PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
PRIVILEGE AND COMMUNICATION PROTOCOL FOR INTERNAL INVESTIGATION
February 27, 2026
Prepared by:
Calderwood & Harkness LLP 1221 Avenue of the Americas, 38th Floor New York, NY 10020
and
One Constitution Plaza, Suite 1400 Hartford, CT 06103
Prepared for:
The Audit Committee of the Board of Directors of Quorum Insurance Holdings Corp.
Matter:
Internal Investigation — Whistleblower Allegations Concerning Ashgrove Equity Partners Specialty Underwriting, Inc.
Matter No.: 1025-00010
IntegriLine Intake Reference: IL-QIH-2026-0214-0033
Authors:
Conrad Ashby, Responsible Partner (NY Bar #4417892) Steven Hollander, Lead Associate (NY Bar #5681234)
with
Victoria Chambers, Billing Partner (NY Bar #4523106) Jasmine Thornton, Working Associate (CT Bar #439772)
This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product prepared in anticipation of litigation. It is intended solely for the use of the Audit Committee of the Board of Directors of Quorum Insurance Holdings Corp. and authorized Calderwood & Harkness LLP personnel. Any unauthorized review, use, disclosure, distribution, or copying of this memorandum is strictly prohibited. If you have received this document in error, please contact Conrad Ashby at Calderwood & Harkness LLP immediately at (212) 555-8200.
Right-click to update Table of Contents
I. PURPOSE AND BACKGROUND
I.A. Purpose of This Protocol
This memorandum establishes binding ground rules for the preservation of attorney-client privilege and attorney work-product protection throughout all phases of the internal investigation arising from an anonymous whistleblower complaint received on February 14, 2026 (IntegriLine Compliance Services, Inc. intake reference IL-QIH-2026-0214-0033). The protocols and procedures set forth herein are designed to ensure that the confidentiality and legal protections attaching to the investigation are maintained from inception through conclusion, including any subsequent regulatory interactions, litigation, or remedial proceedings.
The whistleblower complaint, submitted through the IntegriLine anonymous reporting portal maintained by Quorum Insurance Holdings Corp. ("QIH"), alleges serious financial misconduct by senior personnel at Ashgrove Equity Partners Specialty Underwriting, Inc. ("BSU"), a wholly owned subsidiary of QIH. Specifically, the complaint alleges that BSU senior personnel engaged in (a) the fabrication of approximately 147 binder confirmations routed through three allegedly fictitious retail brokers; (b) the inflation of commission income by approximately $9.6 million through phantom brokerage arrangements; and (c) the premature and unjustified release of approximately $38.5 million in incurred but not reported ("IBNR") reserves, resulting in material overstatement of BSU's reported financial results and, by consolidation, QIH's reported results during fiscal years 2023 through 2025.
In response to these allegations, the Audit Committee of the Board of Directors of QIH convened a special telephonic meeting on February 24, 2026. At that meeting, the Audit Committee resolved to retain independent outside counsel to conduct an investigation into the whistleblower's allegations and related matters. Following a conflicts clearance process completed on February 26, 2026, Calderwood & Harkness LLP ("C&H") was formally engaged effective February 27, 2026, to serve as independent investigation counsel reporting exclusively to the Audit Committee.
This protocol applies to all phases of the investigation, including the initial four-to-six-week scoping phase during which C&H will assess the credibility and scope of the whistleblower's allegations, conduct preliminary fact-gathering, and report initial findings to the Audit Committee. It further applies to any subsequent full investigation phase that the Audit Committee may authorize based on the scoping-phase findings. The protocols set forth herein are intended to be comprehensive and to govern all investigation-related communications, document handling, and interactions with internal and external parties. Adherence to these protocols by all authorized participants is mandatory and is a condition of participation in the investigation.
The importance of strict compliance with this protocol cannot be overstated. The investigation involves allegations of potential securities fraud, financial statement manipulation, and insurance regulatory violations, any or all of which could give rise to enforcement actions by the U.S. Securities and Exchange Commission ("SEC"), criminal referrals by the U.S. Department of Justice ("DOJ"), and regulatory proceedings by the Connecticut Insurance Department. In addition, QIH may face private securities litigation, derivative actions, and claims by policyholders, reinsurers, or other third parties. The attorney-client privilege and work-product protections preserved through this protocol may prove critical to QIH's and the Audit Committee's ability to navigate these potential proceedings effectively.
I.B. Scope of Investigation (Summary)
The investigation encompasses a review of the allegations set forth in the whistleblower complaint as they relate to BSU's commercial property policy placements through three entities identified in the complaint: Veltrano Risk Advisors, Halloran & Pratt Insurance Associates, and CrestPoint Brokerage LLC. The relevant time period spans approximately the third quarter of 2023 through the fourth quarter of 2025. The investigation will examine, among other things, whether these three brokerage entities are legitimate, operating businesses or whether they are fictitious entities created or utilized to generate phantom binder confirmations and fabricated commission income.
The investigation will focus on, but is not necessarily limited to, the conduct of the following subject individuals:
• Garrett T. Lomax, President, Ashgrove Equity Partners Specialty Underwriting, Inc.
• Neil W. Stadler, Senior Vice President, Commercial Property Division, BSU
• Rhonda M. Kessler, Vice President, Finance & Operations, BSU
The aggregate alleged financial misstatement identified in the whistleblower complaint is approximately $48.1 million, comprising approximately $9.6 million in phantom commission income attributed to the three allegedly fictitious retail brokers and approximately $38.5 million in IBNR reserves that were allegedly released prematurely or without actuarial justification, resulting in improper recognition of income and overstatement of underwriting profitability.
