Corporate Governance and Compliance: Duties, Board, and SEC Rules

Corporate governance and compliance is the combined framework that decides how a company is run, who holds the decision-makers accountable, and how the company stays on the right side of the law. Governance is the structure: shareholders, directors, officers, committees, and the rules that bind them. Compliance is the operational side: the policies, training, reporting lines, and audits that keep the company and its people inside the legal lines. For a publicly traded company, both are shaped by federal securities law, stock exchange listing standards, and the corporate law of the state where the entity is incorporated, with failures punishable by fines in the hundreds of thousands and prison sentences up to 20 years.

The Federal Laws That Set the Rules

The Securities and Exchange Commission enforces the two foundational statutes: the Securities Act of 1933, which requires meaningful financial disclosure when securities are sold, and the Securities Exchange Act of 1934, which created the SEC and gave it authority over markets, broker-dealers, and public company reporting.¹

The Sarbanes-Oxley Act of 2002 added personal accountability at the top. Under 18 U.S.C. § 1350, the CEO and CFO of every public company must personally certify that each periodic financial report fully complies with SEC requirements and fairly presents the company’s financial condition. A knowing false certification can draw a fine up to $1 million and up to 10 years in prison. If the false certification is willful, the maximum rises to a $5 million fine and 20 years.² Sarbanes-Oxley also created the Public Company Accounting Oversight Board to supervise the auditors who examine public company financial statements.³

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 added advisory “say-on-pay” votes at least every three years, giving shareholders a non-binding vote on executive compensation packages,⁴ and expanded the protections against retaliating employees who report possible securities violations.⁵

Federal law covers securities regulation and public disclosure. The internal mechanics of the corporation — how it forms, how it issues shares, what its directors owe — are governed by the law of the state of incorporation. Delaware’s General Corporation Law dominates here because of its flexibility and the depth of its courts’ case law.

What Directors and Officers Personally Owe the Company

Directors and officers owe fiduciary duties to the corporation. The law expects them to put the company’s interests ahead of their own, and personal liability is a real consequence when they fall short.

Duty of Care

The duty of care requires directors to make decisions the way a reasonably careful person would in similar circumstances. Read the board materials. Ask questions. Hire advisors when the matter is outside the board’s expertise. Engage with the decision rather than rubber-stamp management’s recommendation. Courts don’t expect perfection, but they do expect diligence, and ignoring obvious red flags can create personal liability.

Duty of Loyalty

The duty of loyalty is more demanding. Directors cannot use their position for personal profit, cannot take business opportunities that belong to the company, and cannot approve transactions where they have an undisclosed financial interest. When a conflict exists, Delaware’s Section 144 provides safe harbors. An interested-director transaction survives legal challenge if it meets any one of three conditions:

The material facts about the director’s interest are disclosed to the board, and a majority of disinterested directors approve the transaction in good faith.
The material facts are disclosed to shareholders, and a majority of disinterested shares vote to approve.
The transaction is entirely fair to the corporation at the time it is authorized.

If a majority of the board is conflicted, approval must come from a committee of at least two directors the board has determined to be disinterested.⁶

Duty of Good Faith and Oversight

Directors also owe a duty of good faith, which includes a duty of oversight. Under Delaware case law, a director can be held personally liable for failing to monitor operations if the board either never implemented a reporting or compliance system at all, or implemented one and then consciously ignored what it produced. It is a hard claim to win, but courts have let it proceed when boards disengaged entirely from known risk areas. A board that sets up a compliance system and regularly reviews its output is in a far stronger position than one that treats compliance as a formality.

The Business Judgment Rule

When directors make an informed decision in good faith and without a conflict, courts generally refuse to second-guess the outcome. A bad business result does not automatically mean the directors breached their duties. Courts focus on process: did the directors educate themselves, consider the relevant facts, and act honestly? If yes, the decision stands even if the company lost money. The protection falls away when there is evidence of fraud, self-dealing, or gross negligence in the decision-making itself.

