Microsoft Word - ShapiraDONE.docx MISSION CRITICAL ESG AND THE SCOPE OF DIRECTOR OVERSIGHT DUTIES Roy Shapira* Corporations are facing increased scrutiny over how they treat their stakeholders and society at large. Failing to address key environmental, social, and governance (ESG) concerns may generate significant blowback, making it harder for corporations to attract talent, access capital, and sell products. ESG concerns have thus become a major source of reputational and financial risk for companies and their shareholders. One way for shareholders to hold managers personally accountable for being inattentive to critical ESG risks is by filing a derivative action on behalf of the company, claiming that managers breached their oversight duties (Caremark duties). Until recently, corporate legal scholars have dismissed this possibility, reasoning that oversight duties are generally unenforceable. That reasoning is no longer valid. In the past two years, Delaware courts have revamped their Caremark framework. The courts are now increasingly willing to apply heightened scrutiny to directors’ efforts, and increasingly willing to grant shareholders access to internal company documents in order to investigate failure-of-oversight claims. There can no longer be any question about Caremark’s relevance, but there remains a question about Caremark’s scope. Would the courts be as willing to apply heightened scrutiny and provide access to pre-suit discovery when the case concerns nonlegal risks? In other words, do directors face *Harry Radzyner Law School, Reichman University (IDC); research member, ECGI. This Article has benefited from conversations with legal advisors and reputation consultants for corporate boards, and I especially thank Ed Coke and Stephen Hahn for their time and insight. I practiced as a reputation consultant myself, from 2014–2016, but the usual caveat applies: my opinions here do not represent the opinions of the companies that I have consulted for. I thank participants at the National Business Law Scholars Conference and the Corporate & Securities Litigation Conference for helpful comments, and Shira Timor for excellent research assistance. No. 2:732] MISSION CRITICAL ESG 733 personal liability for how their companies treat the environment, diversity, and privacy, even when such behaviors are not punishable by law? This Article examines the evolving scope of director oversight duties and makes three contributions. First, the Article synthesizes the caselaw to clarify that the relevant question when determining Caremark’s scope is not whether a risk is “legal” or “reputational,” but rather whether the risk is “critical” to the company’s success. The Article’s second contribution is to build an analytical framework for distinguishing between ESG risks that are critical (and thus subject to a realistic Caremark liability threat) and those that are not. The Article then applies the framework to concrete ESG concerns, such as cybersecurity, climate change, and sexual misconduct. Finally, the Article evaluates the social desirability of extending Caremark to oversight of nonlegal risks. The key disadvantage of doing so is that it increases the costs of judicial hindsight bias, while the key advantage is that it counterbalances the flaws of other ESG enforcement mechanisms. The Article concludes that courts should adopt a more judiciable approach when scrutinizing board oversight of nonlegal risks. I. Introduction ....................................................................... 734 II. Does Caremark Extend to Oversight of ESG? ............... 740 A. Background: The Caremark Framework .............. 744 B. Does the Caremark Framework Extend to ESG Risk Oversight? ............................................................. 750 C. How the Caremark Framework Shapes Behavior 759 III. What ESG Issues are More Likely to Give Rise to a Caremark Claim? ........................................................ 765 A. Adverse Impacts on Consumers: Cybersecurity ... 767 B. Adverse Impact on Workers: Sexual Harassment and Diversity ........................................................ 771 1. Sexual Misconduct ........................................... 771 2. Diversity ........................................................... 775 C. Adverse Impact on the Environment: Climate Change .................................................................. 776 D. Factors that Apply Across All ESG Risks ............ 781 734 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 1. Factors that May Trigger Heightened Scrutiny ........................................................... 781 2. Factors in Assessing Board Oversight Behavior Collectively ...................................... 783 3. What the Future Holds: Caremark Liability for Political Spending and AI Bias? ............... 784 IV. Is It Desirable to Extend Caremark to ESG? ................ 787 A. Prevalent (But Less Convincing) Arguments ....... 787 B. Benefits: Balancing the Flaws of Other Enforcement Mechanisms .......................................................... 792 C. Costs: Hindsight Bias ............................................ 798 V. Conclusion ........................................................................ 800 I. INTRODUCTION Corporations are facing increased societal demands calling on them to treat their stakeholders, and society at large, better.1 In the past, such demands were relegated to a “nice- to-have,” corporate philanthropy category. Accordingly, much of the corporate legal literature focused on the extent to which corporate managers could make decisions that advance the interests of other stakeholder groups, and not solely shareholders.2 These days, by contrast, attention to environmental, social, and governance (ESG) issues is becoming a must. Companies that fail to meet societal demands on issues such as user privacy, racial and gender diversity, and environmental sustainability may face significant blowback.3 Even if the behavior in question is not punishable by law, failure to address critical ESG concerns could lead to reputational fallout and hurt the company’s 1 See Leo E. Strine, Jr., Kirby M. Smith & Reilly S. Steel, Caremark and ESG, Perfect Together: A Practical Approach to Implementing an Integrated, Efficient, and Effective Caremark and EESG Strategy, 106 IOWA L. REV. 1885, 1886 (2021). 2 Cynthia A. Williams & John M. Conley, Is There an Emerging Fiduciary Duty to Consider Human Rights?, 74 U. CIN. L. REV. 75, 75 (2005). 3 Stavros Gadinis & Amelia Miazad, Corporate Law and Social Risk, 73 VAND. L. REV. 1401, 1418, 1437 (2020). No. 2:732] MISSION CRITICAL ESG 735 ability to attract and retain talent, access capital, and sell products. In other words, ESG concerns have become a major source of risk for companies and their shareholders. The question at the heart of corporate law these days is, therefore, how shareholders can hold managers accountable for failures to address critical ESG concerns. Much of the literature focuses on non-litigation channels. Shareholders can vote with their feet, by investing (or divesting) based on ESG criteria.4 They can also vote with their hands, by replacing directors who are inattentive to climate-related risks with “green directors.”5 When the literature invokes law- enforcement channels, it usually does so in the context of securities law’s disclosure requirements. For example, shareholders can bring a federal securities class action, claiming that the company misled or omitted material ESG information.6 This Article focuses on a different accountability mechanism that had been largely ignored in the ESG literature, namely, corporate law’s director oversight duties (dubbed Caremark duties, after Delaware’s leading precedent). The idea is intuitive: the organ in charge of risk oversight is the board of directors. If a company suffers reputational harms due to a failure to address a certain ESG concern, shareholders can theoretically bring a derivative action on behalf of the company, arguing that the directors breached their fiduciary duties by paying insufficient 4 For references on just how much investments are being influenced by ESG criteria, see infra note 14. 5 For a concrete real-world example, see ExxonMobil Loses a Proxy Fight with Green Investors, THE ECONOMIST (May 27, 2021), https://www.economist.com/business/2021/05/23/what-a-proxy-fight-at- exxonmobil-says-about-big-oil-and-climate-change [https://perma.cc/D9QT- 53GM]. On the rise of ESG-related shareholder activism more generally, see Lisa M. Fairfax, Social Activism through Shareholder Activism, 76 WASH & LEE L. REV. 1129 (2019). 6 For concrete, real-world examples, see infra note 19. On ESG disclosure regimes more generally, see Ann M. Lipton, Not Everything Is About Investors: The Case for Mandatory Stakeholder Disclosure, 37 YALE J. REG. 499 (2020); Jill E. Fisch, Making Sustainability Disclosure Sustainable, 107 GEO. L.J. 923 (2019). 736 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 attention to an issue critical to the company’s success. Yet, despite its intuitiveness, the Caremark channel was previously largely dismissed by corporate legal scholars, who reasoned that oversight duties are virtually never enforced, even in the context of clear illegalities.7 This kind of reasoning has become outdated. Over the past two years, Delaware courts have revamped their Caremark framework.8 The courts are now (1) increasingly willing to apply heightened scrutiny of board oversight efforts, and (2) increasingly willing to grant outside shareholders access to internal company documents in order to investigate failure-of-oversight claims. As a result, six (and counting) Caremark cases have succeeded over the past two years. There can no longer be any question about Caremark’s relevance. The only question is about Caremark’s scope. To what extent does this revamped Caremark framework also apply to oversight of nonlegal risks? Would the courts show the same willingness to apply heightened scrutiny and provide access to pre-suit discovery even when the misbehavior in question is not punishable by law (but “merely” by reputational fallouts)? Traditionally, Caremark cases have focused on oversight of clear illegalities. But this state of affairs seems to be changing fast. In several 2021 cases, Delaware courts showed willingness to fault directors for putting short-term profits over consumer safety or user privacy, even when the company met the regulatory requirements. It remains to be seen whether this trend also extends to other ESG issues such as political spending or climate change. 7 See, e.g., Virginia Harper Ho, Board Duties: Monitoring, Risk Management & Compliance, in COMPARATIVE CORPORATE GOVERNANCE 242, 251 (Afra Afsharpour & Martin Gelter eds., 2021); Brett McDonnell et al., Green Boardrooms?, 53 CONN. L. REV. 335, 387 (2021); Lipton, supra note 6, at 505; Tom C. W. Lin, Executive Private Misconduct, 88 GEO. WASH. L. REV. 327, 360 (2020); H. Justin Pace, Rogue Corporations: Unlawful Corporate Conduct and Fiduciary Duty, 85 MO. L. REV. 1, 4 (2020). 8 See generally Roy Shapira, A New Caremark Era: Causes and Consequences, 98 WASH. U. L. REV. 1857 (2021). No. 2:732] MISSION CRITICAL ESG 737 The Article examines the scope of director oversight duties as they pertain to ESG and makes three key contributions. First, the Article canvasses the body of oversight liability cases to examine whether Caremark also extends to ESG risks, and answers in the affirmative. At its core, Caremark is about ensuring that corporate boards take their risk oversight role seriously. What matters most for Caremark’s scope is not whether a risk is legal or reputational, but rather, whether a risk is critical to the company’s operations or not. The Article’s second contribution is to delineate what makes certain ESG risks “mission critical” (and therefore subject to a viable threat of Caremark liability) and others not. One way to distinguish between critical and non-critical risks is to look at their potential impact on the company’s reputation. Not all ESG risks are reputation-relevant. It is tempting to assume that, because trillions of dollars are being invested according to ESG criteria, any ESG risk could have a critical effect on the company’s reputation, and should therefore be on boards’ agendas. But systematic empirical studies show that most ESG news hardly impacts markets.9 This Article sheds light on how companies prioritize among various reputational risks, based on insights from a burgeoning reputation literature, interviews that I conducted with corporate reputation consultants, and an analysis of memos that law firms sent to their corporate clients on the issue. Armed with a better understanding of how different ESG concerns affect corporate reputation differently, I return to the caselaw to build a doctrinal framework for analyzing potential Caremark liability for issues such as cybersecurity, sexual harassment, and climate change. One upshot is that 9 See George Serafeim & Aaron Yoon, Which Corporate ESG News Does the Market React To? (Harv. Bus. Sch. Acct. & Mgmt. Unit, Working Paper No. 21-115). To be sure, empirical studies that are based on stock market reactions are a very crude proxy for measuring reputational impact. Certain ESG issues could impact the company’s long-term reputation without being reflected in short-term stock price movements. See, e.g., Roy Shapira, Legal Sanctions, in THE SAGE ENCYCLOPEDIA OF CORPORATE REPUTATION (Craig Carroll ed., 2016). Still, this is one tractable datapoint that one should not ignore. 