Accountability for Flawed Corporate Culture

Corporate culture matters. A flawed culture can lead to disaster even when a company boasts an elaborate compliance program. Yet scholars and practitioners still know surprisingly little about what legal mechanisms can generate accountability for corporate culture gone wrong. 

In a recent article, we map the relevant legal tools onto a 2x2 framework: what type of liability (criminal vs. civil) and who is held liable (the entity vs. individual decision-makers). While most debates focus on criminal-law mechanisms targeting corporate entities, we explore corporate-law mechanisms that target the directors and officers who set the tone at the top.

Efforts to hold the company itself accountable for flawed culture (whether through criminal or civil liability) often fall short. One reason is basic economics: large companies can generally absorb monetary penalties as relatively small costs of doing business. Another reason is information asymmetries: regulators can promise leniency for companies that cultivate ethical culture, but they find it difficult as outsiders to assess the unwritten norms within large corporations. Regulators therefore typically resort to more easily observable indicia, such as whether the relevant company has a compliance program or certain policies in its employee handbook. Corporate insiders are aware of these dynamics, and so they too direct most of their attention and resources to the easily observable indicia of compliance rather than the hard-to-verify aspects of ethical culture. That way, focusing solely on the entity can lead to check-the-box, cosmetic compliance.

Overcoming a flawed culture requires continuous commitment from the company’s leaders to cultivate an environment where doing the right thing is prioritised over check-the-box compliance. Directors and officers shape corporate culture by providing economic incentives, determining who needs what type of information, and setting an example. Managers set sales targets and compensation for lower-level employees. Directors design executive pay packages, which can affect executives’ time horizons and their willingness to create ethical cultures. Directors and officers also determine how information flows inside the organization. Managers can make it clear that they do not want the details of, say, how employees are meeting sales goals. Finally, directors and officers affect the culture by example. Their behavior sends cues to lower-level employees about whether certain behavior is unacceptable, tolerated, or rewarded.

The question is how to hold directors and officers accountable. Holding them criminally liable for flawed culture would typically require prosecutors to prove beyond a reasonable doubt the mental state of the relevant decision-maker. This may be feasible in small or mid-sized corporations, where directors and officers tend to be involved in key aspects of the business and aware of or willfully blind to pervasive wrongdoing by others. In large corporations, by contrast, directors and officers are typically many steps removed from wrongdoing and have plausible deniability. Prosecuting them for not doing more to improve the corporate culture would be an uphill battle for any prosecutor.

This is where corporate law comes in. The board of directors is responsible for overseeing risk. A flawed culture puts the company’s critical assets—such as its reputation or high-end talent— at risk. Oversight of corporate-culture risk should, therefore, feature prominently on the board’s agenda. But it is far from clear that directors will be held personally liable for the harms a flawed culture caused their companies. To delineate when directors can be liable, our article examines the recent resurgence of Delaware’s oversight duty doctrine (often dubbed Caremark).

First, that duty now uses the ‘mission critical’ designation to hold directors and officers accountable for how they set information flows. Directors and officers can no longer use the ‘I didn't know’ gambit: Delaware courts insist that not being informed about central risks constitutes a breach of fiduciary duty. 

Second, the duty holds directors accountable for how they set incentives. Litigation aims to expose cosmetic compliance with the duty by revealing a disconnect between what directors and officers say and the incentives they give employees. In AmerisourceBergen¸ for example, the court scrutinised directors for adopting superficial measures in response to warnings that opioids were being stolen and diverted and reserved stronger steps as a bargaining chip in future settlements with regulators. 

Third, the oversight duty holds directors and officers accountable for how they set the tone and lead by example. Consider corporate law’s role in the #MeToo movement. While most companies responded quickly to the movement by writing new policies and sending all employees to training sessions, some companies continued to tolerate harassment by their leaders. In the 2023 McDonald's decision, a Delaware court held that a company’s chief people officer could be liable for not doing enough to root out a culture of rampant sexual misconduct. 

To be sure, it is far from certain that corporate law can fix flawed cultures, given that the oversight duty has at least three limitations. First, the standard for proving breach remains high: judges try to avoid hindsight bias and err on the side of underenforcement. Second, the ‘enforcers’ in these cases are shareholders and their attorneys, whose narrow incentives do not always align with social welfare (under certain conditions, shareholders can benefit from unethical corporate culture). Finally, the ‘targets’ in these cases are corporate directors, who may be too removed from the operations to prompt change in corporate culture.

In addition to these limitations, one must consider developments such as Delaware's Senate Bill 21 of March 2025. The bill restricted shareholders' inspection rights in ways that may limit outside shareholders' ability to hold corporate insiders accountable for how they set information flows, incentives, and norms. Such changes may reduce the ability of US-style private litigation to impose accountability for flawed culture. 

We, therefore, examine alternatives to private litigation, based on the experience of the UK and Australia, where shareholder litigation against the directors of public corporations is relatively rare. In the UK, conduits for accountability (of varying efficacy) include soft law in the form of corporate governance codes; director disqualification; entity criminal liability; and perhaps most significantly, reputational sanctions, which are given heft via the outsized influence of institutional investors. In Australia, accountability for flawed culture is predominantly based on public enforcement by the business conduct regulator, the Australian Securities and Investments Commission (ASIC). The Australian corporate law ecosystem includes other distinctive features that can pressure directors to oversee their company’s culture, such as the ‘two strikes’ rule in relation to executive pay (which provides institutional investors with considerable leverage vis-à-vis the board).

Our comparative analysis, nonetheless, reveals how difficult it is for any given legal approach to impose accountability for flawed culture, and how challenging it is for even the most committed directors to police internal norms. Today’s large corporations are astoundingly complex, and it is hard to know just how pervasive problems are or what causes them. A single legal mechanism probably cannot alone fix a flawed culture. 

Still, we highlight corporate law, not as a panacea, but rather as part of a host of admittedly imperfect mechanisms that together could, if designed properly, avert the next corporate debacle.

The authors’ paper, “Accountability For Flawed Corporate Culture,” forthcoming in The Journal of Corporation Law is available here.

Jennifer Hill is a Professor of Law at Monash University and a Research Member at ECGI. 

Roy Shapira is a Professor of Law at Reichman University and a Research Member at ECGI. 

A version of this post also appeared in Columbia Law School’s Blue Sky Blog, available here.