The case

The genesis of the case was the allegations of sexual harassment at McDonald’s involving David Fairhurst, executive vice president and global chief people officer. Public attention to sexual harassment at McDonald’s became more prominent around 2016, and in 2018, workers in 10 cities went on strike to protest the company’s inadequate response to sexual harassment complaints. The board of directors became aware of harassment allegations against Fairhurst in 2018. Fairhurst was required to sign a “last chance” letter admitting his misconduct and promising not to engage in the prohibited conduct in the future.

In 2019, the board became involved with remediation efforts. The general counsel led an effort to investigate the situation, reported to the board, and recommended various actions. Because of his position as head of human resources for the company, Fairhurst was also involved in the anti-harassment program and reported progress to the board. While all of this was going on, the board learned that the CEO, Stephen Easterbrook, had engaged in a prohibited relationship with an employee. At its November 1, 2019, meeting, the board approved a separation agreement with Easterbrook, terminating him “without cause.” At the same meeting, the board terminated Fairhurst for cause.

Shareholders filed a derivative action against the company’s board, Easterbrook, and Fairhurst. Fairhurst was accused of breach of fiduciary duty, breaching his duty of oversight, as well as breaching his duty of loyalty by engaging in acts of sexual harassment. The complaint alleged that Fairhurst and Easterbrook promoted a “party atmosphere” at McDonald’s, which included serving alcohol at company events. Fairhurst responded with a motion to dismiss, asserting that the duty of oversight applied only to directors, not officers.

The duty of oversight

Do officers or directors have a fiduciary duty of oversight as to matters within their areas of responsibility? Going back to 1963, the Delaware Supreme Court, in Graham v. Allis-Chalmers Manufacturing Co.,^[3] notably said that “absent cause for suspicion there is no duty upon the directors to install and operate a corporate systems of espionage to ferret our wrongdoing which they have no reason to suspect exists.”^[4] Many people dismissed that case since it did not require directors to set up a system to monitor company activities; however, technically it did create a duty of oversight if they became aware of information (“red flags”). So if they did learn about something, they were supposed to investigate, but that aspect of their duties never seemed to gain much traction.

Fast forward 33 years to Caremark, where the court ruled that the fiduciary obligation of a director included a duty to ensure that “information and reporting systems exist in the organization that are reasonably designed to provide to senior management and to the board itself timely, accurate information sufficient to allow management and the board, each within its scope, to reach informed judgments concerning both the corporation’s compliance with law and its business performance.”^[5] But the court held that liability for breach of this duty would only attach if there were a “sustained or systematic failure of the board to exercise oversight—such as an utter failure to attempt to assure a reasonable information and reporting system exists—will establish the lack of good faith that is a necessary condition to liability. Such a test of liability—lack of good faith as evidenced by sustained or systematic failure of a director to exercise reasonable oversight—is quite high.”^[6] This decision attracted a lot of attention since it explicitly stated that, at least in theory, a director could be liable for failing to exercise oversight.

This approach was followed in Stone v. Ritter, which refined the Caremark liability theory by identifying two types of claims against directors: one for a failure to implement any reporting or information system, and one for consciously failing to monitor or oversee the information system after establishing it (i.e., failing to respond to red flags).^[7]

Could any possibility of potential or actual corporate liability create a red flag that required board action? In In re Dow Chemical Co. Derivative Litigation, the plaintiffs’ theory of liability was a breach of the duty of oversight for failure to detect that bribery may have caused a proposed joint venture in Kuwait to come undone.^[8] Although there were reports of possible bribery in the Kuwaiti press, the board had no actual knowledge of bribery. The plaintiffs alleged that because Dow had paid a fine to the U.S. Securities and Exchange Commission in 2007 for bribery in India, the accusations of possible bribery in the press was sufficient to constitute a red flag that the board should have investigated. This allegation was rejected by the court. The 2007 incident involved different members of management in another country and for an unrelated transaction. “With neither knowledge of bribery, nor any reason to suspect such conduct, the defendant directors could not “conscious[ly] disregard” their duty to supervise against bribery. Plaintiffs have also failed to allege facts suggesting that the Dow board “utterly fail[ed]” to supervise insiders, or that any director acted with anything other than good faith.^[9] The court also noted that Dow had set up policies to prevent unethical payments to third parties (i.e., a compliance program). Since there was no failure of responsibility by the board, the Caremark claims were dismissed.

