Most company directors understand the fiduciary duties of care and loyalty they owe to the companies they lead. Two recent Delaware law decisions, involving what are colloquially called Caremark duties, bolster the idea that directors must thoughtfully monitor regulatory compliance by their companies.

Caremark duties consist of the board of directors’ responsibility to make sure management reporting systems are in place and are followed so that the board has knowledge of company performance. In re Caremark Litigation Inc. Derivative Litigation[1] involved Caremark’s payment of $250 million to settle a Department of Justice investigation into Caremark’s illegally paying medical professionals for patient referrals. Delaware Chancery Court Chancellor Allen wrote,

[A] sustained or systematic failure of the board to exercise oversight—such as an utter failure to attempt to assure a reasonable information and reporting system exists—will establish the lack of good faith that is a necessary condition to liability [for breach of fiduciary duty].[2]

This expression of the duty deliberately set a low bar for director performance, lower even than gross negligence. As a result, in the two decades since Caremark, derivative litigation plaintiffs have enjoyed scant success. Even the most egregious board governance failures of the 2008 Financial Crisis did not lead to plaintiff victories. For example, the Chancery Court dismissed Caremark-based derivative litigation against Citigroup directors, even though the company would have failed catastrophically but for its federal bailout.[3]

Two recent cases, Marchand v. Barnhill,[4] and In re Clovis Oncology, Inc. Derivative Litigation,[5] reveal Delaware courts have just raised the Caremark duties bar. In Marchand, ice cream manufacturer Blue Bell Creameries USA suffered a listeria outbreak in 2015, leading to three deaths, recall of the company’s products and temporary shutdown of its manufacturing operations. Plaintiffs grounded their fiduciary duty claims on food safety standards set by the Food and Drug Administration (FDA). FDA regulations require companies like Blue Bell to have a written food safety plan, including having a process for identifying and analyzing hazards, implementing preventative controls and sanitation protocols, and having management monitor implementation of these measures.

Beginning in 2009, FDA and state food safety inspections of Blue Bell facilities showed repeated violations, including positive tests for listeria bacteria. Management withheld this information from the board of directors. The board of directors meeting minutes reflected only brief discussion of “operational issues” and only one specific mention of food sanitation inspection findings.

The Delaware Chancery Court dismissed the plaintiff’s case against Blue Bell, saying “[w]hat Plaintiff really attempts to challenge is not the existence of monitoring and reporting controls, but the effectiveness of monitoring and reporting controls in particular instances.”[6] Shades of Citigroup.

On appeal, the Delaware Supreme Court reversed. Although the ruling was procedural rather than a decision on the merits of the case, the court made plain its intent:

If Caremark means anything, it is that a corporate board must make a good faith effort to exercise its duty of care. A failure to make that effort constitutes a breach of the duty of loyalty. Where, as here, a plaintiff has followed our admonishment to seek out relevant books and records and then uses those books and records to plead facts supporting a fair inference that no reasonable compliance system and protocols were established as to the obviously most central consumer safety and legal compliance issue facing the company, that the board’s lack of efforts resulted in it not receiving official notices of food safety deficiencies for several years, and that, as a failure to take remedial action, the company exposed consumers to listeria-infected ice cream, resulting in the death and injury of company customers, the plaintiff has met his onerous pleading burden and is entitled to discovery to prove out his claim.

As in Marchand, directors in Clovis Oncology were sued for not addressing regulatory-related problems in their business. They did not fail to establish a system to monitor mission critical conditions though. They failed to act on information that showed the company’s mission itself was failing.

Clovis Oncology had three developmental stage drugs. The most promising, Roci, was designed to treat a previously-untreatable type of lung cancer. AstraZeneca was simultaneously bringing to market a competing drug, Tagrisso. The addressable market was $3 billion annually. For its clinical trial of Roci, Clovis Oncology chose a standardized and well-known clinical trial protocol named “RECIST”. A key metric for measuring drug success using RECIST is the “objective response rate” (ORR)—the percentage of patients who experience meaningful tumor shrinkage when taking the medication. For reporting purposes in the RECIST protocol, only after tumor shrinkage is “confirmed,” i.e., measured again and found again to be shrunken, can it be counted toward ORR.

In its race with AstraZeneca, Clovis Oncology management fudged its clinical trial results by including unconfirmed tumor scans and reporting a 58% ORR rate. “Management told the board . . . ORR would improve ‘as patients get to their second and third scans.’ By definition then, the ASCO ORR was partially based on unconfirmed results (i.e., it was not RECIST compliant). Notwithstanding this revelation, the board did nothing.”[7]

For two years, Clovis Oncology overstated to both the FDA and its stockholders the ORR rate for Roci by including both confirmed and unconfirmed data. The board of directors knew about this sleight of hand, but let it stand. The Board also learned that Roci had “serious, undisclosed side effects and that the [clinical] trial had been compromised by other clinicial trial protocol violations.”[8] Writing for the Chancery Court, Vice Chancellor Slights concluded,

ORR was the crucible in which Roci’s safety and efficacy were to be tested. Roci was Clovis’ mission critical product. And the Board knew, upon completion of the [clinical] trial, the FDA would consider only confirmed responses when determining whether to approve Roci’s NDA per the agency’s own regulations. As pled, these regulations, and the reporting requirements of the RECIST protocol were not nuanced. The Board was comprised of experts and the RECIST criteria are well-known in the pharmaceutical industry. Moreover given the degree to which Clovis relied upon ORR when raising capital, it is reasonable to infer the Board would have understood the concept and would have appreciated the distinction between confirmed and unconfirmed responses. The inference of Board knowledge is further enhanced by the fact the Board knew that even after FDA approval, physicians (i.e., future prescribers) would evaluate Roci based on its ORR. . . . I am satisfied [plaintiffs’] have well-pled that the Board consciously ignored red flags that revealed a mission critical failure to comply with the RECIST protocol and associated FDA regulations. [9]

The common denominator of these two cases—director performance in a regulated business—makes the plaintiff’s case easier to make out and gives the Delaware courts’ extension of Caremark liability greater purposefulness. The regulatory framework is an objective, publicly available index of required behaviors. Directors’ disregard of it makes the plaintiff’s case for him or her.

Too, the public policy reasons for the regulatory framework—protecting public health and safety—makes the case stronger for holding directors to a higher standard of performance in their fiduciary role. Vice Chancellor Slights summed the Chancery Court’s view in 16 words: “The careful observer is one whose gaze is fixed on the company’s mission critical regulatory issues.” Interesting to watch will be whether courts in Delaware and other jurisdictions apply the Marchand/Clovis Oncology reasoning in cases touching other regulatory regimes—financial services, telecommunications, consumer product safety and more. Our bet is they will.

[1] In re Caremark Int’l Inc. Derivative Litigation, 698 A.2d 959, 971 (Del. Ch. 1996).

[2] Id.

[3] In re Citigroup Inc. Derivative Litigation, 964 A.2d 106 (Del. Ch. 2009).

[4] 212 A.2d 805 (Del. 2019).

[5] C.A. No 2017-0222-JRS (Del. Ch. Oct. 1, 2019).

[6] Marchand, 2018 WL 4657159 at *18 (emphasis in original).

[7] Clovis at 16.

[8] Id. at 23.

[9] Id. at 43.