The investigation has significant potential implications for QIH's SEC filings and public disclosures, including:
• The FY 2025 Annual Report on Form 10-K, which was filed with the SEC on February 21, 2026 — only three days before the Audit Committee's special meeting and six days before C&H's formal engagement;
• QIH's interim filings on Forms 10-Q for the quarters ended March 31, 2025, June 30, 2025, and September 30, 2025;
• QIH's prior-year annual filings for FY 2023 and FY 2024;
• Sarbanes-Oxley Act ("SOX") certifications executed by CEO Marcus P. Galvin and CFO Denise R. Nakamura in connection with each of the foregoing filings; and
• Any earnings releases, investor presentations, or other public communications that incorporated BSU's financial results during the relevant period.
The scoping phase of the investigation will seek to determine the credibility and extent of the alleged misconduct and to provide the Audit Committee with sufficient information to make informed decisions regarding the scope and direction of a full investigation, any interim remedial measures, and any required public disclosures or regulatory notifications.
I.C. The Client — Identity and Privilege Holder
For purposes of this engagement, the client is the Audit Committee of the Board of Directors of Quorum Insurance Holdings Corp. The client is not QIH's management, QIH as an entity directed by management, or BSU. This distinction is critical to the integrity and independence of the investigation. Because the allegations at issue concern the conduct of senior BSU personnel and may implicate the adequacy of QIH management's oversight, the investigation must be conducted independently of QIH management and wholly outside the chain of command that includes the subject individuals.
The Audit Committee is composed of the following independent, non-management directors:
• Priya Subramaniam, Chair
• Thomas K. Driscoll, Member
• Angela F. Delvecchio, Member
All attorney-client privilege and work-product protections arising from C&H's engagement in connection with this investigation are controlled exclusively by the Audit Committee. The Audit Committee is the sole holder of the privilege with respect to investigation-related communications, and the Audit Committee alone has the authority to determine whether, when, and to whom privileged information may be disclosed.
Neither QIH management, BSU management, nor any individual officer, employee, or agent of QIH or BSU has the authority to waive, assert, or direct the waiver of privilege over investigation-related communications and materials without the express authorization of the Audit Committee. This includes QIH's General Counsel, Owen R. Hargrove, whose ordinary authority over legal matters and privilege decisions is circumscribed with respect to this investigation. It also includes CEO Marcus P. Galvin and CFO Denise R. Nakamura, notwithstanding their roles as senior executive officers and SOX certifying officers.
This client-identification structure is adopted to ensure the independence and integrity of the investigation by insulating it from the control or influence of those individuals whose conduct is under review and those who may have supervisory responsibility over the subject individuals. It is consistent with established best practices for audit-committee-directed investigations and with guidance from the SEC, the American Bar Association, and leading authorities on internal corporate investigations.
II. APPLICABLE LEGAL STANDARDS
II.A. Attorney-Client Privilege
The attorney-client privilege protects confidential communications between C&H and the Audit Committee made for the purpose of obtaining or providing legal advice in connection with this investigation. The privilege is one of the oldest and most fundamental protections recognized in American law, and its preservation is essential to the candid and comprehensive exchange of information between counsel and client that this investigation requires.
In the corporate context, the scope of the attorney-client privilege was authoritatively addressed by the Supreme Court in Upjohn Co. v. United States, 449 U.S. 383 (1981). Under Upjohn, the privilege extends to communications between corporate counsel and employees of the corporation where: (a) the communications are made at the direction of corporate superiors in order to secure legal advice from counsel; (b) the information communicated is not available from upper-echelon management; (c) the communications concern matters within the scope of the employees' corporate duties; and (d) the employees are aware that the purpose of the communications is to enable the corporation to obtain legal advice.
As applied to this investigation, the Upjohn privilege extends to communications between C&H and employees of QIH and BSU undertaken at the direction of C&H for purposes of the investigation, provided that proper Upjohn warnings are administered to each employee in accordance with the protocol set forth in Section V below. The privilege belongs to the corporation — and, in this engagement, is exercised by the Audit Committee as the authorized representative of the corporation for purposes of the investigation — and can be waived only by the privilege holder. Individual employees and officers do not hold or control the privilege with respect to communications made in the course of the investigation.
It is important to note that the privilege protects only communications, not the underlying facts. An employee's factual knowledge does not become privileged merely because the employee communicates those facts to C&H during an investigation interview. What is protected is the communication itself — the fact that it was made, its contents, and any legal advice rendered in connection with it.
II.B. Attorney Work-Product Doctrine
The attorney work-product doctrine, codified in Federal Rule of Civil Procedure 26(b)(3) and recognized in substantially similar form under state-law equivalents in relevant jurisdictions, protects materials prepared in anticipation of litigation or for trial. The doctrine encompasses two categories of material:
Fact work product includes factual compilations, chronologies, witness interview summaries (to the extent they reflect factual content), and similar materials prepared in anticipation of litigation. Fact work product is subject to a qualified privilege and may be discoverable upon a showing of substantial need and an inability to obtain the equivalent information without undue hardship.
Opinion work product includes the mental impressions, conclusions, opinions, and legal theories of an attorney. Opinion work product enjoys virtually absolute protection and is discoverable only in extraordinary circumstances, if at all.
Given the nature of the allegations under investigation — potential securities fraud, financial statement manipulation, and insurance regulatory violations — there is a substantial and well-founded basis for anticipating litigation and regulatory proceedings. C&H's investigation materials, including interview memoranda, analytical work product, draft and final reports, internal strategy memoranda, and related documents, are prepared in anticipation of such potential proceedings and are entitled to work-product protection.
