Directors’ Duties: The US Perspective

42.1Introduction

Directors are generally viewed as stewards of the corporation and fiduciaries of the corporation’s shareholders. Boards of directors are primarily responsible for overseeing the company, and in exercising these responsibilities, directors must discharge their fiduciary duties of care and loyalty and their obligation to act in good faith. Directors, however, confront increasing litigation risk and regulatory scrutiny in navigating their fiduciary duties and the demands of shareholders in the face of corporate compliance crises and independent investigations. In addition, regulators in the United States and around the world have become increasingly focused on the role of the board and its directors with respect to governance, financial reporting and reinforcing the commitment to a culture of compliance. In this chapter, we discuss the fiduciary duties owed by directors in the context of independent investigations, potential director liability for violations of those duties, and strategic considerations for directors to satisfy their fiduciary duties when faced with compliance crises.

42.2Directors’ fiduciary duties

In the United States, the fiduciary duties and responsibilities of members of boards of directors arise primarily out of state corporate law, both from state statutes and evolving case law (also known as common law).^[2] Fundamentally, directors owe fiduciary duties of care and loyalty to the corporation and are expected to carry out their obligations in good faith.^[3] These duties lie at the core of a director’s oversight and stewardship responsibilities to the corporation.

42.2.1Duty of care

The duty of care refers to the obligation of corporate directors to exercise the proper amount of care as they make business decisions on behalf of their corporation. Directors must ‘use that amount of care which ordinarily careful and prudent men would use in similar circumstances, [and] consider all material information reasonably available in making business decisions’.^[4] To satisfy their duty of care, therefore, directors must, among other things, be knowledgeable about the corporation, its business, its industry and relevant risks, including by regularly reviewing financial statements and inquiring into corporate affairs; remain informed about decisions faced by the board; and engage in meaningful consideration of the issues.^[5] If a director ‘feels that he has not had sufficient business experience to qualify him to perform the duties of a director, he should either acquire the knowledge by inquiry, or refuse to act’.^[6]

Director liability for a breach of the duty of care typically arises in two contexts: (1) ‘ill-advised’ or grossly negligent board decisions that result in a loss for the corporation; and (2) liability for a loss that arose from an ‘unconsidered failure of the board to act in circumstances in which due attention would, arguably, have prevented the loss’.^[7] In the seminal case of Smith v. Van Gorkom, the Delaware Supreme Court found that the directors of Trans Union Corporation had breached their duty of care by acting with gross negligence in failing to make an informed decision regarding the sale of the company.^[8] The court cited the fact that the board approved the sale without having reviewed a term sheet or any other documentation to support the adequacy of the sale price and that the board relied, without any basis, on the uninformed statements of a director regarding the proposed agreement.^[9]

Directors are only liable for breach of the duty of care if their conduct has amounted to ‘gross negligence’, meaning that they demonstrated a ‘reckless indifference to or a deliberate disregard of the whole body of stockholders or actions which are without the bounds of reason’.^[10] Courts have found that ‘directors’ actions need not achieve perfection to avoid liability’, and that directors do not breach a legal duty simply because they ‘failed to act as a model director might have acted’.^[11] In most cases, monetary damages are unavailable to plaintiffs alleging breach of duty of care, even if they can demonstrate gross negligence. This is because many states, in response to Van Gorkom,^[12] enacted statutes permitting corporations to eliminate or limit directors’ personal liability for monetary damages for breaches of their duty of care.^[13] Significantly, these state laws do not authorise corporations to eliminate or limit directors’ personal liability for breaches of their duty of loyalty or good faith obligations, and monetary damages remain available to plaintiffs for such breaches.^[14]

42.2.2Duty of loyalty

The duty of loyalty ‘mandates that the best interest of the corporation and its shareholders take precedence over any interest possessed by a director, officer or controlling shareholder and not shared by the stockholders generally’.^[15] Corporate directors ‘are not permitted to use their position of trust and confidence to further their private interests’.^[16]

As a ‘subsidiary element’ of the duty of loyalty, directors must carry out their duties in ‘good faith’.^[17] The obligation to act in good faith is not an independent fiduciary duty or direct basis for liability, but rather is at the core of the duty of loyalty – ‘a director cannot act loyally towards the corporation unless she acts in the good faith belief that her actions are in the corporation’s best interest’.^[18] A director fails to act in good faith where the director ‘intentionally acts with a purpose other than that of advancing the best interests of the corporation, where [the director] acts with the intent to violate applicable positive law, or where [the director] intentionally fails to act in the face of a known duty to act, demonstrating a conscious disregard for [his or her] duties’.^[19]

