the Chairperson determines would be beneficial to the Committee's deliberations.

Notwithstanding the foregoing, the Committee shall have the right to meet in executive session without management present at any time and shall do so at each regularly scheduled quarterly meeting unless the Chairperson determines that an executive session is not necessary. Executive sessions may include only members of the Committee and any external advisors as the Committee may determine.

Section 3.4 — Agenda and Materials

The Chairperson, in consultation with the Chief Risk Officer (or equivalent senior officer), the General Counsel & Corporate Secretary, and other members of management as appropriate, shall establish the agenda for each meeting of the Committee. Any member of the Committee may request the inclusion of additional items on the agenda by providing notice to the Chairperson in advance of the meeting. Meeting materials, including reports, presentations, memoranda, and other documents relevant to the matters to be considered at the meeting, shall be distributed to members of the Committee in advance of the meeting to the extent practicable, with the goal of providing members with sufficient time to review and consider such materials prior to the meeting.

Section 3.5 — Minutes

The Corporate Secretary (or the Corporate Secretary's designee) shall attend each meeting of the Committee and shall keep minutes of all meetings of the Committee. The minutes shall accurately reflect the matters discussed, the actions taken, and the votes cast at each meeting, and shall be maintained as part of the permanent corporate records of the Company. Draft minutes shall be circulated to members of the Committee for review and shall be approved by the Committee at a subsequent meeting. Minutes of Committee meetings shall be made available to the full Board upon request and shall be provided to the Board as part of the Committee's regular reporting under Article VII.

ARTICLE IV — AUTHORITY

Section 4.1 — General Authority

The Committee shall have the authority, to the extent it deems necessary or appropriate, to carry out its purposes and responsibilities as set forth in this Charter. The Committee's authority derives from DGCL § 141(c), which permits the Board to delegate authority to committees of the Board composed of one or more directors, subject to limitations on actions that may not be delegated to a committee under the DGCL (including, without limitation, the approval of amendments to the Certificate of Incorporation, the adoption of an agreement of merger or consolidation, the recommendation to shareholders of a dissolution, and the amendment of the Bylaws). The Committee shall exercise its authority in a manner consistent with the Company's Certificate of Incorporation, Bylaws, Corporate Governance Guidelines, and applicable law.

Section 4.2 — Retention of Advisors

The Committee shall have the sole authority to retain and terminate risk management consultants, actuarial firms, legal counsel, and other external advisors as it deems necessary to fulfill its oversight responsibilities, without the need for further Board approval. The Committee may engage such advisors on such terms as it deems appropriate, including with respect to the scope, fees, and duration of any engagement. The Company shall provide appropriate funding, as determined by the Committee in its sole discretion, for the compensation of any advisors retained by the Committee and for the ordinary administrative expenses of the Committee that are necessary or appropriate for carrying out its duties.

Section 4.3 — Access to Information

The Committee shall have full and unrestricted access to any books, records, data, reports, analyses, and personnel of the Company and its subsidiaries as the Committee deems necessary or appropriate to discharge its responsibilities under this Charter. Management shall cooperate fully with the Committee and shall provide requested information on a timely basis. The Committee may direct the Chief Risk Officer, the Chief Compliance Officer, the Chief Audit Executive, subsidiary-level officers, and any other employees or agents of the Company to provide such information, reports, and analyses as the Committee may require.

Section 4.4 — Delegation

The Committee may delegate specific tasks, projects, or investigations to one or more subcommittees or to individual members of the Committee, to the extent permitted by DGCL § 141(c) and the Bylaws; provided, however, that the Committee shall not delegate its overall oversight responsibilities under this Charter and shall retain authority to review and ratify any actions taken by any such subcommittee or individual member. The Committee may also delegate specific authority to officers of the Company consistent with the Delegation of Authority Matrix (the "DOA Matrix") as approved by the Board and as may be amended from time to time. Any delegation of authority to management under this Section 4.4 shall be subject to such limitations, conditions, and reporting requirements as the Committee may impose.

ARTICLE V — RESPONSIBILITIES AND DUTIES

The Committee shall have the following responsibilities and duties. This list is intended to serve as a guide and is not intended to be exhaustive. The Committee may, in its discretion, undertake such additional activities as it deems necessary or appropriate to fulfill its oversight role.

Section 5.1 — Enterprise Risk Management Framework Oversight

The Committee shall oversee the Company's ERM Framework, including the risk appetite, risk tolerance levels, and risk limits established by management and approved by the Board. In discharging this responsibility, the Committee shall:

(a) Review and recommend to the Board the Company's Risk Appetite Statement at least annually, and more frequently as circumstances warrant, ensuring that the Risk Appetite Statement reflects the Company's current strategic objectives, financial condition, and risk profile;

(b) Review management's processes for identifying, assessing, prioritizing, mitigating, and monitoring risks across the enterprise, including the methodologies, tools, and frameworks employed by management in conducting risk assessments and maintaining the Company's risk register;

(c) Evaluate the adequacy and effectiveness of the ERM Framework, including the organizational structure, policies, procedures, and resources dedicated to enterprise risk management;

(d) Receive and review regular reports from the Chief Risk Officer (or equivalent senior officer), the Chief Compliance Officer, the Chief Audit Executive, and subsidiary-level risk officers regarding the status of risk management activities, key risk exposures, and emerging risks;

(e) Review and evaluate the integration of the ERM Framework with the Company's strategic planning, budgeting, and capital allocation processes; and

(f) Oversee the development and maintenance of risk assessment tools, risk dashboards, key risk indicators, and other risk reporting mechanisms.

Section 5.2 — Insurance-Specific Risk Categories

This Section 5.2 reflects the first substantive update to insurance-specific oversight responsibilities since the original adoption of the Risk Committee Charter on February 12, 2016, and is intended to address the expanded scope and complexity of the Company's insurance and reinsurance operations.

5.2.1 — Underwriting and Reserving Risk

The Committee shall oversee the Company's underwriting and reserving risk, including the following:

(a) Oversee the adequacy and integrity of the Company's loss and loss adjustment expense reserves for each regulated insurance subsidiary, including Quorum Property & Casualty Insurance Company (NAIC 38472), Lone Star Specialty Insurance Company (NAIC 41359), and Great Lakes Surety & Indemnity Co. (NAIC 29814);

(b) Review reports from the appointed actuaries of each regulated insurance subsidiary and from external actuarial consultants regarding reserve adequacy, including the Statements of Actuarial Opinion and the Actuarial Opinion Summaries filed with the applicable state insurance regulators;

(c) Monitor trends in loss ratios, combined ratios, and reserve development across lines of business, including identification of adverse development trends, reserve strengthening or releases, and the underlying factors driving such trends;

(d) Review the Company's underwriting guidelines, risk selection criteria, and pricing adequacy, including monitoring for changes in the competitive environment, market conditions, or regulatory requirements that may affect the Company's underwriting strategy; and

(e) Receive periodic reports on the results of internal and external reserve studies and on any material changes to reserving methodologies or assumptions.

5.2.2 — Reinsurance Risk

The Committee shall oversee the Company's reinsurance risk, including the following:

(a) Oversee the Company's reinsurance program, including the adequacy, structure, cost, and credit quality of the Company's reinsurance arrangements, both treaty and facultative;

(b) Review counterparty concentration risk in the reinsurance portfolio, including the credit quality, financial strength ratings, and collateral arrangements of the Company's reinsurance counterparties;

(c) Receive reports on reinsurance recoverables and the collectability thereof, including the aging of recoverables, the status of disputed balances, and any impairment or write-off of uncollectible reinsurance receivables;

(d) Review significant reinsurance treaty placements, including treaties exceeding the Chief Executive Officer's authority threshold as set forth in the DOA Matrix. As of the date of adoption of this Charter, the proposed CEO authority threshold for reinsurance treaty placements is $50.0 million per treaty, with amounts exceeding that threshold requiring Committee or Board approval; and

(e) Monitor changes in the global reinsurance market, including pricing trends, capacity constraints, and regulatory developments, that may affect the Company's ability to obtain reinsurance on favorable terms.