738 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 the threat of Caremark liability becomes more relevant as we move along the acronym letters: “Governance” risks are in general more relevant than “Social” risks, which are in turn more relevant than “Environmental” risks. For example, cybersecurity risks are likely to count as mission critical across business sectors, whereas climate-related risks may count as critical for only a limited number of companies, and outside shareholders would find it difficult to find evidence linking board inaction to climate-related harms. The Article’s third contribution is to evaluate the social desirability of the trend of extending Caremark to nonlegal risks. I analyze the common arguments against broadening Caremark’s scope, such as that doing so will raise the costs of board discussions and impede board primacy, and I find these arguments wanting. As long as a nonlegal risk is critical, there is no good reason why Caremark should not apply in principle to it. Still, there exist good reasons to adopt a more careful approach when scrutinizing reputational risk oversight relative to scrutinizing legal risk oversight. In particular, the costs of judicial hindsight bias seem to loom larger in the former. Recognizing these differences between the types of Caremark cases carries important implications, including for judges deciding whether to grant shareholders pre-suit discovery or what inferences to draw at the pleading stage. A couple of clarifications are in order at the outset. First, one could object to the distinction between legal and nonlegal risks as merely semantic. For example, if a certain ESG risk such as climate change becomes material to the company’s financial success, securities laws require that the company properly disclose it. Failure to be attentive to such climate change risk, even if not punishable by climate regulation, may then become punishable by securities regulation, and directors could be held personally liable for the legal fines that the company incurred in securities enforcement actions. But the purpose of this Article is not to distinguish between legal and nonlegal risks in a vacuum. The purpose, rather, is to explore the evolution of the scope of director oversight duties over the years. If, in the past, Caremark litigation revolved around clear illegalities such as a pharmaceutical company No. 2:732] MISSION CRITICAL ESG 739 paying kickbacks to physicians, today, Caremark cases increasingly edge toward reputational risks, such as faulting the board for neglecting product safety even when the company technically met the regulatory requirements. A second potential objection is that framing crucial topics such as racial diversity and sexual harassment in a corporate- reputation, shareholder-value framework commodifies the real victims and “cheapens the moral imperative for reform.”10 I fully acknowledge that corporate law should not be the primary tool to discuss or address such crucial societal ills. My claim here is rather more modest: when calibrated properly, corporate law’s oversight liability doctrine has the potential to supplement other tools for bringing positive change to these and other societal concerns. Supplement—not substitute. For example, oversight liability litigation nicely balances the flaws of other enforcement mechanisms by emphasizing individual accountability and upward flows of information inside corporations. It can therefore counter the incentives of top corporate managers to remain willfully ignorant of activities that put profits over everything else. Finally, nothing in this Article suggests that corporate managers should not do more to promote broader societal interests. When I conclude that a certain ESG issue is not critical to the company’s success and not subject to Caremark liability, I do not mean that directors cannot take action on said issue. Corporate law enables directors to pay attention even to issues that are not critical to the company’s success. But the converse does not hold: corporate law subjects directors to personal liability for not paying attention only when the issue in question is critical to the company’s success. The Article proceeds in four Parts. Part II provides background, explaining why the Caremark framework is important, how it works, and why it extends also to ESG risks that are not subject to legal regulation. Part III applies the general framework to evaluate the likelihood of Caremark liability across different ESG concerns: cybersecurity, political 10 Chris Brummer & Leo E. Strine, Jr., Duty and Diversity, 75 VAND. L. REV. 1, 27 (2022). See also infra note 223 and accompanying text. 740 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 spending, sexual misconduct, racial diversity, and climate change. Part IV shifts from the positive to the normative, evaluating the desirability of the trend of broadening Caremark’s scope to nonlegal risks. An extended Conclusion follows, juxtaposing the Article’s contributions to the literature, recognizing its limitations, and highlighting its implications for corporate practitioners and policymakers. II. DOES CAREMARK EXTEND TO OVERSIGHT OF ESG? In the past few years, several ESG issues have become sources of major risk for companies.11 Companies that fail to meet evolving societal demands on issues such as cybersecurity, gender and racial diversity, and environmental sustainability may face significant reputational fallouts, and find it harder to recruit and retain top talent, charge premium prices, and access cheap capital.12 In corporate law, the organ in charge of risk oversight is the board of directors. The question then becomes how shareholders can hold directors accountable for ESG risk oversight. Much of the extant literature has focused on accountability via non-litigation channels. One channel for shareholders to 11 For brevity and scope, I do not delve here into the “why now” question, namely, why ESG risks have intensified in recent years. See, e.g., David F. Larcker & Brian Tayan, Blindsided by Social Risk: How Do Companies Survive a Storm of Their Own Making? (Stanford Closer Look Series No. CGRP-85, 2020) (suggesting a variety of reasons, from the proliferation of online platforms, to heightened societal sensitivity to certain issues). Note also the strong “everything old is new again” undertone here. See, e.g., Williams & Conley, supra note 2, at 78 (arguing already in 2005 that society’s expectations for business had grown more demanding “recently,” and citing the rise of activist institutional investors interested in ESG as one reason why). 12 Pamela Marcogliese et al., Board Memo 2022: Sustainability and Beyond, HARV. L. SCH. F. ON CORP. GOVERNANCE (Jan. 15, 2022), https://corpgov.law.harvard.edu/2022/01/15/board-memo-2022- sustainability-and-beyond/. [https://perma.cc/5QST-D65L]; see also ROY SHAPIRA, LAW AND REPUTATION: HOW THE LEGAL SYSTEM SHAPES BEHAVIOR BY PRODUCING INFORMATION 11–35 (2020) (explaining what reputational sanctions are and how they manifest). No. 2:732] MISSION CRITICAL ESG 741 push directors into paying more attention to ESG concerns is by speaking out. Famous examples include the Business Roundtable’s 2019 declaration and BlackRock’s Larry Fink’s annual letters, admonishing corporate managers to put customers, workers, and the climate front and center.13 Another channel is for shareholders to vote with their feet, by investing or divesting (up to trillions of dollars) according to ESG criteria.14 Yet another channel is for shareholders to vote with their hands, by voting in contested elections for the board of directors or in contested shareholder proposals.15 Indeed, 2021 saw record-level support for shareholder ESG proposals,16 and the trend does not seem to be going anywhere.17 To the extent that the literature has invoked the channel of shareholder ESG litigation, it was usually within the context of federal securities litigation to enforce material 13 Business Roundtable Redefines the Purpose of a Corporation to Promote “An Economy That Serves All Americans”, BUS. ROUNDTABLE (Aug. 19, 2019), https://www.businessroundtable.org/business-roundtable- redefines-the-purpose-of-a-corporation-to-promote-an-economy-that- serves-all-americans [https://perma.cc/P2FF-LCM4]; Larry Fink, Larry Fink’s 2018 Letter to CEOs: A Sense of Purpose, BLACKROCK (2018), https://www.blackrock.com/corporate/investor-relations/2018-larry-fink- ceo-letter. [https://perma.cc/S3DE-BV8C]. Fink is the CEO of investment giant BlackRock. 14 Witold Henisz et al., Five Ways that ESG Creates Value, MCKINSEY Q. (Nov. 2019) (providing an estimate of the sum of investments that are influenced by ESG concerns). 15 Supra note 5. 16 Record Breaking Year for Environmental, Social, and Sustainable Governance Shareholder Resolutions, AS YOU SOW (Jun. 24, 2021), https://www.asyousow.org/press-releases/2021/6/24/record-breaking-year- for-environmental-social-and-sustainable-governance-shareholder- resolutions [https://perma.cc/F636-URRD]. The growing success of ESG proposals is driven by a shift in the voting policies of the biggest institutional investors and proxy advisory firms. It also does not hurt that the SEC has modified its shareholder-proposal rules to make it more difficult for companies to exclude ESG proposals. See, e.g., Gadinis & Miazad, supra note 3, at 1408. 17 Holly J. Gregory, Board Oversight: Key Focus Areas for 2022, HARV. L. SCH. F. ON CORP. GOVERNANCE (Jan. 5, 2022), https://corpgov.law.harvard.edu/2022/01/05/board-oversight-key-focus- areas-for-2022/. [https://perma.cc/MA9Q-FPY3]. 742 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 misstatements or omissions of ESG disclosures.18 For example, when Yahoo and Equifax experienced cyberattacks, shareholders filed federal class actions claiming that the companies had misled investors about the scope and sensitivity of the information that leaked.19 But there exists a different channel for shareholders to hold directors accountable, namely, corporate law’s oversight duties doctrine (Caremark). On paper, a Caremark derivative action is the intuitive way to go: shareholders who believe that directors’ lack of attention to ESG has caused their company reputational and financial harms can bring a derivative action on behalf of the company. But in the ESG literature, this channel has largely been dismissed, in the persuasion that Caremark duties are a toothless tiger.20 This belief is no longer accurate. In the past two years, Delaware courts have revamped their oversight duties framework, and it is by now anything but a toothless tiger.21 Corporate practitioners and scholars should therefore take a hard look at Caremark’s potential impact on corporate ESG behavior. There is also a practical, procedural reason for examining Caremark’s application to ESG: failure-of-oversight claims are the key that unlocks other types of corporate law claims. To understand why, consider the following scenario. The CEO of 18 Chris Prentice, U.S. Markets Regulator Deploys Team to Target Climate, ESG Misconduct, REUTERS (Mar. 4, 2021), https://www.reuters.com/article/us-usa-sec-climate-idUSKBN2AW2KH [https://perma.cc/C5ZU-6CXH]. ESG disclosures are scrutinized not just in private enforcement by securities class actions, but also in public enforcement by SEC enforcement actions. Indeed, in 2021, the SEC opened a twenty-two-person task force dedicated to the subject. SEC Announces Enforcement Task Force Focused on Climate and ESG Issues, SEC. & EXCH. COMM’N (Mar. 4, 2021), https://www.sec.gov/news/press-release/2021-42 [https://perma.cc/MG53-264G]. 19 Kevin LaCroix, Equifax Data-Breach Related Securities Suit Settled for $149 Million, THE D&O DIARY (Feb. 17, 2020), https://www.dandodiary.com/2020/02/articles/securities-litigation/equifax- data-breach-related-securities-suit-settled-for-149-million/ [https://perma.cc/RE2X-WBTW]. 20 Supra note 7. 21 See generally Shapira, supra note 8. No. 2:732] MISSION CRITICAL ESG 743 a large company is accused of harassing his female employees and creating a toxic working environment. The well- publicized and corroborated allegations cause the company’s stock price to tumble. Outside shareholders then file a derivative action against the harassing CEO. But because derivative actions usurp the board’s usual authority, the shareholders need to convince the courts that making a demand on the board to assert the company’s claims against the CEO will be futile. In many instances, the only way to do that is by showing that the majority of the board faces substantial likelihood of personal liability for the behavior in question.22 And since the directors were not the ones harassing, the shareholders in this scenario need to show that the directors face liability for not doing enough to stop the harassment (by being inattentive to sexual misconduct). Without such evidence, the courts will likely dismiss the case on the theory that it is for directors to decide whether suing the CEO is in the company’s best interests.23 The upshot is that, without first establishing a Caremark-type claim against the directors, the shareholders will have a hard time holding primary wrongdoers accountable. As another indication of the practical importance of understanding Caremark’s application to ESG, consider that legal advisors to corporate boards report that they are asked this sort of question on a regular basis.24 One cannot provide a definitive answer yet, as no Caremark claim that is based purely on nonlegal risk oversight has succeeded in Delaware thus far.25 But a deep dive into the caselaw reveals ample 22 See United Food & Com. Workers Union v. Zuckerberg, 250 A.3d 862, 885 (Del. Ch. 2020), aff’d, 262 A.3d 1034 (Del. 2021); Rales v. Blasband, 634 A.2d 927, 930 (Del. 1993). 