Materials prepared by Claridge Forensic Advisory LLC ("Claridge") at the direction of C&H in connection with this investigation are also subject to work-product protection. Claridge is proposed to be retained as a non-testifying consulting expert within the meaning of Federal Rule of Civil Procedure 26(b)(4)(D), working under C&H's direction and at C&H's instruction. Materials prepared by such consulting experts are generally protected from disclosure absent exceptional circumstances. The structure of Claridge's engagement, as discussed further in Section VI.E below, is designed to maximize this protection.
II.C. Joint-Defense / Common-Interest Doctrine
The common-interest doctrine (sometimes referred to as the joint-defense privilege, though the term "common-interest doctrine" is more precise where, as here, the parties may not share a joint defense in active litigation) operates to prevent waiver of an otherwise-existing privilege when privileged information is shared among parties who share a common legal interest.
To the extent that communications regarding the investigation occur between C&H (acting on behalf of the Audit Committee) and Pemberton Hale & Creighton LLP ("PHC," QIH's standing outside corporate and securities counsel) on matters of overlapping legal interest — including, for example, SEC disclosure obligations, potential restatement analysis, and corporate governance implications of the investigation — such communications may be protected under the common-interest doctrine, provided that the communications are made in furtherance of the parties' shared legal interest and with a reasonable expectation of confidentiality.
A separate common-interest agreement should be considered and, if appropriate, executed between C&H (on behalf of the Audit Committee) and PHC (on behalf of QIH) before substantive privileged information is shared between the two firms. The common-interest agreement should define the scope of the common legal interest, identify the parties covered, and establish confidentiality and non-waiver obligations. C&H is prepared to draft such an agreement for the Audit Committee's review.
It is critical to note that the common-interest doctrine does not independently create a privilege. It operates solely to prevent waiver when information that is already protected by the attorney-client privilege or work-product doctrine is shared among parties with a common legal interest. If the underlying communication is not privileged, sharing it with PHC (or any other party) will not make it privileged. Conversely, if a privileged communication is shared with PHC in the context of a valid common-interest arrangement, the sharing does not destroy the privilege that would otherwise attach.
III. PRIVILEGE CONTROL AND AUTHORITY
III.A. Audit Committee as Privilege Holder
As set forth in Section I.C, the Audit Committee is the sole privilege holder with respect to all investigation-related attorney-client communications and work product. The Audit Committee has sole and exclusive authority over all privilege determinations in connection with the investigation, including decisions to assert privilege, to waive privilege (in whole or in part), and to authorize or deny the disclosure of privileged materials to third parties.
Priya Subramaniam, as Audit Committee Chair, is authorized to act on behalf of the Audit Committee on privilege matters arising between scheduled Audit Committee meetings, subject to ratification by the full Audit Committee at its next scheduled meeting or at a special session convened for that purpose. This delegated authority is intended to address the practical need for timely privilege decisions in the context of a fast-moving investigation, while preserving the full Audit Committee's ultimate authority over all privilege determinations. The Chair's delegated authority includes, by way of example, the authority to approve or deny requests from C&H to share specific categories of information with identified third parties for logistical or coordination purposes, and to authorize interim communications with QIH's General Counsel on specified topics.
Any request to waive privilege — whether by QIH management, government regulators (including the SEC, DOJ, or Connecticut Insurance Department), the external auditor (Kellner & Strauss LLP), D&O insurers, or any other party — must be presented to the full Audit Committee for consideration and vote. C&H will advise the Audit Committee on the legal implications of any proposed waiver, including the risk that a partial or selective waiver may be deemed a broader waiver of privilege in some jurisdictions or for some purposes. No waiver, partial waiver, or selective disclosure of privileged investigation materials shall occur absent a formal Audit Committee resolution expressly authorizing the specific disclosure.
The Audit Committee's privilege authority extends to all investigation-related materials and communications, regardless of where they are maintained or by whom they were generated, including materials prepared by C&H, materials prepared by Claridge at C&H's direction, and communications with third parties made in connection with the investigation.
III.B. Limitations on Management Authority
The following limitations on management authority are essential to the independence and integrity of the investigation and shall be strictly observed:
General Counsel. Owen R. Hargrove, QIH's General Counsel, does not control privilege over investigation-related communications, notwithstanding his general role as the company's chief legal officer. In the ordinary course of business, the General Counsel typically manages and directs the company's legal affairs and exercises authority over privilege determinations. In the context of this investigation, however, the Audit Committee has assumed exclusive authority over privilege and the direction of the investigation, consistent with best practices for audit-committee-directed investigations involving allegations against senior management. Mr. Hargrove's role in connection with the investigation is that of a facilitator for logistical coordination. He may assist with scheduling witness interviews, arranging physical and electronic access to BSU's premises and systems, coordinating the issuance of the document-preservation notice, and similar logistical tasks. He is not a director of the investigation, and he does not have the authority to make substantive decisions regarding the scope, direction, or conclusions of the investigation, or to access privileged work product, except as specifically authorized by the Audit Committee.
CEO and CFO. CEO Marcus P. Galvin and CFO Denise R. Nakamura shall not have authority to direct the investigation or to access privileged investigation work product except as specifically authorized by the Audit Committee. Their roles in the investigation are those of potential witnesses and, as SOX certifying officers, interested parties whose certifications may be affected by the investigation's findings. The Audit Committee will determine the appropriate level and timing of communication with Galvin and Nakamura regarding the investigation's status and findings on a case-by-case basis, with input from C&H.
