Earlier this month, the Delaware Court of Chancery denied defendant directors’ motion to dismiss a duty-of-oversight claim brought by plaintiff shareholders in In re Clovis Oncology, Inc. Derivative Litigation.[1] This decision, together with a similar June 2019 ruling by the Delaware Supreme Court in Marchand v. Barnhill[2], confirms the prospect of liability for corporate directors who do not work hard enough to establish and monitor effective risk-management procedures at their companies. The two rulings therefore deliver timely lessons regarding directors’ duty of oversight under Delaware’s Caremark standard. The rulings are especially important for directors of companies whose business hinges on the success of a “mission critical” product in a regulated industry.
DIRECTORS’ DUTY OF OVERSIGHT
The Caremark Basics
The duty of oversight is a component of the Delaware fiduciary duty of loyalty that directors owe to the corporation and its shareholders. A director found to have breached the duty of oversight therefore may be exposed to personal liability for resultant shareholder losses.
The seminal Delaware duty-of-oversight case is In re Caremark Int’l Inc. Deriv. Litig.[3] Caremark and its progeny establish directors’ duty to “exercise a good faith judgment that the corporation’s information and reporting is in concept and design adequate to assure the board that appropriate information will come to its attention in a timely manner as a matter of ordinary operations.”[4] In other words, the board needs to: (i) institute a system of management information reporting and controls designed to flag for the board any potential problems with the company’s operational viability, legal compliance and financial performance; and (ii) ensure that the system operates as intended, by making directors aware of matters requiring their attention.[5]
Duty-of-Oversight Claims Are Traditionally Difficult to Assert
Historically it has been hard for shareholder plaintiffs to advance Caremark claims beyond the motion-to-dismiss stage. The impediment is the need to plead facts supporting an inference that a board’s alleged failure to establish or monitor a management reporting system reflects “bad faith”—not merely negligence or even gross negligence. This standard traditionally has been exceptionally challenging to satisfy under the Caremark framework, in which bad faith is evidenced only where directors “utterly fail” to implement any system of reporting and controls; or, having implemented such a system, “consciously” ignore the red flags it produces.[6]
TWO RECENT DELAWARE DECISIONS HAVE ALLOWED DUTY-OF-OVERSIGHT CLAIMS TO GO FORWARD
In light of the above, the recent decisions in Marchand and Clovis stand out for having permitted plaintiffs’ duty-of-oversight claims to survive defendant directors’ motions to dismiss.
Marchand: Tainted Ice Cream
Marchand concerned the listeria contamination in 2015 of ice cream made and sold by Blue Bell Creameries. The tainted ice cream killed three consumers, prompting the company to conduct a mass recall and suspend manufacturing operations. To cope with the ensuing cash crisis, Blue Bell entered into a highly dilutive private equity financing. Plaintiff shareholders sought to recover their losses, in part by derivatively bringing a Caremark claim asserting that Blue Bell’s directors had failed to oversee the food-safety aspects of the company’s operations. The Court of Chancery ruled for defendant directors upon their motion to dismiss. The Delaware Supreme Court reversed on appeal, finding that plaintiffs’ pleadings supported an inference that the board failed to implement any “board-level system of monitoring or reporting on food safety,” as a result of which the directors remained ignorant of the listeria problem until it was too late.[7]
The Supreme Court noted that because Blue Bell’s only product was ice cream, food safety was “one of Blue Bell’s central compliance issues.”[8] This recognition prompted the court to pay attention to two allegations by plaintiffs. First, the complaint alleged that Blue Bell executives had learned of relevant problems during the years preceding the listeria outbreak; inspectors from the FDA and state health departments had reported to management on several potential food safety issues at the company’s facilities, and listeria tests commissioned by management had come back positive.