23 For the real-world case behind this hypothetical, see Daniel Hemel & Dorothy S. Lund, Sexual Harassment and Corporate Law, 118 COLUM. L. REV. 1583, 1615 (2018). 24 Martin Lipton, Some Thoughts for Boards of Directors in 2022, HARV. L. SCH. F. ON CORP. GOVERNANCE (Dec. 28, 2021), https://corpgov.law.harvard.edu/2021/12/28/some-thoughts-for-boards-of- directors-in-2022/ [https://perma.cc/8KSE-FWDL]. 25 Outside of Delaware, there have been a few instances of courts recognizing a claim for failure of business risk oversight. See Sarah Barker, 744 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 indications that the courts are willing to expand Caremark’s scope to ESG risks, as this Part shows. Section A provides some general background on the evolution of the Caremark framework over the years. Section B analyzes recent cases in an attempt to decipher the extent to which the framework applies also to behaviors that are not punishable by law. Section C explains what exactly it means to be under Caremark’s scope. The Caremark framework affects behavior not necessarily by imposing legal sanctions on directors, but rather indirectly, by subjecting directors to the nonlegal (emotional and reputational) costs of going through discovery. Accordingly, in evaluating Caremark’s potential impact on ESG, the important question is not whether judges are likely to ultimately rule in favor of plaintiffs. Rather, the important questions are whether judges are likely to grant pre-suit discovery (ruling in favor of plaintiffs in Section 220 actions), and whether they are likely to draw inferences against directors at the pleading stage (ruling in favor of plaintiffs in motions to dismiss, on the way to full discovery). A. Background: The Caremark Framework The 1996 Caremark decision changed corporate law’s approach to board oversight duties from reactive to proactive.26 Prior to Caremark, directors could assume that everything was fine until someone in the company flagged a problem to them.27 Caremark introduced a duty to implement a system that tracks and reports potential problems to the board, and to constantly monitor that system and to react to Cynthia Williams & Alex Cooper, Fiduciary Duties and Climate Change in the United States 24 nn.71–72 (Commonwealth Climate and Law Initiative Paper, Oct. 2021), https://ccli.ubc.ca/wp-content/uploads/2021/12/Fiduciary- duties-fand-climate-change-in-the-United-States.pdf (compiling references). 26 In re Caremark Int’l Inc. Derivative Litig., 698 A.2d 959 (Del. Ch. 1996), adopted by Stone ex rel. AmSouth Bancorporation v. Ritter, 911 A.2d 362, 365 (Del. 2006). 27 See, e.g., Graham v. Allis-Chalmers Mfg. Co., 188 A.2d 125 (Del. 1963). No. 2:732] MISSION CRITICAL ESG 745 the red flags that it raises.28 At the same time, Caremark called on judges to show restraint, and to impose liability only when it is clear that directors knew they were breaching their duties.29 Negligence or even gross negligence is not enough; to establish a Caremark claim, plaintiffs have to show bad faith on the part of the directors.30 The bad-faith requirement turned into an insuperable pleading hurdle.31 Plaintiffs had to plead with particularity facts about what directors knew and when they knew it, which is not the type of evidence that one can glean from public documents and without access to discovery.32 As a result, plaintiffs usually resorted to regurgitating facts about the trauma that the company suffered, but did not (could not) link the trauma to bad faith on the part of the directors.33 Caremark lawsuits thus turned into a parade of early dismissals, and corporate legal scholars denounced Caremark as a “toothless tiger.”34 This state of affairs started changing in June 2019, with the Blue Bell case (Marchand).35 Blue Bell, an ice cream manufacturer, suffered a listeria outbreak in one of its product lines, causing three deaths and massive recalls.36 When shareholders brought a Caremark claim, the Court of 28 Stone, 911 A.2d at 370. 29 Id.; Caremark, 698 A.2d at 967, 971. 30 Caremark, 698 A.2d at 967, 971. 31 Elizabeth Pollman, Corporate Oversight and Disobedience, 72 VAND. L. REV. 2013, 2032 (2019) (compiling references); Paul E. McGreal, Caremark in the Arc of Compliance History, 90 TEMP. L. REV. 647, 676 n.238 (2018) (same). 32 See, e.g., South v. Baker, 62 A.3d 1, 23 (Del. Ch. 2012). 33 See id.; In re Citigroup Inc. S’holder Derivative Litig., 964 A.2d 106, 128–29 (Del. Ch. 2009). 34 See, e.g., Anne Tucker Nees, Who’s the Boss? Unmasking Oversight Liability within the Corporate Power Puzzle, 35 DEL. J. CORP. L. 199, 216 (2010); Mercer Bullard, Caremark’s Irrelevance, 10 BERKELEY BUS. L.J. 15, 44 (2013); Charles M. Elson & Christopher J. Gyves, In re Caremark: Good Intentions, Unintended Consequences, 39 WAKE FOREST L. REV. 691, 692 (2004). 35 Marchand v. Barnhill, 212 A.3d 805 (Del. 2019). 36 Id. at 807. 746 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 Chancery routinely dismissed it, citing the lack of smoking- gun indications that directors knew about food safety issues yet ignored them. But for Delaware’s Supreme Court, the lack of indications that Blue Bell’s board discussed food safety problems was itself an indication that the directors breached their oversight duties.37 If you are a director of a company that sells only ice cream, and you do not ensure that the board discusses food safety issues, you are probably not making a good-faith effort to engage in oversight, the court reasoned.38 Importantly, the court identified food safety as “mission critical” for an ice cream manufacturing company, and implied that board oversight of such critical issues is subject to heightened judicial scrutiny.39 In the immediate wake of Marchand, corporate legal scholars and practitioners debated whether the case was a harbinger of a different approach to oversight duties, or simply the outcome of rare circumstances (notably, three deaths).40 They got their answer quickly: within a little over a year, three additional Caremark cases survived motions to dismiss: Clovis,41 Hughes,42 and Chou.43 This quartet of 37 Id. at 822–23. 38 Id. 39 Id. at 822–24. 40 See Robert C. Bird, Caremark Compliance for the Next Twenty-Five Years, 58 AM. BUS. L. J. 63, 90–97 (2021) (analyzing thirty law firm memos). 41 In re Clovis Oncology, Inc. Derivative Litig., No. 2017-0222-JRS, 2019 WL 4850188 (Del. Ch. Oct. 1, 2019). The case was about a young pharmaceutical company whose success hinged on the development of a promising lung cancer drug. The court found pleading-stage inferences that Clovis’ directors breached their oversight duties by not responding to red flags about violations of FDA protocols. Id. at *1–*3. 42 Hughes v. Hu, No. 2019-0112-JTL, 2020 WL 1987029 (Del. Ch. Apr. 27, 2020). The case was about a manufacturer of parts for electric vehicles which constantly failed to meet its reporting requirements. The court maintained that having the trappings of an oversight system is not enough if the internal documents reveal that the system operated mostly cosmetically, as window dressing. Id. at *31, *34–36. 43 Teamsters Loc. 443 Health Servs. & Ins. Plan v. Chou, No. 2019- 0816-SG, 2020 WL 5028065 (Del. Ch. Aug. 24, 2020). There, one of the subsidiaries of pharmaceutical giant AmerisourceBergen (ABC) violated FDA rules on marketing and storing drugs. The court found pleading-stage No. 2:732] MISSION CRITICAL ESG 747 successful Caremark claims signaled that a new, revamped mode of oversight liability was upon us.44 This new Caremark era rests on two pillars:45 (1) an increased willingness to apply heightened scrutiny of board oversight, via the “mission critical” designation,46 and (2) an increased willingness to grant outside shareholders access to internal company documents in order to investigate potential failure-of- oversight claims. indications for several red flags that were ignored by ABC’s directors, such as a report by an outside law firm flagging the lack of monitoring of the particular subsidiary in question. Id. at *69. 44 The trend of heightened oversight duties actually extends beyond these four cases. In early 2020, the court applied the Marchand framework to sustain a claim parallel to Caremark in a master limited partnership. Inter-Mktg. Grp. USA v. Armstrong, C.A. No. 2017-0030-TMR, 2020 WL 756965, at *31–40 (Del. Ch. Jan. 31, 2020). And throughout 2019 and 2020, the courts ruled against defendants in preliminary Section 220 actions revolving around failure-of-oversight claims. See AmerisourceBergen Corp. v. Lebanon Cnty. Emps.’ Fund, 243 A.3d 417, 424 (Del. 2020); In re Facebook, Inc. Section 220 Litig., No. 2018-0661-JRS, 2019 WL 2320842, at *12 (Del. Ch. May 30, 2019). More on Section 220 to come in the following paragraphs. In the meantime, and in a nutshell: Section 220 actions are basically litigation over pre-suit discovery rights, where outside shareholders ask to inspect internal company documents and the company objects to the purpose and scope of shareholders’ requests. 45 Shapira, supra note 8, at 1873. 46 An earlier version of this Article used here the term “enhanced scrutiny.” Delaware’s Court of Chancery remarked while citing the Article’s earlier version that the term is restricted to certain situations (implying Revlon and Unocal duties in deal litigation) in which the burden is on defendants to show the reasonableness of their actions, and that “even after Marchand, Delaware courts are not applying reasonableness review in Caremark cases.” City of Detroit Police & Fire Ret. Sys. v. Hamrock, C.A. No. 2021-0370-KSJM, 2022 WL 2387653, at *14 n.111 (Del. Ch. Jun. 30, 2022). While I believe that there are, in fact, some elements resembling reasonableness review in how Delaware courts have been analyzing director oversight duties within a “mission critical zone” (see in particular the Boeing decision as analyzed in Roy Shapira, Max Oversight Duties: How Boeing Signifies a Shift in Corporate Law, 48 J. CORP. L. (forthcoming 2022) (manuscript at 24), https://ssrn.com/abstract=4035952 [https://perma.cc/B3JP-7VDC]), I accept the Chancellor’s remark and revise accordingly to “heightened” scrutiny. 748 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 The recent successful Caremark case of Boeing, decided in September 2021, illustrates these two pillars perfectly.47 The backdrop there was Boeing’s 737 Max debacle, involving two fatal crashes and numerous question marks about the company’s commitment to air safety.48 Aside from the tragic consequence of lost lives, the debacle also cost the company at least $20 billion. Shareholders filed a derivative action against the company’s executives and directors for causing this harm by not being attentive to product safety prior to the first crash, and for not responding properly to red flags after the first crash.49 Defendants filed a motion to dismiss, but the court rejected it. Just like in Marchand, the Boeing court designated product safety as “mission critical,” thereby activating the enhanced mode of scrutiny of board oversight. But unlike in Marchand (and Clovis), where the company in question was small and monoline (offering a single product), in Boeing the company was very large with numerous business units.50 In that sense, Boeing signals Delaware courts’ willingness to expand the zone of heightened scrutiny so that it applies to more types of companies. Following Boeing, one could claim that virtually every director of a manufacturing company operates in the mission critical zone.51 Boeing further illustrates just how enhanced the scrutiny is once a board is in that zone: the court scrutinized 47 In re Boeing Co. Derivative Litig., C.A. No. 2019-0907-MTZ, 2021 WL 4059934 (Del. Ch. Sept. 7, 2021). 48 Id. at *1–2. 49 I elaborate on the case and its many nuances in a separate paper. Shapira, supra note 46. 50 A California federal court applying Delaware law had already maintained a Caremark claim against the board of a giant company in a case concerning the Wells Fargo phony accounts scandal. Shaev v. Baker, No.16-cv-05541-JST, 2017 WL 1735573, at *51 (N.D. Cal. May 4, 2017). 