5.2.3 — Catastrophe and Concentration Risk

The Committee shall oversee the Company's catastrophe and concentration risk, including the following:

(a) Oversee the Company's catastrophe risk modeling, including probable maximum loss ("PML") analyses, stochastic modeling, and aggregate exposure management, utilizing industry-standard catastrophe models and proprietary analytics as appropriate;

(b) Review geographic and line-of-business concentration limits, including monitoring adherence to established limits and evaluating the appropriateness of such limits in light of changes in the Company's portfolio, risk appetite, or external conditions;

(c) Receive reports on natural catastrophe exposures (including hurricane, earthquake, wildfire, flood, and severe convective storm exposures), man-made catastrophe exposures, and emerging catastrophe exposures, including cyber aggregation risk and other novel peril categories;

(d) Review the Company's catastrophe reinsurance program in coordination with the Committee's reinsurance risk oversight responsibilities under Section 5.2.2, including the adequacy of catastrophe excess-of-loss and aggregate stop-loss protections; and

(e) Evaluate management's post-event response and loss estimation processes following significant catastrophe events.

5.2.4 — Claims and Litigation Risk

The Committee shall oversee the Company's claims and litigation risk, including the following:

(a) Monitor trends in claims frequency and severity across the Company's regulated insurance subsidiaries, including analysis of trends by line of business, geography, and policy form;

(b) Review significant claims, including claims exceeding the Board or Committee approval thresholds under the DOA Matrix. As of the date of adoption of this Charter, the proposed threshold for Board or Risk Committee approval of individual claim settlements is $10.0 million;

(c) Oversee the Company's litigation exposure arising from insurance operations, including extra-contractual liability, bad-faith exposure, and class action or mass tort litigation involving the Company's insurance subsidiaries;

(d) Receive periodic reports from the General Counsel on the status of material litigation matters and on trends in the legal and regulatory environment that may affect claims and litigation risk; and

(e) Evaluate the effectiveness of the Company's claims management practices, including staffing, training, use of technology, and vendor management.

Section 5.3 — Operational Risk

The Committee shall oversee the Company's identification and management of operational risks, including risks arising from internal process failures, systems failures, human error, fraud, and external events. In discharging this responsibility, the Committee shall:

(a) Review the Company's operational risk management framework, including the policies, procedures, and controls designed to identify, assess, mitigate, and monitor operational risks across the enterprise;

(b) Review the Company's business continuity plans and disaster recovery plans at least annually, including the results of any business continuity testing or disaster recovery exercises;

(c) Monitor key risk indicators ("KRIs") and key performance indicators related to operational risk, including incident and loss event data, near-miss reporting, and trend analyses;

(d) Receive reports on significant operational risk events, including root cause analyses and corrective action plans; and

(e) Oversee the Company's third-party risk management program as it relates to operational risk, including vendor due diligence, ongoing monitoring, and concentration risk among critical service providers.

Section 5.4 — Regulatory and Compliance Risk

The Committee shall oversee the Company's regulatory and compliance risk, including the following:

(a) Oversee the Company's compliance with applicable insurance regulatory requirements in each domiciliary state — Connecticut, Texas, and Ohio — and in each state where the Company's subsidiaries are licensed, authorized, or otherwise subject to regulatory oversight;

(b) Receive periodic updates on examinations, inquiries, market conduct investigations, and enforcement actions by state insurance regulators, including the Connecticut Department of Insurance, the Texas Department of Insurance, and the Ohio Department of Insurance, as well as any proceedings initiated by the National Association of Insurance Commissioners ("NAIC") or other regulatory bodies;

(c) Monitor the Company's compliance with insurance holding company act requirements, including the Company's obligations to file the Connecticut Holding Company Registration Statement (Form B) with the Connecticut Department of Insurance, and informational filing requirements in Texas and Ohio (including, without limitation, requirements under Ohio Revised Code § 3901.32 et seq.);

(d) Oversee the Company's compliance risk management program as administered by the Chief Compliance Officer (Ivan D. Pruett), including the effectiveness of compliance training, compliance monitoring and testing activities, and the compliance reporting and escalation framework;

(e) Receive reports on any material regulatory developments — including proposed or adopted changes to insurance laws, regulations, or regulatory guidance — that may affect the Company's operations, capital requirements, or risk profile; and

(f) Coordinate with the Audit Committee on compliance matters that have implications for both risk oversight and financial reporting.

Section 5.5 — Emerging and Strategic Risks

The Committee shall oversee the identification and assessment of emerging risks and strategic risks, including but not limited to the following:

(a) Climate-Related Risks. The Committee shall receive reports on the impact of climate change on the Company's underwriting portfolios, including changes in catastrophe frequency and severity, regulatory developments related to climate risk disclosure, and the potential effects of the transition to a low-carbon economy on the Company's investment portfolio and insured exposures;

(b) Geopolitical and Macroeconomic Risks. The Committee shall monitor geopolitical developments, macroeconomic conditions, and market dislocations that may affect the Company's operations, investment portfolio, or risk profile;

(c) Pandemic and Public Health Risks. The Committee shall oversee the Company's preparedness for and response to pandemic and public health risks, including the potential impact on claims, operations, and workforce;

(d) Social Inflation and Litigation Funding Trends. The Committee shall receive reports on trends in social inflation, nuclear verdicts, litigation funding, and other developments in the legal environment that may affect the Company's loss experience and reserve adequacy;

(e) Fintech and Insurtech Risks. The Committee shall oversee risks associated with the Company's financial technology and insurtech initiatives, including those conducted through Vantage Digital Insurance Solutions, Inc. and Quorum MGA Services, LLC, in coordination with the Technology & Cybersecurity Oversight Committee; and

(f) Strategic Risk Integration. The Committee shall review the integration of risk considerations into the Company's strategic planning process, including the identification of strategic risks associated with mergers, acquisitions, divestitures, new product launches, and market entry or exit decisions.

Section 5.6 — Capital and Liquidity Risk

The Committee shall oversee the Company's capital adequacy and liquidity risk, including the following:

(a) Oversee the Company's capital adequacy framework, including regulatory capital requirements (Risk-Based Capital, or "RBC") for each regulated insurance subsidiary, and monitor the Company's actual capital levels relative to required and target capital levels;

(b) Review the results of stress testing and scenario analysis exercises, including reverse stress tests and sensitivity analyses, and evaluate management's responses to adverse scenarios;

(c) Monitor liquidity risk across the enterprise, including the Company's access to funding sources, the liquidity profile of the investment portfolio, and the adequacy of liquidity contingency plans; and

(d) Coordinate with the Investment Committee and the Audit Committee on matters relating to capital management, liquidity, and financial condition, as appropriate.

Section 5.7 — Risk Culture

The Committee shall oversee management's efforts to foster a strong and effective risk culture throughout the organization. The Company employs approximately 6,400 employees across its holding company, regulated insurance subsidiaries, managing general agency, and fintech subsidiary. In discharging this responsibility, the Committee shall:

(a) Evaluate the tone at the top and management's commitment to risk-aware decision-making;

(b) Review risk-related training programs and risk-awareness initiatives directed at employees, officers, and agents of the Company and its subsidiaries;

(c) Monitor the effectiveness of the Company's risk escalation and reporting protocols, including the mechanisms by which employees and officers may report risk concerns to senior management and the Board; and

(d) Receive periodic assessments of risk culture, including the results of employee surveys, culture audits, or other diagnostic tools employed by management.

Section 5.8 — Delegation of Authority Matrix Oversight

The Committee shall oversee the DOA Matrix as it pertains to risk-related authority categories. In discharging this responsibility, the Committee shall:

(a) Review and recommend to the Board any amendments to the DOA Matrix as it pertains to risk-related authority categories, including claims-settlement authority, reinsurance authority, litigation-settlement authority, and other risk-related authority thresholds;

(b) Monitor compliance with the DOA Matrix, including reviewing management's reports on adherence to established authority thresholds and any instances of authority being exceeded; and

(c) Coordinate with the Board and with other standing committees of the Board on amendments to the DOA Matrix that may affect multiple authority categories or multiple committees.

This responsibility is exercised in connection with the Company's comprehensive DOA Matrix overhaul. The parent-level DOA Matrix is to be adopted by the Board alongside this Amended and Restated Charter at the Board meeting on December 11, 2025, and subsidiary-level delegation matrices are expected to be adopted by the respective subsidiary boards promptly thereafter.