Courts have interpreted the duty of loyalty as giving rise to the duty to exercise oversight in the day-to-day business operations of the corporation. The Delaware Court of Chancery set forth the standard for directors’ obligation to oversee and monitor the corporation in In re Caremark International Inc Derivative Litigation, holding that directors have an affirmative duty to establish a reporting system and internal controls, and to monitor and oversee internal compliance activity.^[20] Directors must assure themselves that the system of internal controls is ‘reasonably designed’ to allow senior management and the board to reach ‘informed judgments concerning both the corporation’s compliance with law and its business performance’.^[21] Failure to do so, the court held, may ‘render a director liable for losses caused by non-compliance with applicable legal standards’.^[22]

Thus, while ‘directors’ good faith exercise of oversight responsibility may not invariably prevent employees from violating criminal laws, or from causing the corporation to incur significant financial liability or both’,^[23] directors are expected to take steps to implement reasonable reporting, information and compliance systems, and to address corporate misconduct of which they become aware.^[24]

42.2.3Oversight obligations under US securities laws

In addition to the standards articulated in Caremark and its progeny, the Sarbanes-Oxley Act of 2002 sets expectations for public company audit committees (and consequently the independent directors that serve on audit committees) with respect to their oversight of companies’ accounting, internal controls and auditing matters. These include oversight of the company’s independent auditors, review of audit reports and the establishment of procedures to address complaints regarding the company’s accounting and financial reporting.^[25] Audit committees may also hire independent counsel to assist them in fulfilling their responsibilities, including in independent audit committee investigations and compliance reviews.^[26]

42.3Liability for breach of fiduciary duties

42.3.1Caremark claims in private civil actions

Directors may be subject to civil action in their personal capacity by shareholders of the corporation, both directly and in derivative suits on behalf of the corporation, for alleged breaches of their fiduciary duties. Courts make liability determinations on a director-by-director basis, rather than on the basis of the conduct of the board as a whole.^[27] In most US states, the remedy for breach of a fiduciary duty can be ‘[a]ny form of equitable and monetary relief’^[28] that the court finds ‘appropriate’.^[29]

Caremark established the standard of liability for alleged breaches of directors’ duty of oversight, holding that ‘only a sustained or systemic failure of the board to exercise oversight – such as an utter failure to attempt to assure a reasonable information and reporting system exists – will establish the lack of good faith that is a necessary condition to liability’.^[30] Caremark, therefore, ‘articulates a standard for liability for failures of oversight that requires a showing that the directors breached their duty of loyalty by failing to attend to their duties in good faith’.^[31] Liability is premised on plaintiffs’ demonstration that ‘the directors were conscious of the fact that they were not doing their jobs’.^[32]

In Stone v. Ritter, the Delaware Supreme Court affirmed the standard for oversight liability articulated in Caremark^[33] and held that a Caremark claim for director oversight liability requires the following conditions predicate: (1) that the directors ‘utterly failed to implement any reporting or information system or controls’; or (2) that the directors, ‘having implemented such a system or controls, consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention’.^[34] In either instance, directors can only be liable if plaintiffs demonstrate that they knowingly violated their fiduciary obligations.^[35]

While Caremark and Stone set a high standard for establishing liability for breach of oversight obligations, board processes and decision-making nonetheless can result in director liability. In Wells Fargo & Co Shareholder Derivative Litigation, for example, the plaintiffs alleged that the defendant directors ‘knew or consciously disregarded’ that Wells Fargo employees were fraudulently creating millions of deposit and credit card accounts for customers as part of ‘cross-selling’ activities.^[36] In denying Wells Fargo’s motion to dismiss, the court relied on allegations that the board had been informed of multiple ‘red flags’ of improper conduct, including alleged communications between employees and board members regarding the fraudulent activity, several related lawsuits, news reports, investigations by government agencies, employee terminations allegedly aimed at silencing whistleblowers, and emphasis on the importance of cross-selling practices in the bank’s financial reports.^[37] The court found that the numerous red flags alleged ‘collectively supported an inference that a majority of the Director Defendants consciously disregarded their fiduciary duties despite knowledge regarding widespread illegal account-creation activities, and that there is a substantial likelihood of director oversight liability’.^[38]

42.3.2The business judgment rule

The ‘business judgment rule’ is a standard of judicial review that protects directors from personal civil liability for their decisions as long as the decision was independent, informed, made in good faith, with due care and with the honest belief that the action taken was in the company’s best interest.^[39] The business judgment rule presumes that ‘in making a business decision the directors of a corporation acted on an informed basis, . . . and in the honest belief that the action taken was in the best interests of the company [and its shareholders]’.^[40] Therefore, the business judgment rule presupposes that directors have complied with their duty of loyalty to the corporation. In the absence of evidence to the contrary, the board’s ‘decision will be upheld unless it cannot be attributed to any rational business purpose’.^[41] If plaintiffs fail to rebut the presumption, they will not be entitled to any remedy, unless the transaction constitutes corporate waste.^[42]