Subject Individuals. Garrett T. Lomax, Neil W. Stadler, and Rhonda M. Kessler are identified as subjects of the investigation. They shall not have access to any privileged investigation materials, communications, work product, reports, or analyses at any time during the investigation. They shall not be informed of the investigation's strategy, direction, preliminary findings, or conclusions. Their sole contact with the investigation team will be in the context of formal witness interviews, at which the Upjohn warning protocol set forth in Section V will be administered.
IV. COMMUNICATION GUIDELINES — INTERNAL
IV.A. Communications Between C&H and the Audit Committee
All substantive communications regarding the investigation between C&H and the members of the Audit Committee shall be marked with the following legend:
"PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — INTERNAL INVESTIGATION"
Oral Briefings. C&H, primarily through Conrad Ashby (Responsible Partner) and/or Steven Hollander (Lead Associate), will provide periodic oral updates to the Audit Committee in executive session. These sessions shall be conducted without management present unless the Audit Committee specifically invites management attendance for a discrete, identified topic and C&H has been consulted regarding the privilege implications of such attendance. Oral briefings are the preferred method for communicating sensitive substantive findings and strategic recommendations, as they minimize the creation of written records that could be the subject of discovery disputes. C&H will prepare internal attorney work-product memoranda summarizing the topics discussed during oral briefings, but such memoranda will be maintained in C&H's files and will not be distributed to the Audit Committee or any other party except as the Audit Committee directs.
Written Reports. Any written investigation updates, preliminary findings memoranda, interim reports, or final investigation reports shall be addressed solely to the three Audit Committee members — Priya Subramaniam, Thomas K. Driscoll, and Angela F. Delvecchio — and delivered via encrypted email using C&H's approved secure-file-sharing platform, or in hard copy at Audit Committee meetings. Written reports shall bear the privilege legends specified in Section VII.A below. Hard copies distributed at Audit Committee meetings may, at C&H's recommendation, be collected at the conclusion of the meeting and maintained by C&H in the investigation file rather than retained by individual Audit Committee members, in order to minimize the risk of inadvertent disclosure.
Restrictions on Forwarding. The Audit Committee shall not forward, copy, or distribute C&H's privileged communications to any person outside the Audit Committee without C&H's prior consultation and Audit Committee approval. This restriction applies to QIH management (including the General Counsel, CEO, and CFO), other QIH or BSU personnel, QIH's outside corporate counsel (PHC), the external auditor (K&S), D&O insurers, regulators, and all other parties. If an Audit Committee member believes that a particular communication should be shared with a person outside the Audit Committee, the member should consult with C&H before making any disclosure, so that C&H can advise on the privilege implications and, if disclosure is appropriate, recommend the manner in which it should be made.
IV.B. Communications with QIH Management
Coordination with Owen R. Hargrove (General Counsel)
Owen R. Hargrove will serve as the primary management-side point of contact for logistical matters related to the investigation. His logistical responsibilities will include, among other things:
• Scheduling witness interviews, including identifying and confirming the availability of potential interviewees;
• Arranging physical access to BSU's offices and premises for C&H and Claridge personnel;
• Coordinating electronic access to BSU's and QIH's information-technology systems, including email servers, shared drives, and enterprise applications, for purposes of document preservation and collection;
• Coordinating the issuance and implementation of the document-preservation notice (litigation hold) to relevant custodians; and
• Facilitating the provision of routine corporate records, organizational charts, policies, and similar non-privileged business documents requested by C&H.
Hargrove will receive only such information as the Audit Committee authorizes C&H to share. C&H will consult with the Audit Committee (or, between meetings, with the Audit Committee Chair) before disclosing substantive investigation information to Hargrove. As a general matter, Hargrove should be provided with sufficient information to carry out his logistical responsibilities effectively, but he should not be provided with copies of C&H's privileged memoranda, interview notes, analytical work product, or draft or final investigation reports unless specifically approved by the Audit Committee.
All communications with Hargrove regarding the investigation shall include the privilege legend specified in Section VII.A below. Although the sharing of privileged information with the General Counsel of the corporate entity does not necessarily waive privilege (since the General Counsel is an agent of the corporate client), the unique structure of this investigation — in which the Audit Committee, rather than management, controls privilege — requires that communications with Hargrove be carefully managed to avoid any argument that management has obtained access to privileged work product and thereby diminished the Audit Committee's control over the investigation.
Communications with CEO Marcus P. Galvin and CFO Denise R. Nakamura
Galvin and Nakamura will be informed of the existence and general status of the investigation as the Audit Committee deems appropriate. The Audit Committee has discretion to determine the timing, substance, and level of detail of communications to these officers regarding the investigation.
Because both Galvin and Nakamura are SOX certifying officers and the investigation may bear directly on the accuracy of their certifications — including certifications filed in connection with QIH's FY 2025 Form 10-K on February 21, 2026 — the Audit Committee should consider on a rolling basis the appropriate level of disclosure to these officers. There is a tension between the need to keep the certifying officers informed of potential material misstatements (which may affect their certification obligations) and the need to protect the independence and confidentiality of the investigation. C&H will advise the Audit Committee on navigating this tension as the investigation progresses.
C&H will not provide substantive investigation updates directly to Galvin or Nakamura. Such communications, if authorized, will flow through the Audit Committee Chair or through such other channel as the Audit Committee directs. This structure ensures that the Audit Committee retains control over the substance and timing of disclosures to management.
Galvin and Nakamura may be interviewed as witnesses during the investigation. If so, the Upjohn warning protocol set forth in Section V applies in full. They will be advised that C&H represents the Audit Committee and not them personally, and they will be encouraged to consult with personal counsel if they so desire.