ARTICLE VI — COORDINATION WITH OTHER BOARD COMMITTEES

Section 6.1 — Coordination with the Audit Committee

The Committee shall coordinate with the Audit Committee of the Board (currently chaired by Dr. Lilian Fong-Archer) to avoid duplication of effort and to ensure comprehensive coverage of risk and control matters. Areas of coordination between the Committee and the Audit Committee include, without limitation:

(a) ERM Framework Oversight. The Committee and the Audit Committee share responsibility for oversight of the ERM Framework. The Committee focuses primarily on risk identification, risk assessment, risk mitigation strategy, and risk appetite, while the Audit Committee focuses primarily on internal controls over risk management processes and the effectiveness of those controls;

(b) Financial Reporting Risks. The Committee shall coordinate with the Audit Committee on risks that may have a material impact on the Company's financial statements, including reserving risk, investment risk, and other risks that bear on the accuracy and reliability of financial reporting;

(c) Internal Audit Risk-Based Planning. The Chief Audit Executive (Renata M. Vásquez) reports to both the Committee and the Audit Committee on relevant matters. The Committee shall coordinate with the Audit Committee on the risk-based audit plan to ensure that the internal audit function is addressing the most significant enterprise risks;

(d) Compliance Matters. The Committee and the Audit Committee shall coordinate on compliance matters that have implications for both risk oversight and financial reporting, including regulatory examination findings, enforcement actions, and remediation activities.

The Chairpersons of the Risk Committee and the Audit Committee shall confer at least quarterly to align agendas, share information, and identify areas where joint or coordinated oversight is appropriate. Joint sessions of the Risk Committee and the Audit Committee may be convened at the discretion of either Chairperson.

Section 6.2 — Coordination with the Technology & Cybersecurity Oversight Committee

The Committee shall coordinate with the Technology & Cybersecurity Oversight Committee of the Board (proposed Chairperson: Priya Narasimhan) on matters where technology, cybersecurity, and data-privacy risks intersect with the Company's broader enterprise risk profile. Areas of coordination include, without limitation:

(a) Cybersecurity Risk and Insurance Operations. The Committee and the Technology & Cybersecurity Oversight Committee shall coordinate on cybersecurity risk as it affects insurance underwriting, including cyber insurance product offerings, cyber aggregation risk, and the potential for systemic cyber events to affect the Company's loss experience;

(b) IT Operational Risk and Third-Party Technology Risk. The Committee shall coordinate with the Technology & Cybersecurity Oversight Committee on information technology operational risk, including risks associated with legacy systems, system migrations, and third-party technology providers;

(c) AI Governance Risks. The Committee and the Technology & Cybersecurity Oversight Committee shall coordinate on risks associated with the Company's use of artificial intelligence and machine learning in underwriting, claims processing, and compliance activities, including algorithmic bias, model risk, and regulatory requirements applicable to the use of AI in insurance;

(d) Data-Privacy Risk and Regulatory Compliance. The Committee shall coordinate with the Technology & Cybersecurity Oversight Committee on data-privacy risk, including compliance with applicable state and federal data-privacy laws and regulations; and

(e) Incident Response Planning. The Committee and the Technology & Cybersecurity Oversight Committee shall coordinate on the Company's incident response plans, including the integration of cybersecurity incident response with the Company's broader enterprise risk management and crisis management frameworks.

The Chairpersons of the Risk Committee and the Technology & Cybersecurity Oversight Committee shall share relevant reports and confer as needed to ensure complementary, rather than duplicative, oversight. The Technology & Cybersecurity Oversight Committee shall report quarterly to the full Board, and the Risk Committee shall receive copies of such reports.

Section 6.3 — Coordination with the Investment Committee

The Committee shall coordinate with the Investment Committee of the Board (currently chaired by Jonathan K. Whitmore) on investment risk matters, including credit risk, market risk, interest rate risk, and liquidity risk in the Company's investment portfolio. As of the end of fiscal year 2024, the Company's total invested assets were approximately $16.4 billion. Given the significance of the investment portfolio to the Company's financial condition and risk profile, coordination between the Committee and the Investment Committee is essential. The Chairpersons of the Risk Committee and the Investment Committee shall confer at least semi-annually to discuss investment risk exposures, stress testing results, and any material changes to the risk profile of the investment portfolio.

Section 6.4 — Coordination with the Compensation & Human Capital Committee

The Committee shall provide input to the Compensation & Human Capital Committee of the Board (currently chaired by Claudia M. Severin) on risk-related aspects of compensation design. Specifically, the Committee shall evaluate and provide input on whether the Company's compensation programs, including incentive compensation arrangements for senior officers and other risk-taking personnel, create incentives for excessive or imprudent risk-taking. The Committee shall communicate its views on such matters to the Compensation & Human Capital Committee at least annually, or more frequently as circumstances warrant.

ARTICLE VII — REPORTING

Section 7.1 — Reports to the Board

The Chairperson shall report to the full Board on the Committee's activities, findings, and recommendations at each regularly scheduled Board meeting, and not less frequently than quarterly. Reports to the Board shall include, at a minimum:

(a) A summary of key risks discussed by the Committee during the reporting period;

(b) The status of risk mitigation actions and any open action items;

(c) Any significant changes to the Company's risk profile, including new or emerging risks, changes in risk severity or likelihood, and changes in the external risk environment;

(d) Recommendations for Board action, if any, including recommendations regarding the Risk Appetite Statement, the DOA Matrix, or other risk-related policies or frameworks; and

(e) Any other matters that the Committee believes should be brought to the attention of the full Board.

Section 7.2 — Reports from Management

The Committee shall receive regular reports from management, including, at a minimum, the following:

(a) The Chief Risk Officer (or equivalent senior officer), who shall report on the overall status of the ERM Framework, key risk exposures, key risk indicators, and risk mitigation activities;

(b) The Chief Compliance Officer (Ivan D. Pruett), who shall report on regulatory and compliance risk matters, including the results of compliance monitoring and testing, regulatory examination findings, and enforcement actions;

(c) The Chief Audit Executive (Renata M. Vásquez), who shall report on the results of internal audit activities relevant to risk management, including findings from risk-focused audits and the status of management's remediation of audit findings;

(d) The presidents of the Company's regulated insurance subsidiaries, including Dexter W. Ng, President of Quorum Property & Casualty Insurance Company, and the presidents of Lone Star Specialty Insurance Company and Great Lakes Surety & Indemnity Co., who shall report on subsidiary-level risk matters, including underwriting risk, claims trends, and regulatory developments;

(e) The appointed actuaries of the Company's regulated insurance subsidiaries, who shall report on reserve adequacy and actuarial analyses; and

(f) Such other members of management and advisors as the Committee may request from time to time.

Section 7.3 — External Advisor Reports

The Committee may request and receive reports from external advisors retained by the Committee or by the Company, including but not limited to risk management consultants, actuarial firms, regulatory consultants (such as Broadleaf Insurance Regulatory Consultants, LLC), catastrophe modeling firms, and outside legal counsel. The Committee shall have the authority to direct the scope and content of such reports and to meet with external advisors in executive session without management present.

ARTICLE VIII — ANNUAL SELF-EVALUATION

The Committee shall conduct an annual self-evaluation of its performance, including an assessment of the adequacy of this Charter. The self-evaluation shall assess whether the Committee has fulfilled its responsibilities as set forth in this Charter, whether the Committee's composition, meeting frequency, and processes are appropriate and effective, and whether there are areas in which the Committee's performance or this Charter should be improved. The self-evaluation may take such form as the Committee determines to be appropriate, including written questionnaires, facilitated discussions, or evaluations conducted with the assistance of external governance consultants.

The results of the annual self-evaluation shall be reported to the Nominating & Corporate Governance Committee (currently chaired by Arthur J. Pennington) and to the full Board. The Committee shall recommend to the Board any amendments to this Charter that it deems necessary or advisable based on the results of the self-evaluation, changes in applicable law or regulation, changes in the Company's business or risk profile, or evolving best practices in risk governance.

This annual self-evaluation provision is a new addition to this Charter, adopted as part of this Amended and Restated Charter consistent with NYSE listing standards and governance best practices. The inclusion of this provision is consistent with the recommendations set forth in the Apex Proxy Advisors benchmarking report dated June 30, 2025, which identified the absence of a formal self-evaluation requirement as an area for improvement in the Company's committee governance practices.