51 Shapira, supra note 46, at 1; Stephen Bainbridge, After Boeing, Caremark is No Longer “The Most Difficult Theory in Corporation Law Upon Which a Plaintiff Might Hope to Win a Judgment”, PROFESSORBAINBRIDGE.COM (Sept. 8, 2021), https://www.professorbainbridge.com/professorbainbridgecom/2021/09/afte r-boeing-caremark-is-no-longer-the-most-difficult-theory-in-corporation- law-upon-which-a-plainti.html [https://perma.cc/Y3VV-5U85]. No. 2:732] MISSION CRITICAL ESG 749 directors not just for what they knew but also for what they should have known, and criticized directors not just for doing nothing but also for not doing enough.52 Boeing also illustrates the new Caremark era’s second pillar, namely, increased willingness to provide outside shareholders with access to internal company documents. Shareholders have always enjoyed a qualified right, nestled in Delaware law’s Section 220, to inspect their companies’ books and records.53 But over the past couple of years, Section 220 has increasingly become an effective pre-filing investigatory tool, as Delaware courts have liberalized their interpretation of the section’s requirements.54 The courts now order the provision of documents in more cases,55 and are willing to include in those orders more types of documents.56 In that respect, footnote 1 of the Boeing opinion may be the most important part of the decision: it tells us that, prior to filing the derivative action, the plaintiffs submitted a request to inspect the company’s books and records, which gave them 52 See Shapira, supra note 46, at 8. 53 DEL. CODE ANN. tit. 8, § 220 (2021). In a nutshell, Section 220 grants stockholders access to their company’s books and records, as long as stockholders show “proper purpose” (such as wanting to investigate a potential breach of fiduciary duty). The access is further limited only to these documents that are “necessary and essential” to achieve the stated proper purpose. As the body of text explains, in recent years, Delaware courts have relaxed their interpretation of both the purpose and the scope requirements. See generally Roy Shapira, Corporate Law, Retooled: How Books and Records Revamped Judicial Oversight, 42 CARDOZO L. REV. 1949, 1952 (2021); Geeyoung Min & Alexander M. Krischik, Realigning Stockholder Inspection Rights, 27 STAN. J. L. BUS. FIN. 225, 233 (2022). 54 On the Section 220 turn in deal litigation, see Shapira, supra note 53, at 1976–79. 55 See, e.g., AmerisourceBergen Corp. v. Lebanon Cnty. Emps.’ Fund, 243 A.3d 417, 427 (Del. 2020) (clarifying that to demonstrate a “proper purpose” for inspection, shareholders do not need to show indications of an actionable claim against the directors). 56 See, e.g., In re Facebook, Inc. Section 220 Litig., No. 2018-0661-JRS, 2019 WL 2320842, at *18 n.185 (Del. Ch. May 30, 2019) (ordering Facebook’s top executives and directors to produce not just formal board materials, but also private emails). 750 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 access to over 630,000 pages of internal Boeing materials relevant to airplane safety oversight.57 Giving sophisticated plaintiffs access to 630,000 pages of internal discussions completely alters the prospect of Caremark liability. Armed with this powerful pre-suit discovery tool, plaintiffs have strong chances of finding indications of one of two alternative Caremark prongs: (1) that directors utterly failed to collect information about a critical issue, or (2) that directors collected information but failed to respond to red flags. All in all, it is clear that the prospect of oversight liability looms larger today than ever before. What remains unclear is the scope of this revamped Caremark framework. Certain corporate behaviors may not lead to the company paying legal sanctions but may nevertheless cause the company to suffer reputational harms. How likely are the courts to apply heightened scrutiny and grant inspection requests in such cases? B. Does the Caremark Framework Extend to ESG Risk Oversight? The Caremark decision did not limit itself to oversight of legal compliance. Rather, it explicitly mentioned oversight of the company’s business performance as an integral part of director oversight duties.58 And Stone—the Delaware Supreme Court case that adopted Caremark—similarly required oversight of “operational viability” along with “legal compliance” and “financial performance” as the focus of oversight duties.59 Indeed, in the first decade of the Caremark framework’s development, corporate legal scholars assumed that there exists no doctrinal reason for not extending 57 In re Boeing Co. Derivative Litig., C.A. No. 2019-0907-MTZ, 2021 WL 4059934, at *1 n.1 (Del. Ch. Sept. 7, 2021). 58 In re Caremark Int’l Inc. Derivative Litig., 698 A.2d 959, 970 (Del. Ch. 1996). 59 Marchand v. Barnhill, 212 A.3d 805, 809 (Del. 2019) (citing Stone v. Ritter, 911 A.2d 362, 370 (Del. 2006)). No. 2:732] MISSION CRITICAL ESG 751 Caremark to business risk oversight.60 But at the start of the framework’s second decade, a couple of cases arising from the 2008 financial crisis challenged that perception. The 2009 Citigroup decision introduced a clear distinction between oversight of legal compliance risk and oversight of business risk.61 Courts should be extra wary of extending Caremark to the latter, Citigroup maintained, so as to not allow plaintiffs to bypass the policy behind the deferential “business judgment rule.”62 Managers occasionally make decisions that blow up in their company’s face, yet corporate law refrains from judging with hindsight the reasonableness of said decisions.63 Extending Caremark to business risks would provide plaintiff attorneys a guise to lure judges into undesirable second-guessing: instead of claiming that directors took bad decisions, plaintiffs would claim that directors did not do enough to prevent risks from materializing.64 60 Stephen M. Bainbridge, Caremark and Enterprise Risk Management, 34 J. CORP. L. 967, 968 (2009) (discussing business risk more generally); Geoffrey Christopher Rapp, A New Direction for Shareholder Environmental Activism: The Aftermath of Caremark, 31 WM. & MARY ENVTL. L. & POL’Y REV. 163, 164 (2006) (discussing ESG risk). 61 In re Citigroup Inc. S’holder Derivative Litig., 964 A.2d 106, 131 (Del. Ch. 2009). 62 Id. at 126. Under the “business judgment rule,” courts give deference to disinterested, informed board decisions. See Gregory A. Markel, Daphne Morduchowitz & Matthew C. Catalano, A Director’s Duty of Oversight after Marchand in “Caremark” Case, HARV. L. SCH. F. ON CORP. GOVERNANCE (Jan. 23, 2022), https://corpgov.law.harvard.edu/2022/01/23/a-directors-duty-of- oversight-after-marchand-in-caremark- case/#:~:text=Delaware’s%20business%20judgement%20rule%20protects,r esulted%20in%20an%20unfortunate%20result. [https://perma.cc/3M2B- MFXZ]. 63 Stephen M. Bainbridge, The Business Judgment Rule as Abstention Doctrine, 57 VAND. L. REV. 83, 87 (2004). 64 The business judgment rule does not apply to failure-of-oversight claims, as these do not involve making a concrete business decision. Id. at 99; Lisa Fairfax, Managing Expectations: Does the Directors’ Duty to Monitor Promise More Than It Can Deliver?, 10 U. ST. THOMAS L.J. 416, 432 (2012). 752 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 The 2011 Goldman Sachs decision provided an even clearer illustration of the hostile approach for extending Caremark to reputational risk. The court recognized the possibility that Goldman’s employees were engaged in “disloyal and unethical” transactions, yet dismissed the failure-of-oversight claim against Goldman’s directors.65 Pertinently, the Goldman decision acknowledged that there may have been a failure of reputational risk oversight, noting that when a company lets its employees operate in grey zones, it risks suffering reputational fallout.66 Still, the Goldman court maintained, these are usually not the type of risks that give rise to an actionable Caremark claim.67 Every business decision implicates reputational risks, the court explained, and judges should not scrutinize in retrospect decisions when the company’s reputation ends up taking a hit.68 Following Citigroup and Goldman, the prospect of oversight liability for nonlegal risks was deemed practically nonexistent.69 The tide started turning on this front as well with Marchand. Marchand is endlessly discussed and quoted as ramping up judicial scrutiny of corporate compliance.70 But a key aspect of the decision has gone relatively unnoticed, namely, how it explicitly goes beyond compliance with regulatory requirements. Blue Bell’s officers and directors argued in their defense that the company met the regulatory requirements for food safety, and therefore they could not be 65 In re Goldman Sachs Group, Inc. S’holder Litig., Civ. No. 5215–VCG, 2011 WL 4826104, at *20–24 (Del. Ch. Oct. 12, 2011). 66 Id. at *22–23. 67 Id. 68 Both Citigroup and Goldman left open the theoretical possibility of Caremark liability for business risk oversight. Id. at *21–22. But corporate legal scholars and practitioners did not treat it as a realistic possibility. Eric J. Pan, A Board’s Duty to Monitor, 54 N.Y. L. SCH. L. REV. 717, 738 (2009). 69 Pollman, supra note 31, at 2031. 70 See, e.g., Paul J. Lockwood, Delaware Supreme Court Reinforces Director Oversight Obligation, SKADDEN (Nov. 19, 2019), https://www.skadden.com/insights/publications/2019/11/insights-the- delaware-edition/delaware-supreme-court-reinforces [https://perma.cc/7KF4-HZMG]. No. 2:732] MISSION CRITICAL ESG 753 faulted for failure of oversight of compliance.71 For the Marchand court, that was not enough.72 The court insisted that, for a company that sells only ice cream, failures of product (food) safety can be detrimental to business operations, regardless of whether the company meets certain minimum legal requirements or not.73 In Chief Justice Strine’s words, “Blue Bell can only thrive if its consumers enjoyed its products and were confident that its products were safe to eat.”74 Viewed from this angle, Marchand is a case about oversight of critical reputational risks.75 Indeed, Marchand’s progeny—the successful Caremark claims that followed in 2020 and 2021—regularly invoked concepts of reputational risk management.76 Boeing, for example, calls on corporate boards to pay close attention to issues of product safety even when the regulators (there, the FAA) approve its products and procedures.77 Just like no one wants to eat the ice cream of a 71 Marchand v. Barnhill, 212 A.3d 805, 822–23 (Del. 2019). 72 Id. at 823. 73 Id. at 809, 823–24. 74 Id. at 809; see also Jill E. Fisch & Steven Davidoff Solomon, Should Corporations Have a Purpose?, 99 TEX. L. REV. 1309, 1326–27 (2021). 75 The line between “reputational” risk and “financial” risk can be blurred. If a company’s reputation among its workers, suppliers, investors, and customers drops, that drop will likely translate into reduced willingness to work with, sell to, invest in, and buy from the company, which in turn will translate into poorer financial results. But that translation process is not automatic and is often hard to measure. Stock prices may not reflect it immediately. Or the company may enjoy market power that prevents its stakeholders from leaving it and switching to competitors even if the company’s reputation has taken a hit in their eyes. See Roy Shapira, The Challenge of Holding Big Business Accountable, 44 CARDOZO L. REV. (forthcoming 2022) (manuscript at 32–38), https://ssrn.com/abstract=4125334 [https://perma.cc/GBK7-6RFF]. 76 See, e.g., In re Clovis Oncology, Inc. Derivative Litig., 2019 WL 4850188, *15, *15 n.217 (Del. Ch. Oct. 1, 2019). 77 In fact, one could claim that the Boeing decision goes a step further, criticizing directors not just for completely ignoring reputational risk but also for mishandling it. Before the first crash, Boeing’s board seemingly ignored reputational risk, focusing only on profit margins and time-to- market, and failing to implement a reporting system on airplane safety. 754 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 company that has poor food safety controls, no one wants to fly with a company that has poor airplane safety controls. In other words, product failures can pose an existential threat to the company’s reputation and profitability, regardless of what the legal system has to say about these issues.78 In Vice Chancellor Zurn’s words, “the fact that the company’s product facially satisfies regulatory requirements does not mean that the board has fulfilled its oversight obligations to prevent corporate trauma.”79 Following Marchand and Boeing, it is clear that Caremark’s scope extends beyond classic claims of illegalities.80 Still, one could claim that it extends only slightly beyond. After all, these cases involved product safety issues that led to deaths, subjected the company to significant legal risk aside from the reputational risk, and jeopardized the company’s ability to continue selling its main product.81 In After the first crash, Boeing’s board became painfully aware of reputational risk, yet apparently mishandled it: the company supposedly managed the crisis by shifting blame to the airline operators and communicating a “nothing to see here” message, and the board did not delve deep enough into the core safety problems that led to the crash. This strategy ended up increasing Boeing’s long-term reputational risk, as the second crash and the investigations that followed painfully demonstrated. Shapira, supra note 46. 78 David A. Katz & Laura A. McIntosh, Board Structure is Key to Oversight, HARV. L. SCH. F. ON CORP. GOVERNANCE (Sept. 27, 2021), https://corpgov.law.harvard.edu/2021/09/27/board-structure-is-key-to- oversight/ [https://perma.cc/G278-MMRF]. 