Audit Committee Transparency Barometer

PDF page 103, Item 3. Ratification of KPMG LLP - Background

The disclosure satisfies Rating 3 by naming multiple concrete evaluation activities performed in connection with the auditor review and retention decision, including a structured survey and peer fee comparisons. The proxy states: "To assist the Audit Committee with its review, management prepares an annual assessment of KPMG that includes (1) an analysis of KPMG’s known legal risks and significant proceedings that may impair KPMG’s ability to perform BNY’s annual audit, (2) the results of a survey of management and Audit Committee members regarding KPMG’s overall performance and (3) KPMG’s fees and services compared to services provided by KPMG and other auditing firms to peer companies."

Names a structured survey of management and committee members plus peer fee benchmarking, showing non-PCAOB evaluation work also earns Rating 3.

PDF page 57, Proposal 2 – Ratify the Appointment of BDO USA, P.C. as our Independent Registered Public Accounting Firm for 2026

The disclosure satisfies Rating 3 by naming multiple concrete evaluation activities performed by the Audit Committee in deciding to retain the auditor. On PDF page 57 (Proposal 2), the proxy states: "To address these concerns, the Audit Committee: ... conducts a quarterly assessment of BDO’s service quality, and its working relationship with our management; conducts regular private meetings separately with each of BDO and our management; interviews and approves the selection of BDO’s new lead engagement partner with each rotation; at least annually, obtains and reviews a report from BDO, describing all relationships between the independent auditor and Hecla; and reviews data relating to audit quality and performance, including the most recent Public Company Accounting Oversight Board (“PCAOB”) reports on BDO and its peer firms."

Rich MidCap example: interviews the incoming engagement partner, holds private meetings, quarterly assessments, and reviews PCAOB reports.

page 65, Proposal No. 2 - Ratification of Appointment of Independent Registered Public Accounting Firm

The proxy states that the audit committee evaluated the independent auditor for re-appointment and lists factor categories considered, but does not identify any concrete evaluation activities (such as surveys, PCAOB inspection report reviews, interviews, or peer comparisons). Under Proposal No. 2 (page 65), the filing states: "In making the determination to re-appoint Ernst & Young for 2026, the Audit Committee considered, among other factors, the independence and performance of Ernst & Young, and the quality and candor of Ernst & Young’s communications with the Audit Committee and management." This satisfies the Rating 2 criterion of naming factor categories without describing concrete evaluation activities.

Canonical minimal Rating 2: names independence, performance, and communication quality as reappointment factors in one sentence, with no evaluation activity described.

PDF page 77 (page 63), Audit Committee Report

The Audit Committee Report lists specific factor categories evaluated when deciding whether to reappoint the auditor, but does not identify any concrete evaluation activity (such as structured surveys, PCAOB inspection report reviews, or interviews). The proxy states: "In determining whether to reappoint Ernst & Young as Envista's independent auditor, the Audit Committee took into consideration a number of factors, including the firm's tenure, independence, global capability and expertise and performance."

Compact Audit Committee Report sentence naming tenure, independence, global capability, expertise, performance; clean factor-category-only language for MidCap coders.

page 67, Proposal No. 3 - We Engaged KPMG After a Rigorous Review Process

The disclosure satisfies both prongs of Rating 3: (1) it explicitly discloses the start year: "KPMG has served as the Company’s independent registered public accounting firm continuously since 1993" (page 67), and (2) it provides an extensive discussion of tenure-related benefits, risks, and safeguards, stating: "The Audit Committee believes that, if handled properly, there are numerous benefits of a long-term independent auditor relationship, including: Higher Audit Quality: Through 33 years of experience with the Company KPMG has gained institutional knowledge of and deep expertise regarding our operations and primary business segments, accounting policies and practices and internal controls over financial reporting; Efficient Fee Structure: KPMG’s aggregate fees are competitive with peer companies because of KPMG’s familiarity with the Company and industry expertise; and Avoidance of Disruption: Onboarding a new independent auditor requires a significant time and cost commitment that could distract from management’s and the Audit Committee’s focus on financial reporting and internal controls." It also explicitly identifies independence risk and safeguards ("The Company and the Audit Committee are also aware that a long-tenured auditor may be believed by some to pose an independence risk. To address these concerns, there are safeguards for auditor independence...").

PDF page 74, PROPOSAL 2 – RATIFICATION OF SELECTION OF INDEPENDENT REGISTERED PUBLIC ACCOUNTANT

The proxy explicitly states the start year of KPMG's service and discusses specific tenure-related benefits and safeguards on page 74: "KPMG LLP has served as our Company’s independent registered public accountants since 1989. In order to assure continuing auditor independence, the audit committee periodically considers whether the annual audit of the Company’s financial statements should be conducted by another firm. With respect to the length of KPMG LLP’s tenure, we believe this enhances our audit quality due to their significant institutional knowledge and deep expertise of our Company’s global business, accounting policies and practices, and internal controls over financial reporting. In addition, as a result of their familiarity with our Company, audit and other fees remain competitive, and we avoid the costs and disruptions associated with bringing on a new independent auditor. Furthermore, the lead audit partner on the Company’s engagement serves no more than five consecutive years in that role, in accordance with SEC rules." This satisfies both prongs of Rating 3: explicit start year (1989) and substantive discussion connecting tenure to audit quality, institutional knowledge, fee competitiveness, avoided onboarding costs, and rotation safeguards.

Page 129, Proposal 3 - Ratification of Appointment of Independent Registered Public Accounting Firm for 2026

The proxy discloses the explicit start year of the relationship ('PwC, or its predecessor firm, has served as our independent registered public accounting firm continuously since 1985.') and explicitly details tenure-related benefits (audit efficiency from deep understanding, efficient fee structures from familiarity, and avoidance of significant costs and disruptions from onboarding a new auditor), tenure-related risks (independence risk), and specific safeguards (regulatory framework, partner rotation, annual assessment, private executive sessions). This satisfies both prongs of Rating 3.

Page 30, Proposal 3: Ratification of the Selection of the Independent Registered Public Accounting Firm for Fiscal 2027 (PDF page 58)

The proxy explicitly quantifies auditor tenure by specifying the starting fiscal year of the relationship, but it does not provide any tenure-related rationale, benefit, risk, or safeguard. Proposal 3 on page 30 (PDF page 58) states: "EY has served as Brown-Forman’s independent registered public accounting firm since fiscal 2021. The members of the Audit Committee believe that retaining EY to serve as the independent registered public accounting firm is in the best interests of Brown-Forman and its stockholders." Under the Q2 codebook rule, providing an explicit start year without an accompanying substantive discussion of tenure-related effects or rationale meets the threshold for Rating 2.

States "EY has served since fiscal 2021," then only a generic best-interests sentence; explicit start year with no named tenure benefit, risk, or safeguard. | contrast: Clean R2 pole: quantification without rationale. Adding any institutional-knowledge or fee-efficiency benefit would make it R3.