ARTICLE IX — LIMITATION ON COMMITTEE'S ROLE

While the Committee has the responsibilities and authority set forth in this Charter, it is not the duty of the Committee to plan, manage, or conduct the Company's risk management activities. Management of the Company, including the Chief Executive Officer, the Chief Risk Officer, the Chief Compliance Officer, and the officers and employees of the Company's subsidiaries, is responsible for the day-to-day identification, assessment, management, and mitigation of risk. The Committee's function is one of oversight, and the Committee is entitled to rely on the expertise, integrity, and good faith of the Company's officers, employees, and external advisors in discharging its responsibilities.

Nothing in this Charter is intended to expand the personal liability of any member of the Committee or any other director of the Company beyond what is required by applicable law, including the DGCL, the Company's Certificate of Incorporation (including the exculpation provision set forth therein), the Company's Bylaws, and the Company's indemnification agreements with its directors. Each member of the Committee shall be entitled to rely on the protections afforded by the Company's Certificate of Incorporation, Bylaws, and indemnification agreements, as well as the business judgment rule, in discharging his or her duties as a member of the Committee.

ARTICLE X — AMENDMENT

This Charter may be amended, modified, or restated by the Board at any time and from time to time, by resolution duly adopted at a meeting of the Board at which a quorum is present or by unanimous written consent of the Board. No amendment to this Charter shall require the approval of the shareholders of the Company unless otherwise required by applicable law or the rules of the NYSE.

The Committee shall review this Charter at least annually and shall recommend to the Board any amendments that the Committee deems necessary or advisable in light of changes in applicable law or regulation, changes in the Company's business or risk profile, the results of the Committee's annual self-evaluation, or evolving best practices in risk governance. Any amendment to this Charter shall be effective upon adoption by the Board and shall be reflected in the minutes of the Board meeting at which such amendment is adopted.

ARTICLE XI — EFFECTIVE DATE AND HISTORY

This Amended and Restated Charter is effective as of its adoption by the Board on December 11, 2025.

Charter History:

No interim amendments were adopted between the original adoption date of February 12, 2016, and the adoption of this Amended and Restated Charter on December 11, 2025. This Amended and Restated Charter represents the first substantive update to the Risk Committee Charter since its original adoption.

This Amended and Restated Charter was prepared in connection with the Company's comprehensive governance overhaul, undertaken during 2025, which also includes the following actions to be taken by the Board at or around the December 11, 2025 Board meeting:

(a) Restatement of the Audit Committee Charter;

(b) Restatement of the Compensation & Human Capital Committee Charter;

(d) Restatement of the Investment Committee Charter;

(e) Adoption of a new Technology & Cybersecurity Oversight Committee Charter;

(f) Revision of the Delegation of Authority Matrix at the parent-company and subsidiary levels;

(g) Amendment of the Corporate Governance Guidelines; and

(h) Conforming amendments to the Bylaws, including amendments to Article III, Section 3.3 (reflecting the establishment of six standing committees of the Board), Article III, Section 3.4 (updated committee-appointment mechanics), and Article IV, Section 4.2 (conforming changes relating to delegation of authority).

ATTESTATION

The undersigned, being the duly appointed General Counsel & Corporate Secretary of Quorum Insurance Holdings Corp., hereby certifies that this Amended and Restated Charter of the Risk Committee of the Board of Directors of Quorum Insurance Holdings Corp. was duly adopted by the Board of Directors of Quorum Insurance Holdings Corp. on December 11, 2025, pursuant to the Omnibus Board Resolution adopted on the same date.

QUORUM INSURANCE HOLDINGS CORP.

By: ________

Name: Dennis R. Okonkwo

Title: General Counsel & Corporate Secretary

Date: December 11, 2025

Adopted by the Board of Directors of Quorum Insurance Holdings Corp. on December 11, 2025, pursuant to the Omnibus Board Resolution adopted on the same date.

Event	Date
Original Charter adopted	February 12, 2016
Interim amendments	None
Amended and Restated Charter adopted	December 11, 2025