IV.C. Communications with BSU Personnel
No substantive investigation-related communications shall be directed to BSU personnel except in the following limited contexts:
1. Formal witness interviews conducted by C&H, subject to the Upjohn warning protocol set forth in Section V;
2. Document-preservation and document-collection activities, which will be coordinated through QIH's General Counsel and conducted by Claridge under C&H's direction; and
3. Such other contacts as may be specifically authorized by C&H on a case-by-case basis for limited, defined purposes.
Subject individuals Garrett T. Lomax, Neil W. Stadler, and Rhonda M. Kessler shall be treated as subjects of the investigation — not as representatives of the client. They shall not receive any privileged communications, work product, or investigation-related materials. They shall not be consulted regarding the scope, direction, or strategy of the investigation. They shall not be invited to attend Audit Committee executive sessions or other meetings at which the investigation is discussed.
BSU personnel who are not subjects may be contacted for factual information and document production. However, care must be taken to avoid disclosing privileged strategy, analysis, or the substance of other witnesses' statements during such contacts. C&H team members interacting with non-subject BSU personnel should limit their communications to fact-gathering and should not volunteer information about the investigation's scope, findings, or direction.
V. UPJOHN / CORPORATE MIRANDA WARNING PROTOCOL
V.A. Requirement to Administer Warnings
Before conducting any substantive interview with a current employee, officer, or director of QIH or BSU, the C&H interviewer must administer the Upjohn/corporate Miranda warning set forth in Section V.B below. This requirement is mandatory and applies to all witness interviews without exception.
The warning must be given at the outset of each interview, even if the individual has been previously interviewed during the investigation. Repeated administration of the warning ensures that the interviewee is reminded, at the commencement of each session, of the nature of the attorney-client relationship and the fact that C&H does not represent the interviewee personally. This practice also creates a clear and documented record that the warning was given, which is important both for privilege preservation and to protect against any later claim by the interviewee that he or she was misled about the nature of the relationship.
The interviewer should confirm on the record that the interviewee understands the warning and consents to proceed with the interview. If the interviewee expresses confusion or uncertainty about any element of the warning, the interviewer should take the time to explain the relevant point clearly and should document the exchange in the interview memorandum. If the interviewee declines to proceed after receiving the warning, the interviewer should not attempt to compel participation but should note the refusal and report it to the C&H team leads.
V.B. Template Upjohn Warning
The following warning shall be read aloud to, or provided in writing to, each witness at the commencement of every interview. A printable card version of this warning is attached as Appendix A for use by C&H attorneys during interviews.
1. "We are lawyers from Calderwood & Harkness LLP. We represent the Audit Committee of the Board of Directors of Quorum Insurance Holdings Corp. We do not represent you personally."
2. "The purpose of this interview is to gather facts in connection with an internal investigation being conducted at the direction of the Audit Committee."
3. "This conversation is protected by the attorney-client privilege. The privilege belongs to Quorum Insurance Holdings Corp. and its Audit Committee — not to you personally."
4. "The Audit Committee may choose to waive the privilege at any time and disclose the substance of this conversation to third parties, including government regulators, without your consent."
5. "We ask that you keep this interview and its contents confidential and not discuss it with other employees, other than your own personal attorney, if you choose to retain one."
6. "You are entitled to have your own personal attorney present during this interview, at your own expense. Do you understand these points, and are you willing to proceed?"
The administration of the warning and the witness's response (including whether the witness confirmed understanding and consented to proceed) shall be documented in the interview memorandum prepared by the C&H team member conducting the interview. If the warning is provided in writing, a signed copy should be retained in the investigation file where practicable.
V.C. Special Considerations for Subject Individuals
Garrett T. Lomax, Neil W. Stadler, and Rhonda M. Kessler are identified as subjects of the investigation. Their interviews require heightened care and additional disclosures beyond the standard Upjohn warning.
In addition to the standard six-point Upjohn warning set forth above, subject individuals should be informed at the outset of the interview that they are considered subjects of the investigation and that the investigation may result in findings adverse to their interests. This disclosure is a matter of fundamental fairness and also serves to protect against any later claim that the subject individual was misled about the nature of his or her status in the investigation.
Subject individuals should be strongly encouraged to consult with personal counsel before participating in the interview. C&H should allow reasonable time for the subject individual to retain personal counsel before scheduling the interview. If a subject individual requests an adjournment to consult with counsel, that request should generally be honored unless exigent circumstances exist (such as a risk of evidence destruction that would be exacerbated by delay).
If a subject individual retains personal counsel, C&H may communicate with the individual only through that counsel, consistent with Rule 4.2 of the New York Rules of Professional Conduct and the corresponding rule in any other applicable jurisdiction. C&H should obtain the name and contact information of the subject individual's personal counsel promptly and should direct all further communications to that counsel.
Under no circumstances should C&H provide legal advice to subject individuals regarding their personal legal exposure, their rights in connection with the investigation, or their options for responding to the investigation's findings. Any such advice would create a risk of an unintended attorney-client relationship with the subject individual, which could compromise the investigation and create conflicts of interest.
V.D. Interview Documentation
All interviews shall be memorialized in detailed attorney work-product memoranda prepared by the C&H team member or members conducting the interview. Interview memoranda are a critical component of the investigation record and should be prepared promptly after each interview — ideally within 48 hours — while the interviewer's recollection is fresh.
Interview memoranda shall be marked with the following legend:
"PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT — PREPARED IN ANTICIPATION OF LITIGATION"
The memoranda should include, at a minimum: the name and title of the interviewee; the date, time, and location of the interview; the names of the C&H team members present; a notation that the Upjohn warning was administered and the interviewee's response; a detailed summary of the substantive content of the interview; and any follow-up items or document requests identified during the interview.
