The Caremark decision built a high wall for plaintiffs to scale in asserting a board’s failure to comply with duty of care and loyalty standards. A recent decision applied the Caremark standard in ruling for the plaintiff on a critical operational risk matter.
A landmark case before the Delaware courts in 1996, the Caremark decision, written by the Chancery Court of Delaware, clarifies the board’s duties in relation to its oversight activities. In that case, the shareholders of Caremark International Inc. brought a derivative action, alleging the directors breached their duty of care by failing to put in place adequate internal control systems. That failure allegedly enabled the company’s employees to commit criminal offenses, resulting in substantial fines and civil penalties amounting to over US$250 million.
In addressing a board’s responsibility, the court outlined what plaintiffs must prove when claiming that directors breached their duties. Specifically, plaintiffs would have to show that either: (1) the directors knew or (2) should have known that violations of law were occurring; and, in either event, (3) the directors took no steps in good faith to prevent or remedy that situation; and (4) such failure resulted in the losses alleged in the complaint.
In essence, the fundamental issue underlying a board oversight inquiry is “whether there was [a] good faith effort to be informed and exercise judgment.” Director liability for a breach of this duty may, “in theory, arise in two distinct [ways]. First, such liability may be said to follow from a board decision that results in a loss because that decision was ill-advised or ‘negligent.’ Second, liability to the corporation for a loss may be said to arise from an unconsidered failure of the board to act in circumstances in which due attention would, arguably, have prevented the loss.”
Recently, the Supreme Court of Delaware overturned and remanded a decision by the Chancery Court, ruling a plaintiff had indeed scaled the Caremark standard in his complaint. The case, Marchand v. Barnhill, et al., involved Blue Bell Creameries’ directors and officers. In 2015 the company recalled all of its ice cream products and shut down all production operations after the U.S. Food and Drug Administration and several state health agencies found evidence of listeria bacteria in its factories and products. The contamination resulted in the deaths of three people. As the company’s revenues dropped substantially, it fired or suspended more than half of its workforce and ceased paying distributions to its limited partners. Ultimately, it was fined by government authorities for poor safety policies and practises.
The plaintiffs in this case brought a complaint that the board breached its common law fiduciary duties. In ruling for the plaintiff, the court noted:
Directors have a duty to exercise oversight and to monitor the corporation’s operational viability, legal compliance, and financial performance. A board’s utter failure to attempt to assure a reasonable information and reporting system exists is an act of bad faith in breach of the duty of loyalty.
Evidence compelling the court to decide for the plaintiffs included the simplicity of the business model, the industry-specific risk of food safety, the lack of board oversight of food safety issues and the absence of protocols by which the board expected to be advised of developments in this area. It was concerning to the court that when “yellow and red flags about food safety were presented to management, there was no equivalent reporting to the board and the board was not presented with any material information about food safety” during the critical period leading up to the three deaths. In the court’s view, these facts created “a reasonable inference that the directors consciously failed to attempt to assure a reasonable information and reporting system exist[ed].”
The Caremark standard is burdensome for the plaintiffs’ bar to overcome. Indeed, it was stated in a footnote to the Marchand ruling that, under Delaware law, director liability based on the duty of oversight “is possibly the most difficult theory … upon which a plaintiff might hope to win a judgment.” Whether this decision opens the door for Delaware case law to evolve remains to be seen. In the meantime, directors should consider the following advice.
Never truncate the oversight process by merely listing risks — Align the board’s oversight with the company’s most significant risks, given its strategy and business model. Periodically listing risks and doing nothing else falls short of effective oversight. To target the board’s oversight on the big picture, prioritise the most critical risks and focus on them.
Delineate roles of the full board and standing committees — The complaint alleges that, despite the importance of food safety, the board had no committee overseeing it, no full board-level process to address it, and no protocol by which the board expected to be advised of developments relating to it. When delegating responsibilities to its committees, the full board should ensure the key risks are covered by the appropriate committee — whether it currently exists or has to be created and newly chartered — and that information flows are sufficient to apprise the full board of critical matters.
Allow time on the board agenda for risk oversight — Executives responsible for managing risk should be positioned to succeed with policies, processes, reporting and systems appropriate to the industry. Risk management issues should be discussed regularly.
Set risk escalation/monitoring protocols — In understanding who is responsible for the key risks, the broad strokes of the risk responses in place and the nature of issues arising, the board should ask appropriate questions to satisfy itself that mission-critical matters are escalated in a timely manner to its attention, especially those related to compliance.
Pay attention to company culture — Organisational culture and performance incentives came into play in this case because it was inexplicable to stakeholders that management did not inform the board of the matters in question. The board must have confidence management will act promptly to inform it when mission-critical issues of any nature arise. Setting specific and clear expectations of management and risk owners tied to mission-critical risks and including relevant topics at regularly scheduled meetings will help the board attain that confidence and nurture a culture of trust and open, timely communication about emerging problems.
Maintain minutes concerning critical risk matters — According to the court, “minutes from the board’s … meetings are bereft of reports on the listeria issues … [and] revealed no evidence that these were disclosed to the board.” These findings suggest an expectation that management will escalate mission-critical matters to the board on a timely basis, that the board will set protocols for such escalation, and that there will be evidence in the minutes that such matters were discussed by the board. It was troubling to the court that the board left the company’s response to the listeria outbreak to management instead of holding more frequent emergency board meetings to receive ongoing updates.
The Blue Bell Creameries case is based on unique facts dealing with a food safety and compliance matter. Nonetheless, the court’s decision is a wake-up call for boards to ensure that their risk oversight processes meet or exceed fiduciary standards and take into account the unique regulatory demands of the industry.
Questions for Boards
Following are suggested questions that boards of directors may want to consider, based on the risks inherent in the entity’s operations:
- Has the board assessed its oversight process to ensure that it considers appropriate risks and reflects current business realities? Is the board satisfied that risk monitoring and escalation protocols are up to date? Do directors have confidence management will escalate key issues in a timely manner, particularly those pertaining to compliance matters affecting the viability of the business?
- Is the board satisfied it is constructively engaged with management on risk matters? Is it satisfied an effective information and reporting system (e.g., people, processes, organisational structure, reporting and other infrastructure) is in place to inform it as it discharges its responsibilities?
How Protiviti Can Help
Protiviti assists boards and executive management with assessing the risks inherent in the enterprise’s strategy and business plans, both across the entity and at various operating units, and the capabilities for managing those risks.
We help organisations identify and prioritise the risks that can impair their reputation, brand image and business model viability, and lead to failure to execute the corporate strategy successfully.
In Re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996).
Jack L. Marchand II v. John W. Barnhill Jr., et al. and Blue Bell Creameries USA, Inc., Supreme Court of the State of Delaware, June 18, 2019, available here.
(Board Perspectives: Risk Oversight - Issue 118)