79 In re Boeing Co. Derivative Litig., C.A. No. 2019-0907-MTZ, 2021 WL 4059934, at *80 (Del. Ch. Sept. 7, 2021). 80 It would be inaccurate to say that Marchand overturned Citigroup and Goldman, as the latter acknowledge some possibility of holding directors accountable beyond clear illegalities. See In re Citigroup Inc. S’holder Derivative Litig., 964 A.2d 106, 126 (Del. Ch. 2009); In re Goldman Sachs Group, Inc. S’holder Litig., Civ. No. 5215–VCG, 2011 WL 4826104, at *21 (Del. Ch. Oct. 12, 2011). What Marchand did, rather, was to pave a way for heightened scrutiny of directors’ oversight efforts in this realm, as the cases cited in the following paragraphs demonstrate. 81 Kevin LaCroix, Del. Court Substantially Denies Boeing Duty of Oversight Claim Dismissal Motion, THE D&O DIARY (Sept. 9, 2021), https://www.dandodiary.com/2021/09/articles/shareholders-derivative- No. 2:732] MISSION CRITICAL ESG 755 other words, the claim would be that these are easy cases that are not indicative of how courts will treat broader ESG concerns. A partial rebuttal to that claim came a month after Boeing, in the October 2021 Marriott case.82 Marriott arguably broadened Caremark’s scope even more. The corporate trauma there was a data security breach, which exposed the personal information of up to 500 million guests.83 Upon announcing the incident, Marriot saw its stock price drop dramatically, and the company started facing private consumer lawsuits and investigations by state attorneys general.84 The company was therefore facing both reputational and legal sanctions. A pension fund shareholder filed a Section 220 request and received access to 3,000 pages of internal cybersecurity discussions. Based on these documents, the shareholder alleged failures to respond not just to legal red flags, but also to reputational red flags. Delaware’s Court of Chancery granted the defendants’ motion to dismiss, reasoning that all these board-level documents actually showed that Marriott’s board took cybersecurity very seriously and was routinely apprised of potential risks and their mitigation.85 litigation/del-court-substantially-denies-boeing-duty-of-oversight-claim- dismissal-motion/ [https://perma.cc/6EP5-GVXN]. 82 Retirement System for Firefighters from St. Louis v. Sorenson, C.A. No. 2019-0965-LWW, 2021 WL 4593777 (Del. Ch. Oct. 5, 2021) [hereinafter Marriott]. 83 Id. at *1. The leak came from the reservation system of a company that Marriott had acquired two years prior (i.e., Starwood). 84 Michal Barzuza & Ido Kenan, Delaware Court in Marriott Ruling: Directors Have Duty of Oversight in Cybersecurity, CALCALIST (Nov. 1, 2021), https://www.calcalistech.com/ctech/articles/0,7340,L-3921397,00.html [https://perma.cc/TG7A-2V3U]. 85 Marriott, 2021 WL 4593777, at *17, *19. In other words, the court did not think that the documents painted a picture of a complete failure to implement a system of monitoring cybersecurity, or of consciously ignoring red flags about potential data leaks. At worst, the court viewed them as painting a picture of responses to red flags that were unsatisfactory. Unsatisfactory responses do not give rise to Caremark liability; only bad faith responses do. Id. at *16. See also Richardson v. Clark, C.A. No. 2019- 1015-SG, 2020 WL 7861335 (Del. Ch. Dec. 31, 2020). 756 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 But for purposes of this Article, more important than the specific outcome of the case is the court’s analysis of oversight of nonlegal risks. Marriott acknowledged that in the past, Delaware courts did not apply Caremark to nonlegal risks, yet maintained that the times are changing.86 One could argue that, if a certain issue comes with the risk of causing the company significant reputational harms, boards could be held accountable for not paying enough attention to it. Cybersecurity, in particular, is not something that corporate boards today can afford to ignore, and meeting the minimum legal requirements may not be enough.87 Marriott actually denotes cybersecurity risk as “an area of consequential risk that spans modern business sectors,” in the context of discussing what counts as “mission critical.”88 One could view this as an important step in the following sense. Prior to Marriott, all one could say was that the courts may, under certain conditions, scrutinize board oversight of reputational risk. Following Marriott, one can now say that the courts may actually apply heightened scrutiny of reputational risk oversight. Marriott thus potentially strengthens the trend of broadening Caremark’s scope beyond classic cases of illegality. This trend toward incorporating ESG risk oversight into Caremark’s scope should not come as a surprise when considering the rationale behind Caremark. Chancellor Allen based Caremark’s departure from the then-binding precedent on a the-times-are-changing argument of his own.89 In 1994, two years prior to Caremark, new federal sentencing guidelines came into effect, promising companies that implemented an effective compliance program leniency in prosecution.90 For Chancellor Allen, such a development transformed compliance into something that corporate boards could no longer ignore, as they would now clearly do so at their 86 Marriott, 2021 WL 4593777, at *12, *12 n.140. 87 Id. at *12. 88 Id. 89 In re Caremark Int’l Inc. Derivative Litig., 698 A.2d 959, 970 (Del. Ch. 1996). 90 Id. No. 2:732] MISSION CRITICAL ESG 757 companies’ peril.91 Fast forward twenty-six years to today, and one can make a similar argument regarding certain ESG issues. Once an ESG issue becomes salient and stakeholders are super-attentive to it, directors ignore that issue at their company’s peril.92 Just like how Caremark reflected and intensified the rise of compliance risk oversight in corporate boardrooms in the 1990s, decisions like Marriott reflect (and will likely intensify) a change that is already underway in corporate boardrooms today: the rise of reputational risk oversight. To illustrate, one 2021 survey found that more than half of directors say that ESG issues feature regularly on their boards’ agendas.93 Another survey found that the overwhelming majority (82%) of directors today consider reputation to be “a business-critical asset,”94 and still another found that the majority of directors consider reputational risk to be the most important area in 91 Id. 92 See E. Norman Veasey & Randy J. Holland, Caremark at the Quarter-Century Watershed: Modern-Day Compliance Realities Frame Corporate Directors’ Duty of Good Faith Oversight, Providing New Dynamics for Respecting Chancellor Allen’s 1996 Caremark Landmark, 76 BUS. LAWYER 1 (2021). Anecdotally, a recent study documents a positive correlation between investment in corporate social responsibility and leniency in corporate prosecutions. Harrison Hong et al., Crime, Punishment and the Value of Corporate Social Responsibility (Working Paper, Oct. 14, 2019), https://ssrn.com/abstract=2492202 [https://perma.cc/YR25-QHDS]. That is, companies that go beyond legal requirements tend to receive reduced sanctions when they are caught violating legal requirements. One can construe this finding as bringing us closer to Chancellor Allen’s Caremark maneuver: corporate boards should engage in oversight of legal compliance (then) and ESG (now), if only because it provides their companies with insurance against tougher sanctions down the road. 93 Maria Castañón Moats & Paul DeNicola, The Corporate Director’s Guide to ESG, HARV. L. SCH. F. ON CORP. GOVERNANCE (Dec. 15, 2021), https://corpgov.law.harvard.edu/2021/12/15/the-corporate-directors-guide- to-esg/ [https://perma.cc/3GG7-FMSM]. 94 Tal Donahue, Managing the Intangible: Reputation in the Boardroom, INFINITE (Aug. 3, 2018), https://infiniteglobal.com/infinite- brief/managing-the-intangible-reputation-in-the-boardroom/ [https://perma.cc/TTC5-VH7B]. 758 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 risk management.95 In the same spirit, directors’ how-to manuals have been updated over the past two years to put much heavier emphasis on reputational risk oversight.96 It is not only that reputational risk has entered boards’ agendas, but also that today’s reputational risk frameworks encompass a broad array of issues. Boards dealt with reputational risk in the past almost solely in the context of product safety crises. Nowadays, by contrast, boards regularly discuss broader ESG concerns, from racial diversity to climate change. Indeed, reputation consultants regularly stress to their corporate clients that in today’s world, “it is not about what you sell, but who you are.”97 According to one well- recognized reputation-measurement methodology, the “Products & Services” component currently accounts for less than 20% of a company’s overall reputation score. The bulk of a company’s reputation score is comprised of multiple other issues such as reputation for “leadership,” “sustainability,” and “workplace.”98 To my mind, this is yet another reason to believe that the trend of extending Caremark to broader ESG concerns will only intensify, as the expansion reflects the reality on the ground in contemporary boardrooms.99 95 Larcker & Tayan, supra note 11. 96 For example, the National Associations of Corporate Directors, which has been publishing an annual “projections on emerging board matters” for decades, included for the first time in its 2020 outlook sentences such as, “boards should also consider reputational risk as a more significant risk than it has been in the past”; and, specifically to cyber risk, “in addition to compliance risk, boards are increasingly aware of the reputational risk of a data incident.” NACD, 2020 GOVERNANCE OUTLOOK: PROJECTIONS ON EMERGING BOARD MATTERS 24, 30 (2020). 97 Zoom Interview with Stephen Hahn, Vice President, RepTrak (Jan. 27, 2022) (transcript on file with the Columbia Business Law Review). 98 Id. 99 Another reason to believe that the courts’ willingness to expand Caremark’s scope is here to stay is rooted in political economy considerations. Corporate legal scholars have long recognized that Delaware corporate law flexibly evolves to meet changing societal demands and co-opt the threat of public backlash and federal intervention. See Mark J. Roe, Delaware’s Competition, 117 HARV. L. REV. 588 (2003) (on Delaware’s efforts to co-opt federal intervention); Sean J. Griffith, Good Faith Business Judgment: A Theory of Rhetoric in Corporate Law No. 2:732] MISSION CRITICAL ESG 759 * At its core, Caremark is about ensuring that directors make an effort to engage in oversight of critical risks. It should not matter that a given critical risk may materialize via market (reputational) sanctions rather than via legal sanctions. All that matters is that, if the risk materializes, it could jeopardize the company’s ability to operate. In other words, what matters is not whether a risk is legal or not, but rather whether the risk is critical or not. To understand Caremark’s scope, we therefore need to understand what issues will be considered critical. In some cases, the answer is intuitive. Product safety is definitely mission critical for manufacturing companies. Cybersecurity is probably mission critical for companies handling the private data of millions of users. From there, things get muddier. Is climate change mission critical for companies that are not carbon majors? Is racial diversity and inclusion critical for companies looking to attract a high-quality, millennial-based labor force?100 Part III will delve into these questions at length. But before we get there, let us first clarify what exactly it means to say that the Caremark framework applies to a given ESG issue. C. How the Caremark Framework Shapes Behavior Saying that the Caremark framework extends to ESG is not the same as saying that directors are likely to be found liable. Indeed, none of the cases I mentioned above ended in a Jurisprudence, 55 DUKE L.J. 1 (2005) (on Delaware’s changing rhetoric to meet societal demands regarding executive pay). Specific to oversight duties, Elizabeth Pollman has claimed that Delaware courts use the flexible “bad faith” standard as a safety valve for acknowledging broader public policy considerations. Pollman, supra note 31, at 2016. It is easy to envision Delaware courts responding similarly to today’s increased societal demands from business corporations by extending the Caremark framework to cover highly salient issues such as data privacy, climate change, sexual harassment, and racial diversity. 100 See Michal Barzuza, Quinn Curtis & David H. Webber, Shareholder Value(s): Index Fund ESG Activism and the New Millennial Corporate Governance, 93 S. CAL. L. REV. 1243, 1295–98 (2020) (on millennial employees and what they are after). 