Second, against that background of management awareness of food safety red flags, the complaint alleged that the board’s minutes and other records contained no evidence that the directors had established a board-level system to monitor food safety issues and to require management to report potential problems up to the board. The court found that plaintiffs fairly alleged the absence of any: (i) board committee charged with monitoring food safety; (ii) regular schedule for the board to discuss food safety compliance; (iii) processes or protocols requiring management to keep the board apprised of food safety compliance practices, risks or reports; and (iv) expectation that management would bring food safety compliance red flags to the board’s attention.[9]
Clovis: A Failed Drug Candidate
Clovis Oncology, Inc. was a small biopharmaceutical company. During the relevant 2014-15 timeframe, Clovis had no products on the market but had one especially promising cancer treatment drug (Rociletinib, or “Roci”) undergoing a clinical trial. Management expected Roci to generate large profits if Clovis could secure FDA approval for the drug and bring it to market ahead of a competing treatment being developed by AstraZeneca. Given the centrality of Roci to Clovis’s business prospects, the court referred to Roci as the company’s “mission critical product.”[10]
Roci’s initial clinical results were encouraging, but later trial data revealed that the drug was unlikely to gain FDA approval. When it ultimately became clear to investors in late 2015 that the FDA would not approve Roci, Clovis’s share price dropped 70%. The plaintiff shareholders sued derivatively to recover their losses via a Caremark claim, alleging that the Clovis directors had breached their fiduciary duty by failing to oversee the integrity of the Roci clinical trial and then allowing management to mislead the public about the drug’s efficacy while the trial was ongoing. The court ruled in favor of plaintiffs on defendants’ motion to dismiss, finding that if the pled facts were true, the Clovis board had “ignored red flags that [management] was not adhering to the clinical trial protocols, thereby placing FDA approval of the drug in jeopardy”; and then, with “the trial’s skewed results in hand, . . . [had] allowed the Company to deceive regulators and the market regarding the drug’s efficacy” prior to the FDA identifying the flawed trial data and rejecting Roci’s candidacy for approval.[11]
The court made a point of noting that Clovis—like the ice cream manufacturer Blue Bell—was a “monoline company operat[ing] in a highly regulated industry,” which made especially important the board’s duty to establish and monitor a viable management oversight system.[12] In this context, the court related plaintiffs’ allegation that the board stood idly by when it learned that management was knowingly departing from clinical protocols by miscalculating Roci’s objective response rate (ORR) for patients in the trial, and was publicizing the inaccurate ORR data in a way that misled investors about Roci’s potential for success.[13] The court further credited plaintiffs’ allegations that the board knew the FDA likely would not approve Roci on the basis of the correct ORR data it eventually would demand, and knew of other clinical protocol violations and patient side effects that dimmed the prospect of FDA approval, but did nothing to tone down management’s encouraging public statements about Roci’s progress.
An interesting feature of Clovis was the court’s recognition that the board did have a committee charged with oversight of FDA compliance and related matters, and that each board meeting did feature a detailed review of Roci’s clinical trial status. Accordingly—unlike in Marchand—the court doubted that plaintiffs could establish the lack of a reporting and controls system as the basis for a duty-of-oversight claim. But the court was more sympathetic to plaintiffs’ pleading that the board had failed to monitor the output of the reporting and controls system it had established—the second possible way for a board to breach its duty of oversight. For example, in recounting the board’s failure to respond to evidence that management was not respecting accepted clinical protocols and was misleading investors about Roci’s efficacy, the court described the directors as proceeding “[w]ith hands on their ears to muffle the alarms.” In discussing the board’s alleged unresponsiveness to clinical- and disclosure-related red flags, the court emphasized that the Clovis board was comprised largely of pharmaceutical industry experts who could be presumed to understand the ORR concept, know the proper ORR reporting protocols and anticipate how investors would react to apparently positive ORR data.[14]
TAKEAWAYS FOR DIRECTORS
- The duty of oversight is alive and well in Delaware. It is true that plaintiffs historically have found it difficult to bring duty-of-oversight claims, due to the challenge of pleading facts implying directors’ bad faith. But the willingness of the Delaware courts to allow two Caremark claims to survive in recent months signals that the duty of oversight remains a vital fiduciary duty concept. A board that can be portrayed as failing to implement and monitor a reasonable reporting and controls system is at risk of liability, or at least of having to defend itself in ongoing legal proceedings after losing on a motion to dismiss.