PDF page 101, Section: 'PROPOSALS TO BE VOTED ON AT THE ANNUAL MEETING - VOTING ITEM 2—RATIFICATION OF THE APPOINTMENT OF INDEPENDENT AUDITOR'

The proxy discusses the benefits and safeguards associated with auditor tenure but omits an explicit start year: "PricewaterhouseCoopers LLP has been retained as our external auditor continuously for many years. During its tenure as the external auditor, the firm has maintained its independence and regularly rotated the audit partner as required by the SEC and PCAOB. Through its external audit work the firm has gained valuable institutional knowledge enabling effective audit practices and procedures." Under the Q2 codebook rule, substantive tenure discussion (naming institutional knowledge, audit practices, and independence safeguards) without an explicit calendar or fiscal start year qualifies for Rating 2.

Names institutional knowledge, effective audit practices, and partner-rotation safeguards, but says only "continuously for many years" with no start year. | contrast: Mirror image of the other R2s: full tenure substance, missing year. Contrast with R1's identical vagueness but zero substance.

PDF page 121; Proposal Three: Ratification of Appointment of Independent Registered Public Accounting Firm - Evaluation of Independent Registered Public Accounting Firm

In Proposal Three, under the Audit Committee's annual evaluation factors for reappointing Ernst & Young LLP, the proxy explicitly links fees to audit quality and efficiency: 'The appropriateness of the independent auditor’s fees relative to the quality and efficiency of audit services provided.' This directly connects fee levels to audit quality and efficiency, meeting the Rating 3 criterion ('fee levels reflect the scope and quality of services').

Evaluation factor expressly weighs auditor fees relative to the quality and efficiency of audit services provided, the codebook's bright-line fee-to-quality formulation. | contrast: SmallCap counterpart showing concise checklist language can satisfy R3 where Welltower's list does not.

PDF page 65, Proposal 3 – Ratification of Appointment of Independent Registered Public Accounting Firm

The proxy satisfies Rating 3 by explicitly connecting audit fee levels to audit quality within the committee's evaluation criteria. Proposal 3 states that the Audit Committee considered: "● The appropriateness of the firm’s fees relative to both efficiency and audit quality;" (PDF page 65). This explicitly links fee appropriateness directly to audit quality, satisfying the codebook standard that fee levels be evaluated relative to audit quality.

Committee considers the appropriateness of fees relative to both efficiency and audit quality, explicitly measuring fee levels against quality of services. | contrast: The word 'relative to' is what lifts this above Welltower's parallel list of fee and quality items.

PDF page 88, Proposal No. 3: Ratification of Appointment of Independent Auditor

Proposal 3 discusses audit quality and fees in the same sentence: "EY has developed significant expertise and experience with our business, accounting policies and practices and our internal control over financial reporting, which we believe allows for a higher quality audit and a competitive fee structure." Because audit quality and fee structure are discussed in direct proximity as co-benefits of auditor familiarity, but without an explicit causal link stating that the fee level itself causes or is necessary to ensure audit quality, this meets the criterion for Rating 2.

Tenure-based expertise is said to allow both a higher quality audit and a competitive fee structure, making them coordinate benefits rather than linked quantities. | contrast: Contrasts with R3 tenure language where efficiency 'results in' the fee structure; here both merely coexist.

PDF page 47, Independent Auditor Fees (page 35)

The disclosure meets Rating 2 because the proxy discusses audit fees and audit quality in close proximity within the fee deliberation process, but does not state an explicit causal link that fee levels cause or determine audit quality. The proxy states: "The Committee's deliberations consider balancing the design of an audit scope that will achieve a high-quality audit that drive efficiencies from both the Company and PwC while compensating PwC fairly."

Scope deliberation balances achieving a high-quality audit with compensating the auditor fairly; quality and pay are adjacent objectives, not an asserted fee-quality relationship. | contrast: Shows proximity inside one sentence still falls short of R3 absent a stated causal or relative link.

PDF page 40, Proposal 2 – Ratification of the Selection of the Independent Registered Public Accounting Firm (Audit Fees, page 30)

The proxy mentions fees and audit quality in direct proximity within the same sentence outlining committee considerations: 'The Audit Committee considers whether the independent registered public accounting firm is best positioned and qualified to provide the most effective and efficient service based on factors such as the independent registered public accounting firm\'s familiarity with Welltower\'s business, personnel, culture, accounting systems, and risk profile; the appropriateness of fees charged; and whether provision of the service by the independent registered public accounting firm would enhance Welltower\'s ability to manage or control risk or improve audit quality.' Because 'appropriateness of fees charged' and 'improve audit quality' are discussed in proximity as separate items in a list of considerations rather than establishing an explicit causal connection where fee levels drive audit quality, it satisfies the criteria for Rating 2.

Fee appropriateness and improving audit quality appear as separate bullet-style items in one list of retention considerations, with no stated connection between fee level and quality. | contrast: Near-miss on R3: same list format as Victoria's Secret and Matson, but fees and quality stay parallel rather than relative.

Item 2: Proposal to Ratify the Selection of Ernst & Young LLP as the Company's Independent Registered Public Accounting Firm for 2026 - Policy for Approval of Audit and Permitted Non-Audit Services, page 38 (PDF page 45)

The proxy describes an active monitoring activity performed by the Audit Committee to safeguard auditor independence regarding non-audit services. On page 38 (PDF page 45): "These services are actively monitored (both spending and work content) by the Audit Committee to maintain the appropriate objectivity and independence in EY's core work, which is the annual audit of the Company's consolidated financial statements and internal control over financial reporting. The Audit Committee determined that all services provided by EY in 2025 were permissible under applicable independence rules." This ongoing monitoring of spending and work content satisfies Rating 3.

Committee 'actively monitored (both spending and work content)' non-audit services to maintain objectivity and independence in EY's core audit work. | contrast: Monitoring activity path to R3: describes ongoing committee conduct, not just a conclusion.

PDF page 75, Pre-Approval of Audit and Non-Audit Services

The proxy details specific tests and criteria the Audit Committee must apply when evaluating non-audit services for independence, as well as a specific safeguard prohibiting approval if independence is impaired. Under 'Pre-Approval of Audit and Non-Audit Services': "Under our policy and procedures, when considering whether to approve non-audit services to be provided by our independent accountant, the Audit Committee must consider whether the provision of the service would adversely affect the independence of the independent accountant. Specifically, the Audit Committee must consider whether the provision of the service would (i) place the accountant in the position of auditing his or her own work; (ii) result in the accountant acting as management or an employee of the Company; or (iii) place the accountant in the position of being an advocate for us. Any proposed non-audit service that the Audit Committee determines would adversely affect the independence of our independent accountant will not be approved."