760 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 verdict in favor of the plaintiffs. When I denoted a certain case as “successful,” it was merely in the sense of surviving the motion to dismiss. One could therefore object to the conclusions thus far that a revamped mode of oversight duties is upon us (Section A) or that this revamped mode gradually expands and encompasses also nonlegal risks (Section B). “Come back to me when plaintiffs actually win a case,” an objector could say. In fact, such an objection misconstrues how Caremark, and corporate law more generally, work. Delaware courts rarely produce final verdicts after full trials.101 And it is even rarer for them to make directors pay out of pocket.102 Corporate law’s impact on behavior therefore cannot be measured by the legal sanctions it imposes. Rather, corporate law affects behavior more indirectly, by shaping norms and reputations in the business community.103 The process of litigation in itself subjects managers to the nonlegal costs of having to go through discovery and depositions. These include the emotional stress and the potential reputational harm from having damning information about you dug out for all other market participants to see.104 In the new mode of Caremark litigation, these nonlegal costs are front-loaded: they come from pre-suit discovery (Section 220 requests), 101 Lawrence A. Hamermesh & Michael L. Wachter, The Importance of Being Dismissive: The Efficiency Role of Pleading Stage Evaluation of Shareholder Litigation, 42 J. CORP. L. 597, 652 (2017) (noting that, in a span of five years, Delaware has produced only five such verdicts, one a year on average). 102 Bernard Black, Brian Cheffins & Michael Klausner, Outside Director Liability, 58 STAN. L. REV. 1055, 1055 (2006) (finding that, in a span of twenty-five years, only thirteen outside directors had to pay out of pocket). 103 See generally Edward B. Rock, Saints and Sinners: How Does Delaware Corporate Law Work?, 44 UCLA L. REV. 1009 (1997) (arguing that corporate law shapes external morals); Margaret M. Blair & Lynn A. Stout, Trust, Trustworthiness, and the Behavioral Foundations of Corporate Law, 149 U. PA. L. REV. 1735 (2001) (arguing that corporate law shapes internal morals); Roy Shapira, A Reputational Theory of Corporate Law, 26 STAN. L. & POL’Y REV. 1 (2015) (arguing that corporate law shapes reputation). 104 See also Claire A. Hill, Caremark as Soft Law, 90 TEMP. L. REV. 681, 692 (2018) (noting that Caremark litigation is one area where the legal and reputational realms affect each other). No. 2:732] MISSION CRITICAL ESG 761 before a complaint is even filed, and from the complaints themselves, before any motion is filed.105 In order to assess the extent to which the threat of Caremark is likely to push directors to take ESG more seriously, one therefore needs to ask whether courts are likely to treat plaintiffs’ inspection requests as having proper purpose and permissible scope, and whether courts are likely to draw pleading-stage inferences in favor of the plaintiffs even when there is no smoking-gun evidence tying the directors to the trauma.106 If one answers these questions in the affirmative, directors have already lost, even if they do not ultimately face liability.107 To illustrate, consider how recent Caremark cases have affected behavior already in the preliminary stages, through three conduits: (1) settlements, (2) law firm memos, and (3) reputational fallout. Settlements. In corporate law, cases that survive the motion to dismiss (or have a good chance of doing so) tend to settle quickly and for hefty amounts, as defendants seek to avoid getting into prolonged legal battles. Until recently, Caremark claims did not fit this description. The chance for them to survive the motion to dismiss was minuscule, and so it made sense for their settlement value to be low. This logic no longer holds. The string of successful Caremark cases in 105 Chris Brummer & Leo E. Strine, Jr., Duty and Diversity, 75 VAND. L. REV. 1, 77 (2022) (“Even if a complaint . . . does not survive, public revelation of corporate monitoring practices that fall short of best practices can be embarrassing for the defendants and harmful to the corporation’s reputation.”). 106 Barker et al., supra note 25, at 37; David A. Katz & Laura A. McIntosh, Integrating ESG into Corporate Culture: Not Elsewhere, but Everywhere, HARV. L. SCH. F. ON CORP. GOVERNANCE (Mar. 29, 2021) https://corpgov.law.harvard.edu/2021/03/29/integrating-esg-into-corporate- culture-not-elsewhere-but-everywhere/ [https://perma.cc/8YFT-DHQW] (noting that, in oversight duty litigation over ESG risks, “the most important outcome is not necessarily the legal result”). 107 Brummer & Strine, supra note 105, at 7 (writing in the context of Caremark litigation over diversity and inclusion); Williams & Conley, supra note 2, at 88–89 (writing in the context of Caremark litigation over human rights violations). 762 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 the past two years has changed these dynamics. For example, the first in the string, Marchand, settled for $60 million, and the last (as of this writing), Boeing, settled for a record $237 million.108 Still, one cannot assume that the threat of paying settlements will incentivize boards to invest optimally in compliance, if only because directors are usually not the ones paying. These settlements tend to come out of the insurers’ pockets.109 And as others have painstakingly detailed, there is little reason to think that insurers will monitor and push directors to improve their behavior.110 Much of the impact on directors’ behavior, therefore, tends to come from the other two channels—namely, law firm memos and reputational fallouts. Law firm memos. Following significant corporate law cases, legal advisors send their clients memos explaining what the court decision means for them going forward.111 I have detailed elsewhere how four successful Caremark cases in 2019 and 2020 created a wave of law firm memos calling on boards to place legal compliance on their agenda and make sure that they properly document compliance discussions and 108 Brummer & Strine, supra note 105, at 74; Ellen Bardash, Proposed $237.5M Boeing Deal Could be Largest “Caremark” Settlement in Delaware History, DELAWARE BUS. CT. INSIDER (Nov. 8, 2021), https://www.law.com/delbizcourt/2021/11/08/proposed-237-5m-deal-with- boeing-could-be-largest-caremark-settlement-in-delaware-history/ [https://perma.cc/VR7H-CSFX]. 109 See, e.g., Bardash, supra note 108. For two recent treatments of how D&O underwriters are already taking the risk of ESG litigation into account, see generally Angela N. Aneiros & Karen E. Woody, Caremark’s Butterfly Effect, AM. U. L. REV. (forthcoming) (manuscript at 57), https://ssrn.com/abstract=4197520 [https://perma.cc/FQE5-GFS9]; Amelia Miazad, D&O Insurers as ESG Monitors (Working Paper, 2022), https://ssrn.com/abstract=4222100 [https://perma.cc/6Q9F-RJTD]. 110 For an early classic, see Tom Baker & Sean J. Griffith, The Missing Monitor in Corporate Governance: The Directors’ & Officers’ Liability Insurer, 95 GEO. L.J. 1795, 1798–99 (2007). For a novel perspective, see Andrew Verstein, Changing Guards: Improving Corporate Governance with D&O Insurance Rotations, 108 VA. L. REV. 983, 987 (2022). 111 On the importance of law firm memos, see Rock, supra note 103, at 1070–71. No. 2:732] MISSION CRITICAL ESG 763 efforts.112 Here I am interested in whether the more recent 2021 cases have impacted legal advice concerning board oversight of ESG risk. The answer is a resounding yes. To illustrate, one memo aptly titled “Carbon, Caremark, and Corporate Governance” tells clients that the abovementioned caselaw developments highlight the “urgent imperative for boards and management teams to address climate-related challenges as part of their regular risk assessment practices.”113 Part III below provides additional examples broken down into the various ESG categories.114 There is a broader point at play here. What matters for deterrence is not the actual sanction, but rather the perceived sanction. Most directors do not take it upon themselves to read judicial opinions to decipher the scope of their oversight duties; rather, they rely on what their legal advisors tell them. If these legal advisors regularly portray in their memos data privacy, racial diversity, and environmental sustainability as key board oversight issues that are potentially subject to Caremark, then that is what matters. Viewed from this angle, Caremark already applies to broader ESG concerns. Reputational fallouts. Corporate law affects behavior not just by imposing legal sanctions, but also by producing information that facilitates reputational sanctions.115 In board oversight duties cases, in particular, one may observe that even the preliminary stages can extract damning information about defendants, making it public for all other market participants to see. This information, in turn, can hurt directors’ and officers’ labor market reputations (their chances of landing other positions), as well as their personal 112 Shapira, supra note 8, at 1881. 113 William Savitt, Sabastian V. Niles & Sarah K. Eddy, Carbon, Caremark, and Corporate Governance, HARV. L. SCH. F. ON CORP. GOVERNANCE (May 30, 2021), https://corpgov.law.harvard.edu/2021/05/30/carbon-caremark-and- corporate-governance/ [https://perma.cc/34FQ-HFZD]. 114 See, e.g., infra notes 126, 133 and the accompanying text. 115 For the theory and evidence of reputation-through-litigation dynamics, see Shapira, supra note 12, at 35–74. 764 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 reputation and the esteem they receive from their social circles. To illustrate, let us recast the Boeing decision.116 The case settled shortly after the motion to dismiss, but by then the behavior of Boeing’s directors and officers was already put through the wringer of a detailed Section 220 request (630,000 pages), and Vice Chancellor Zurn’s detailed account of what went wrong.117 Mainstream media outlets directly quoted the court’s scolding of then-Lead Independent Director (current CEO) David Calhoun for being dishonest.118 And even directors who were not named in the decision suffered from reputational ricochets. Consider, for example, the case of Lynn Good, who aside from being a Boeing director is also the CEO of Duke Energy. When Good received a prestigious award from Yale School of Management for her leadership in transforming Duke into a greener institution, media coverage of the award was marred by references to the Boeing decision.119 The media was apparently questioning Yale’s decision to award a prize for leadership and personal character to someone who was a member of a board that seemingly prioritized profits over safety and misled the public and regulators.120 Just as with law firm memos, then, media coverage of the early stages of oversight duty litigation tells us that the Caremark framework already applies to broader ESG 116 For in-depth analysis of the Boeing decision’s fallout, see Shapira, supra note 46. 117 Indeed, Boeing’s officers filed a motion to Delaware’s Supreme Court, asking to clarify that Vice Chancellor Zurn’s criticisms were not based on factual determinations reached after a full trial, but were merely inferences drawn at the pleading stage. Rose Krebs, Abrams & Bayliss Says Chancery Must Clarify Boeing Ruling, LAW360 (Sept. 14, 2021). That officers went to all that trouble even though the case against them was dismissed tells us that the issue here is the reputational costs of the process rather than the legal outcome at the end of the process. 118 Andrew Tangel, Boeing Board to Face 737 MAX Lawsuit, WALL ST. J. (Sept. 8, 2021). 119 Eda Aker, Lynn Good Wins SOM Leadership Award While Facing Negligence Lawsuit for Time at Boeing, YALE DAILY NEWS (Oct. 7, 2021). 120 See id. No. 2:732] MISSION CRITICAL ESG 765 concerns, even if a court case has yet to say so definitively. Indeed, Part III below provides additional examples in various ESG categories of media coverage of Caremark complaints.121 * We therefore have an answer to this Part’s titular question: yes, the Caremark framework applies to ESG risks. But we learned in the process that the relevant question to examine is not the types of risks, but rather the criticality of risks. Let us therefore move from making claims in general (“in general, Caremark applies to ESG”) to examining the cross-sectional variation by identifying the specific ESG issues and circumstances that are more likely to give rise to a viable Caremark claim. III. WHAT ESG ISSUES ARE MORE LIKELY TO GIVE RISE TO A CAREMARK CLAIM? Not all ESG risks are created equal. From an oversight duty perspective, only ESG risks that are “critical” to the company’s operations fit squarely within Caremark’s scope. In practice and in academia, ESG issues are often lumped together: fund managers rely on aggregate ESG scores in their investment decisions, and scholars find it easier to debate about the acronym in its entirety.122 But when dealing with corporate law’s oversight duties, one must make an effort to break ESG down into its various components and examine how each component is subject to Caremark liability to a greater or lesser degree. In that regard, one could borrow a page from the extensive literature on the link between “corporate social performance” (CSP) and “corporate financial performance” (CFP). For decades, researchers tried to empirically document a link between doing good and doing well. After thousands of studies and dozens of meta-analyses, they concluded that there is no 121 See, e.g., infra note 145 and the accompanying text. 122 Florian Berg et al., ESG Confusion and Stock Returns: Tackling the Problem of Noise (Oct. 12, 2021) (unpublished manuscript), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3941514 [https://perma.cc/E5RG-CKG8]. 