Recordings of interviews — whether audio or video — are not contemplated unless specifically authorized by the Audit Committee after consultation with C&H. The default method of documentation is contemporaneous note-taking by two C&H team members present at the interview. Having two note-takers ensures a more complete and accurate record and provides corroboration in the event of any dispute regarding what was said during the interview.
Interview memoranda shall not be shared with the interviewee or the interviewee's counsel unless specifically approved by the Audit Committee. The decision whether to share interview memoranda with any party is a privilege decision reserved to the Audit Committee, and C&H will not release such materials without express authorization.
VI. COMMUNICATION GUIDELINES — EXTERNAL
VI.A. Communications with Pemberton Hale & Creighton LLP (Standing Corporate/Securities Counsel)
Pemberton Hale & Creighton LLP ("PHC") serves as QIH's regular outside counsel for SEC reporting, corporate governance, and general corporate matters. The lead PHC partner for the QIH relationship is Elaine R. Foxworth (partner, PHC, 599 Lexington Avenue, Suite 2600, New York, NY 10022). PHC is not conducting the internal investigation; C&H's investigation is fully independent of PHC and is directed exclusively by the Audit Committee.
Notwithstanding the independence of the investigation, coordination between C&H and PHC will be necessary on several fronts as the investigation progresses:
(a) SEC Disclosure Obligations. The investigation and its findings may trigger disclosure obligations under the federal securities laws, including potential obligations to file a Current Report on Form 8-K if the investigation reveals material information regarding QIH's financial condition, operations, or internal controls. PHC, as QIH's securities disclosure counsel, will need to be involved in assessing and implementing any required disclosures.
(b) Potential Financial Restatement. If the investigation confirms that BSU's financial results were materially misstated during FY 2023 through FY 2025, QIH may be required to restate its consolidated financial statements for some or all of the affected periods. PHC will play a central role in advising QIH on the restatement process, including related SEC filings and communications with the SEC's Division of Corporation Finance.
(c) FY 2025 Form 10-K. QIH's FY 2025 Annual Report on Form 10-K was filed with the SEC on February 21, 2026, only days before the investigation was authorized. If the investigation reveals that the FY 2025 financial statements are materially misstated, QIH may need to file a Form 8-K disclosing non-reliance on previously issued financial statements, and PHC will need to advise on the timing and content of such filing.
(d) Corporate Governance Matters. The investigation may result in recommendations for personnel actions regarding the subject individuals, including potential suspension, reassignment, or separation. PHC's advice on corporate governance and employment-law implications may be needed in connection with such actions.
Before sharing substantive privileged investigation information with PHC, C&H and PHC should enter into a written common-interest agreement. The common-interest agreement is intended to avoid any argument that the sharing of privileged information between C&H and PHC constitutes a waiver of privilege. The agreement shall define the scope of the common legal interest shared by the Audit Committee and QIH (as represented by PHC), the parties covered by the agreement, and the confidentiality and non-waiver obligations of each party.
Until a common-interest agreement is executed, C&H should limit its communications with PHC to non-privileged factual and logistical matters, and should not share privileged work product, legal analysis, or investigation strategy with PHC. Once a common-interest agreement is in place, communications between C&H and PHC regarding the investigation should be marked with the privilege legend specified in Section VII.A below and with an additional notation:
"COMMON INTEREST COMMUNICATION"
VI.B. Communications with Kellner & Strauss LLP (External Auditor)
Kellner & Strauss LLP ("K&S") serves as QIH's independent registered public accounting firm. Howard M. Bressler is the lead engagement partner at K&S (345 Park Avenue, 18th Floor, New York, NY 10154). K&S issued an unqualified audit opinion on QIH's FY 2025 consolidated financial statements, which were included in the Form 10-K filed on February 21, 2026.
If the investigation reveals that BSU's financial results were materially misstated, QIH may be required to inform K&S of the findings. Notification to K&S could trigger a number of significant consequences, including: (a) K&S's reconsideration of its audit opinion on the FY 2025 financial statements; (b) potential withdrawal of one or more previously issued audit opinions; (c) initiation of a restatement process; and (d) K&S's independent obligations under Section 10A of the Securities Exchange Act of 1934, which requires auditors to report suspected illegal acts to the SEC if the issuer fails to take appropriate remedial action.
Communication with K&S regarding the investigation presents significant and complex privilege risks that must be carefully managed:
• Waiver Risk. Sharing privileged investigation findings with the external auditor may constitute a waiver of privilege in some jurisdictions. Although the D.C. Circuit in In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014), adopted a protective approach that narrowed the waiver risk in certain contexts, other circuits have not uniformly followed this approach, and the risk of waiver remains substantial, particularly in jurisdictions that reject the selective-waiver doctrine.
• Recommendation Against Sharing Privileged Work Product. C&H recommends that no substantive privileged work product — including interview memoranda, analytical memoranda, draft reports, or legal opinions — be shared directly with K&S without Audit Committee authorization. The Audit Committee should be advised of the privilege implications before any decision is made to share such materials with K&S.
• Factual Information. Factual information — as distinguished from privileged legal analysis, attorney mental impressions, and strategic assessments — may be shared with K&S as necessary for audit purposes, but through carefully managed channels. The preferred approach is for factual information to flow to K&S through QIH's General Counsel or CFO in coordination with C&H, rather than directly from C&H to K&S. This approach helps to maintain the argument that the factual information was shared in the ordinary course of the company's interactions with its auditor, rather than as a disclosure of privileged investigation materials.