Committee must test whether a service makes the accountant audit its own work, act as management, or become an advocate, and must reject impairing services. | contrast: Criteria/tests path to R3, contrasting with R1 policies that merely list prohibited services.

PDF page 114, Proposal 3 – Independent Registered Public Accounting Firm Fees

The proxy includes an explicit conclusory statement by the Audit Committee connecting non-audit services to auditor independence, but does not describe the specific evaluation process, criteria, monitoring activities, or tests applied. On PDF page 114, under Independent Registered Public Accounting Firm Fees, the proxy states: "The Audit Committee has considered whether the provision of non-audit services is compatible with maintaining the independence of Deloitte and has concluded that it is." Under codebook rules, an explicit conclusory determination linking NAS to independence without describing how the committee evaluated or monitored the impact meets the exact criterion for Rating 2.

Canonical conclusory statement: the committee 'has considered whether the provision of non-audit services is compatible with maintaining the independence of Deloitte and has concluded that it is.' | contrast: Textbook R2 anchor: explicit NAS-independence conclusion with zero description of how it was reached.

page 93 (PDF page 122), PROXY ITEM NO. 2: RATIFICATION OF APPOINTMENT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTANTS

The proxy contains an explicit conclusory statement by the audit committee connecting non-audit services to auditor independence without detailing specific evaluative tests or monitoring frameworks. On page 93 (PDF page 122), under Proposal 2, the proxy states: "The Audit and Finance Committee reviewed summaries of the services provided by Deloitte and the related fees and determined that the provision of non-audit services is compatible with maintaining the independence of Deloitte." Under the Q4 codebook, an explicit conclusory determination linking non-audit services to independence without describing how the committee reached that conclusion meets the criterion for Rating 2.

Committee reviewed summaries of Deloitte services and related fees and determined non-audit services compatible with independence, but names no criteria, tests, or monitoring. | contrast: Boundary toward R3: reviewing fee summaries is an input, not a disclosed evaluation standard.

PDF page 41, Proposal Two: Ratification of Appointment of Independent Registered Public Accounting Firm — Independent Registered Public Accounting Firm Fees and Services

The Audit Committee provides an explicit conclusory determination linking non-audit services to independence without describing the evaluation process or criteria used: "In addition to performing the audit of our consolidated financial statements, KPMG LLP provided various other services during the fiscal year ended September 27, 2025. Our Audit Committee has determined that KPMG LLP’s provision of these services, which are described below, does not impair KPMG LLP’s independence from us." (PDF page 41). Under the codebook, an explicit conclusory statement in the committee's voice that NAS does not impair independence without explaining how the committee evaluated NAS is Rating 2.

Single explicit determination that KPMG's provision of the listed other services 'does not impair KPMG's independence,' with no evaluative process described. | contrast: Shows R2 needs only one committee-voice conclusion, distinguishing it from R1's purpose clauses.

page 74 (PDF page 77), Audit Matters — Policy on Pre-Approval of Audit Services and Non-Audit Services

The proxy explicitly discloses that the Audit Committee is actively involved in negotiating audit fees rather than merely approving a predetermined figure. On page 74 (PDF page 77), under 'Policy on Pre-Approval of Audit Services and Non-Audit Services', the filing states: "For audit services, our independent auditor provides an engagement letter to our Audit Committee prior to commencing its second quarter review work, which outlines the scope of the proposed audit and audit-related fees. Our Audit Committee reviews the letter and negotiates with and formally engages the auditor." Because the disclosure explicitly states that the Audit Committee reviews the engagement letter and negotiates fees with the auditor, it satisfies the bright-line criterion for Rating 3.

Committee reviews the auditor's engagement letter outlining proposed fees and then 'negotiates with and formally engages the auditor' — direct committee fee negotiation. | contrast: Crosses the R2 line because the committee itself negotiates, rather than approving a letter management negotiated.

PDF page 114, Proposal 3 (Evaluation of the Independent Registered Public Accounting Firm)

The proxy explicitly describes substantive Audit Committee involvement in determining audit fees through peer benchmarking and evaluation of audit scope and complexity. Verbatim: "CNO undertakes an annual benchmarking of audit fees paid by our peers in the insurance industry. This data provides a reference point to the Audit Committee to judge the appropriateness of the audit fee. Additionally, the Audit Committee evaluates the scope of the audit, the complexity of the CNO environment, any history of prior issues and adjustments and the overall audit plan presented by the independent auditor in arriving at an appropriate fee." This satisfies Rating 3 by showing active committee evaluation of fee levels against peer benchmarks and operational factors rather than mere sign-off.

Committee uses annual peer-industry fee benchmarking plus scope, complexity, and audit-plan evaluation to arrive at an appropriate fee, without using 'negotiate'. | contrast: Shows R3 is reachable via committee benchmarking and fee-setting judgment, not only negotiation language.

PDF page 57, Proposal 2: Ratification of the Appointment of Deloitte & Touche LLP (Audit Committee Pre-Approval Policy)

Verbatim from PDF page 57: "The Audit Committee has adopted a Pre-Approval Policy for Audit, Audit-Related, and Non-Audit Services. The Audit Committee has delegated to the Audit Committee Chairperson the authority to pre-approve services not prohibited by law up to various maximums depending on the type of service provided, provided that the Audit Committee Chairperson shall report any decisions to pre-approve services to the full Audit Committee at its next meeting." The disclosure describes the committee's pre-approval authority and sign-off procedures without indicating active involvement in setting, negotiating, or benchmarking fee levels, which meets Rating 2.

Pure pre-approval policy with chair delegation thresholds and reporting back; no mention of fee levels, negotiation, or benchmarking anywhere. | contrast: Baseline R2 floor: approval machinery only, contrasting with R3 cases that add fee-level participation.

PDF page 32, Information Concerning Independent Registered Public Accountants - Negotiation of Fees Payable to the Independent Registered Public Accountants

The proxy states on PDF page 32 under 'Negotiation of Fees Payable to the Independent Registered Public Accountants' that: "Each year, the Company’s management conducts a robust, good-faith negotiation, overseen by the Audit Committee, with the independent registered public accountant regarding the proposed fees for the engagement. This negotiation includes a review for reasonableness of fees incurred during the previous year, as well as a review for reasonableness of fees for the proposed engagement, with consideration of any enhancements to the Company’s financial and other internal controls as a result of the Company’s year-over-year growth and expansion into new international jurisdictions." Because management conducts the negotiation and the Audit Committee's role is described as oversight of that process rather than direct committee negotiation or fee-setting, this meets the criteria for Rating 2 under the conservative interpretation rule.

Describes a robust good-faith fee negotiation with reasonableness review, but management conducts it and the committee only oversees the process. | contrast: Teaches that the word 'negotiation' alone does not earn R3 when the negotiator is management.

