Operational Risk and the New Caremark Liability for Boards of Directors

In a new article, we identify a subtle and unrecognized shift in the In re Caremark Int’l Inc. Derivative Litig (1996) 698 A.2d 959 (‘Caremark’) cases that changes how the Caremark doctrine actually works. Caremark claims, which accuse corporate directors of breaching the fiduciary duty of loyalty by not making a good faith effort to oversee their company’s operations, have traditionally focused on financial mismanagement and regulatory violations. Yet recent Caremark claims have arisen from sudden and physical accidents that cause loss of human life or major damage to the environment. These accidents have included ice cream contamination, oil pipeline explosions that irreparably damaged the environment, and two airplane accidents that killed hundreds of people.

Courts are in some cases allowing shareholders to prove that board misconduct directly contributed to these sorts of catastrophes, making directors responsible for not only the financial affairs of a firm, but also the human, physical, and life-altering consequences of their actions. We describe this responsibility, and the trend that underlies it, with a term rarely used in Caremark discourse: operational risk. Operational risk is the risk of loss arising from failed systems, processes, or practices. Distinct from banking and financial risk, operational risk implicates human error, inadequate procedures, and system and technological breakdowns. Operational risk also encompasses failure to meet regulatory requirements in company processes or to manage external factors such as natural disasters.

The new Caremark liability is placing operational risk at center stage, and our article identifies the emerging trend of operational risk, discusses its specific doctrinal contours, and presents implications for the emergence of such risk to board governance. We first show that, while Caremark claims have continued to achieve little success, subtle and important changes have emerged that show an evolution in Caremark doctrine.

We then explore the facts of recent and relevant Caremark cases that have survived a defendant’s motion to dismiss and tease out commonalities between the factually disparate cases in order to assess the emerging emphasis on operational risk. First, the cases all implicate some form of operational misconduct. At their heart is mismanagement of a physical risk based upon deficient internal processes, people, or systems. Second, the cases involve a failure to properly handle a critical compliance risk of the enterprise. Third, the companies involved are all heavily regulated. Fourth, the companies involved were under extreme financial pressure. One firm had bet its existence on a single product, and another was implementing an aggressive plan of expansion when a costly accident occurred. The third organization faced the opposite extreme, a prolonged absence of competitive threats that generated complacency allowing basic compliance functions to erode.

In light of this new reality of board exposure to liability for operational risk, we present the new demands on boards of operational governance. First, directors cannot consider legal compliance alone sufficient to protect them from Caremark liability. Limiting compliance to what the law requires leaves exposure to operational risk due to inevitable mistakes by board members and management as well as changes in the regulatory environment.

Second, directors must learn how to predict the future impact of major decisions. Operational risks cannot be assessed solely under current law but also under what a judge might consider the relevant standards tomorrow. No board wants its actions to become the factual basis for a judicial opinion that pushes corporate governance into novel domains.

Third, boards must carefully attend to unusual and unlikely tail risks, which are particularly common in companies whose businesses involve physical risks. Even at companies where the chances of a catastrophic accident are small, boards must manage such risks to avoid a major scandal for the firm and liability under Caremark doctrine.

Finally, boards will need to stay informed about changing social trends. Operational risks are often societal risks. Unlike their often difficult-to-comprehend financial counterparts, physical catastrophes are highly visible to a public already suspicious of corporate behavior. Neither judges nor juries hear a dispute in a vacuum. A shocking tragedy can prompt a visceral demand for full and complete justice regardless of what legal experts think the rules require. Boards must consider the societal perspective when managing operational risk.

The legal basis for filing Caremark claims is also changing gradually. A few cases have survived the once-nearly insurmountable motion to dismiss, signaling to directors and others that proving a Caremark claim is possible. The nature and scope of these recent decisions do not appear to be random, and the trend has clear implications for boards of directors. Boards may have been inattentive to such risks, especially when they appear relatively minor or involve mundane matters. That inattention must now change. The ideal result will be better board decisions, fewer physical accidents by companies, and best practices that benefit all stakeholders.

Robert C. Bird is a Professor of Business Law at the University of Connecticut School of Business.

Julie Manning Magid is a Professor of Business Law at Indiana University’s Kelley School of Business.

A version of this post was first published on the CLS Blue Sky blog and can be accessed here.