• Documentation. Any communication with K&S regarding the investigation should be carefully documented and tracked, including the date of the communication, the participants, the substance of the information conveyed, and the basis on which the Audit Committee authorized the communication.
K&S may independently seek to interview C&H personnel or obtain investigation documents under applicable auditing standards, including AU-C Section 250 (Consideration of Laws and Regulations in an Audit of Financial Statements) and AU-C Section 501 (Audit Evidence — Specific Considerations for Selected Items, including Litigation, Claims, and Assessments). C&H will not provide information to K&S in response to such requests without Audit Committee authorization. Any such request from K&S should be directed to C&H, which will promptly advise the Audit Committee and recommend a course of action.
VI.C. Communications with Sentinel Mutual Assurance Group (D&O Insurer)
QIH maintains directors' and officers' liability insurance with Sentinel Mutual Assurance Group ("Sentinel"). The relevant contact at Sentinel is Patricia L. Munroe, Vice President — Executive Liability Claims (200 Clarendon Street, Suite 4400, Boston, MA 02116). The relevant policies are:
• D&O Primary Policy: SMA-EL-2025-07741 ($15,000,000 aggregate limit; $1,000,000 per-claim retention)
• D&O Excess Policy: SMA-XS-2025-07742 ($25,000,000 excess of $15,000,000)
Timely notice to Sentinel is required under the terms of both policies. The policies contain notice-of-claim and notice-of-circumstances provisions that may be triggered by the whistleblower complaint and the commencement of the investigation. A draft notice letter to Sentinel is being prepared separately by C&H for the Audit Committee's review and approval.
Communication with the D&O carrier involves important privilege considerations:
• Notice of Claim. The notice of claim or potential claim should be provided with sufficient factual information to comply with the policy requirements and to protect QIH's coverage rights, but should not attach or transmit privileged work product, including C&H's memoranda, interview notes, or analytical materials. The notice should describe the whistleblower complaint and the investigation in general terms and should reserve all rights under the policy.
• Carrier Requests for Investigation Materials. Sentinel may request access to investigation findings, reports, or other materials as part of its claims-evaluation process. The Audit Committee should not provide privileged investigation materials to Sentinel without careful consideration of the privilege implications. In some jurisdictions, disclosure of privileged materials to an insurer may constitute a waiver of privilege. If the Audit Committee determines that sharing investigation materials with Sentinel is necessary or advisable, C&H recommends that such sharing occur pursuant to a written confidentiality agreement or reservation-of-rights framework that expressly preserves privilege.
• Independence of the Investigation. If Sentinel appoints defense counsel or seeks to participate in or direct the investigation (which is unlikely at this stage but may occur if claims are asserted against insured directors or officers), the Audit Committee must ensure that the investigation remains independent and that privilege remains under Audit Committee control. Sentinel's rights under the policies do not extend to control over the Audit Committee's investigation.
• C&H Review of Communications. All communications with Sentinel regarding the investigation should be reviewed by C&H before transmission. This includes the initial notice of claim, any supplemental notices, responses to Sentinel's information requests, and any other correspondence related to the investigation or potential claims.
VI.D. Communications with Regulators (SEC, DOJ, Connecticut Insurance Department)
No voluntary disclosure to any government regulator shall be made without the express prior authorization of the Audit Committee. This is a fundamental principle of this protocol and shall be observed without exception.
At this early stage of the investigation, C&H does not recommend voluntary disclosure to any regulator. The investigation has not yet produced findings that would compel disclosure, and premature disclosure could compromise the investigation, result in loss of the opportunity for a complete and informed presentation to regulators, and create unnecessary legal risk. The Audit Committee will be advised as the investigation progresses if circumstances change and voluntary disclosure becomes advisable or legally required.
If the investigation confirms that fraud occurred, the Audit Committee will need to evaluate a range of options regarding engagement with regulators, including:
• SEC (Division of Enforcement). Self-reporting to the SEC may be advisable if the investigation reveals material misstatements in QIH's SEC filings. The SEC's Enforcement Cooperation Program provides potential benefits for companies that self-report, cooperate proactively, and implement effective remedial measures. C&H will advise the Audit Committee on the advantages and risks of self-reporting, including the scope of any cooperation and the potential for credit in the form of reduced sanctions.
• DOJ. If the investigation reveals conduct that may constitute criminal violations — including securities fraud, wire fraud, or mail fraud — the Audit Committee will need to consider whether to engage with the DOJ. Recent DOJ guidance, including the Monaco Memorandum and the Updated Evaluation of Corporate Compliance Programs, emphasizes the importance of timely voluntary self-disclosure.
• Connecticut Insurance Department. As a Connecticut-domiciled insurance subsidiary, BSU is subject to regulation by the Connecticut Insurance Department. The investigation may reveal violations of Connecticut insurance laws, including fraudulent financial reporting. The Audit Committee will need to consider whether and when to notify the Connecticut Insurance Department.
Any production of documents or information to regulators, including pursuant to subpoena, shall be coordinated through C&H to preserve applicable privileges and to create a documented record of any compelled disclosures. If the SEC issues a formal order of investigation or subpoenas, C&H will advise the Audit Committee on the applicability of the selective-waiver doctrine and other privilege considerations, including the potential to seek confidential-treatment requests or protective orders.
VI.E. Communications with Claridge Forensic Advisory LLC (Proposed Forensic/E-discovery Advisor)
C&H proposes to retain Claridge Forensic Advisory LLC ("Claridge") to provide forensic accounting analysis and electronic discovery support in connection with the investigation. The lead Claridge contact is Daniel J. Petrov, Managing Director (101 Park Avenue, 26th Floor, New York, NY 10178).