AMENDED AND RESTATED CHARTER OF THE RISK COMMITTEE OF THE BOARD OF DIRECTORS OF QUORUM INSURANCE HOLDINGS CORP.
Adopted by the Board of Directors on December 11, 2025
This Amended and Restated Charter supersedes the Charter of the Risk Committee originally adopted on February 12, 2016.
EXECUTION VERSION
Right-click to update Table of Contents
ARTICLE I — PURPOSE
The Board of Directors (the "Board") of Quorum Insurance Holdings Corp., a Delaware corporation (the "Company" or "QIH"; NYSE: QIHC), hereby establishes and sets forth this Amended and Restated Charter (this "Charter") of the Risk Committee of the Board (the "Committee").
The Committee is established pursuant to Article III, Section 3.3 of the Amended and Restated Bylaws of the Company (as amended from time to time, the "Bylaws") and Section 141(c) of the Delaware General Corporation Law (the "DGCL"), which authorizes the Board to designate one or more committees of the Board and to delegate to such committees such authority as the Board deems appropriate, subject to limitations set forth in the DGCL.
The primary purpose of the Committee is to assist the Board in its oversight of the Company's enterprise-wide risk management framework (the "ERM" or the "ERM Framework"), including the identification, assessment, monitoring, and mitigation of material risks facing the Company and its subsidiaries. The Committee shall serve as the principal Board-level body responsible for ensuring that the Company maintains a comprehensive, effective, and appropriately resourced approach to enterprise risk management, consistent with the Company's strategic objectives, regulatory obligations, and the expectations of its shareholders, policyholders, and other stakeholders.
The Company operates as a multi-line insurance holding company with regulated insurance subsidiaries domiciled in multiple jurisdictions, including: (i) Quorum Property & Casualty Insurance Company, domiciled in the State of Connecticut (NAIC Company Code 38472); (ii) Lone Star Specialty Insurance Company, domiciled in the State of Texas (NAIC Company Code 41359); and (iii) Great Lakes Surety & Indemnity Co., domiciled in the State of Ohio (NAIC Company Code 29814). In addition, the Company operates a managing general agent, Quorum MGA Services, LLC, and a financial technology subsidiary, Vantage Digital Insurance Solutions, Inc. By virtue of these operations, the Company faces risks that are unique to the insurance and financial services industries, including but not limited to underwriting risk, reserving risk, reinsurance risk, catastrophe risk, investment risk, regulatory and compliance risk, operational risk, and emerging risks related to climate change, social inflation, cyber aggregation, and technological disruption. The Committee's oversight responsibilities are designed to address this distinctive risk profile.
The Committee's role is one of oversight. The management of the Company, including the Chief Risk Officer (or equivalent senior officer), the Chief Compliance Officer, the Chief Audit Executive, and the presidents and officers of the Company's subsidiaries, is responsible for the day-to-day identification, assessment, management, and mitigation of risk. The Committee does not itself manage risk on behalf of the Company, but rather oversees and evaluates the processes, policies, and frameworks that management employs in discharging its risk management responsibilities.
Nothing in this Charter is intended to alter or diminish the responsibilities of any other standing committee of the Board, including the Audit Committee, the Compensation & Human Capital Committee, the Nominating & Corporate Governance Committee, the Investment Committee, or the Technology & Cybersecurity Oversight Committee. Each such committee retains its respective responsibilities as set forth in its own charter, and this Charter is intended to complement — not supersede — those responsibilities. Where oversight responsibilities overlap or intersect, the Committee shall coordinate with the relevant committee or committees in the manner described in Article VI of this Charter.
ARTICLE II — COMPOSITION
Section 2.1 — Number of Members
The Committee shall consist of no fewer than three (3) members of the Board. The members of the Committee shall be appointed by the Board annually at the first Board meeting following the annual meeting of shareholders of the Company, and each member shall serve until such member's successor is duly appointed and qualified, or until such member's earlier resignation, removal, or cessation of service as a director of the Company. The Board may, in its discretion, appoint additional members to the Committee at any time, provided that the Committee shall at all times consist of no fewer than three (3) members. The appointment and removal of members of the Committee shall be conducted in conformity with Bylaws Article III, Section 3.4, as revised in connection with the Company's comprehensive governance overhaul to reflect updated committee-appointment mechanics.
Section 2.2 — Independence
Each member of the Committee shall be "independent" as that term is defined under the New York Stock Exchange ("NYSE") Listed Company Manual Section 303A, including as amended through the 2024 amendments to Section 303A relating to independence standards for board committee members. In determining independence, the Board shall consider all relevant facts and circumstances, including but not limited to any material relationships between the director and the Company or its subsidiaries, affiliates, or significant counterparties. No member of the Committee may be an employee of the Company or any of its subsidiaries or affiliates, and no member may have any relationship with the Company that would impair such member's ability to exercise independent judgment in carrying out the Committee's responsibilities.
Section 2.3 — Qualifications
At least one (1) member of the Committee shall have experience in risk management, insurance regulation, actuarial science, or a related discipline, as determined by the Board in its business judgment. The Board shall endeavor to appoint members who collectively possess sufficient expertise, experience, and diversity of perspective to understand and oversee the Company's risk profile, including, without limitation, insurance underwriting risk, investment risk, operational risk, regulatory and compliance risk, and emerging risks. The Board recognizes that the Company's multi-line insurance operations and its fintech and managing general agency activities require Committee members who are able to evaluate complex and interrelated risk factors across a range of disciplines and business lines.
Section 2.4 — Chairperson
The Board shall designate one independent member of the Committee as the Chairperson of the Committee (the "Chairperson"). As of the date of adoption of this Charter, the Chairperson is Raymond T. Huerta. In the event that the Chairperson is absent from or unable to participate in any meeting of the Committee, the members present at such meeting shall elect a temporary chairperson for such meeting by majority vote of the members present.
The duties of the Chairperson shall include: (a) establishing the agenda for each meeting of the Committee, in consultation with the Chief Risk Officer (or equivalent senior officer) and the General Counsel & Corporate Secretary; (b) presiding over meetings of the Committee; (c) reporting to the full Board on the activities, findings, and recommendations of the Committee; and (d) serving as the principal liaison between the Committee and management on risk-related matters and between the Committee and other standing committees of the Board on matters of overlapping responsibility.
Section 2.5 — Removal and Vacancies
Any member of the Committee may be removed or replaced by the Board at any time, with or without cause, by action of the Board. Vacancies on the Committee, whether resulting from removal, resignation, death, incapacity, or increase in the number of Committee members, shall be filled by the Board. Any member appointed to fill a vacancy shall serve for the remainder of the term of the predecessor member (or, in the case of a vacancy resulting from an increase in the size of the Committee, until the next annual appointment of the Committee following the annual meeting of shareholders), or until such member's earlier resignation, removal, or cessation of service as a director.
ARTICLE III — MEETINGS AND PROCEDURES
Section 3.1 — Frequency
The Committee shall meet at least four (4) times per year, on a quarterly basis, and more frequently as circumstances require. The Chairperson shall have the authority to call additional meetings of the Committee at any time. Special meetings of the Committee may also be called by any two (2) members of the Committee, by the Chair of the Board & Chief Executive Officer (Margaret A. Calloway), by the General Counsel & Corporate Secretary (Dennis R. Okonkwo), or by the Chief Compliance Officer (Ivan D. Pruett). Meetings may be held in person, by telephone conference, by video conference, or by any other means of communication by which all members participating in the meeting can hear one another, in accordance with the DGCL and the Bylaws.
Section 3.2 — Quorum and Voting
A majority of the members of the Committee then serving shall constitute a quorum for the transaction of business at any meeting of the Committee. Actions of the Committee shall be taken by a majority vote of the members present at a meeting at which a quorum is present. Each member of the Committee shall have one vote. In the event of a tie, the matter shall be referred to the full Board for consideration.
The Committee may act by unanimous written consent in lieu of a meeting, in accordance with DGCL § 141(c) and the applicable provisions of the Bylaws. Any action taken by unanimous written consent shall have the same force and effect as if taken at a duly convened meeting.
Section 3.3 — Attendance by Non-Members
The Committee may invite members of management and other persons to attend all or any portion of any meeting of the Committee in a non-voting capacity, as the Chairperson deems appropriate. Persons who may be invited to attend include, without limitation, the Chief Executive Officer, the Chief Financial Officer (Patricia Sung-Hee Lam), the Chief Compliance Officer (Ivan D. Pruett), the Chief Audit Executive (Renata M. Vásquez), the Chief Risk Officer (or equivalent senior officer), presidents of regulated insurance subsidiaries, representatives of the Company's appointed actuaries, external advisors (including risk management consultants, actuarial firms, regulatory consultants, and outside legal counsel), and any other officers, employees, or advisors whose participation the Chairperson determines would be beneficial to the Committee's deliberations.
Notwithstanding the foregoing, the Committee shall have the right to meet in executive session without management present at any time and shall do so at each regularly scheduled quarterly meeting unless the Chairperson determines that an executive session is not necessary. Executive sessions may include only members of the Committee and any external advisors as the Committee may determine.
Section 3.4 — Agenda and Materials
