Corporate culture matters. A flawed culture can lead to disaster even when a company boasts an elaborate compliance program. Yet scholars and practitioners still know surprisingly little about what legal mechanisms can generate accountability for corporate culture gone wrong.

In a recent article, we map the relevant legal tools onto a framework: what type of liability (criminal vs. civil) and who is held liable (the entity vs. individual decision-makers). While most debates focus on criminal-law mechanisms targeting corporate entities, we explore corporate-law mechanisms that target the directors and officers who set the tone at the top.

Efforts to hold the company itself accountable for flawed culture (whether through criminal or civil liability) often fall short. One reason is basic economics: Large companies can generally absorb monetary penalties as relatively small costs of doing business. Another reason is information asymmetries: Regulators can promise leniency for companies that cultivate ethical culture, but they find it difficult as outsiders to assess the unwritten norms within large corporations. Regulators therefore typically resort to more easily observable indicia, such as whether the relevant company has a compliance program or certain policies in its employee handbook. Corporate insiders are aware of these dynamics, and so they too direct most of their attention and resources to the easily observable indicia of compliance rather than the hard-to-verify aspects of ethical culture. That way, focusing solely on the entity can lead to check-the-box, cosmetic compliance.

Overcoming a flawed culture requires continuous commitment from the company’s leaders to cultivate an environment that gives doing the right thing priority over checking-the-box compliance. Directors and officers shape corporate culture by providing economic incentives, determining who needs what type of information, and setting an example. Managers set sales targets and compensation for lower-level employees. Directors design executive pay packages, which can affect how far ahead executives are willing to look and their inclination to invest in creating ethical cultures. Directors and officers also determine how information flows inside the organization. Managers can make it clear that they do not want the details of, say,  how employees are meeting sales goals. Finally, directors and officers affect the culture by example. Their behavior sends cues to lower-level employees about whether certain behavior is unacceptable, tolerated, or rewarded.

The question is how to hold these directors and officers accountable. Holding them criminally liable for flawed culture would typically require prosecutors to prove beyond a reasonable doubt the mental state of the relevant decision-maker. This may be feasible in small or mid-sized corporations, where directors and officers tend to be involved in key aspects of the business and aware of or willfully blind to pervasive wrongdoing by others. In large corporations, by contrast, directors and officers are typically many steps removed from wrongdoing and have plausible deniability. Prosecuting them for not doing more to improve the corporate culture would be an uphill battle for any prosecutor.

This is where corporate law comes in. The board of directors is responsible for overseeing risk. A flawed culture puts the company’s critical assets – such as its reputation or high-end talent – at risk. Oversight of corporate-culture risk should, therefore, feature prominently on the board’s agenda. But it is far from clear that directors will be held personally liable for the harms a flawed culture caused their companies. To delineate when directors can be liable, our article examines the recent resurgence of Delaware’s oversight duty doctrine (often dubbed Caremark).

First, that duty now uses the “mission critical” designation to hold directors and officers accountable for how they set information flows. Directors and officers can no longer use the “I didn’t know” gambit: Delaware courts insist that not being informed about central risks constitutes a breach of fiduciary duty.

Second, the duty holds directors accountable for how they set incentives. Litigation aims to expose cosmetic compliance with the duty by revealing a disconnect between what directors and officers say and the incentives they give employees. In AmerisourceBergen¸ for example, the court scrutinized directors for adopting superficial measures in response to warnings that opioids were being stolen and diverted and reserved stronger steps as a bargaining chip in future settlements with regulators.

Third, the oversight duty holds directors and officers accountable for how they set the tone and lead by example. Consider corporate law’s role in the #MeToo movement. While most companies responded quickly to the movement by writing new policies and sending all employees to training sessions, some companies continued to tolerate harassment by their leaders. In the 2023 McDonald’s decision, a Delaware court held that a company’s chief people officer could be liable for not doing enough to root out a culture of rampant sexual misconduct.

To be sure, it is far from certain that corporate law can fix flawed cultures, given that the oversight duty has at least three limitations. First, the standard for proving breach remains high: Judges try to avoid hindsight bias and err on the side of underenforcement. Second, the “enforcers” in these cases are shareholders and their attorneys, whose narrow incentives do not always align with social welfare (under certain conditions, shareholders can benefit from unethical corporate culture). Finally, the “targets” in these cases are corporate directors, who may be too removed from the operations to prompt change in corporate culture.

In addition to these limitations, one must consider developments such as Delaware’s Senate Bill 21 of March 2025. The bill restricted shareholders’ inspection rights in ways that may limit outside shareholders’ ability to hold corporate insiders accountable for how they set information flows, incentives, and norms. Such changes may reduce the ability of U.S.-style private litigation to impose accountability for flawed culture.

We therefore examine alternatives to private litigation, based on the experience of the UK and Australia, where shareholder litigation against the directors of public corporations is relatively rare. For example, civil liability in Australia for corporate behavior emanating from flawed culture is predominantly based on public enforcement. Our comparative analysis reveals how difficult it is for any given legal approach to impose accountability for flawed culture, and how challenging it is for even the most committed directors to police internal norms. Today’s large corporations are astoundingly complex, and it is hard to know just how pervasive problems are or what causes them. A single legal mechanism probably cannot alone fix a flawed culture.

Still, we highlight corporate law, not as a panacea, but rather as part of a host of admittedly imperfect mechanisms that together could, if designed properly, avert the next corporate debacle.

This post comes to us from Jennifer G. Hill, a professor of law at Monash University and a research member at ECGI, and Roy Shapira, a professor of law at Reichman University and a research  member at ECGI. It is based on their recent paper, “Accountability For Flawed Corporate Culture,” forthcoming in The Journal of Corporation Law and available here.