766 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 conclusive answer.123 More generally, they concluded that, instead of looking for a causal link in a vacuum (doing X leads to better results), one should strive to identify the moderators: the factors that determine how doing X may lead to good results in some cases and to bad results in others. In particular, researchers identified reputation as a key mediating variable between CSP and CFP.124 Some socially responsible behaviors earn the company reputation credit points, thereby leading to improvements in the bottom line, whereas other socially responsible behaviors are ignored or perceived as cynical, not earning reputation credit points and therefore less likely to improve the bottom line. To understand when doing good leads to doing well, one therefore needs to understand when doing good improves the company’s reputation and when it does not. The parallel to our context is straightforward: reputation is a moderator between ESG and Caremark liability. Inattention to some ESG issues will cause the company serious difficulties in attracting talent, accessing capital, and broadening their customer base, whereas inattention to other ESG issues may cause none of the above. To understand the extent to which a certain ESG issue is mission critical, one needs to understand the magnitude of the reputational impact that not addressing said ESG issue will have on the company. To be sure, understanding the reputational ramifications is a tall task. Each different branch of ESG affects reputation differently. Even within a single ESG issue, the reputational impact varies greatly across industries and regions. My purpose here is not to map every possible reputational ramification, but rather more modestly to build an analytical 123 Lipton, supra note 6, at 529 n.170 (compiling references of the studies showing no conclusive evidence that social performance is linked with financial performance); Michael L. Barnett & Robert M. Salomon, Does It Pay to be Really Good? Addressing the Shape of the Relationship between Social and Financial Performance, 33 STRATEGIC MGMT. J. 1304, 1305 (2012). 124 Naomi A. Gardberg et al., The Impact of Corporate Philanthropy on Reputation for Corporate Social Performance, 58 BUS. & SOC’Y. 1177, 1178 (2019) (compiling references showing reputation acts as this mediating variable). No. 2:732] MISSION CRITICAL ESG 767 framework that can help assess the “criticality” of ESG risks on a case-by-case basis. To do that, this Part combines insights from how Delaware courts treat the concept of reputational risk, and from how corporate boards treat it in practice—specifically, from what lawyers, reputation consultants, and international bodies advise boards to do regarding prioritization of reputational risks. Together, these insights shed light on the conditions under which a given ESG risk poses a critical reputational risk for the company and a critical Caremark liability risk for its directors. Section A examines the likelihood of Caremark claims for cybersecurity breaches. Section B focuses on issues of sexual misconduct and racial discrimination. Section C highlights environmental risks, such as those stemming from climate change. Section D offers lessons that apply across all types of ESG risks. A. Adverse Impacts on Consumers: Cybersecurity Cybersecurity is a major risk for companies and boards across industries.125 The costs of cyberattacks are now in the trillions annually, and rising.126 Regulators around the world are constantly ramping up their enforcement efforts.127 And 125 Bert Wells, Rukesh Korde & Teresa Lewi, Cyber Insurance: Emerging Coverage Issues, NEW APPLEMAN ON INSURANCE LAW LIBRARY EDITION §29.05 (Jeffrey E. Thomas & Francis J. Mootz eds., 2022) (reporting on a survey of D&O insurance underwriters); Rebecca Rabinowitz, From Securities to Cybersecurity: The SEC Zeroes in on Cybersecurity, 61 B.C. L. REV. 1535, 1536 (2020). 126 Martin Lipton et al., Risk Management and the Board of Directors, WACHTELL, LIPTON, ROZEN & KATZ (June 2020), https://www.wlrk.com/webdocs/wlrknew/ClientMemos/WLRK/WLRK.2697 8.20.pdf [https://perma.cc/4A8Z-BXYK]; H. Justin Pace & Lawrence J. Trautman, Mission Critical: Caremark, Blue Bell, and Director Responsibility for Cybersecurity Governance, 2022 WIS. L. REV. 887 (2022). 127 The SEC, for example, has opened a dedicated cyber unit in its Enforcement division, and in 2022 proposed a new cybersecurity disclosure rule, meant to enhance and standardize disclosures regarding how companies manage cybersecurity risk. Zachary Cochran et al., SEC Proposes Rules Enhancing Cybersecurity Disclosures, HARV. L. SCH. F. ON 768 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 companies themselves are now designating cyberattacks as a “major reputational risk” in their disclosures.128 The market thus clearly expects corporate boards to put cyber risk oversight on their agendas. But does that mean that the courts could hold directors personally liable when their company suffers a cyberattack? The abovementioned Marriott case illustrates that the answer is “yes, but.” Yes, the courts view cyber-risk oversight as falling squarely within Caremark’s scope. In Vice Chancellor Will’s words: “Cybersecurity has increasingly become a central compliance risk deserving of board level monitoring at companies across sectors.”129 But that does not mean that it would be easy for shareholders to establish a Caremark claim in the wake of a cyber breach. The bar remains high, as Marriott and other cases illustrate.130 And CORP. GOV. (Apr. 5, 2022), https://corpgov.law.harvard.edu/2022/04/05/sec- proposes-rules-enhancing-cybersecurity-disclosures/ [https://perma.cc/Q4VK-G7JQ]; Paul Ferrillo & Bob Zukis, The SEC’s Clear Reminder about the Need for Quality Cybersecurity Disclosures, HARV. L. SCH. F. ON CORP. GOV. (Aug. 23, 2021), https://corpgov.law.harvard.edu/2021/08/23/the-secs-clear-reminder-about- the-need-for-quality-cybersecurity-disclosures/ [https://perma.cc/9RXM- TZ6A]; Lipton, supra note 126, at 24 (noting that “lawmakers and regulators in the United States and around the world have increased their attention to cybersecurity risk”). See also Pace & Trautman, supra note 126, at 8. 128 Christina Parajon Skinner, Bank Disclosures of Cyber Exposure, 105 IOWA L. REV. 239, 265–68 (2019) (analyzing the content of banks’ disclosures). 129 Marriott, C.A. No. 2019-0965-LWW, 2021 WL 4593777, at *2. See also Pace & Trautman, supra note 124, at Part V (arguing that cybersecurity is mission critical for every U.S. publicly traded company these days). 130 Marriott, 2021 WL 4593777, at *33; Palkon v. Holmes, No. 2:14-CV- 01234 (SRC), 2014 WL 5341880, at *2, *7 (D.N.J. Oct. 20, 2014) (dismissing derivative action claims against another hotel giant arising from data security breaches, because directors did take some affirmative steps to address cybersecurity concerns both before and after the breach); Benjamin Dynkin & Barry Dynkin, Derivative Liability in the Wake of a Cyber Attack, 28 ALB. L.J. SCI. & TECH. 23, 39–40 (2018) (analyzing the Palkon ruling). Just before the last round of edits for this Article, a new Delaware decision affirmed the two-pronged argument here: cybersecurity may be mission No. 2:732] MISSION CRITICAL ESG 769 because by now virtually all boards of large companies have processes in place by which they are apprised of cyber risks, plaintiffs’ chances to succeed are mostly limited to prong-two- type indications of the board being aware of potential significant data leaks and doing nothing about them.131 Further, the courts are cognizant of the fact that, unlike other Caremark claims in which the company in question is the primary perpetrator (think of polluting, bribing, or cooking the books), in cyberattacks the company is the victim.132 Still, on all the vectors that Part II.C identified as determining Caremark’s scope and impact, cybersecurity passes the test with flying colors. Marriot signals that the courts could designate cybersecurity as mission critical, thereby significantly increasing the chance of a failure-of- oversight claim surviving the motion to dismiss. The pre-suit action in Marriott signals that the courts are likely to grant outside shareholders wide access to internal cyber-risk discussions. And law firm memos post-Marriott tell us that corporate boards are already receiving legal advice to treat cybersecurity as a top area of risk oversight.133 Going forward, three factors in particular strike me as important predictors of the outcome of future cybersecurity oversight cases. The first concerns the likelihood that the courts would activate a heightened scrutiny mode. Marriott refers to cybersecurity as a consequential risk across sectors, critical, but succeeding in a Caremark claim when cyberattacks happen remain a very tall task. Construction Industry Laborers Pension Fund v. Mike Bingle, C.A. No. 2021-0940-SG (Del. Ch. Sept. 6, 2022) (mem.). 131 Sean Joyce & Catie Hall, Overseeing Cyber Risk, HARV. L. SCH. F. ON CORP. GOV. (Feb. 24, 2022), https://corpgov.law.harvard.edu/2022/02/24/overseeing-cyber-risk-2/ [https://perma.cc/B4SD-HTJ3]. 132 Marriott, 2021 WL 4593777, at *50; Benjamin P. Edwards, Cybersecurity Oversight Liability, 35 GA. ST. U. L. REV. 663, 676 (2019). 133 Gregory A. Markel, Daphne Morduchowitz & Matthew C. Catalano, A Director’s Duty of Oversight after Marchand in “Caremark” Case, HARV. L. SCH. F. ON CORP. GOV. (Jan. 23, 2022), https://corpgov.law.harvard.edu/2022/01/23/a-directors-duty-of-oversight- after-marchand-in-caremark-case/ [https://perma.cc/X6CZ-PN2X]. 770 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 but there seem to be certain types of companies where a “mission critical” designation is even likelier. One example is large financial institutions. Bank managers acknowledge that the largest challenge they face these days is cybersecurity, and banks’ disclosures reflect as much.134 More generally, it seems that the directors of every company that holds the personal details of millions of users operate in the “mission critical zone.” To illustrate, consider a recent example from the distinct but related context of SEC enforcement. In a 2021 action against Pearson, the SEC suggested that, for companies like Pearson, which are in the business of collecting and storing large volumes of private data, cybersecurity issues are clearly “material.”135 A second factor to consider is the potential scenarios that could give rise to one of two alternative Caremark prongs. As mentioned, it is hard to envision plaintiffs establishing a prong-one claim here, as most companies have by now implemented a form of cyber-risk monitoring. It is easier to envision the courts scrutinizing boards for not having in place the right protocols to minimize harms once breaches occur, and for not scrutinizing management’s disclosures. Boeing provides a blueprint: there, the court held the fact that directors blindly accepted the CEO’s “nothing to see here” promises following the first 737 crash against them, reasoning that they should have been more critical and independently probed into potential safety issues.136 The third and final factor to consider is shareholders’ ability to locate indications that directors ignored cybersecurity red flags. Here, the fact that regulators are increasingly focusing attention on cybersecurity could greatly 134 Kim Zetter, Hacking Wall Street, N.Y. TIMES (Jul. 3, 2021), https://www.nytimes.com/2021/07/03/business/dealbook/hacking-wall- street.html [https://perma.cc/S4ZL-M7RT]. 135 Paul Ferrillo, Bob Zukis & George Platsis, Cybersecurity and Disclosures, HARV. L. SCH. F. ON CORP. GOV. (Oct. 4, 2021), https://corpgov.law.harvard.edu/2021/10/04/cybersecurity-and-disclosures/ [https://perma.cc/39LD-56B4]. 136 In re Boeing Co. Derivative Litig., C.A. No. 2019-0907-MTZ, 2021 WL 4059934, at *34–39 (Del. Ch., Sept. 7, 2021). No. 2:732] MISSION CRITICAL ESG 771 enhance plaintiffs’ chances in Caremark litigation, if only because regulatory investigations tend to extract relevant information on which plaintiffs can piggyback. To illustrate, when Yahoo suffered a cyberattack, shareholders filed a Caremark claim that relied on information they gleaned from the regulatory investigation report, and the case settled quickly for $29 million.137 B. Adverse Impact on Workers: Sexual Harassment and Diversity 1. Sexual Misconduct The #MeToo movement turned a spotlight on sexual misconduct, and corporate America still feels the shockwaves today. At the individual level, since 2017, numerous top executives have been forced to resign amidst such allegations.138 At the organizational level, a recent empirical study shows that the average effect of a sexual harassment scandal on stock market prices is “significantly negative and robust.”139 And more and more companies are including “MeToo termination rights” in their contracts with top executives.140 Sex-based misconduct has therefore turned into a key corporate governance issue. What is the likelihood of a Caremark claim against directors for not being attentive enough to (and therefore enabling by omission) a misogynistic corporate culture and incidents of workplace harassment? In a comprehensive analysis of the various ways to hold managers accountable for sexual misconduct, Professors Hemel and Lund concluded 137 Edwards, supra note 132, at 675. 