- A board must both implement a reporting and controls system and monitor its functioning. One way for a board to breach its duty of oversight is by failing to set up a system of management reporting and controls. That was the problem with the Blue Bell board. However, creating a reporting and controls system is not enough. To meet their duty of oversight, directors also must monitor the system. This means ensuring that relevant information in fact is being surfaced to the board as intended, and not ignoring any red flag information the system delivers to the board. The court in Clovis did not deny that the board had created a management reporting system—the trouble was the directors’ failure to act on the information it brought to their attention.
- Oversight is in the spotlight when the company has a “mission critical” product and operates in a heavily regulated industry. Blue Bell and Clovis both depended on the success of a single product, and both operated under significant federal and/or state regulation. The board of a company in this situation may be subject to special scrutiny of its oversight performance, in the sense that dependence on a single product subject to a regulatory scheme creates compliance risks beyond the general business risks a typical board must monitor. As the Clovis court warned, “when a company operates in an environment where externally imposed regulations govern its ‘mission critical’ operations, the board’s oversight function must be more rigorously exercised.”[15]
- Industry expertise is valuable for a board, but it may increase oversight expectations. Industry expertise on the board is clearly a good thing from a risk-monitoring perspective, especially for companies with complex business models, cutting-edge products or a high degree of regulation. From a Caremark point of view, however, the presence of expert directors may be a double-edged sword. The success of a duty-of-oversight claim depends on a showing that the directors acted in bad faith, i.e., knew they were ignoring their fiduciary duties in failing to provide oversight. A court may be more receptive to an allegation of bad faith on the part of directors who are industry experts, in that the court may perceive experts as especially knowledgeable about what potential problems to look for and particularly equipped to recognize and respond to red flags. The Clovis court tellingly devoted several pages to detailing the pharmaceutical industry experience of nearly every director.
- The board should catalogue the company’s key risks and make sure the management reporting system produces actionable board-level information about each one. The current governance environment increases the expectation that directors will be proactive in understanding and acting on the company’s key business, compliance and operational risks. Directors must demand a regular flow of risk information from senior management, rather than trusting that employee-level compliance programs will keep problems at bay. Boards may wish to consider whether certain risks merit attention at a committee level, and should not hesitate to seek input from outside experts if the situation warrants. Boards also may wish to assess whether they would benefit from adding one or more directors with specific industry or regulatory experience.
- Boards should document the existence and functioning of their reporting and control systems. A board that has established and is monitoring a reasonable system of reporting and controls should take care to get credit for that fact via careful documentation. This means properly documenting the system at its implementation phase; keeping records of any adjustments to the system; and ensuring that board minutes reflect the board’s receipt of information from management and the directors’ response to that information.
ENDNOTES
[1] 2019 Del. Ch. LEXIS 1293 (Del. Ch. Oct. 1, 2019).
[2] 212 A.3d 805 (Del. 2019).
[3] 698 A.2d 959 (Del. Ch. 1996). Shareholder derivative suits alleging a board’s failure of oversight are sometimes called “Caremark claims.”
[4] Id. at 970.
[5] See Stone v. Ritter, 911 A.2d 362 (Del. 2006).
[6] Id. at 370.
[7] Marchand, 212 A.3d at 824.
[8] Id. at 809.
[9] Id. at 813.
[10] Clovis, 2019 Del. Ch. LEXIS 1293 at *31.
[11] Id. at *3.
[12] Id.
[13] The court’s decision explains that ORR measures the percentage of patients who experience meaningful tumor shrinkage when treated with a cancer drug, and is thus a “success-defining metric” in a clinical trial. Plaintiffs alleged that Clovis management was improperly including “unconfirmed” patient responses in its ORR calculations, whereas the rules of the well-known clinical trial protocol adopted by Clovis (known as RECIST) required ORR to include only “confirmed” patient responses.
[14] Clovis, 2019 Del. Ch. LEXIS 1293 at *31.
[15] Id. at *28, citing Marchand, 212 A.3d at 824.
This post comes to us from Richards Kibbe & Orbe. It is based on the firm’s memorandum, “DIRECTORS’ DUTY OF OVERSIGHT FOLLOWING RECENT DELAWARE DECISIONS INTERPRETING CAREMARK,” dated October 15, 2019.