How the Board Is Built to Deliver Governance

The organizational chain starts with shareholders, who provide capital and elect directors. The board sets strategy, oversees management, and appoints the executive officers who run day-to-day operations. Both the NYSE and Nasdaq require listed companies to maintain a board where a majority of directors qualify as independent, meaning they have no material relationship with the company that could compromise their objectivity.⁷ The NYSE defines independence broadly, requiring the board to consider all relevant facts and circumstances, including commercial, banking, consulting, legal, and familial relationships.⁸

Three board committees handle the heaviest governance work. The audit committee oversees financial reporting, engages the external auditors, and monitors internal controls; Nasdaq requires at least three independent members, with at least one who has financial sophistication from direct experience in accounting or finance.⁷ The compensation committee sets executive pay structures and reviews incentive arrangements for alignment with long-term performance, with at least two independent members under Nasdaq rules. The nominating committee identifies qualified candidates for board vacancies and evaluates whether current directors should continue serving.

Independent directors also hold regular executive sessions without management present. These private meetings give independent members room to discuss sensitive topics candidly, including CEO performance, succession, and concerns about management conduct.

What a Real Compliance Program Looks Like

A compliance program that exists only on paper creates a false sense of security. The Department of Justice has published detailed guidance on what prosecutors look for when evaluating a program, and asks three questions: Is it well designed? Is it adequately resourced and empowered to function effectively? Does it actually work in practice?⁹

A well-designed program starts with a risk assessment tailored to the company’s industry, business model, and regulatory environment. Cookie-cutter policies imported from another company signal that nobody thought carefully about where the real risks lie. The DOJ expects policies and procedures that address the misconduct most likely to occur in that company’s line of business, not generic prohibitions.

The core components include:

A code of conduct setting out ethical and legal expectations across topics like anti-bribery, data handling, conflicts of interest, and workplace conduct.
A Chief Compliance Officer with genuine authority and direct access to the board, not someone buried below the general counsel with no budget.
Confidential reporting channels — anonymous hotlines or digital tools that employees trust enough to actually use.
Training tailored to each employee’s role and risk exposure, not a once-a-year video everyone clicks through.
Risk-based due diligence on suppliers, agents, distributors, and acquisition targets, because compliance risk extends beyond the company’s own employees.
A documented process for investigating reports, taking corrective action, and feeding lessons learned back into the program.

The DOJ also looks at whether compliance personnel can raise concerns without fear of retaliation and whether the program has been updated after past incidents. A program that has never been revised since the day it was written tells prosecutors nobody is paying attention.

Specific Obligations Public Companies Carry Today

Periodic SEC Filings and Officer Certifications

Public companies file an annual Form 10-K with audited financial statements, risk factors, management’s discussion of performance, and information about controls. Large accelerated filers (generally those with a public float above $700 million) have 60 days after fiscal year-end to file; accelerated filers get 75 days; everyone else gets 90.¹⁰ Quarterly updates come via Form 10-Q with unaudited statements, due within 40 days for large accelerated and accelerated filers and 45 days for non-accelerated filers. The CEO and CFO sign these filings, personally certifying both accuracy and the evaluation of internal controls.

Internal Controls Under Section 404

Sarbanes-Oxley Section 404 requires management to include in each annual report a written assessment of the effectiveness of internal controls over financial reporting. This is not a vague endorsement; management must identify specific weaknesses and describe the framework used for the evaluation. For larger companies, an independent external auditor must separately attest to the effectiveness of those controls, and that attestation becomes part of the public filing. External audits conducted by independent accounting firms verify that financial statements comply with Generally Accepted Accounting Principles and look for weaknesses that could lead to material misstatements or fraud.¹¹

Executive Compensation Clawbacks

Since late 2023, every company listed on a major stock exchange must maintain a written policy for recovering executive compensation paid on financial results that later turn out to be wrong. Under SEC Rule 10D-1, when a company is required to restate its financials due to a material error, it must claw back any incentive-based compensation that executives received in excess of what they would have received under the corrected numbers.¹² The lookback period covers the three completed fiscal years before the restatement is required. The rule applies whether or not the executive was personally at fault for the error. Compensation is “received” in the fiscal year the triggering metric was achieved, so a bonus tied to 2024 revenue targets that is paid in early 2025 is still subject to clawback if 2024 results are later restated.

