The duty of oversight requires corporate directors and officers to build systems that surface compliance problems and to act on serious warning signs when those systems deliver them. It is a Delaware fiduciary obligation rooted in the duty of loyalty, which means a breach can reach a leader’s personal assets even when corporate charters, indemnification agreements, and D&O insurance would normally stand in the way. The legal bar for proving a breach is high, but the financial consequences when plaintiffs clear it are among the most severe in corporate law.
Where the Duty Comes From
The modern duty traces to the 1996 Delaware Court of Chancery decision in In re Caremark International Inc. Derivative Litigation. Chancellor Allen held that directors have “a duty to attempt in good faith to assure that a corporate information and reporting system, which the board concludes is adequate, exists,” and that failing to do so could make a director personally liable for losses caused by legal violations within the company.1Justia. In re Caremark International Inc. Derivative Litigation
Caremark set out two theories of liability. The first targets boards that never built a reporting system at all. The second targets boards that had a system but consciously ignored what it was telling them. Both demand proof of “a sustained or systematic failure of the board to exercise oversight” so severe that it reflects a complete absence of good faith.1Justia. In re Caremark International Inc. Derivative Litigation Simple negligence is not enough. Plaintiffs must show leaders were willfully disengaged, not that they made imperfect decisions.
Why a Breach Reaches Personal Assets
For a decade after Caremark, courts debated whether oversight sat under the duty of care or the stricter duty of loyalty. The Delaware Supreme Court settled it in 2006 in Stone v. Ritter, holding that “a showing of bad faith conduct” is essential and that “the fiduciary duty violated by that conduct is the duty of loyalty.” Good faith, the court explained, is a subsidiary element of loyalty rather than a freestanding duty. When directors “fail to act in the face of a known duty to act, thereby demonstrating a conscious disregard for their responsibilities, they breach their duty of loyalty by failing to discharge that fiduciary obligation in good faith.”2Justia. Stone v Ritter
That classification controls what happens after a finding of liability. Delaware’s Section 102(b)(7), amended in August 2022 to cover certain senior officers as well as directors, lets corporations eliminate personal monetary liability for breaches of the duty of care. The statute expressly excludes “any breach of the director’s or officer’s duty of loyalty,” “acts or omissions not in good faith,” and “intentional misconduct or a knowing violation of law.”3State of Delaware. Delaware Code, Title 8, Chapter 1, Subchapter 1 Because oversight claims sit inside the loyalty framework and require bad faith, they fall squarely outside what a charter can shield.
Standard directors’ and officers’ liability policies carry comparable exclusions for bad faith and intentional wrongdoing. The very finding that establishes oversight liability is often the finding that removes insurance coverage. A leader who assumes the D&O policy will absorb a Caremark judgment is often wrong about the protection they have.
Prong One: Failing to Build a Reporting System
The first path to liability asks a blunt question: did the board try at all? A board that makes no effort to create channels for compliance information has, in the court’s language, “utterly failed” its obligation. The system need not be perfect, but it must be a genuine attempt. A program that exists only on paper and never actually delivers reports to the board is treated as no system at all.
Documentation matters. Formal reporting lines that move compliance data from the operating level up to the board, recorded in board minutes, create the evidence that directors engaged with the information rather than waiting for someone to bring them bad news.
Mission-Critical Risks Raise the Bar
In 2019, the Delaware Supreme Court sharpened these expectations in Marchand v. Barnhill, a case arising from a deadly listeria outbreak at Blue Bell Creameries. Because Blue Bell was a single-product company, food safety was “essential and mission critical.” Yet “Blue Bell’s board had no committee overseeing food safety, no full board-level process to address food safety issues, and no protocol by which the board was expected to be advised of food safety reports and developments.”4Justia. Marchand v Barnhill, et al
The takeaway is that boards cannot treat every risk the same. When a particular compliance area is central to the business, directors need a dedicated board-level monitoring structure for it. Routine management updates about general operations will not satisfy the duty when the risk at stake could end the company.4Justia. Marchand v Barnhill, et al
The 2021 Boeing derivative litigation showed what the same failure looks like at a large public company. After two fatal 737 MAX crashes, shareholders alleged that Boeing’s board had no committee specifically tasked with airplane safety, did not regularly allocate meeting time to safety and quality control, and maintained no mechanism for internal safety complaints to reach the board. The company’s primary internal safety reporting process had “no link to the Board and no Board reporting mechanism.”5Justia. In Re The Boeing Company Derivative Litigation For a company whose business depends on aircraft safety, the court found that absence damning.
Prong Two: Ignoring Red Flags
The second path applies when a reporting system does exist. If the board receives specific warnings of serious misconduct or risk and consciously fails to investigate, that inaction can constitute bad faith. The question is not whether the board could have detected a problem but whether it knew about one and chose to do nothing.
Boeing again illustrates the pattern. After the October 2018 Lion Air crash, the board did not request information from management for over a week. When directors finally convened, the call was optional. Media reports circulated a theory that the 737 MAX’s flight-control system had serious engineering defects concealed from regulators and pilots. The board was aware of those reports but did not challenge management’s assurances that the aircraft was safe. Instead, the board treated the crash “as an anomaly, a public relations problem, and a litigation risk, rather than investigating the safety of the aircraft.” The board even formally resolved to delay any internal investigation until regulators finished theirs. A second fatal crash followed months later. The court held that passively accepting management’s reassurances in the face of public evidence to the contrary supported an inference of bad faith.5Justia. In Re The Boeing Company Derivative Litigation
Most oversight claims are won or lost on this prong. Courts look for patterns, not isolated lapses. One ambiguous report misread by a board is not bad faith. Repeated, specific warnings from multiple sources that never prompt follow-up are a different matter.