The Chairperson, in consultation with the Chief Risk Officer (or equivalent senior officer), the General Counsel & Corporate Secretary, and other members of management as appropriate, shall establish the agenda for each meeting of the Committee. Any member of the Committee may request the inclusion of additional items on the agenda by providing notice to the Chairperson in advance of the meeting. Meeting materials, including reports, presentations, memoranda, and other documents relevant to the matters to be considered at the meeting, shall be distributed to members of the Committee in advance of the meeting to the extent practicable, with the goal of providing members with sufficient time to review and consider such materials prior to the meeting.
Section 3.5 — Minutes
The Corporate Secretary (or the Corporate Secretary's designee) shall attend each meeting of the Committee and shall keep minutes of all meetings of the Committee. The minutes shall accurately reflect the matters discussed, the actions taken, and the votes cast at each meeting, and shall be maintained as part of the permanent corporate records of the Company. Draft minutes shall be circulated to members of the Committee for review and shall be approved by the Committee at a subsequent meeting. Minutes of Committee meetings shall be made available to the full Board upon request and shall be provided to the Board as part of the Committee's regular reporting under Article VII.
ARTICLE IV — AUTHORITY
Section 4.1 — General Authority
The Committee shall have the authority, to the extent it deems necessary or appropriate, to carry out its purposes and responsibilities as set forth in this Charter. The Committee's authority derives from DGCL § 141(c), which permits the Board to delegate authority to committees of the Board composed of one or more directors, subject to limitations on actions that may not be delegated to a committee under the DGCL (including, without limitation, the approval of amendments to the Certificate of Incorporation, the adoption of an agreement of merger or consolidation, the recommendation to shareholders of a dissolution, and the amendment of the Bylaws). The Committee shall exercise its authority in a manner consistent with the Company's Certificate of Incorporation, Bylaws, Corporate Governance Guidelines, and applicable law.
Section 4.2 — Retention of Advisors
The Committee shall have the sole authority to retain and terminate risk management consultants, actuarial firms, legal counsel, and other external advisors as it deems necessary to fulfill its oversight responsibilities, without the need for further Board approval. The Committee may engage such advisors on such terms as it deems appropriate, including with respect to the scope, fees, and duration of any engagement. The Company shall provide appropriate funding, as determined by the Committee in its sole discretion, for the compensation of any advisors retained by the Committee and for the ordinary administrative expenses of the Committee that are necessary or appropriate for carrying out its duties.
Section 4.3 — Access to Information
The Committee shall have full and unrestricted access to any books, records, data, reports, analyses, and personnel of the Company and its subsidiaries as the Committee deems necessary or appropriate to discharge its responsibilities under this Charter. Management shall cooperate fully with the Committee and shall provide requested information on a timely basis. The Committee may direct the Chief Risk Officer, the Chief Compliance Officer, the Chief Audit Executive, subsidiary-level officers, and any other employees or agents of the Company to provide such information, reports, and analyses as the Committee may require.
Section 4.4 — Delegation
The Committee may delegate specific tasks, projects, or investigations to one or more subcommittees or to individual members of the Committee, to the extent permitted by DGCL § 141(c) and the Bylaws; provided, however, that the Committee shall not delegate its overall oversight responsibilities under this Charter and shall retain authority to review and ratify any actions taken by any such subcommittee or individual member. The Committee may also delegate specific authority to officers of the Company consistent with the Delegation of Authority Matrix (the "DOA Matrix") as approved by the Board and as may be amended from time to time. Any delegation of authority to management under this Section 4.4 shall be subject to such limitations, conditions, and reporting requirements as the Committee may impose.
ARTICLE V — RESPONSIBILITIES AND DUTIES
The Committee shall have the following responsibilities and duties. This list is intended to serve as a guide and is not intended to be exhaustive. The Committee may, in its discretion, undertake such additional activities as it deems necessary or appropriate to fulfill its oversight role.
Section 5.1 — Enterprise Risk Management Framework Oversight
The Committee shall oversee the Company's ERM Framework, including the risk appetite, risk tolerance levels, and risk limits established by management and approved by the Board. In discharging this responsibility, the Committee shall:
(a) Review and recommend to the Board the Company's Risk Appetite Statement at least annually, and more frequently as circumstances warrant, ensuring that the Risk Appetite Statement reflects the Company's current strategic objectives, financial condition, and risk profile;
(b) Review management's processes for identifying, assessing, prioritizing, mitigating, and monitoring risks across the enterprise, including the methodologies, tools, and frameworks employed by management in conducting risk assessments and maintaining the Company's risk register;
(c) Evaluate the adequacy and effectiveness of the ERM Framework, including the organizational structure, policies, procedures, and resources dedicated to enterprise risk management;
(d) Receive and review regular reports from the Chief Risk Officer (or equivalent senior officer), the Chief Compliance Officer, the Chief Audit Executive, and subsidiary-level risk officers regarding the status of risk management activities, key risk exposures, and emerging risks;
(e) Review and evaluate the integration of the ERM Framework with the Company's strategic planning, budgeting, and capital allocation processes; and
(f) Oversee the development and maintenance of risk assessment tools, risk dashboards, key risk indicators, and other risk reporting mechanisms.
Section 5.2 — Insurance-Specific Risk Categories
This Section 5.2 reflects the first substantive update to insurance-specific oversight responsibilities since the original adoption of the Risk Committee Charter on February 12, 2016, and is intended to address the expanded scope and complexity of the Company's insurance and reinsurance operations.
5.2.1 — Underwriting and Reserving Risk
The Committee shall oversee the Company's underwriting and reserving risk, including the following:
(a) Oversee the adequacy and integrity of the Company's loss and loss adjustment expense reserves for each regulated insurance subsidiary, including Quorum Property & Casualty Insurance Company (NAIC 38472), Lone Star Specialty Insurance Company (NAIC 41359), and Great Lakes Surety & Indemnity Co. (NAIC 29814);
(b) Review reports from the appointed actuaries of each regulated insurance subsidiary and from external actuarial consultants regarding reserve adequacy, including the Statements of Actuarial Opinion and the Actuarial Opinion Summaries filed with the applicable state insurance regulators;
(c) Monitor trends in loss ratios, combined ratios, and reserve development across lines of business, including identification of adverse development trends, reserve strengthening or releases, and the underlying factors driving such trends;
(d) Review the Company's underwriting guidelines, risk selection criteria, and pricing adequacy, including monitoring for changes in the competitive environment, market conditions, or regulatory requirements that may affect the Company's underwriting strategy; and
(e) Receive periodic reports on the results of internal and external reserve studies and on any material changes to reserving methodologies or assumptions.
5.2.2 — Reinsurance Risk
The Committee shall oversee the Company's reinsurance risk, including the following:
(a) Oversee the Company's reinsurance program, including the adequacy, structure, cost, and credit quality of the Company's reinsurance arrangements, both treaty and facultative;
(b) Review counterparty concentration risk in the reinsurance portfolio, including the credit quality, financial strength ratings, and collateral arrangements of the Company's reinsurance counterparties;
(c) Receive reports on reinsurance recoverables and the collectability thereof, including the aging of recoverables, the status of disputed balances, and any impairment or write-off of uncollectible reinsurance receivables;
(d) Review significant reinsurance treaty placements, including treaties exceeding the Chief Executive Officer's authority threshold as set forth in the DOA Matrix. As of the date of adoption of this Charter, the proposed CEO authority threshold for reinsurance treaty placements is $50.0 million per treaty, with amounts exceeding that threshold requiring Committee or Board approval; and
(e) Monitor changes in the global reinsurance market, including pricing trends, capacity constraints, and regulatory developments, that may affect the Company's ability to obtain reinsurance on favorable terms.
5.2.3 — Catastrophe and Concentration Risk
The Committee shall oversee the Company's catastrophe and concentration risk, including the following:
(a) Oversee the Company's catastrophe risk modeling, including probable maximum loss ("PML") analyses, stochastic modeling, and aggregate exposure management, utilizing industry-standard catastrophe models and proprietary analytics as appropriate;
(b) Review geographic and line-of-business concentration limits, including monitoring adherence to established limits and evaluating the appropriateness of such limits in light of changes in the Company's portfolio, risk appetite, or external conditions;
(c) Receive reports on natural catastrophe exposures (including hurricane, earthquake, wildfire, flood, and severe convective storm exposures), man-made catastrophe exposures, and emerging catastrophe exposures, including cyber aggregation risk and other novel peril categories;
(d) Review the Company's catastrophe reinsurance program in coordination with the Committee's reinsurance risk oversight responsibilities under Section 5.2.2, including the adequacy of catastrophe excess-of-loss and aggregate stop-loss protections; and
(e) Evaluate management's post-event response and loss estimation processes following significant catastrophe events.
5.2.4 — Claims and Litigation Risk
The Committee shall oversee the Company's claims and litigation risk, including the following:
(a) Monitor trends in claims frequency and severity across the Company's regulated insurance subsidiaries, including analysis of trends by line of business, geography, and policy form;
(b) Review significant claims, including claims exceeding the Board or Committee approval thresholds under the DOA Matrix. As of the date of adoption of this Charter, the proposed threshold for Board or Risk Committee approval of individual claim settlements is $10.0 million;
(c) Oversee the Company's litigation exposure arising from insurance operations, including extra-contractual liability, bad-faith exposure, and class action or mass tort litigation involving the Company's insurance subsidiaries;
(d) Receive periodic reports from the General Counsel on the status of material litigation matters and on trends in the legal and regulatory environment that may affect claims and litigation risk; and
(e) Evaluate the effectiveness of the Company's claims management practices, including staffing, training, use of technology, and vendor management.
Section 5.3 — Operational Risk
