OCTAVE SPECIALTY GROUP INC

The Company's policies and procedures relating to risk assessment and risk management are overseen by its Board of Directors. The Board of Directors takes an enterprise-wide approach to risk management oversight that is designed to support the Company's business plans at a level of risk considered by the Board to be reasonable. A fundamental part of risk assessment and risk management is not only understanding the risks the Company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for the Company. The Board of Directors periodically reviews the Company's business plan, taking risk management into account. It also approves the Company's risk appetite statements, which articulate the Company's tolerance for certain risks and describe the general types of risk that the

Company accepts, within certain parameters, or attempts to avoid.

While the Board of Directors has the ultimate oversight responsibility for the risk management process, various committees of the Board also have responsibilities related to risk assessment and risk management, and management has responsibility for managing the risks to which the Company is exposed and reporting on such matters to the Board of Directors and applicable Board committees.

•The Audit Committee oversees the management of risks associated with the integrity of Octave’s financial statements and its compliance with legal and regulatory requirements. In addition, the Audit Committee discusses policies with respect to risk assessment and risk management, including major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee reviews with management, internal auditors and independent auditors Octave's critical accounting policies, Octave's system of internal controls over financial reporting and the quality and appropriateness of disclosure and content of financial statements and other external financial communications.

•The Compensation Committee oversees the management of risk primarily associated with our ability to attract, motivate and retain quality talent (particularly executive talent) and with setting financial incentives that do not motivate undue risk-taking.

•The Governance and Nominating Committee oversees the management of risk primarily associated with Octave’s ability to attract and retain quality directors, Octave’s corporate governance programs and practices and our compliance therewith, including integration of ESG and sustainability policies, practices and goals into the Company's business strategy and decision making. Additionally, the Governance and Nominating Committee oversees the processes for evaluation of the performance of the Board of Directors and its committees each year and considers risk management effectiveness as part of its evaluation. This committee also reviews succession plans for Octave's executive officers, including the Chief Executive Officer. The Governance and Nominating Committee also performs oversight of the business ethics and compliance program and reviews compliance with Octave’s Code of Business Conduct.

•The Strategy Committee oversees the management of strategic plans and initiatives.

The Board of Directors receives quarterly updates from Board committees and the Board provides guidance to individual committee activities, as appropriate.

In order to assist the Board of Directors in overseeing Octave’s risk management, Octave uses enterprise risk management, a company-wide process that involves the Board of Directors, management and other personnel in an integrated effort to identify, assess and manage a broad range of risks (e.g., credit, financial, legal, liquidity, market, model, fraud, operational, regulatory, reputational and strategic) that may affect the Company’s ability to execute on its corporate strategies and fulfill its business objectives. The Enterprise Risk Committee

(“ERC”), which is a management committee, is comprised of executive and senior level management responsible for assisting in the management of the Company’s risks on an individual and aggregate basis. The ERC produces the relevant risk management information for executive and senior management and the Board of Directors.

Octave management has established other management committees to assist in managing the risks throughout the enterprise. These committees will meet monthly or as needed on an ad hoc basis.

•The Disclosure Committee's objective is to assist the CEO and CFO in their responsibilities to design, establish, maintain and evaluate the effectiveness of disclosure controls and procedures. Members of the Disclosure Committee include the CEO, CFO, Chief Accounting Officer, General Counsel, Group Chief Operating Officer, who is also the Head of Risk Management, and senior managers from finance and legal.

•The Everspan Underwriting Risk Committee's objective is to provide oversight of the active underwriting operations of Everspan, develop underwriting parameters, and assist the Boards of the Everspan companies in overseeing the integrity and effectiveness of Everspan’s underwriting risk management framework. Members of the committee include the CEO, key members of Everspan management and other senior managers or advisors of Octave. Additionally, a Reinsurance and Program Administrator Credit Risk sub-committee was established at the direction of the Underwriting Risk Committee to assist with the management of credit risk emanating from ceded reinsurance and program administrators.

•Subsidiary Boards of Directors. Each of Octave's subsidiaries has an Octave management-led Board charged with overseeing the strategy, performance and operations of such subsidiary. These subsidiaries include Everspan as well as each of our MGA/Us. Many of these Boards are led by Executive Management of OSG and, in other instances, senior management from throughout the organization. Occasionally, our subsidiary boards may also include independent members that are not employees of Octave or its subsidiaries. Many of our MGA/U subsidiaries also maintain Underwriting Committees to oversee the underwriting quality and risk management of such underwriting unit. These Underwriting Committees provide regular updates to their respective Boards of Directors.

The Company’s Enterprise Risk Management efforts build upon the foundation of an effective internal control environment. The design of any risk management or control system must reflect the fact that there are resource constraints, and the benefits must be considered relative to their costs. As a result, the possibility of material financial loss remains regardless of the Company’s Enterprise Risk Management efforts. An investor should carefully consider the risks and all of the other information set forth in this annual report, including the discussions included in Item 1A. Risk Factors, Item 7A. Quantitative and Qualitative Disclosures About Market Risk, and Item 8. Financial Statements and Supplementary Data.