PDF pages 65, 75, 76, Board Committees - Audit Committee; Item 2 - Benefits of longer tenure and independence controls; Pre-Approval Processes

The proxy describes the audit committee's formal charter authority to compensate the auditor and pre-approve fees, while disclosing that management conducts the discussions and benchmarking regarding proposed fee levels. On page 42 (PDF page 65), the proxy states: "The committee has ultimate authority and responsibility to appoint, retain, compensate, evaluate, and where appropriate, replace the external auditors." On page 49 (PDF page 76): "The audit committee is responsible for the appointment, retention, compensation and oversight of our independent registered public accounting firm. The audit committee has adopted policies and procedures for pre-approving all services..." Meanwhile, on page 48 (PDF page 75), the proxy discloses: "Management meets with Ernst & Young to discuss proposed audit fees, including impacts from proposed changes to the scope of the engagement and from rate increases. Management also considers benchmarking data for our peer companies as well as for public companies in general." Reciting statutory/charter authority and approval processes without indicating direct committee participation in negotiating or setting fee levels satisfies the criteria for Rating 2.

Charter authority to compensate the auditor plus pre-approval procedures, while the proxy explicitly places fee discussion and benchmarking with management, not the committee. | contrast: Shows the R2/R3 line: same benchmarking language earns R3 only when the committee, not management, performs it.

PDF page 50, Service Fees Paid to the Independent Registered Public Accounting Firm

On PDF page 50, the fee table shows 'Audit Fees' of $4,554 thousand for fiscal year 2026 compared to $5,372 thousand for fiscal year 2025, which is a decrease of $818 thousand or 15.23% (exceeding the 10% materiality threshold). In the fee table description column, the proxy provides an explicit causal explanation for the change: 'The decrease in audit fees for fiscal year 2026 is primarily attributable to integration and divestiture activities in fiscal year 2025 that were non-recurring in fiscal year 2026.' This satisfies the Rating 3 criteria of a material fee change (>10%) accompanied by an explicit reason with causal language.

Audit fees fell 15.23% and the proxy attributes the decrease to prior-year integration and divestiture activities that were non-recurring. | contrast: Demonstrates R3 applies to decreases, and that explaining a prior-year driver counts.

PDF page 35, Section III. Ratification of Appointment of Independent Registered Public Accountants (Proposal 2), table footnote (a)

In the fee table on page 28 (PDF page 35), top-line Audit Fees increased from $3,800,000 in 2024 to $5,895,000 in 2025, representing an increase of $2,095,000 (+55.13%), which strictly exceeds the 10% materiality threshold. Footnote (a) to the table provides an explicit causal explanation for this change: "The increase in audit fees for 2025 as compared to 2024 is primarily driven by audits of the carve-out financial statements of the Company's small cells and fiber solutions businesses in connection with the Company's pending sale of its small cells and fiber solutions businesses." This satisfies all requirements for Rating 3.

Audit fees rose 55.13% with a footnote stating the increase was 'primarily driven by' carve-out audits for the pending small cells and fiber sale. | contrast: Footnote placement still qualifies; it is causal attribution, not a list of covered services.

PDF page 55, Proposal 2 (Ratification of Appointment of Independent Auditors - Principal Accounting Fees and Services)

Audit Fees changed by +110.3% from fiscal 2024 ($790,929) to fiscal 2025 ($1,663,452), exceeding the 10% materiality threshold. The proxy explicitly provides a causal explanation directly attributing the increase to an acquisition and integration on page 55: "Audit fees increased on a year-over-year basis primarily as a result of the acquisition of VOXX and integration of the same."

Audit fees rose 110.3% and the proxy states fees increased 'primarily as a result of the acquisition of VOXX and integration of the same.' | contrast: Minimal-but-sufficient causal sentence — the exact element the R2 scope lists lack.

PDF page 69, AUDIT INFORMATION - Fees Paid to Independent Registered Public Accounting Firm

Audit Fees increased from $1,384,600 in 2024 to $1,534,890 in 2025, which represents an increase of $150,290 or +10.85% (strictly greater than the 10% materiality threshold). However, the proxy provides no causal explanation for the change, providing only the standard category definition: "professional services rendered for the audit of Sabra’s consolidated financial statements and review of the interim condensed consolidated financial statements included in quarterly filings and services that are normally provided by PwC in connection with statutory and regulatory filings or engagements". Under the codebook rules, when Audit Fees change by more than 10% and no explicit causal explanation is provided, the disclosure is rated 2.

Audit fees rose 10.85% ($1,384,600 to $1,534,890), just over the threshold, with only a boilerplate definition of covered services. | contrast: Immediately above the R1 cutoff: materiality triggers the explanation test, which boilerplate fails.

PDF page 79, Audit and Non-Audit Fees and Independent Public Accountants

On PDF page 79 (proxy page 57), the fee table discloses Audit Fees of $4,603,826 for fiscal 2025 compared to $1,467,010 for fiscal 2024, representing an increase of +213.8%, which strictly exceeds the 10% materiality threshold. The narrative below the table only provides a generic definition of what audit fees cover ("Audit fees include fees associated with the audit of our annual financial statements, the audit of our internal control over financial reporting...") without providing any causal explanation for why audit fees more than tripled. Under the Q6 rules, a material fee change without an explicit causal explanation is scored Rating 2.

Audit fees tripled (+213.8%, $1,467,010 to $4,603,826) yet the proxy offers only generic definitions of what audit fees cover. | contrast: Shows even an enormous change stays at 2 when no causal reason is given.

PDF page 72, Proxy page 66, 'Independent Registered Public Accountants'

Audit fees changed by +35.59% (from $869,893 in 2024 to $1,179,494 in 2025), which strictly exceeds the 10% materiality threshold, but the proxy does not provide an explicit causal explanation for the increase. Footnote (1) on page 66 states: "Audit fees included fees and expenses associated with the audit of our annual financial statements, the reviews of the financial statements in our quarterly reports on Form 10-Q and regulatory and statutory filings, and reviews of purchase accounting related to the FBMS merger." Under the codebook rule, descriptive lists of services covered in the audit fee category do not count as causal explanations, requiring Rating 2.

Audit fees rose 35.59% and the footnote lists FBMS merger purchase-accounting reviews as covered services, but never states the merger caused the increase. | contrast: Sharp R2/R3 boundary: naming a transaction in a scope list is not causal attribution.

page 65 (PDF page 88), Proposal Two – Ratification of the Appointment of Ernst & Young LLP

The proxy explicitly states that the external auditor is reviewed annually and specifies criteria evaluated in that review: "The Audit Committee reviews the performance of the independent registered public accounting firm annually. In making the determination to re-appoint Ernst & Young LLP for FY 2026, the Audit Committee considered, among other factors, the independence and performance of Ernst & Young LLP, and the quality and candor of Ernst & Young LLP’s communications with the Audit Committee and management." This directly satisfies Rating 3 by establishing annual frequency and naming substantive evaluation criteria (performance, independence, and quality/candor of communications).

