In a decision which should further reduce concerns about personal liability for directors, the Delaware Supreme Court has ruled in favor of directors accused of a bad faith failure to adequately supervise employees. The November 6 opinion in Stone v. Ritter expressly characterized itself as an application and elaboration upon the Court’s June opinion in Walt Disney, which absolved directors of personal liability for actions or failures to act without malevolent intent or a knowing disregard of responsibilities. The combined effect of the Disney and Stone decisions should be to reassure boards of directors that the risk of personal liability based on claims of bad faith will be remote for directors engaged in reasonable practices. The two decisions also should have favorable implications for independent directors defending against liability claims of improper board conduct in connection with financial restatements and deficient internal controls or for violations of law, such as the Foreign Corrupt Practices Act or campaign contribution law, committed by employees.

The case arose out of AmSouth’s payment of $50 million in penalties and fines to resolve governmental and regulatory investigations of the failure of AmSouth employees to comply with suspicious activity reporting and anti-money laundering regulations. Plaintiff stockholders filed the derivative action against AmSouth directors, seeking personal liability for the failure to exercise good faith oversight of employees’ compliance activities, without making a pre-suit demand on the AmSouth board to pursue the corporate claim against the directors. Plaintiffs claimed that the AmSouth board could not make a disinterested decision whether to pursue the claim because the directors faced a substantial likelihood of liability if the claims were pursued. The Chancery Court dismissed the derivative action, concluding that a demand on the AmSouth board would not have been futile. Chancellor Chandler found that the directors did not face a meaningful prospect of liability because they had no knowledge of inadequate internal controls or that the inadequacies would result in illegal activity and made no “conscious decision to take no action in the face of red flags.” Directors would not lose the protections of the business judgment rule simply because information was not reaching the board as the result of ineffective internal controls not yet known to be ineffective.

The Supreme Court used its review of the Chancery Court’s dismissal of the derivative suit as an opportunity to affirm and clarify existing law on directors’ oversight responsibilities and, in doing so, to discuss the place of the duty of good faith in the pantheon of fiduciary duties. Both this decision and the Disney decision are responses to the tactics of the plaintiffs’ bar to seek personal liability in cases where there are no conflicts of interests at the board level by recharacterizing claims of negligence or gross negligence as “bad faith”. Under Delaware statutory law, corporations may eliminate personal liability of directors for breaches of fiduciary duty other than breaches of the duty of loyalty or conduct not in good faith. As a result, breaches of the duty of care, the obligation of directors to inform themselves, even if resulting from gross negligence, are not the basis for personal liability. Traditionally, a breach of the duty of loyalty was thought to occur if a director pursued a personal or individual financial interest instead of corporate or stockholder interests. Consequently, absent a conflict of interest, the foundation for claims for personal liability for directors rested upon allegations of bad faith. Prior to the Disney decision, there was some uncertainty as to the type of misconduct which would qualify as bad faith. Disney established a high bar for claims of bad faith – either intentional misconduct or a conscious disregard of a known duty to act – and, thus, quelled fears that a seismic shift in the landscape of director liability was occurring. The Stone decision continues this affirmation of traditional Delaware doctrine.

Reviewing the case law on director liability for corporate loss predicated upon director ignorance of liability creating activities, the Supreme Court approved the standard from a 1996 Chancery Court opinion, In re Caremark Int’l Inc. Deriv. Litig., and relied upon one of its own 1963 opinions, Graham v. Allis – Chalmers Mfg. Co., that directors will not be liable for the illegal conduct of a corporation’s employees if they do not have actual knowledge of the conduct or a cause for suspicion that improper conduct is occurring unless there is “a sustained or systematic failure of the board to exercise oversight” (emphasis added). Absent red flags signaling cause for concern, “there is no duty upon the directors to install and operate a corporate system of espionage to ferret out wrongdoing.”

Applying this standard to the AmSouth situation, the Supreme Court found that the board had implemented a reasonable compliance program and reporting system, including the creation of a compliance department and a suspicious activity oversight committee and requirements for periodic reports to the board or board committees. Echoing the traditional statement of the business judgment rule’s protection of directors’ decisions, the Court concluded.

“Although there ultimately may have been failures by employees to report deficiencies to the Board, there is no basis for an oversight claim seeking to hold the directors personally liable for such failures by the employees . . .

