On November 6, 2006, the Delaware Supreme Court affirmed the dismissal of a derivative action against certain current and former directors of AmSouth. Stone v. Ritter, 911 A.2d 362 (Del. 2006). In doing so, the court articulated for the first time the standard for determining whether directors can be personally liable for failing to detect and eliminate the activities of employees that result in corporate liability. The court rejected the plaintiffs’ attempt to “equate a bad outcome with bad faith” and emphasized that the “test of liability — lack of good faith as evidenced by sustained or systemic failure of a director to exercise reasonable oversight — is quite high.”

In 2004, AmSouth and its subsidiary AmSouth Bank paid $40 million in fines and $10 million in civil penalties to resolve government investigations pertaining principally to the failure by bank employees to file “Suspicious Activity Reports” (“SARs”) as required by the federal Bank Secrecy Act and various anti-moneylaundering regulations. These fines were alleged to be the largest ever of their kind.

Two shareholders filed a derivative suit on behalf of AmSouth against fifteen of its current and former directors. They accused those directors of violating their fiduciary duties by failing to implement monitoring systems that would have enabled them to learn of the company’s legal problems before it was too late. In short, they alleged a classic Caremark claim. In re Caremark Int’l Deriv. Litig., 698 A.2d 959 (Del. Ch. 1996).

The defendants moved to dismiss on the grounds that the plaintiffs failed to make a demand on the board before initiating suit. The plaintiffs argued that demand was excused because the directors, who faced a “substantial likelihood of liability,” could not possibly have rendered an impartial decision on whether to pursue litigation. The Court of Chancery rejected this argument and dismissed the complaint for failure to make a demand.

On appeal, the Supreme Court affirmed. It held that the plaintiff’s allegations of failure of oversight were insufficient “for a court to conclude that a majority of the corporation’s board of directors [was] disqualified from considering demand that AmSouth bring suit against those responsible.” In analyzing plaintiffs’ oversight claims, the Supreme Court adopted Chancellor Allen’s analysis in Caremark, holding that a court would not impose personal liability unless: (i) “the directors utterly failed to implement any reporting or information system or controls”; or (ii) “having implemented such a system or controls, [they] consciously failed to monitor or oversee its operation thus disabling themselves from being informed of risks or problems requiring their attention.” In either case, “imposition of liability requires a showing that the directors knew that they were not discharging their fiduciary obligations.”

Turning to the facts, the court noted that there were no allegations that the AmSouth board knew or should have known that bank employees were breaking the law. Rather, the board “received and approved relevant policies and procedures, delegated to certain employees and departments the responsibility for filing SARs and monitoring compliance, and exercised oversight by relying on periodic reports from them.” In the absence of red flags indicating employee misconduct, no more was required.

The court concluded that good faith “must be measured by the directors’ actions to assure a reasonable information and reporting system exists and not by second-guessing after the occurrence of employee conduct that results in an unintended adverse outcome.”

While this reassuring message to directors is perhaps the most salient feature of Stone, another noteworthy aspect of the decision is its clarification of the duty of good faith. Delaware commentators had long speculated as to whether directors owed shareholders a duty of good faith that was in any meaningful sense separate from the duties of care and loyalty. The decision in Stone answered this question in the negative. The obligation to act in good faith “does not establish an independent fiduciary duty that stands on the same footing as the duties of care and loyalty.” Rather, the duty of good faith “is a subsidiary element . . . of the fundamental duty of loyalty.”

The moral of Stone is that directors can protect themselves from personal liability for failing to prevent employee misconduct by ensuring that their company has implemented a reasonable system for reporting critical information to the board. The Delaware Courts understand very well that a “bad outcome” does not equal “bad faith.”