Opens with the identical annual-review sentence, then adds independence, performance, and quality and candor of communications considered in re-appointing Ernst & Young. | contrast: Near-perfect minimal pair with the R2 Jabil pick — the appended criteria sentence is exactly what earns Rating 3.

PDF page 45, Proposal No. 2 – Ratification of Independent Auditors, Oversight of Independent Auditor

On PDF page 45, the proxy states: "In connection with the selection and appointment of the independent auditors each year, the Audit Committee reviews and evaluates the qualifications, performance, and independence of the independent auditors and lead partner including taking into account the opinions of management and the Company’s internal auditor." This explicitly states annual frequency ('each year') and names specific evaluation criteria ('qualifications, performance, and independence') and context ('opinions of management and the Company’s internal auditor'), directly matching the Rating 3 criterion and codebook example.

'Each year' review of qualifications, performance, and independence of auditors and lead partner, informed by management and internal auditor opinions. | contrast: Shows 'each year' equals 'annually,' and that named criteria plus input sources comfortably clear the R2 line.

PDF page 46, ITEM 2 Ratification of the Independent Registered Public Accounting Firm (page 34)

The disclosure satisfies Rating 3 by explicitly specifying an annual frequency for evaluating the independent auditor and identifying specific evaluation criteria, activities, and context. The proxy states: "At least annually, the Committee meets in executive session without PwC present to evaluate the quality of PwC's audit services and its performance, including PwC's industry knowledge from an accounting and tax perspective, PwC's continued independence and professional skepticism, the Committee's discussions with management about PwC's performance, and information available from Public Company Accounting Oversight Board ('PCAOB') inspection reports."

'At least annually' executive-session evaluation citing audit quality, industry knowledge, independence, professional skepticism, and PCAOB inspection reports. | contrast: Illustrates the richer end of R3: at-least-annual cadence plus concrete activity and external evidence, not just an adjective list.

page 34, Proposal No. 2: Ratification of Appointment of Independent Registered Public Accounting Firm

On page 34, under Proposal 2, the proxy explicitly states: 'The Audit Committee reviews the performance of the independent registered public accounting firm annually.' This explicitly establishes that the external auditor's performance is reviewed annually, but provides no named evaluation criteria, concrete activities (e.g., surveys, questionnaires, inspection reviews), or contextual details. Under the codebook, a bare statement of annual evaluation without named criteria or substantive context is Rating 2.

'The Audit Committee reviews the performance of the independent registered public accounting firm annually' — explicit annual cadence, but no named criterion, activity, or context. | contrast: Bare cadence sentence: beats R1's 'periodically' yet lacks the named criteria that would lift it to 3.

Page 76 (PDF page 100), Proposal 3 — Ratification of Appointment of Ernst & Young LLP as Independent Auditor

The proxy explicitly describes concrete committee actions in the selection of the engagement partner: "In accordance with SEC rules, lead audit partners are subject to rotation requirements, which limit the number of consecutive years an individual partner may serve us. The Audit Committee oversees the rotation of the audit partners. The Audit Committee Chair interviews candidates for audit partner and the Audit Committee discusses them." Naming that the Audit Committee Chair interviews candidates and the Audit Committee discusses them represents concrete actions in the partner selection process, directly matching the codebook's Rating 3 criterion (and serving as a named codebook example).

'The Audit Committee Chair interviews candidates for audit partner and the Audit Committee discusses them' — a concrete, committee-performed selection action. | contrast: Minimal-but-sufficient R3: one named act (interviewing candidates) is all that separates it from R2 involvement claims.

page 25, Audit Committee Report — Independent Auditor Tenure and Rotation

The proxy details specific, concrete actions taken by the Audit Committee in the selection of the lead engagement partner. In the Audit Committee Report under 'Independent Auditor Tenure and Rotation', the proxy states: "The Audit Committee also oversees the process for the selection of the lead audit engagement partner every five years. At the Audit Committee’s instruction, PwC selects candidates to be considered for this role, who are then interviewed by Broadcom’s senior management and the Audit Committee. The Audit Committee then considers and votes on the selection." This disclosure names explicit selection actions: instructing PwC to present candidates, interviewing candidates, and considering and voting on the selection, fully satisfying Rating 3.

Committee instructs PwC to produce candidates, interviews them, then 'considers and votes on the selection' — the fullest concrete decision chain. | contrast: Ceiling case: an explicit committee vote shows the maximum distance from R2's unspecified 'involvement'.

page 26, Independent Auditor

The proxy statement states that the audit committee and its chairperson are involved in the selection of the lead audit partner, but does not identify a concrete selection action (such as interviewing candidates, reviewing candidate profiles, or voting). On page 26, under Independent Auditor, the proxy states: 'In addition, in conjunction with the mandated rotation of Deloitte’s lead audit partner, the audit committee and the audit committee chairperson are directly involved in the selection of Deloitte’s lead audit partner'. Under the codebook rules, stating that the committee is 'directly involved in the selection' without naming a specific concrete action is the textbook definition of Rating 2.

Audit committee and chairperson are 'directly involved in the selection of Deloitte's lead audit partner,' asserting a role without naming any concrete selection step. | contrast: Canonical R2: 'directly involved' is the exact phrase that stops short of R3's interviews, meetings, or votes.

PDF page 92, Audit and Finance Committee Matters — Report of the Audit and Finance Committee for Fiscal 2025

The proxy claims a role and participation for the Audit Committee in lead partner selection without describing a concrete selection activity (such as interviewing candidates, reviewing candidate profiles, or voting). On page 73, the Audit Committee Report states: 'PwC rotates its lead audit engagement partner every five years, and the Audit Committee takes a lead role in the process for evaluating and selecting the new lead audit engagement partner. PwC\'s lead audit engagement partner rotated following the filing of the Company\'s Fiscal 2025 Form 10-K.' Stating that the committee 'takes a lead role in the process for evaluating and selecting' asserts committee involvement but names no specific selection action, qualifying for Rating 2.

Committee 'takes a lead role in the process for evaluating and selecting the new lead audit engagement partner' — strong role language, but no named action. | contrast: Hardest R2/R3 boundary: 'evaluating and selecting' sounds concrete, yet no candidate interview, review, or vote is described.

PDF page 17, Proposal 1: Election of Directors — Board Skills and Expertise; PDF page 29, Director Nominees — William M. Thornberry

On PDF page 17 (Proposal 1: Election of Directors — Board Skills and Expertise), the board skills matrix contains a specific category titled "Cybersecurity / Information Security / Information Tech" mapped to seven director nominees (Dial, Flournoy, Jewett, McClain, Nolan, Read, and Thornberry). Under the Q9 bright-line rule, because the exact category name in the skills matrix contains the word "Cybersecurity", this qualifies for Rating 3. (Additionally, on PDF page 29, William M. Thornberry's biography details his "involvement and expertise in oversight of cybersecurity-related risks at the Departments of Defense and Homeland Security... and chaired the Cyber Task Force in 2011").