To maximize work-product protection, Claridge's engagement should be structured as follows:
• Claridge will be retained as a non-testifying consulting expert under the umbrella of C&H's engagement with the Audit Committee. Claridge's work will be performed at C&H's direction and for the purpose of assisting C&H in rendering legal advice to the Audit Committee and in anticipation of potential litigation and regulatory proceedings.
• The engagement letter between C&H and Claridge (to be executed upon Audit Committee approval of Claridge's retention) will specify that Claridge is engaged as a consulting expert, that its work product is prepared at the direction of counsel in anticipation of litigation, and that Claridge will not be designated as a testifying expert unless the Audit Committee subsequently determines otherwise.
• All communications between C&H and Claridge regarding the investigation shall be treated as protected work product. Such communications should be marked with the work-product privilege legend specified in Section VII.A below.
• Claridge's reports, analyses, and workpapers shall be addressed to and provided exclusively to C&H, not directly to QIH management or the Audit Committee. This structure ensures that the work-product protection flows through C&H's engagement with the Audit Committee. The Audit Committee may receive Claridge's work product through C&H as part of C&H's reporting to the Audit Committee, but the Audit Committee should not communicate directly with Claridge except through C&H.
• Claridge personnel shall be instructed on the privilege and communication protocols set forth in this memorandum and shall execute individual confidentiality and protocol-compliance acknowledgments. Claridge personnel shall not communicate about the investigation with QIH or BSU personnel except as specifically directed by C&H.
VI.F. Communications with Linden Actuarial Consulting Group (Appointed Actuary)
Linden Actuarial Consulting Group ("Linden") serves as the appointed actuary for BSU. The principal contact at Linden is Margaret Y. Cho, FCAS, Principal & Consulting Actuary (280 Trumbull Street, Suite 900, Hartford, CT 06103). Linden maintains the IBNR reserve schedules that are central to the whistleblower's allegations regarding the $38.5 million in alleged improper reserve releases.
Communications with Linden may be necessary during the investigation to obtain factual information regarding BSU's reserve-setting methodology, the basis for specific reserve releases during the relevant period, and the actuarial analyses underlying the IBNR reserves as reported in QIH's financial statements. Such communications should be treated with caution for the following reasons:
• Linden is an independent actuarial advisor, not an employee or agent of the Audit Committee or of C&H. Communications with Linden are unlikely to be protected by the attorney-client privilege unless they are structured as part of C&H's legal analysis — for example, if Linden is retained by C&H (rather than by QIH management) to provide actuarial analysis specifically for the purpose of the investigation.
• C&H should coordinate any contact with Linden to ensure that privileged investigation analysis, strategy, or findings are not inadvertently disclosed to Linden. Linden is a potential witness in the investigation — its personnel may be interviewed regarding the reserve-release decisions — and any privileged information shared with Linden could be discoverable.
• To the extent practicable, C&H should prefer to obtain Linden's materials (including reserve schedules, actuarial reports, workpapers, and correspondence with BSU management) through QIH's internal channels — for example, through the General Counsel or CFO — rather than through direct contact with Linden. This approach allows C&H to obtain the factual materials it needs without creating a direct communication channel with Linden that could give rise to privilege disputes.
• If direct contact with Linden is necessary, C&H should limit the communication to requests for factual information and documents and should not share privileged investigation analysis, interview summaries, or strategic assessments with Linden.
VII. DOCUMENT LABELING AND HANDLING CONVENTIONS
VII.A. Privilege Legends
All documents and communications generated in connection with the investigation shall bear one or both of the following legends, as applicable:
Attorney-Client Privilege Legend:
"PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — INTERNAL INVESTIGATION CONDUCTED AT THE DIRECTION OF THE AUDIT COMMITTEE OF QUORUM INSURANCE HOLDINGS CORP."
Work-Product Legend:
"PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT — PREPARED IN ANTICIPATION OF LITIGATION"
Documents that constitute both attorney-client communications and attorney work product should bear both legends. A combined legend and templates for specific use cases are set forth in Appendix C to this memorandum.
For email communications, the applicable legend shall be included in the subject line and/or prominently at the top of the email body text, above the substance of the message. For hard-copy documents, the applicable legend shall appear on the first page of the document and, where practicable, as a header or footer on each subsequent page.
The use of appropriate privilege legends is an important element of privilege preservation. While a legend alone does not create a privilege, it serves as evidence that the parties intended the communication to be confidential and treated it as privileged. The absence of a legend does not necessarily waive privilege, but it may be cited by an adverse party as evidence that the communication was not treated as confidential. Consistent and systematic use of privilege legends reduces this risk.
VII.B. File Organization and Storage
C&H will maintain a dedicated, access-restricted investigation file within its document-management system, indexed to matter number 1025-00010. Access to this file will be limited to the authorized C&H team members identified in Appendix B (Conrad Ashby, Victoria Chambers, Steven Hollander, and Jasmine Thornton) and to such additional C&H personnel as may be authorized by Conrad Ashby.
Electronic files will be stored on C&H's secure, encrypted servers in accordance with C&H's information-security policies and procedures. Cloud-based file-sharing platforms, other than C&H's approved secure-file-sharing tool (currently C&H SecureShare), shall not be used for investigation materials. Investigation files shall not be stored on personal devices, portable storage media (USB drives, external hard drives), or local workstation drives unless specifically authorized by Conrad Ashby and subject to encryption and access-control requirements.
Physical documents — including hard-copy interview notes, printed reports, and collected business records — will be maintained in locked filing cabinets in C&H's offices (New York or Hartford, as applicable). Physical documents shall not be removed from C&H premises without partner-level approval from Conrad Ashby or Victoria Chambers.