In a recent opinion, the Delaware Court of Chancery for the first time expressly held that corporate officers, like corporate directors, owe a duty of oversight. In defining the scope of the oversight duty at the officer level, the court held that (1) in application, the duty of officer oversight is “context-driven” such that some officers, like a CEO or Chief Compliance Officer, “will have company-wide oversight portfolios,” while “other officers generally [will] have a more constrained area of authority” although they may still have a duty to report up particularly egregious red flags outside their area of responsibility;^[1] and (2) oversight liability requires a showing of bad faith, where “[t]he officer must consciously fail to make a good faith effort to establish information systems, or the officer must consciously ignore red flags.”^[2]

The Decision

Company shareholders alleged that officers, like directors, should be held to a fiduciary duty of oversight, which requires fiduciaries to exercise good faith in both (i) establishing a system that generates sufficient information to carry out proper oversight and (ii) properly acting upon pertinent information that the system generates.^[3]

In sustaining plaintiffs’ breach of fiduciary duty claim, the court first discussed generally the history of the duty of oversight at the board level, noting that directors could be liable for a failure to act in the face of subjective awareness of red flags that indicated wrongdoing, and that the duty of oversight necessarily encompasses an obligation to construct information-gathering systems that will provide fiduciaries with sufficient information upon which to act.^[4]

The court then explained that, from a policy perspective, the duty of oversight for directors should apply equally—if not more so—to corporate officers. The decision observed that most corporations are managed “under the direction” of the board through officers who run the day-to-day operations of the business.^[5] This dynamic means that while oversight may remain the ultimate responsibility of the board, oversight is not the exclusive domain of the board, and officers often have a greater capacity to implement oversight decisions than the typical board director.^[6] The court also stressed that an officer’s duty to make a good faith effort to establish an appropriate information system is an important predicate to fulfilling the officer’s obligation to provide information to the board.^[7] Given this reality, the court explained that disclaiming any duty of oversight on the part of corporate officers also would impair the ability of directors to hold officers accountable for their oversight failures, including failures to alert the board of egregious issues.^[8]

The court, however, was careful to note that the scope of oversight duty for particular corporate officers is not necessarily as broad as it is for directors. Unlike directors, who are tasked with overseeing the entire corporation, many corporate officers are limited in their authority and have more confined areas of responsibility, which constrains their oversight ability.^[9] Nevertheless, the court cautioned that even officers with confined areas of responsibility are not free to turn a blind eye to misconduct simply because those concerns fall outside the ambit of their job description. The court explained that while the duty of officers to make a good faith effort to establish information systems and controls may apply only to their areas of responsibility, where such officers become aware of particularly egregious or “sufficiently prominent” red flags outside their areas, such as credible information that indicates the corporation is violating the law, then such officers have a duty “to address or report upward regarding what they see.”^[10]

Conclusion

In 2019, in Marchand v. Barnhill, the Delaware Supreme Court emphasized that directors of a Delaware corporation may not simply defer to management for risk oversight, but must make a good faith effort to put in place a reasonable system of monitoring and reporting about the corporation’s significant risks.^[11] This Court of Chancery opinion confirms, as a corollary, that the duty of oversight in a Delaware corporation is not the responsibility of directors alone. Delaware officers likewise should ensure that they have sufficient reporting systems in place that, at a minimum, encompass their corporate duties so that they can properly monitor their business lines and prevent against any potential legal violations. In addition, Delaware officers should be cognizant of and report on any “red flags” that surface within their corporation, even if such red flags are outside of their area of responsibility, and should report up any such issues so that they can be addressed by other appropriate officers and/or the board.