Booz Allen's matrix category is "Cybersecurity / Information Security / Information Tech," mapped to seven nominees; Thornberry's bio adds DoD/DHS cyber oversight. | contrast: Same compound label as R2 cases but adds "Cybersecurity" first — one word moves it from 2 to 3.

PDF page 26, Proposal 1 – Summary of Board Skills; PDF page 9, Proxy Summary – Director Skills and Experience

The proxy statement includes a structured board skills matrix with an explicit competency category labeled "Cybersecurity" mapped to individual directors. On PDF page 26, the "Summary of Board Skills" matrix includes a row labeled "Cybersecurity" indicating that 4 out of 8 director nominees possess this core competency (with indicators marked for Kapila K. Anand, Craig R. Callen, Barbara B. Hill, and Burke W. Whitman). In addition, on PDF page 9 (Proxy Summary), the skills summary bar chart includes the category "CYBER". Under the Q9 codebook rule, when the exact term "Cybersecurity" or "Cyber" appears in the skills matrix category name, the disclosure qualifies for Rating 3.

Standalone "Cybersecurity" row in the Summary of Board Skills matrix mapped to four nominees, plus a "CYBER" skills category in the proxy summary. | contrast: The cleanest R3 anchor: a dedicated, unqualified "Cybersecurity" category label with no adjacent-term hedging.

PDF page 52, PROPOSAL 1: Election of Directors - David C. Wajsgras; PDF page 40, Board Refreshment Timeline

On page 33 (PDF page 52), director nominee David C. Wajsgras is explicitly identified as: "Chairman and Chief Executive Officer of Everfox, a leading global cybersecurity company." Under his Key Attributes, the proxy highlights his "Expertise in cybersecurity products and services." Furthermore, on page 23 (PDF page 40), he is highlighted as "A highly regarded aerospace, defense, and cybersecurity executive... with deep expertise in risk management and advanced technology solutions." Because Mr. Wajsgras serves as CEO of a cybersecurity company and cybersecurity is a primary defining feature of his executive leadership and board expertise, this satisfies the biography test for Rating 3.

No cyber matrix label, but Wajsgras is Chairman/CEO of Everfox, "a leading global cybersecurity company," with expertise in cybersecurity products and services. | contrast: Demonstrates the biography path to R3 — a security-defined career, versus R1's coordinate-list mentions.

PDF pages 79-80 (Proxy Statement pages 34-35), Board Skills Matrix; PDF page 83 (Proxy Statement page 37), Director Biographies

The Board Skills Matrix on pages 34-35 includes a specific category titled 'Information Security Experience' (an adjacent security term without the word 'Cybersecurity' in the category name), mapped to individual directors (Ms. Arnold, Mr. Blackmore, Mr. Landless, Mr. Parrette). The description notes 'Experience in management of IT functions, carrying out IT risk assessments and audits, implementing IT security policies and knowledge and management of IT capabilities and risks associated with cyber security matters.' Furthermore, in director biographies, Ms. Arnold's bio mentions 'experience in information technology, including cyber security' in a coordinate list alongside industry knowledge and financial expertise, which is a secondary mention rather than a primary career focus.

Matrix category name is "Information Security Experience"; "cyber security" appears only in the descriptor text and a bio coordinate list, not the label. | contrast: Boundary case: cyber wording present but outside the category name, so it stays at 2 rather than 3.

PDF page 23, PROPOSAL ONE: ELECTION OF DIRECTORS - Board Skills and Demographic Matrix

In the 'Board Skills and Demographic Matrix' on PDF page 23, the proxy includes the category 'Information Technology / IT Security Experience'. Under the codebook rule, when an adjacent security term appears ('IT Security' or 'Information Security') in the skills matrix category label without the word 'Cybersecurity', 'Cyber Security', or 'Cyber', the disclosure is rated 2. Three director nominees (Barry, Cafritz, and Weiner) are marked for this category. None of the director biographies describe cybersecurity as a primary career focus or defining expertise.

Board skills matrix category is "Information Technology / IT Security Experience," marked for three nominees; "IT Security" is an enumerated adjacent term without "Cyber." | contrast: Tests a second adjacent term (IT Security) and separates it from R3's "Cyber / IT" phrasing.

PDF page 15, Proxy Statement Summary — Strategy and Risk Oversight — Cybersecurity; PDF page 67, Governance — Committees of the Board — Audit Committee; PDF page 73, Governance — Board Oversight — Cybersecurity

Cybersecurity oversight is explicitly and repeatedly assigned to the Audit Committee by name. PDF page 15 states: "The Audit Committee is responsible for oversight of our programs, policies, procedures, and risk management activities related to information security, cybersecurity and data protection. It meets regularly with management to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape." PDF page 67 confirms under Audit Committee key responsibilities: "oversees the company’s programs, policies, procedures, and risk management activities related to information security, cybersecurity and data protection".

Audit Committee is expressly 'responsible for oversight of our programs, policies, procedures, and risk management activities related to information security, cybersecurity and data protection.' | contrast: Unambiguous R3 anchor: dedicated cyber responsibility stated in both charter duties and the risk oversight narrative.

PDF page 35, Corporate Governance — Risk Oversight; PDF page 36, Corporate Governance — Data Privacy and Cybersecurity Risk Oversight; PDF page 41, Corporate Governance — Board Committees — Audit & Finance Committee

The proxy explicitly assigns data privacy and cybersecurity oversight to the Audit and Finance Committee by name in multiple dedicated sections. On PDF page 36, under "DATA PRIVACY AND CYBERSECURITY RISK OVERSIGHT", the proxy states: "The Audit and Finance Committee of the Board oversees the Company’s data privacy and cybersecurity programs as well as risk exposures and steps taken by management to monitor and mitigate data privacy and cybersecurity risks." In addition, the committee's key oversight responsibilities listed on PDF page 35 and PDF page 41 explicitly include "Oversight of our Data Privacy and Cybersecurity programs." This unambiguous assignment satisfies Rating 3.

A dedicated 'Data Privacy and Cybersecurity Risk Oversight' section assigns the programs and risk exposures to the Audit and Finance Committee by name. | contrast: Shows R3 survives a combined audit/finance committee; the dedicated cyber section names that committee, not the Board.

PDF pages 20-21, Board of Directors and Corporate Governance - Risk Management Oversight and Cybersecurity Risk Management

Under Risk Management Oversight on page 20, the proxy states: "Our Audit Committee oversees and reviews with management our policies with respect to risk assessment and risk management and our significant operational, financial, information technology and regulatory exposures, among others, and the actions management has taken to limit, monitor or control such exposures." Under Cybersecurity Risk Management on page 20, the proxy states: "The Board is responsible for oversight over the Company’s cybersecurity risk management." Under Q10 rules, when the Audit Committee's oversight includes language that could encompass cyber ("information technology... exposures") without specifically naming cybersecurity, and dedicated cybersecurity oversight is assigned to the full Board, the disclosure receives Rating 2.