A few other cases fleshed out the director’s duty with regard to oversight. In Marchand v. Barnhill, the shareholder challenged the board’s inactivity concerning food safety when listeria was discovered in ice cream—the only product made by the company, Blue Bell Creameries USA Inc.^[10] The contamination required a recall of all products, the layoff of a third of its workforce, and the shutdown of operations. Three people died. The court held that the board’s failure to implement any system to monitor food safety breached the duty of oversight to monitor the corporation’s operational viability, legal compliance, and financial performance. This was an “utter failure” to assure a reasonable information and reporting system exists and was an act of bad faith in breach of the duty of loyalty. The court emphasized that Blue Bell made only one product, and yet there was “no committee overseeing food safety, no full board-level process to address food safety issues, and no protocol by which the board was expected to be advised of food safety reports and developments. . . . [W]hen yellow and red flags about food safety were presented to management, there was no equivalent reporting to the board and the board was not presented with any material information about food safety.”^[11] The complaint alleged both the failure to establish an information system and the failure to respond to red flags.

In re Clovis Oncology, Inc. Derivative Litigation dealt with allegations against the board of a company developing a cancer drug.^[12] The allegation was that the board ignored red flags that Clovis was not adhering to clinical trial protocols, which placed U.S. Food and Drug Administration (FDA) approval of the drug in jeopardy. With misleading trial results, the board allowed Clovis to deceive regulators regarding the drug’s efficacy. As in Marchand, liability for breach of the duty of oversight is more likely to occur when there is a failure to oversee compliance with positive law, including FDA regulations, by failing to implement compliance systems or monitor existing compliance systems. The FDA regulations here were mission critical, and red flags of problems were ignored.

The oversight system must be real, or, to put it into compliance speak, it must not be a paper program. In Hughes v. Hu, the plaintiff alleged that the board failed to exercise its oversight obligations since it created an audit committee that met only sporadically, had clear notice of financial irregularities, and consciously turned a blind eye to problems. The “trappings of oversight,” such as the mere existence of audit committees and compliance departments, were insufficient to rebut a Caremark claim.^[13] In Teamsters Local 443 Health Services & Insurance Plan v. Chou, the Chancery court sustained a breach of the duty of oversight claim against the board of AmerisourceBergen Company, based on allegations that the directors had ignored red flags of regulatory and operational noncompliance at a subsidiary, based, among other things, on the board’s failure to require updates and progress reports after the deficiencies were flagged.^[14]

The McDonald’s decision

The court ruled that the plaintiffs had adequately pleaded a claim for breach of the duty of oversight related to his position as well as a claim for the breach of the duty of loyalty related to his own misconduct. Vice Chancellor Laster explicitly stated that corporate officers owe the same duty of oversight as corporate directors, noting that the fact that directors have this duty did not foreclose officers from having a similar duty. The duty of oversight for officers will necessarily be context driven and will generally apply to the officer’s particular area of responsibility. A finding of liability will require proof that the officer acted in bad faith and hence disloyally.

As noted above, the bad faith claim can be either an information systems claim or a red flags claim. The court found that the case against Fairhurst was a red flags claim, requiring a showing that the fiduciary knew of evidence of corporate misconduct; consciously failed to take action; and the inaction was sufficiently sustained, systematic, or striking to constitute bad faith. Fairhurst’s job as head of human resources created a duty of oversight with respect to the company workforce. The complaint included facts sufficient to show red flags regarding sexual harassment and supported the inference that Fairhurst was aware of the red flags. The court looked to allegations of Fairhurst’s own misconduct and observed that when a corporate officer engages in acts of sexual harassment, it is reasonable to infer that the officer consciously ignored red flags that warned of similar behavior by others.