The Committee shall oversee the Company's identification and management of operational risks, including risks arising from internal process failures, systems failures, human error, fraud, and external events. In discharging this responsibility, the Committee shall:
(a) Review the Company's operational risk management framework, including the policies, procedures, and controls designed to identify, assess, mitigate, and monitor operational risks across the enterprise;
(b) Review the Company's business continuity plans and disaster recovery plans at least annually, including the results of any business continuity testing or disaster recovery exercises;
(c) Monitor key risk indicators ("KRIs") and key performance indicators related to operational risk, including incident and loss event data, near-miss reporting, and trend analyses;
(d) Receive reports on significant operational risk events, including root cause analyses and corrective action plans; and
(e) Oversee the Company's third-party risk management program as it relates to operational risk, including vendor due diligence, ongoing monitoring, and concentration risk among critical service providers.
Section 5.4 — Regulatory and Compliance Risk
The Committee shall oversee the Company's regulatory and compliance risk, including the following:
(a) Oversee the Company's compliance with applicable insurance regulatory requirements in each domiciliary state — Connecticut, Texas, and Ohio — and in each state where the Company's subsidiaries are licensed, authorized, or otherwise subject to regulatory oversight;
(b) Receive periodic updates on examinations, inquiries, market conduct investigations, and enforcement actions by state insurance regulators, including the Connecticut Department of Insurance, the Texas Department of Insurance, and the Ohio Department of Insurance, as well as any proceedings initiated by the National Association of Insurance Commissioners ("NAIC") or other regulatory bodies;
(c) Monitor the Company's compliance with insurance holding company act requirements, including the Company's obligations to file the Connecticut Holding Company Registration Statement (Form B) with the Connecticut Department of Insurance, and informational filing requirements in Texas and Ohio (including, without limitation, requirements under Ohio Revised Code § 3901.32 et seq.);
(d) Oversee the Company's compliance risk management program as administered by the Chief Compliance Officer (Ivan D. Pruett), including the effectiveness of compliance training, compliance monitoring and testing activities, and the compliance reporting and escalation framework;
(e) Receive reports on any material regulatory developments — including proposed or adopted changes to insurance laws, regulations, or regulatory guidance — that may affect the Company's operations, capital requirements, or risk profile; and
(f) Coordinate with the Audit Committee on compliance matters that have implications for both risk oversight and financial reporting.
Section 5.5 — Emerging and Strategic Risks
The Committee shall oversee the identification and assessment of emerging risks and strategic risks, including but not limited to the following:
(a) Climate-Related Risks. The Committee shall receive reports on the impact of climate change on the Company's underwriting portfolios, including changes in catastrophe frequency and severity, regulatory developments related to climate risk disclosure, and the potential effects of the transition to a low-carbon economy on the Company's investment portfolio and insured exposures;
(b) Geopolitical and Macroeconomic Risks. The Committee shall monitor geopolitical developments, macroeconomic conditions, and market dislocations that may affect the Company's operations, investment portfolio, or risk profile;
(c) Pandemic and Public Health Risks. The Committee shall oversee the Company's preparedness for and response to pandemic and public health risks, including the potential impact on claims, operations, and workforce;
(d) Social Inflation and Litigation Funding Trends. The Committee shall receive reports on trends in social inflation, nuclear verdicts, litigation funding, and other developments in the legal environment that may affect the Company's loss experience and reserve adequacy;
(e) Fintech and Insurtech Risks. The Committee shall oversee risks associated with the Company's financial technology and insurtech initiatives, including those conducted through Vantage Digital Insurance Solutions, Inc. and Quorum MGA Services, LLC, in coordination with the Technology & Cybersecurity Oversight Committee; and
(f) Strategic Risk Integration. The Committee shall review the integration of risk considerations into the Company's strategic planning process, including the identification of strategic risks associated with mergers, acquisitions, divestitures, new product launches, and market entry or exit decisions.
Section 5.6 — Capital and Liquidity Risk
The Committee shall oversee the Company's capital adequacy and liquidity risk, including the following:
(a) Oversee the Company's capital adequacy framework, including regulatory capital requirements (Risk-Based Capital, or "RBC") for each regulated insurance subsidiary, and monitor the Company's actual capital levels relative to required and target capital levels;
(b) Review the results of stress testing and scenario analysis exercises, including reverse stress tests and sensitivity analyses, and evaluate management's responses to adverse scenarios;
(c) Monitor liquidity risk across the enterprise, including the Company's access to funding sources, the liquidity profile of the investment portfolio, and the adequacy of liquidity contingency plans; and
(d) Coordinate with the Investment Committee and the Audit Committee on matters relating to capital management, liquidity, and financial condition, as appropriate.
Section 5.7 — Risk Culture
The Committee shall oversee management's efforts to foster a strong and effective risk culture throughout the organization. The Company employs approximately 6,400 employees across its holding company, regulated insurance subsidiaries, managing general agency, and fintech subsidiary. In discharging this responsibility, the Committee shall:
(a) Evaluate the tone at the top and management's commitment to risk-aware decision-making;
(b) Review risk-related training programs and risk-awareness initiatives directed at employees, officers, and agents of the Company and its subsidiaries;
(c) Monitor the effectiveness of the Company's risk escalation and reporting protocols, including the mechanisms by which employees and officers may report risk concerns to senior management and the Board; and
(d) Receive periodic assessments of risk culture, including the results of employee surveys, culture audits, or other diagnostic tools employed by management.
Section 5.8 — Delegation of Authority Matrix Oversight
The Committee shall oversee the DOA Matrix as it pertains to risk-related authority categories. In discharging this responsibility, the Committee shall:
(a) Review and recommend to the Board any amendments to the DOA Matrix as it pertains to risk-related authority categories, including claims-settlement authority, reinsurance authority, litigation-settlement authority, and other risk-related authority thresholds;
(b) Monitor compliance with the DOA Matrix, including reviewing management's reports on adherence to established authority thresholds and any instances of authority being exceeded; and
(c) Coordinate with the Board and with other standing committees of the Board on amendments to the DOA Matrix that may affect multiple authority categories or multiple committees.
This responsibility is exercised in connection with the Company's comprehensive DOA Matrix overhaul. The parent-level DOA Matrix is to be adopted by the Board alongside this Amended and Restated Charter at the Board meeting on December 11, 2025, and subsidiary-level delegation matrices are expected to be adopted by the respective subsidiary boards promptly thereafter.
ARTICLE VI — COORDINATION WITH OTHER BOARD COMMITTEES
Section 6.1 — Coordination with the Audit Committee
The Committee shall coordinate with the Audit Committee of the Board (currently chaired by Dr. Lilian Fong-Archer) to avoid duplication of effort and to ensure comprehensive coverage of risk and control matters. Areas of coordination between the Committee and the Audit Committee include, without limitation:
(a) ERM Framework Oversight. The Committee and the Audit Committee share responsibility for oversight of the ERM Framework. The Committee focuses primarily on risk identification, risk assessment, risk mitigation strategy, and risk appetite, while the Audit Committee focuses primarily on internal controls over risk management processes and the effectiveness of those controls;
(b) Financial Reporting Risks. The Committee shall coordinate with the Audit Committee on risks that may have a material impact on the Company's financial statements, including reserving risk, investment risk, and other risks that bear on the accuracy and reliability of financial reporting;
(c) Internal Audit Risk-Based Planning. The Chief Audit Executive (Renata M. Vásquez) reports to both the Committee and the Audit Committee on relevant matters. The Committee shall coordinate with the Audit Committee on the risk-based audit plan to ensure that the internal audit function is addressing the most significant enterprise risks;
(d) Compliance Matters. The Committee and the Audit Committee shall coordinate on compliance matters that have implications for both risk oversight and financial reporting, including regulatory examination findings, enforcement actions, and remediation activities.
The Chairpersons of the Risk Committee and the Audit Committee shall confer at least quarterly to align agendas, share information, and identify areas where joint or coordinated oversight is appropriate. Joint sessions of the Risk Committee and the Audit Committee may be convened at the discretion of either Chairperson.
Section 6.2 — Coordination with the Technology & Cybersecurity Oversight Committee
The Committee shall coordinate with the Technology & Cybersecurity Oversight Committee of the Board (proposed Chairperson: Priya Narasimhan) on matters where technology, cybersecurity, and data-privacy risks intersect with the Company's broader enterprise risk profile. Areas of coordination include, without limitation:
(a) Cybersecurity Risk and Insurance Operations. The Committee and the Technology & Cybersecurity Oversight Committee shall coordinate on cybersecurity risk as it affects insurance underwriting, including cyber insurance product offerings, cyber aggregation risk, and the potential for systemic cyber events to affect the Company's loss experience;
(b) IT Operational Risk and Third-Party Technology Risk. The Committee shall coordinate with the Technology & Cybersecurity Oversight Committee on information technology operational risk, including risks associated with legacy systems, system migrations, and third-party technology providers;
(c) AI Governance Risks. The Committee and the Technology & Cybersecurity Oversight Committee shall coordinate on risks associated with the Company's use of artificial intelligence and machine learning in underwriting, claims processing, and compliance activities, including algorithmic bias, model risk, and regulatory requirements applicable to the use of AI in insurance;
(d) Data-Privacy Risk and Regulatory Compliance. The Committee shall coordinate with the Technology & Cybersecurity Oversight Committee on data-privacy risk, including compliance with applicable state and federal data-privacy laws and regulations; and