Audit Committee oversees 'information technology' exposures generically, while the dedicated cybersecurity paragraph assigns cybersecurity risk management to the full Board. | contrast: Bridges R1 and R3: IT-risk language in audit's mandate lifts it above R1, but named cyber oversight sits with the Board.

Page 18, Board’s Role in Risk Oversight (PDF page 44)

The proxy assigns risk oversight encompassing technology and information risk to the Audit Committee, but does not specifically name cybersecurity. Under "Board’s Role in Risk Oversight" on page 18 (PDF page 44), the Audit Committee's responsibilities include: "Overseeing the integrity of the Company's financial statements and financial reporting processes; overseeing our policies and processes on enterprise risk assessment, risk management, and compliance, including technology and information risk; overseeing our most significant financial reporting and accounting control risks...". Under the Q10 codebook rule, when the audit committee's oversight includes language that could encompass cyber (such as "technology risk" or "information risk") without specifically using the term cybersecurity, information security, or data privacy, Rating 2 is assigned.

Audit Committee oversees enterprise risk 'including technology and information risk' but the proxy never names cybersecurity, information security, or data privacy. | contrast: Core R2 case: cyber-encompassing 'technology and information risk' wording without the explicit cyber term that would make it R3.

PDF page 10, Proposal 1: Election of Directors; PDF page 33, Nomination of Directors

On page 10, under Proposal 1: Election of Directors, the proxy contains a structured skills matrix table that maps each of the nine director nominees individually across eight distinct competency categories (Accounting & Corporate Finance, Software Industry Knowledge, Transformation Experience, Strategy and Management, Technology Expertise, Corporate Governance, Risk Management (including Cybersecurity Expertise), and Regulatory Industry Knowledge) using individual checkmarks. Page 33 also explicitly references: "See the Skills Matrix immediately prior to our director and nominee biographies under Proposal 1—Election of Directors." This provides a clear director-level mapping, satisfying Rating 3.

Grid maps each of nine nominees to eight competencies with checkmarks, and a later governance section explicitly cross-references the skills matrix. | contrast: Demonstrates the 'present or referenced' clause while still showing the actual director-level mapping.

PDF page 11, Proposal 1 - Board of Directors Skills Matrix

On page 11, under the section heading "BOARD OF DIRECTORS SKILLS MATRIX," the proxy presents a structured grid mapping all nine individual director nominees (Brian Chambers, Michelle Collins, Eduardo Cordeiro, Adrienne Elsner, Alfred Festa, Edward Lonergan, Paul Martin, Suzanne Nimocks, John Williams) across 12 distinct competency categories: Public Company Management, Strategy / Corporate Development, Business Transformation Leadership, Financial, Technology / Cybersecurity, Research & Development / Product Innovation, Global Business, Manufacturing / Operations, Marketing / Sales, Sustainability Management, Public Policy / Regulatory, and Human Capital Management. This satisfies the codebook criterion for Rating 3.

Section titled 'Board of Directors Skills Matrix' maps all nine named nominees across twelve competency categories in a structured grid. | contrast: Canonical Rating 3 anchor: named directors as rows, competencies as columns — exactly what Rating 2 lacks.

PDF page 24, Corporate Governance — Board Skills and Experience Matrix

On PDF page 24, under Corporate Governance — Board Skills and Experience Matrix, the proxy includes a structured grid mapping nine continuing directors individually across 10 competency categories (Automotive Industry, Senior Management, Finance / Accounting, International Business, Legal / Regulatory / Compliance, Corporate Governance and Public Company Board, Semiconductor / Technology Industries, Sales & Marketing, Operations / Manufacturing / Supply Chain, and Corporate Responsibility / Climate / Sustainability) using five proficiency levels (no experience, emerging experience, some experience, substantial experience, expert-level experience). This satisfies the Rating 3 criterion for a structured disclosure mapping individual directors to competency areas.

Board Skills and Experience Matrix maps nine directors across ten categories using five graded proficiency levels rather than binary marks. | contrast: Graded per-director proficiency exceeds Rating 2's aggregate counts, showing depth is mapped to individuals.

PDF page 40, Corporate Governance and Board Matters - Director Nominees - Experience and Qualifications of All Nominees

The proxy satisfies Rating 2 because it presents a structured skills disclosure in the form of a collective board competency summary bar chart rather than an individual director-by-skill matrix grid. The proxy states: 'The graph below shows the number of directors who have certain of the skills, qualifications and experience in key areas that are important for the Board’s oversight of the Company’s business. DIRECTOR SKILLS MATRIX (Number of directors with relevant skills)' and displays aggregate counts across 9 competency areas. While individual biographies contain bulleted 'Qualification Highlights', there is no tabular grid mapping each director against the full set of competency categories.

Chart literally titled 'Director Skills Matrix' but shows only aggregate counts per skill; biographies list qualification highlights, with no director-by-skill grid. | contrast: Teaches that the label 'matrix' does not earn Rating 3 — only actual director-to-competency mapping does.

PDF pages 31, 33, 34, 36, 38, Proposal 1 — Election of Director Nominees For Terms Expiring At The 2027 Annual Meeting

The proxy provides a structured presentation of director qualifications using individual "KEY SKILLS" sidebars with standardized category icons and labels alongside each nominee's biography, rather than a consolidated director-by-skill matrix table. The standardized competency labels across the nominees are: "Audit/Finance", "Brand & Marketing", "CEO/CFO Experience", "Dealers/Distribution", "Global", "Governance and Compliance", "Operations/Manufacturing", "Public Company Board", and "Technology/Innovation/Digital". Under the Q13 criteria, "structured qualifications that are not a traditional director-level matrix" receive Rating 2.

Standardized 'Key Skills' labels appear in each nominee's biography sidebar with consistent categories, but never consolidated into a director-by-competency table. | contrast: Shows per-director skill tags alone fall short of Rating 3; the structured cross-director grid is what lifts it.

PDF page 36, Proposal 1: Election of Directors - Director Nominee Biographies - Alexandr Wang

Director Alexandr Wang is explicitly identified with AI expertise as his primary career focus in his biography on page 36. His professional highlights state: "• Chief AI Officer, Meta Platforms, Inc. (since June 2025) • Founder and board member, Scale AI, a leading test and evaluation partner for artificial intelligence companies (since 2016) • Chief Executive Officer, Scale AI (2016 through June 2025)". His board membership qualifications further state: "Mr. Wang has extensive technology experience and expertise, including in artificial intelligence and machine learning." Under the codebook rules, holding a title of 'Chief AI Officer' and founding an AI company satisfies Rating 3 via the biography test.

