AMBAC FINANCIAL GROUP INC

The Company's policies and procedures relating to risk assessment and risk management are overseen by its Board of Directors. The Board of Directors takes an enterprise-wide approach to risk management oversight that is designed to support the Company's business plans at a level of risk considered by the Board to be reasonable. A fundamental part of risk assessment and risk management is not only understanding the risks the Company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for the Company. The Board of Directors periodically reviews the Company's business plan, factoring risk management into account. It also approves the Company's risk appetite statements, which articulate the Company's tolerance for certain risks and describes the general types of risk that the Company accepts, within certain parameters, or attempts to avoid.

While the Board of Directors has the ultimate oversight responsibility for the risk management process, various committees of the Board also have responsibilities related to risk assessment and risk management, and management has responsibility for managing the risks to which the Company is exposed and reporting on such matters to the Board of Directors and applicable Board committees.

•The Audit Committee oversees the management of risks associated with the integrity of Ambac’s financial statements and its compliance with legal and regulatory requirements. In addition, the Audit Committee discusses policies with respect to risk assessment and risk management, including major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee reviews with management, internal auditors and independent auditors Ambac's critical accounting policies, Ambac's system of internal controls over financial reporting and the quality and appropriateness of disclosure and content in the financial statements and other external financial communications.

•The Compensation Committee oversees the management of risk primarily associated with our ability to attract, motivate and retain quality talent (particularly executive talent) and with setting financial incentives that do not motivate undue risk-taking.

•The Governance and Nominating Committee oversees the management of risk primarily associated with Ambac’s ability to attract and retain quality directors, Ambac’s corporate governance programs and practices and our compliance therewith, including integration of ESG and sustainability policies, practices and goals into the Company's business strategy and decision making. Additionally, the Governance and Nominating Committee oversees the processes for evaluation of the performance of the Board of Directors and its committees each year and considers risk management effectiveness as part of its evaluation. This committee also reviews succession plans for Ambac's executive officers, including the Chief Executive Officer. The Governance and Nominating Committee also performs oversight of the business ethics and compliance program, and reviews compliance with Ambac’s Code of Business Conduct.

•The Strategy Committee oversees the management of strategic plans and initiatives.

The Board of Directors receives quarterly updates from Board committees and the Board provides guidance to individual committee activities, as appropriate.

In order to assist the Board of Directors in overseeing Ambac’s risk management, Ambac uses enterprise risk management, a company-wide process that involves the Board of Directors, management and other personnel in an integrated effort to identify, assess and manage a broad range of risks (e.g., credit, financial, legal, liquidity, market, model, operational, regulatory, reputational and strategic), that may affect the Company’s ability to execute on its corporate strategy and fulfill its business objectives. The Enterprise Risk Committee (“ERC”), which is a management committee, is comprised of executive and senior level management responsible for assisting in the management of the Company’s risks on an individual and aggregate basis. The ERC produces the relevant risk management information for executive and senior management and the Board of Directors.

Ambac management has established other management committees to assist in managing the risks throughout the enterprise. These committees will meet monthly or as needed on an ad hoc basis.

•The AAC Risk Committee's objective is to provide oversight of the key risk remediation issues impacting AAC. The purview of the committee is to review and approve risk remediation activities for the financial guarantee insured portfolio. Additionally, the Risk Committee will provide oversight and review new risk remediation structures or approaches in connection with risk remediation plans or anticipated transactions. Members of the Risk Committee include the CEO, Head of Risk Management, CFO and senior managers from throughout risk, corporate services, operations, legal and finance.

•The Disclosure Committee's objective is to assist the CEO and CFO in their responsibilities to design, establish, maintain and evaluate the effectiveness of disclosure controls and procedures. Members of the Disclosure Committee include the CEO, CFO, Chief Accounting Officer, General Counsel, Chief Operating Officer, Head of Risk Management and senior managers from finance and legal.

•The AAC Reserve Committee'sobjective is to provide oversight and review of the reserving process at AAC and Ambac UK. The committee reviews and discusses, on at least a quarterly basis, reserve-related developments and key metrics and assumptions, including, but not limited to, credit, economic, interest rates, legal and regulatory. The committee gives approval to proceed with the development of loss estimates and related projections utilized in developing the consolidated quarterly reserves of the Legacy Financial Guarantee Insurance business. Members of the Reserve Committee include the CEO, Head of Risk Management, CFO, General Counsel and senior managers throughout risk, legal and finance.

•The Everspan Underwriting Risk Committee's objective is to provide oversight of the active underwriting operations of Everspan, develop underwriting parameters, and assist the Boards of the Everspan companies in overseeing the integrity and effectiveness of Everspan’s underwriting risk management framework. Members of the committee include the CEO, key members of Everspan management and other senior managers or advisors of Ambac. Additionally, a Reinsurance and Program Administrator Credit Risk sub-committee was established at the direction of the Underwriting Risk Committee to assist with the management of credit risk emanating from ceded reinsurance and program administrators.

The Company’s Enterprise Risk Management efforts build upon the foundation of an effective internal control environment. The design of any risk management or control system must reflect the fact that there are resource constraints, and the benefits must be considered relative to their costs. As a result, the possibility of material financial loss remains regardless of the Company’s Enterprise Risk Management efforts. An investor should carefully consider the risks and all of the other information set forth in this annual report, including the discussions included in Item 1A. Risk Factors, Item 7A. Quantitative and Qualitative Disclosures About Market Risk, and Item 8. Financial Statements and Supplementary Data.