Plaintiffs may rebut the presumption by showing that the directors breached one of their fiduciary duties of loyalty or care in connection with the transaction at issue.^[43] In that case, the burden shifts to the director defendants to demonstrate that the challenged transaction was ‘entirely fair to the corporation and its shareholders’.^[44]

Even if directors have exercised their business judgment, the protections of the business judgment rule will not apply if the directors have made an ‘unintelligent or unadvised judgment’.^[45] Furthermore, the protections of the business judgment rule will not apply in the event of director inaction, unless the directors made a conscious decision not to act.^[46] For this reason, it is critical that boards and directors work with management to develop a process that (1) enables the board to obtain the information it needs in order to evaluate and decide on a course of action, (2) facilitates careful consideration and debate at the board level consistent with fiduciary obligations and (3) results in a record that demonstrates the board’s execution of its responsibilities.

42.3.3Regulatory enforcement actions

In addition to being named in securities class action or derivative suits, public company directors can be subjected to regulatory investigations and enforcement actions under US securities laws. Indeed, directors increasingly face all three proceedings – securities class actions, derivative litigation and enforcement proceedings – in parallel. The Securities Exchange Act of 1934 (the Exchange Act), as amended by the Dodd-Frank Wall Street Reform and Consumer Protection Act, authorises the US Securities and Exchange Commission (SEC) to institute administrative and civil proceedings and to seek monetary and injunctive relief from directors for their violations of the securities laws.^[47] The SEC also can request that a court permanently or temporarily bar an individual from serving as a public company officer or director for violations of the anti-fraud provisions of the US securities laws.^[48] In addition, the US Department of Justice (DOJ) can criminally prosecute directors for ‘willful’ or ‘knowing’ violations^[49] of the US securities laws or conspiracy to commit such violations.^[50]

There are clear and direct consequences for companies when oversight is found lacking. In evaluating corporate compliance programmes, regulators focus on the types of information that the board has examined in its exercise of oversight in the area in which misconduct occurred. US regulators have been vocal in commenting on the roles and responsibilities of directors, and have been critical of boards of directors that, in their view, failed to exercise reasonable oversight.^[51] The SEC and DOJ have been particularly outspoken with respect to financial reporting and Foreign Corrupt Practices Act (FCPA) matters. In the settlement made with Sociedad Química y Minera de Chile (SQM) for internal controls and books-and-records violations under the FCPA in 2017, for instance, the DOJ explicitly noted that although SQM’s board had been briefed on certain internal controls failures flagged by internal audit, ‘no adequate changes were made to SQM’s internal accounting controls’.^[52]

Of particular relevance to public company directors, Section 20(a) of the Exchange Act provides that every person who indirectly or directly controls another person found liable for a securities violation under the Exchange Act is liable for that same conduct.^[53] For ‘control person’ liability to attach, the majority of US circuit courts require only that the director exercised control over the general operations of the business that included the violation and could exercise control over the transaction or activity giving rise to it.^[54] Section 20(a) provides an affirmative defence to a director who ‘acted in good faith’ and ‘did not directly or indirectly induce’ the act constituting the violation.^[55]

For example, in 2009, the SEC filed a settled enforcement action against Nature’s Sunshine Products, its chief executive officer (CEO) and board member, and its chief financial officer (CFO), alleging that the CEO/director and CFO, in their capacities as control persons under Section 20(a), violated the books-and-records and internal controls provisions of the FCPA.^[56] Notably, the SEC did not allege that these individuals had direct knowledge of, or participated in, the underlying improper payments or accounting failures, but rather that the executives failed to identify certain red flags that would have alerted them to the improper payments and failed to perform their corporate duties adequately and in good faith.^[57]

42.4Duty of oversight in investigations

Directors’ duty of oversight, and their obligation to act in good faith, are implicated at multiple stages of a corporate investigation – from the decision whether to initiate an investigation, to the decision whether to self-disclose potential wrongdoing to regulators, to decisions authorising negotiation or settlement with regulators. At each stage, directors will need to ask appropriate questions, obtain sufficient information and engage in meaningful consideration to satisfy themselves that the decision is in the best interests of the corporation. Increasingly, independent auditors threaten to initiate reporting procedures under Section 10A of the Exchange Act absent an independent investigation into suspected wrongdoing.^[58] In addition, directors must consider that, in the event the corporation is prosecuted for misconduct, the board’s execution of its duty of oversight will be considered by prosecutors and the court in sentencing the corporation.^[59]

Moreover, directors play a central role in the remediation process that often results from an investigation. Directors must oversee the process of enhancing or establishing internal controls for financial reporting or other material aspects of the company’s compliance infrastructure that are found lacking. This often requires directors to adapt to, and sometimes reassess, their view of company processes and the conduct of management based on facts developed during an investigation. At the same time, directors must interact with external auditors in connection with the issuance of an audit opinion and oversee a financial reporting process that contemplates such changes.