Alexandr Wang's bio lists Chief AI Officer of Meta and founder/CEO of Scale AI — AI is the central defining feature of his career. | contrast: Purest biography path: an AI title and AI company, versus R1's coordinate-list mentions.

page 19, Proposal 1 - Election of Directors, Nominees for Election to the Board of Directors; page 25, Proposal 1 - Election of Directors, Director Skills and Qualifications

The proxy satisfies Rating 3 through both the skills matrix category test and the director biography test. In the skills matrix on page 25, the competency category label is explicitly named "AI/Data Analytics/Digital Infrastructure", which includes the qualifying term "AI". Additionally, on page 19, director nominee Paul Eremenko's primary occupation and defining career expertise is explicitly in artificial intelligence: "Mr. Eremenko is the Chief Executive Officer and Co Founder of P-1 AI, a company focused on developing agentic artificial intelligence for complex systems engineering... His leadership and expertise in AI, aerospace research and development... position him as a pioneer in driving technological transformation". Under the codebook rules, an AI term in the skills matrix category name or a director whose primary career focus is leading an AI company establishes Rating 3.

Matrix category 'AI/Data Analytics/Digital Infrastructure' embeds 'AI', and Eremenko is CEO/co-founder of P-1 AI, an agentic artificial intelligence company. | contrast: Teaches that adding 'AI' to an analytics-style label flips R2 to R3; also satisfies the bio path.

PDF page 16, Director Skills and Experience

The board skills matrix includes the explicit category name 'Artificial Intelligence' and maps checkmarks to directors Ravi Gupta, Meredith Kopit Levien, Chris Rogers, Lily Sarafan, and Josh Silverman. PDF page 16 lists the row: "Artificial Intelligence" defined as "Experience in the strategic application and risks of artificial intelligence." Under the codebook bright-line rule, the presence of the exact term 'Artificial Intelligence' in the skills matrix category satisfies Rating 3.

Skills matrix contains a standalone 'Artificial Intelligence' row defined as strategic AI application and risks, mapped to five named directors. | contrast: Cleanest matrix bright line — contrast with R2 matrices whose only term is 'Data Analytics'.

PDF page 14, Proposal No. 1 - Election of Directors / Board Skills Matrix

The Board Skills Matrix includes an explicit category containing the adjacent term "data analytics," satisfying the criteria for Rating 2. On page 11 (PDF page 14), the Board Skills Matrix lists the competency category: "Branding/marketing/data analytics/consumer products" with individual director checkmarks for Brewer, Bricker, and Harrison. The codebook specifies that if an adjacent term—specifically including "Data Analytics"—appears in the skills matrix category name without any R3 AI term, the disclosure qualifies for Rating 2.

Skills matrix category literally reads 'Branding/marketing/data analytics/consumer products', supplying the adjacent term 'data analytics' with no AI term anywhere. | contrast: Pure matrix-path R2: identical mechanism to R3's label test, but the term is adjacent rather than AI.

page 5, Corporate Governance — Proposal 1 — Election of Directors — Class I Directors (Paul D. Ballew)

No skills matrix is present. In director biographies, director Paul D. Ballew's primary career focus and expertise are explicitly defined by the adjacent term 'Data Analytics': 'Mr. Ballew currently serves as Chief Data and Analytics Officer for the National Football League. Mr. Ballew served as Senior Vice President, Data, Insights & Analytics at Loblaw Companies Limited from April 2019 to August 2021 and as Global Chief Data and Analytics Officer at Ford Motor Company from December 2014 to April 2019. Prior to joining Ford, Mr. Ballew held senior positions in data and customer analytics at The Dun & Bradstreet Corporation, Nationwide Mutual Insurance Company, General Motors Corporation, and JD Power Associates... Mr. Ballew brings to our Board of Directors extensive experience in customer analytics, data operations, and strategy.' (page 5). Under the codebook, when an adjacent term ('Data Analytics', 'Data Science') serves as the primary description of a director's career expertise without an explicit R3 AI term, the disclosure is Rating 2.

No matrix; Ballew's primary career is Chief Data and Analytics Officer at the NFL, Loblaw and Ford — adjacent term as the defining expertise, no AI term. | contrast: Biography-path R2: mirrors R3's primary-career test with 'Data Analytics' substituted for an AI term.

PDF page 32, Corporate Governance — Sustainability and Responsible Technology; PDF page 33, Corporate Governance — Responsible AI Innovation

The proxy explicitly assigns AI risk and AI governance oversight to the Audit Committee by name. In the dedicated 'Responsible AI Innovation' governance section on PDF page 33, the filing enumerates committee responsibilities, stating: "• Audit Committee. Monitors AI risks as a part of its oversight of our ERM program." Additionally, in the governance summary table on PDF page 32, the Audit Committee's functional purview is explicitly listed as including "Responsible AI as part of its ERM program oversight". Under Q15 rules, explicitly assigning AI risk or AI oversight to the Audit Committee by name using the term 'AI' / 'Responsible AI' qualifies for Rating 3.

A dedicated Responsible AI section states 'Audit Committee. Monitors AI risks as a part of its oversight of our ERM program,' naming AI in the committee's remit. | contrast: Minimal-but-sufficient 3: one AI-named ERM sentence clears the bar generic risk oversight misses.

pages 24, 25, Corporate governance – Board responsibilities and oversight / Cybersecurity & Artificial Intelligence

The proxy explicitly assigns AI governance oversight by name to the Audit Committee using specific AI terminology. On page 24, delegated risk oversight to the Audit Committee includes 'Cybersecurity, privacy and artificial intelligence (“AI”) governance.' On page 25, under 'Cybersecurity & Artificial Intelligence', the filing states: 'The Audit Committee is responsible for overseeing Otis’ cybersecurity program and artificial intelligence (“AI”) governance model as part of its broader risk management and compliance oversight responsibilities' and 'The Audit Committee has responsibility for overseeing AI governance while the full Board monitors AI strategy.'

Otis assigns 'artificial intelligence (AI) governance' to the Audit Committee and states the committee oversees AI governance while the full Board monitors AI strategy. | contrast: Explicitly splits board-level AI strategy (Rating 1 pattern) from Audit's named AI governance duty.

PDF page 30 (page 21), Corporate Governance – Cybersecurity Risk Oversight

The proxy addresses emerging technologies including artificial intelligence within the reporting structure provided to the Audit Committee under its cybersecurity risk oversight mandate, but does not formally designate a standalone AI governance or AI risk oversight assignment to the committee. Under Cybersecurity Risk Oversight, the proxy states: "The Board has delegated to the Audit Committee the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, relevant internal and industry cybersecurity attacks, and updates on emerging technologies, including artificial intelligence."

AI surfaces only as CIO reporting content on 'emerging technologies, including artificial intelligence' under a cybersecurity mandate; no standalone AI oversight assignment to the committee. | contrast: Teaches the 2/3 line: AI named in briefing topics is not AI oversight assigned to Audit.