With the benefit of hindsight, the plaintiff’s complaint seeks to equate a bad outcome with bad faith. The lacuna in the plaintiffs’ argument is a failure to recognize that the directors’ good faith exercise of oversight responsibility may not invariably prevent employees from violating criminal laws, or from causing the corporation to incur significant financial liability, or both…. In the absence of red flags, good faith in the context of oversight must be measured by the directors’ actions “to assure a reasonable information and reporting system exists” and not by second-guessing after the occurrence of employee conduct that results in an unintended adverse outcome.” (emphasis added).

Then the Court articulated the standard for liability for director failure to supervise:

“We hold that Caremark articulates the necessary conditions predicate for director oversight liability: (a) the directors utterly failed to implement any reporting or information system or controls; or (b) having implemented such a system or controls, consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention. In either case, imposition of liability requires a showing that the directors knew that they were not discharging their fiduciary obligations. Where directors fail to act in the face of a known duty to act, thereby demonstrating a conscious disregard for their responsibilities, they breach their duty of loyalty by failing to discharge that fiduciary obligation in good faith.”

Finding that the AmSouth board had satisfied its duty to be reasonably informed concerning the corporation by establishing information and reporting systems reasonably designed to provide the board with appropriate information, the directors could rely on those systems until they became aware of possible deficiencies in the systems. “Only the sustained or systematic failure of the board to exercise oversight … will establish the lack of good faith that is a necessary condition to liability.” Consequently, the Court held there was no bad faith.

In a discussion of fiduciary duties that likely will be of more interest to taxonomists and academics than to directors, the Court explored “doctrinal” issues of fiduciary duty. First, it stated that a failure to act in good faith is a necessary, but not sufficient, condition to personal liability. The failure to act in good faith may result in liability if it results in a violation of the duty of loyalty of which the duty of good faith is a “subsidiary element.” Although directors may be subject to a triad of duties, those of loyalty, care and good faith, the obligation to act in good faith is not “an independent fiduciary duty standing on the same footing as the duties of care and loyalty.” Violations of the duty of good faith may result indirectly in liability by resulting in a breach of the duty of loyalty. (The Court did not offer an example of a violation of the obligation to act in good faith not resulting in a violation of the duty of loyalty. Nor did it speculate on the anticipated practical consequences of the demotion in status of the good faith duty.) Adding to its somewhat metaphysical exposition, the Court then stated that the duty of loyalty has at least two components, the avoidance of financial or other conflicts of interest and the obligation to act in good faith, which are part of the director’s duty to act “in the good faith belief that her actions are in the corporation’s best interests.”

It seems unlikely that there will be any substantive implications to no longer characterizing directors’ duties as a triad but as a dyad (with the duty of loyalty having two components). Indeed, some waggish commentators may suggest that the anti-trinitarian/pro-binary views of the Court should ultimately result in a single duty of loyalty, the obligation to act in the best interests of the corporation, with three components: care, good faith, and loyalty (that is, the avoidance of conflicts). The effect of these distinctions without obvious difference may be that cases may be pleaded and argued slightly differently; but boardroom conduct remains subject to the same standards, with personal liability reserved for egregious deficiencies in director conduct.

The Stone decision is reassuring; however, it is not cause for complacency. The Court recognized that most of the decisions a corporation makes are not the subject of director attention. The test for liability in these cases should be “quite high” and liability for employee failures is “possibly the most difficult theory in corporation law upon which a plaintiff might hope to win a judgment”. The practical requirements of running a business means that directors must rely on reasonable reporting systems and, without bad faith, should not be exposed to liability. By reducing director fears of liability, the desirable policy consequences of this approach were clear to the Court:

“[A] demanding test of liability in the oversight context is probably beneficial to corporate shareholders as a class, as it is in the board decision context, since it makes board service by qualified persons more likely, while continuing to act as a stimulus to good faith performance of duty by such directors.”

However, in addition to the obligation to create a structure for information gathering, directors have a continuing responsibility to periodically assess the adequacy of their systems, investigate possible misconduct once it comes to their attention, to resolve actual instances of improper behavior, and to institute measures reasonably designed to prevent recurrences of misconduct.

Both this case and Disney attest to the continuing vitality of the business judgment rule: so long as the decision-making process of a board is adequate, even if not perfect, the Delaware courts will defer to the board’s decision. This extends not only to actions resulting from board deliberations but, even more importantly, to inaction if reasonable information and control systems do not alert the directors to the need for remedial measures.