Often, director liability for breach of fiduciary duty arises from the alleged failure of the board to respond to red flags of corporate misconduct. When faced with actual knowledge or red flags of wrongdoing, directors must take good-faith steps to conduct reasonable inquiry to understand the cause and scope of the issue, and to implement appropriate remediation, as necessary. Directors may be subject to oversight liability on the basis of inaction, wilful ignorance or failure to investigate and address possible misconduct in good faith.

As reflected in Wells Fargo, there are numerous ways in which a director may be considered to be on notice of possible wrongdoing at the corporation.^[60] These include internal and external audit reports, whistleblower complaints, consumer complaints, news reports, regulatory investigations and related civil litigation claims. The case law emphasises the need for directors to respond to repeated signs of misconduct, as courts and regulators may interpret the absence of a response as a conscious disregard of the directors’ duty of oversight. As the Delaware Court of Chancery explained, ‘a Caremark plaintiff can plead that “the directors were conscious of the fact that they were not doing their jobs,” and that they ignored “red flags” indicating misconduct in defiance of their duties. A claim that an audit committee or board had notice of serious misconduct and simply failed to investigate . . . would survive a motion to dismiss, even if the committee or board was well constituted and was otherwise functioning’.^[61]

Importantly, by virtue of the audit committee’s oversight of accounting, internal controls and auditing matters, the independent directors naturally receive information regarding the corporation’s internal controls and compliance system that implicates their duty of oversight. This level of knowledge could subject the independent directors to increased risk of regulatory scrutiny and private shareholder action if they fail to respond to internal control deficiencies and red flags of potential misconduct that are reported to them.

42.5Strategic considerations for directors

While there is no effective one-size-fits-all approach to satisfaction of fiduciary duties, directors can take certain steps to meet the ongoing challenges and expectations of regulators and shareholders. Implementation of these strategies may not eliminate the risk of director liability, but they will demonstrate directors’ adherence to the core principles of their fiduciary duties.

• Risk-based compliance framework: Directors should require management to demonstrate that the company has adopted an effective risk-based compliance framework to identify high-risk compliance issues and prioritise resources accordingly.
• Remaining informed: Directors should implement a formal process that facilitates communications between the board and management regarding the compliance framework and business performance. Directors should remain informed about ongoing and acute risks, as well as about the broader business environment and industries in which the company is operating.
• Independent investigations and compliance crises: Directors should establish a crisis management strategy and investigative protocol before such measures are needed, including a framework for the board’s response if an independent investigation is necessary. This may include proactive delegation of oversight responsibility to the company’s audit committee or a special litigation or investigation committee. This also may include an annual presentation from management, including the legal and compliance functions, as to the company’s readiness if a government inquiry, whistleblower complaint or other occurrence gives rise to consideration of an independent investigation.
• Training: Directors should have sufficient training not only to be familiar with principles of corporate governance and the corporation’s business, but also to provide directors a basis from which they can ask questions regarding compliance risks and analyse responses consistent with their oversight responsibilities.
• Overseeing the external auditor relationship: The audit committee owns the relationship with the external auditor. Too often, directors limit their interaction with the external auditor to engagement of the auditor and a quarterly discussion in advance of the issuance of a filing. The better course is for independent directors, particularly those on the audit committee, to establish a deeper relationship that provides for a foundation of trust and familiarity from which both parties can act when an unexpected problem arises.
• Making the record: A documented approach to corporate governance and adherence to fiduciary duties can mitigate directors’ risks in the event of litigation or an enforcement proceeding. Real-time documentation, including through minutes of audit committee or special investigative committee meetings, are critical evidence of directors’ fulfilment of their oversight obligations in the context of a board committee’s evaluation of issues involving investigations and compliance crises.

Effective board processes enable directors to execute their responsibilities in accordance with applicable fiduciary duties and the expectations of regulators and the market. Adherence to sound principles of corporate governance protects directors and promotes tangible benefits to the company in the form of:

• heightened investor confidence and corporate reputation;
• increased efficiency and avoidance of costly investigation due to early issue spotting and risk mitigation; and
• higher levels of customer and employee retention.

Footnotes