The court also found that Fairhurst’s individual acts of sexual harassment violated his fiduciary duties. Since these acts were not undertaken to advance the company’s interests, they were done in bad faith. It was not reasonable to infer that Fairhurst acted in good faith and remained loyal to the company while committing acts of sexual harassment, violating company policy, violating positive law, and subjecting McDonald’s to liability. It was, therefore, reasonable to infer that Fairhurst acted disloyally and for an improper purpose unrelated to the company’s best interests.

The court in the McDonald’s case bluntly stated that officers had the same fiduciary duties as directors regarding oversight. This derived from the Delaware Supreme Court holding in Gantler v. Stephens, which was not an oversight case; however, for the McDonald’s court, this was a fiduciary duty that would apply in the oversight context even if it had never been expressly so stated.^[15] The court noted that officers are agents of the corporation, with a fiduciary duty to keep the principal informed. Although the board and chief compliance officer may have responsibility for the entire corporation, the oversight duties of an officer will normally be limited to their area of responsibility. In that area, the officer will be best positioned to know what is going on—and report upward where appropriate. However, if an officer receives credible information indicating a violation of law outside of their immediate area of responsibility, the officer cannot turn a blind eye and ignore the issue by saying, “not in my area.”

So, after establishing the principle of officer liability, the Delaware court dismissed the case against the directors.^[16] But compliance officers should not take any comfort from this result. The specific facts showed that the directors did take action. The McDonald’s directors did not ignore the red flags or show a total failure of oversight. It took action by engaging a consultant to help it address the sexual harassment complaints, revising policies and training materials, providing support to franchisees, and ending a policy of mandatory arbitration of harassment and discrimination claims. Based on these actions, the court could not infer that the directors acted in bad faith.

Not so different from existing obligations

Although there are some technicalities surrounding the rights of shareholders under Delaware law, the decision extends the concept of the corporate officer as a gatekeeper of the compliance program, like lawyers, accountants, compliance officers, and other professionals within the company. Anyone with the gatekeeper’s responsibility already has an obligation to be sensitive to red flags of possible misconduct.

The Federal Sentencing Guidelines make it clear that “[a]n individual was ‘willfully ignorant of the offense’ if the individual did not investigate the possible occurrence of unlawful conduct despite knowledge of circumstances that would lead a reasonable person to investigate whether unlawful conduct had occurred.”^[17] In the application notes to subsection (b)(2), the Guidelines state that “[h]igh-level personnel and substantial authority personnel of the organization shall be knowledgeable about the content and operation of the compliance and ethics program, shall perform their assigned duties consistent with the exercise of due diligence, and shall promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law.”^[18]

For lawyers, the Model Rules of Professional Conduct make it clear that the “ostrich” approach to wrongdoing is never appropriate since knowledge can be inferred from circumstances.^[19] Lawyers are also admonished that, in addition to law, they are to consider relevant moral, economic, social, psychological, and political factors as they advise their clients.^[20]

Conclusion

There will be some questions about whether the extension of the duty of oversight to misconduct by an officer is appropriate. Will every sexual harassment allegation turn into a shareholder suit? The McDonald’s opinion suggests that the specific rules about derivative actions in Delaware would make this type of claim relatively unlikely; however, the opinion suggests that it is not inappropriate to find liability when there is an affirmative act (like harassment) rather than a conscious decision not to act.

Overall, the McDonald’s decision is a strong buttress to the compliance officer’s duties. Although the precise rules of liability in this area will be refined in subsequent cases, compliance officers should take advantage of the decision to make sure that their compliance programs cover the areas of liability that were exposed.

Takeaways

• Make certain that corporate culture supports compliance and ethics, not just “letter of the law.”

• Boards and all officers must be educated about compliance, including specific subjects related to their areas of responsibility. Boards should also document their activities to ensure an effective compliance program is in place, including a robust information flow to the board and responses to any red flags of noncompliance whether raised in the media or transmitted through internal communications.

• Particular attention should be paid to any area of corporate activity with specific government regulations and whether there are adequate systems to report any problems and respond to those reports.

• If the company has more than one product, there should be a tailored compliance program for each product area where the regulatory environment may differ.

• An officer or director who engages in wrongdoing personally will be presumed to be acting disloyally and in bad faith.