Officers Owe the Duty, Too
For decades, Caremark claims targeted only directors. That changed in 2023, when Vice Chancellor Laster held in In re McDonald’s Corporation Stockholder Derivative Litigation that corporate officers also owe a duty of oversight. The case involved allegations against former CEO Stephen J. Easterbrook regarding his handling of a workplace culture that included widespread sexual harassment complaints.6Justia. In re McDonalds Corporation Stockholder Derivative Litigation
An officer’s duty is narrower than a director’s in scope but identical in standard. A board is responsible for the company as a whole; an officer is responsible for the risks tied to their role and authority. A chief human resources officer would be expected to monitor and escalate workplace safety and harassment concerns. A chief financial officer would be expected to flag accounting irregularities. Each must build systems within their domain and report significant problems upward to the board. The liability standard mirrors the board’s: an officer “must consciously fail to make a good faith effort to establish information systems, or the officer must consciously ignore red flags,” and the alleged failure must be “sufficiently sustained, systematic, or striking to constitute action in bad faith.”6Justia. In re McDonalds Corporation Stockholder Derivative Litigation
What an Adequate Compliance System Looks Like
Delaware does not publish a checklist for Caremark compliance, but two federal frameworks offer the clearest guidance on what counts as a good faith effort. Courts and regulators routinely reference them when evaluating whether leaders met the standard.
The Federal Sentencing Guidelines
The U.S. Sentencing Commission’s guidelines for organizational defendants describe seven elements of an effective compliance and ethics program:7United States Sentencing Commission. 2018 Chapter 8 – Sentencing of Organizations
- Written standards and procedures designed to prevent and detect misconduct.
- Oversight by leadership, with the board knowledgeable about the program and specific individuals assigned day-to-day responsibility, adequate resources, and direct access to the board.
- Due diligence in hiring, so that people with a history of misconduct are not placed in positions of authority.
- Training and communication tailored to the audience.
- Monitoring, auditing, and a confidential reporting mechanism that protects employees from retaliation.
- Consistent enforcement, with real incentives for compliance and real consequences for violations.
- Response and remediation when misconduct is detected, including changes to prevent recurrence.
These elements track what Delaware courts expect under Caremark. A board that can show each component, documented in minutes and committee reports, is in a far stronger position to defend an oversight claim.
The DOJ’s Three Questions
When the Department of Justice decides whether to charge a corporation, prosecutors evaluate the compliance program using three questions: Was it well designed? Was it applied earnestly and in good faith? Did it work in practice? The assessment is individualized to the company’s size, industry, and risk profile. Prosecutors look at whether compliance personnel have sufficient autonomy and direct access to the board, whether the confidential reporting mechanism is one employees actually trust, and whether leadership has built a genuine culture of compliance rather than a paper program.8U.S. Department of Justice. Evaluation of Corporate Compliance Programs
A board that structures its oversight around these criteria reduces its criminal exposure and builds the record that makes a Caremark claim much harder to sustain.
How Oversight Claims Get Filed
Oversight suits are derivative, meaning shareholders sue on behalf of the corporation rather than in their own name. Before filing, a shareholder must either demand that the board pursue the claim or demonstrate that demand would be futile because the board is too conflicted to evaluate it fairly. Under the standard in United Food & Commercial Workers Union v. Zuckerberg (2021), futility turns on whether a majority of directors received a personal benefit from the alleged misconduct, face a substantial likelihood of liability, or lack independence from someone who did. When the board itself is accused of the oversight failure, futility is easier to establish, because the directors being asked to evaluate the claim are the ones who would be defendants.
Delaware encourages shareholders to investigate before suing. Section 220 of the Delaware General Corporation Law lets stockholders inspect corporate books and records on a “credible basis” for suspecting wrongdoing, a bar courts have described as relatively low. Section 220 demands are now the standard first step. The documents produced often supply the particularized allegations needed to survive a motion to dismiss. Plaintiffs in both Marchand and Boeing used books and records demands to build their cases before filing.5Justia. In Re The Boeing Company Derivative Litigation
What’s at Stake Financially
Derivative settlements in oversight cases can be enormous. In 2025, a Delaware court approved a $190 million settlement in a derivative lawsuit alleging that Meta’s directors failed to oversee the company during the Cambridge Analytica data-harvesting scandal. The case was reportedly the first Caremark claim to reach trial and produced the second-largest derivative settlement in Delaware history for an oversight claim. The settlement was paid from D&O insurance, though a trial verdict finding bad faith rather than a settlement could have eliminated that coverage entirely.
That is the dynamic to understand. The legal standard is one of the hardest in corporate law to meet. When plaintiffs do meet it, the exposure is severe, and the familiar protections drop away at the moment they are needed most. A director or officer found to have acted in bad faith cannot be exculpated by the corporate charter, cannot be indemnified by the company under Delaware law, and may find the D&O policy excludes the claim. The combination of a high legal bar and devastating personal consequences when the bar is cleared is what makes the duty of oversight the governance issue most worth getting right in advance.