Cybersecurity Disclosure

Cybersecurity is now a board-level governance issue. Under rules the SEC adopted in July 2023, public companies must disclose material cybersecurity incidents on Form 8-K within four business days of determining the incident is material, and the materiality determination itself cannot be unreasonably delayed.¹³ If a company discloses an incident before the assessment is finished and later concludes it was material, an updated 8-K is required within four business days of that conclusion. The Form 10-K now contains a dedicated cybersecurity section (Item 1C) requiring companies to describe how they identify, assess, and manage cybersecurity risks and how the board oversees them.¹⁰ A board that cannot articulate its cybersecurity oversight process in the annual report is failing the disclosure requirement.

The Foreign Corrupt Practices Act

Companies doing business internationally face additional obligations under the Foreign Corrupt Practices Act. The FCPA has two prongs: an anti-bribery provision that prohibits paying or offering anything of value to foreign government officials to win or keep business, and an accounting provision that requires accurate books and effective internal controls to detect corruption. A company convicted of anti-bribery violations faces criminal fines up to $2 million per violation. Individual officers, directors, or employees who willfully participate face up to $100,000 in criminal fines and up to five years in prison. Civil penalties of up to $10,000 per violation apply to both companies and individuals.¹⁴ Negotiated FCPA settlements frequently reach hundreds of millions of dollars when the underlying conduct is widespread.

What Enforcement Looks Like When Things Fail

The SEC uses a tiered civil penalty structure. For non-fraud violations, the maximum is $5,000 per violation for an individual and $50,000 for a company. If fraud or deliberate disregard of a regulatory requirement is involved, those caps rise to $50,000 and $250,000. The top tier applies when fraud causes substantial losses to others: up to $100,000 per violation for an individual and $500,000 for a company, or the total amount of profit the violator gained, whichever is greater.¹⁵

Monetary penalties are only part of the picture. The SEC can seek court orders barring individuals from serving as officers or directors of any public company, require disgorgement of profits, and refer cases for criminal prosecution. Sustained failures in reporting or disclosure can lead the SEC to suspend trading in a company’s stock or open a formal investigation into leadership.

ESG and Climate Disclosure in 2026

The disclosure landscape for environmental, social, and governance topics is in flux. In March 2024, the SEC adopted a climate-related disclosure regime for public companies. On May 29, 2026, the SEC proposed to rescind those rules entirely. The proposed rescission is subject to a public comment period and a subsequent commission vote, and is unlikely to become final before late 2026 or early 2027.

Even without a federal mandate, climate reporting obligations persist through other channels. California’s SB 253 requires large companies doing business in the state to report greenhouse gas emissions, with the first reporting deadline set for August 10, 2026. Internationally, the European Union’s Corporate Sustainability Reporting Directive and the International Sustainability Standards Board frameworks impose disclosure requirements on companies with significant operations or revenue in those jurisdictions.

Regardless of the regulatory outcome in Washington, major institutional investors continue to use their proxy voting power to push companies on ESG oversight. Boards that cannot describe their process for identifying, assessing, and monitoring material ESG-related risks may face votes against individual directors during proxy season. Building that capability now puts the board in position to comply with whichever disclosure regime ultimately applies.

1
Securities and Exchange Commission. Statutes and Regulations
2
Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports
3
Public Company Accounting Oversight Board. Sarbanes-Oxley Act of 2002
4
U.S. Securities and Exchange Commission. Investor Bulletin – Say-on-Pay and Golden Parachute Votes
5
U.S. Securities and Exchange Commission. Whistleblower Protections
6
Delaware Code Online. Delaware Code Title 8, Chapter 1, Subchapter IV
7
Nasdaq. Nasdaq Listing Rules – Reference Library
8
U.S. Securities and Exchange Commission. NYSE Section 303A Corporate Governance Standards
9
U.S. Department of Justice. Evaluation of Corporate Compliance Programs
10
U.S. Securities and Exchange Commission. Form 10-K
11
Public Company Accounting Oversight Board. AU Section 150 – Generally Accepted Auditing Standards
12
eCFR. 17 CFR 240.10D-1 – Listing Standards Relating to Recovery of Erroneously Awarded Compensation
13
U.S. Securities and Exchange Commission. Disclosure of Cybersecurity Incidents Determined To Be Material
14
Office of the Law Revision Counsel. 15 USC 78dd-2 – Prohibited Foreign Trade Practices by Domestic Concerns
15
Office of the Law Revision Counsel. 15 USC 78u – Investigations and Actions