(e) Incident Response Planning. The Committee and the Technology & Cybersecurity Oversight Committee shall coordinate on the Company's incident response plans, including the integration of cybersecurity incident response with the Company's broader enterprise risk management and crisis management frameworks.
The Chairpersons of the Risk Committee and the Technology & Cybersecurity Oversight Committee shall share relevant reports and confer as needed to ensure complementary, rather than duplicative, oversight. The Technology & Cybersecurity Oversight Committee shall report quarterly to the full Board, and the Risk Committee shall receive copies of such reports.
Section 6.3 — Coordination with the Investment Committee
The Committee shall coordinate with the Investment Committee of the Board (currently chaired by Jonathan K. Whitmore) on investment risk matters, including credit risk, market risk, interest rate risk, and liquidity risk in the Company's investment portfolio. As of the end of fiscal year 2024, the Company's total invested assets were approximately $16.4 billion. Given the significance of the investment portfolio to the Company's financial condition and risk profile, coordination between the Committee and the Investment Committee is essential. The Chairpersons of the Risk Committee and the Investment Committee shall confer at least semi-annually to discuss investment risk exposures, stress testing results, and any material changes to the risk profile of the investment portfolio.
Section 6.4 — Coordination with the Compensation & Human Capital Committee
The Committee shall provide input to the Compensation & Human Capital Committee of the Board (currently chaired by Claudia M. Severin) on risk-related aspects of compensation design. Specifically, the Committee shall evaluate and provide input on whether the Company's compensation programs, including incentive compensation arrangements for senior officers and other risk-taking personnel, create incentives for excessive or imprudent risk-taking. The Committee shall communicate its views on such matters to the Compensation & Human Capital Committee at least annually, or more frequently as circumstances warrant.
ARTICLE VII — REPORTING
Section 7.1 — Reports to the Board
The Chairperson shall report to the full Board on the Committee's activities, findings, and recommendations at each regularly scheduled Board meeting, and not less frequently than quarterly. Reports to the Board shall include, at a minimum:
(a) A summary of key risks discussed by the Committee during the reporting period;
(b) The status of risk mitigation actions and any open action items;
(c) Any significant changes to the Company's risk profile, including new or emerging risks, changes in risk severity or likelihood, and changes in the external risk environment;
(d) Recommendations for Board action, if any, including recommendations regarding the Risk Appetite Statement, the DOA Matrix, or other risk-related policies or frameworks; and
(e) Any other matters that the Committee believes should be brought to the attention of the full Board.
Section 7.2 — Reports from Management
The Committee shall receive regular reports from management, including, at a minimum, the following:
(a) The Chief Risk Officer (or equivalent senior officer), who shall report on the overall status of the ERM Framework, key risk exposures, key risk indicators, and risk mitigation activities;
(b) The Chief Compliance Officer (Ivan D. Pruett), who shall report on regulatory and compliance risk matters, including the results of compliance monitoring and testing, regulatory examination findings, and enforcement actions;
(c) The Chief Audit Executive (Renata M. Vásquez), who shall report on the results of internal audit activities relevant to risk management, including findings from risk-focused audits and the status of management's remediation of audit findings;
(d) The presidents of the Company's regulated insurance subsidiaries, including Dexter W. Ng, President of Quorum Property & Casualty Insurance Company, and the presidents of Lone Star Specialty Insurance Company and Great Lakes Surety & Indemnity Co., who shall report on subsidiary-level risk matters, including underwriting risk, claims trends, and regulatory developments;
(e) The appointed actuaries of the Company's regulated insurance subsidiaries, who shall report on reserve adequacy and actuarial analyses; and
(f) Such other members of management and advisors as the Committee may request from time to time.
Section 7.3 — External Advisor Reports
The Committee may request and receive reports from external advisors retained by the Committee or by the Company, including but not limited to risk management consultants, actuarial firms, regulatory consultants (such as Broadleaf Insurance Regulatory Consultants, LLC), catastrophe modeling firms, and outside legal counsel. The Committee shall have the authority to direct the scope and content of such reports and to meet with external advisors in executive session without management present.
ARTICLE VIII — ANNUAL SELF-EVALUATION
The Committee shall conduct an annual self-evaluation of its performance, including an assessment of the adequacy of this Charter. The self-evaluation shall assess whether the Committee has fulfilled its responsibilities as set forth in this Charter, whether the Committee's composition, meeting frequency, and processes are appropriate and effective, and whether there are areas in which the Committee's performance or this Charter should be improved. The self-evaluation may take such form as the Committee determines to be appropriate, including written questionnaires, facilitated discussions, or evaluations conducted with the assistance of external governance consultants.
The results of the annual self-evaluation shall be reported to the Nominating & Corporate Governance Committee (currently chaired by Arthur J. Pennington) and to the full Board. The Committee shall recommend to the Board any amendments to this Charter that it deems necessary or advisable based on the results of the self-evaluation, changes in applicable law or regulation, changes in the Company's business or risk profile, or evolving best practices in risk governance.
This annual self-evaluation provision is a new addition to this Charter, adopted as part of this Amended and Restated Charter consistent with NYSE listing standards and governance best practices. The inclusion of this provision is consistent with the recommendations set forth in the Apex Proxy Advisors benchmarking report dated June 30, 2025, which identified the absence of a formal self-evaluation requirement as an area for improvement in the Company's committee governance practices.
ARTICLE IX — LIMITATION ON COMMITTEE'S ROLE
While the Committee has the responsibilities and authority set forth in this Charter, it is not the duty of the Committee to plan, manage, or conduct the Company's risk management activities. Management of the Company, including the Chief Executive Officer, the Chief Risk Officer, the Chief Compliance Officer, and the officers and employees of the Company's subsidiaries, is responsible for the day-to-day identification, assessment, management, and mitigation of risk. The Committee's function is one of oversight, and the Committee is entitled to rely on the expertise, integrity, and good faith of the Company's officers, employees, and external advisors in discharging its responsibilities.
Nothing in this Charter is intended to expand the personal liability of any member of the Committee or any other director of the Company beyond what is required by applicable law, including the DGCL, the Company's Certificate of Incorporation (including the exculpation provision set forth therein), the Company's Bylaws, and the Company's indemnification agreements with its directors. Each member of the Committee shall be entitled to rely on the protections afforded by the Company's Certificate of Incorporation, Bylaws, and indemnification agreements, as well as the business judgment rule, in discharging his or her duties as a member of the Committee.
ARTICLE X — AMENDMENT
This Charter may be amended, modified, or restated by the Board at any time and from time to time, by resolution duly adopted at a meeting of the Board at which a quorum is present or by unanimous written consent of the Board. No amendment to this Charter shall require the approval of the shareholders of the Company unless otherwise required by applicable law or the rules of the NYSE.
The Committee shall review this Charter at least annually and shall recommend to the Board any amendments that the Committee deems necessary or advisable in light of changes in applicable law or regulation, changes in the Company's business or risk profile, the results of the Committee's annual self-evaluation, or evolving best practices in risk governance. Any amendment to this Charter shall be effective upon adoption by the Board and shall be reflected in the minutes of the Board meeting at which such amendment is adopted.
ARTICLE XI — EFFECTIVE DATE AND HISTORY
This Amended and Restated Charter is effective as of its adoption by the Board on December 11, 2025.
Charter History:
No interim amendments were adopted between the original adoption date of February 12, 2016, and the adoption of this Amended and Restated Charter on December 11, 2025. This Amended and Restated Charter represents the first substantive update to the Risk Committee Charter since its original adoption.
This Amended and Restated Charter was prepared in connection with the Company's comprehensive governance overhaul, undertaken during 2025, which also includes the following actions to be taken by the Board at or around the December 11, 2025 Board meeting:
(a) Restatement of the Audit Committee Charter;
(b) Restatement of the Compensation & Human Capital Committee Charter;
(c) Restatement of the Nominating & Corporate Governance Committee Charter;
(d) Restatement of the Investment Committee Charter;
(e) Adoption of a new Technology & Cybersecurity Oversight Committee Charter;
(f) Revision of the Delegation of Authority Matrix at the parent-company and subsidiary levels;
(g) Amendment of the Corporate Governance Guidelines; and
(h) Conforming amendments to the Bylaws, including amendments to Article III, Section 3.3 (reflecting the establishment of six standing committees of the Board), Article III, Section 3.4 (updated committee-appointment mechanics), and Article IV, Section 4.2 (conforming changes relating to delegation of authority).
ATTESTATION
The undersigned, being the duly appointed General Counsel & Corporate Secretary of Quorum Insurance Holdings Corp., hereby certifies that this Amended and Restated Charter of the Risk Committee of the Board of Directors of Quorum Insurance Holdings Corp. was duly adopted by the Board of Directors of Quorum Insurance Holdings Corp. on December 11, 2025, pursuant to the Omnibus Board Resolution adopted on the same date.
QUORUM INSURANCE HOLDINGS CORP.
By: ________
Name: Dennis R. Okonkwo
Title: General Counsel & Corporate Secretary
Date: December 11, 2025
Adopted by the Board of Directors of Quorum Insurance Holdings Corp. on December 11, 2025, pursuant to the Omnibus Board Resolution adopted on the same date.
Event | Date
Original Charter adopted | February 12, 2016
Interim amendments | None
Amended and Restated Charter adopted | December 11, 2025

AMENDED AND RESTATED CHARTER OF THE RISK COMMITTEE OF THE BOARD OF DIRECTORS OF QUORUM INSURANCE HOLDINGS CORP.

EXECUTION VERSION

ATTESTATION

QUORUM INSURANCE HOLDINGS CORP.

Record

Parties

Dates

Amounts