Table of Contents MANAGEMENT'S REPORT ON INTERNAL CONTROL OVER FINANCIAL REPORTING The management of CNA Financial Corporation (CNAF or the Company) is responsible for establishing and maintaining adequate internal control over financial reporting. CNAF's internal control system was designed to provide reasonable assurance to the Company's management, its Audit Committee and Board of Directors regarding the preparation and fair presentation of published financial statements. There are inherent limitations to the effectiveness of any internal control or system of control, however well designed, including the possibility of human error and the possible circumvention or overriding of such controls or systems. Moreover, because of changing conditions the reliability of internal controls may vary over time. As a result even effective internal controls can provide no more than reasonable assurance with respect to the accuracy and completeness of financial statements and their process of preparation. CNAF management assessed the effectiveness of the Company's internal control over financial reporting as of December 31, 2018. In making this assessment, it has used the criteria set forth by the 2013 Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control - Integrated Framework. Based on those criteria and our assessment we believe that, as of December 31, 2018, the Company's internal control over financial reporting was effective. CNAF's independent registered public accountant, Deloitte & Touche LLP, has issued an audit report on the Company's internal control over financial reporting. This report appears on page 131. CNA Financial Corporation Chicago, Illinois February 13, 2019 133