138 Hemel & Lund, supra note 23, at 1585–87. 139 Mads Borelli-Kjaer, Laurids Moehl Schack & Ulf Nielsson, #MeToo: Sexual Harassment and Company Value, 67 J. CORP. F. (2021), https://doi.org/10.1016/j.jcorpfin.2020.101875 [https://perma.cc/YBZ8- 89PR]. 140 Rachel S. Arnow-Richman, James Hicks & Steven Davidoff Solomon, Do Social Movements Spur Corporate Change? The Rise of “MeToo Termination Rights” in CEO Contracts, 98 INDIANA L.J. 125, 126 (2022). 772 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 that the Caremark channel has a low probability of success.141 They illustrate their claim with the American Apparel case, where the court dismissed a Caremark claim even though the systematic sexual misconduct by the company’s CEO was widely reported in major newspapers for many years and supported by multiple sources.142 American Apparel’s directors had many red flags of sexual misconduct flown in their faces for years, and were still let off the hook. But Hemel and Lund’s analysis was written in 2018, predating Marchand and the new Caremark era. How would a case like American Apparel fare today? The July 2021 settlement in the L Brands (Victoria’s Secret) case provides some clues. The backdrop there was allegations of systematic sexual harassment by top executives at the global fashion leader, as well as the company founder’s deep connections with Jeffrey Epstein (who was apparently posing as a Victoria Secret’s recruiter to prey on aspiring young girls). Several L Brands shareholders filed Section 220 requests and then Caremark actions, in the persuasion that the board’s failure to tackle the misogynistic corporate culture had caused the company major reputational harms, which manifested in L Brands’ inability to sell the Victoria’s Secret brand at a premium price.143 This point bears emphasizing: the complaints focused not only on law compliance failures, but also—indeed, more so—on how the board’s inattention to sexual misconduct created significant reputational risk.144 The company quickly settled the complaint by committing $90 141 Hemel & Lund, supra note 23, at 1646. 142 Id. at 1616–18. 143 Verified Stockholder Derivative Complaint, Lambrecht v. Wexner et al., No. 2021-0029-JTL (Del. Ch. Jan. 12, 2021); see also Stipulation and Agreement of Settlement, Rudi v. Wexner et al., No. 2:20-cv-3068 (S.D. Ohio July 30, 2021). 144 See Kevin LaCroix, L Brands Establishes $90 Million Fund in Sexual Misconduct Derivative Suit Settlement, THE D&O DIARY (Aug. 2, 2021), https://www.dandodiary.com/2021/08/articles/director-and-officer- liability/l-brands-establishes-90-million-fund-in-sexual-misconduct- derivative-suit-settlement/ [https://perma.cc/25T2-HKYD]. No. 2:732] MISSION CRITICAL ESG 773 million to prophylactic measures meant to root out its misogynistic culture.145 The Victoria’s Secret case illustrates how a Caremark claim can make an impact even if it never advances past the complaint stage. Shareholders gained access to internal company documents via Section 220 requests. They then filed a detailed Caremark complaint that the media picked up and covered extensively. When the complaint was filed in January 2021, the media coverage mentioned by name not just the top executives who harassed, but also the board members who supposedly did little to address constant internal complaints against the harassers.146 When the settlement was announced in July 2021, the media was back on the story, reiterating the allegations in detail.147 And law firms sent memos to their clients that invoked the complaint as another indication of an increased threat of ESG-related litigation.148 145 Sierra Jackson, L Brands Inks Deal with Shareholders To Exit Workplace Harassment Cases, REUTERS (Jul. 30, 2021), https://www.reuters.com/legal/litigation/l-brands-inks-deal-with- shareholders-exit-workplace-harassment-cases-2021-07-30/ [https://perma.cc/TD9D-8TC5]. 146 See, e.g., Kellie Ell & Sindhu Sundar, L Brands Founder Leslie Wexner Faces New Complaints about ‘Culture of Misogyny’ at Victoria’s Secret, YAHOO! FINANCE (Jan. 15, 2021), https://finance.yahoo.com/news/l- brands-founder-leslie-wexner-202839664.html [https://perma.cc/Q4E7- QDGP]; Ben Ashford & Greg Woodfield, Disgraced Victoria’s Secret Mogul Les Wexner “Let Jeffrey Epstein Abuse Young Girls at His Sprawling Ohio Mega-Mansion” While the Pedophile Posed as a Modeling Scout to Recruit His Victims, New Bombshell Lawsuit Claims, DAILY MAIL (Jan. 14, 2021) https://www.dailymail.co.uk/news/article-9148553/Victorias-Secret- mogul-Les-Wexner-let-former-friend-Jeffrey-Epstein-abuse-girls- mansion.html [https://perma.cc/4WKH-7DCT] (focusing on the company’s founder). 147 See, e.g., Jackson, supra note 145; Lisa Fickenscher, Victoria’s Secret Settles Lawsuit over Sex Harassment Ahead of Spinoff, N.Y. POST (Jul. 30, 2021), https://nypost.com/2021/07/30/victorias-secret-settles-sex- harassment-suits-before-spinoff/ [https://perma.cc/GWK6-7HJS]. 148 See, e.g., Catherine M. Clarkin & Melissa Sawyer, ESG Trends and Hot Topics, HARV. L. SCH. F. ON CORP. GOV. (Aug. 25, 2021), https://corpgov.law.harvard.edu/2021/08/25/esg-trends-and-hot-topics/ [https://perma.cc/4QHT-PHYU]. 774 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 The 2020 Alphabet (Google) case similarly settled shortly after a complaint was filed and before it was discussed in court, with the company committing $310 million to prophylactic measures.149 And the Fox complaint settled for $90 million on the day it was filed, together with the creation of a commitment to establish a Workplace Professionalism and Inclusion Council.150 These are all some of the largest derivative settlements ever in Delaware.151 Going forward, the following circumstances are likely to give rise to one of two alternative Caremark prongs. A prong- one claim could arise when directors have not reviewed their company’s process of handling sexual misconduct complaints, and information from the internal hotlines does not flow up to the board.152 That is, following bad news of constant sexual harassment, directors could be held personally liable if it turns out that even constant complaints could not find their way to the boardroom. The Boeing case illustrates this: lower- level engineers consistently flagged concerns about the 737 149 See, e.g., Danielle Abril, Alphabet to Fund $310 Million Diversity Initiative to Settle Sexual Misconduct Lawsuit from Shareholders, FORTUNE (Sept. 25, 2020), https://fortune.com/2020/09/25/alphabet-sexual- misconduct-lawsuit-310-million-diversity-inclusion-initiatives/ [https://perma.cc/79Q3-C6FN]. The background here was an investigative report finding that Alphabet paid millions of dollars in exit packages to male employees who were accused of sexual misconduct, while trying to keep information about the transgressions under wraps. When the news broke, it ignited employee backlash, with massive walkouts occurring in the company’s offices around the world. Daisuke Wakabayashi et al., Google Walkout: Employees Stage Protest over Handling of Sexual Harassment, N.Y. TIMES (Nov. 1, 2018), https://www.nytimes.com/2018/11/01/technology/google-walkout-sexual- harassment.html [https://perma.cc/3LAN-3RAW]. 150 Verified Derivative Complaint at 1–2, City of Monroe Emps.’ Ret. Sys. v. Murdoch, No. 2017-0833 (Del. Ch. filed Nov. 20, 2017); Stipulation & Agreement of Settlement, Compromise, & Release at 26–28, City of Monroe Emps.’ Ret. Sys. v. Murdoch, No. 2017-0833-AGB (Del. Ch. filed Nov. 20, 2017). The backdrop to this case included allegations of a rampant sexual harassment culture at Fox News, which culminated in the departures of Fox’s CEO and key broadcasters. See Hemel & Lund, supra note 23, at 1587. 151 LaCroix, supra note 144. 152 Cf. Hemel & Lund, supra note 23, at 1660. No. 2:732] MISSION CRITICAL ESG 775 Max flight control system, yet the internal board documents did not reflect discussions of these complaints.153 For Vice Chancellor Zurn, this was another pleading-stage indication of a prong-one violation.154 A prong-two claim could arise if the harassment complaints did make it to the board, but directors focused on keeping damning information in-house instead of on protecting the women who were harassed. Here as well, Boeing may serve as a case in point: the court faulted the board for focusing on maintaining the company’s image and profitability after the first crash, instead of on what the red flags were about, namely, consumer safety.155 In the harassment context, the red flags will be about employee wellbeing. And so, courts could fault boards that focused on, say, signing the women who complained to non-disclosure agreements, instead of on female employees’ wellbeing moving forward. Courts may be even more willing to scrutinize board responses to warnings when the company in question has a primarily female consumer base, as was the case with Victoria’s Secret.156 2. Diversity The topic of sexual harassment is part of a much broader trend of increased societal demands regarding how companies treat their workforce.157 In a “post-George Floyd, post- pandemic environment,” societal demands for better corporate behavior on diversity and inclusion have “swelled and intensified.”158 Regulators and investors are increasingly making diversity and inclusion a corporate and securities 153 In re Boeing Co. Derivative Litig., No. 2019-0907-MTZ, 2021 Del. Ch. LEXIS 197, at *29–30 (Del. Ch. Sept. 7, 2021). 154 Id. at *55. 155 Id. 156 Hemel & Lund, supra note 23, at 1656 (making the argument in the context of a high-end jewelry company). 157 For a concise explanation of how this trend can interact with Caremark duties, see George S. Georgiev, The Human Capital Management Movement in U.S. Corporate Law, 95 TUL. L. REV. 639, 705–07 (2021). 158 Brummer & Strine, supra note 105, at 5–6. 776 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 laws issue.159 And more and more companies are hiring outside consultants to conduct a “racial equity audit,” a sort of independent internal investigation of a company’s practices and policies regarding diversity and inclusion.160 Can corporate failures to promote gender diversity in the boardroom, or root out racial biases throughout the company, give rise to a valid failure-of-oversight claim against the board?161 From this vantage point, it is hard to envision a realistic prong-one or prong-two scenario in this context. Indeed, in the past couple of years, shareholders who filed derivative actions alleging a failure to diversify were rebuked, on the grounds that demand on the board could not be excused.162 There is therefore no realistic corporate law conduit for attacking the failure to diversify without establishing failure of oversight.163 And there is no realistic possibility of establishing a failure-of-oversight claim without convincing the court that gender or racial diversity is critical for the company’s operations. Perhaps in the future the courts will designate diversity and inclusion issues as critical to companies operating in talent-intensive sub-industries, thereby making the Caremark threat more realistic.164 C. Adverse Impact on the Environment: Climate 159 Clarkin & Sawyer, supra note 148 (compiling references). 160 Ron S. Berenblat & Elizabeth R. Gonzalez-Sussman, Racial Equity Audits: A New ESG Initiative, HARV. L. SCH. F. ON CORP. GOV. (Oct. 30, 2021), https://corpgov.law.harvard.edu/2021/10/30/racial-equity-audits-a- new-esg-initiative/ [https://perma.cc/27US-9KKE]. 161 See Brummer & Strine, supra note 105 (answering in the affirmative). 162 Clarkin & Sawyer, supra note 148. 163 For a different opinion, namely, that directors’ fiduciary duties include a duty to diversify, see Anat Alon-Beck, Michal Agmon-Gonnen & Darren Rosenblum, A Duty to Diversify, 75 VAND. L. REV. 97, 100 (2022). 164 See John Borneman et al., ESG and Incentives 2021 Report, HARV. L. SCH. F. ON CORP. GOV. (Aug. 27, 2021), https://corpgov.law.harvard.edu/2021/08/27/esg-and-incentives-2021- report/ [https://perma.cc/KX89-U99R]; see also Georgiev, supra note 157, at 680 (noting former SEC Chairman Clayton’s words along that line). No. 2:732] MISSION CRITICAL ESG 777 Change Another area where companies are facing heightened expectations from investors and regulators is climate change.165 2021 saw ExxonMobil shareholders replacing three incumbent directors with the nominees of activist shareholder Engine No. 1,166 and Chevron’s shareholders forcing the company to more aggressively commit to cutting carbon emissions.167 And in March of 2022, the SEC proposed sweeping new rules concerning climate-related risk disclosures.168 Such climate-related risks include extreme weather events that could damage physical assets, economy- wide net zero emissions goals that could make existing technologies obsolete, and more.169 Does a board-level failure to consider steps to mitigate such risks give rise to a viable Caremark claim?170 In a thorough October 2021 white paper, Professor Cynthia 165 Lisa Benjamin, The Road to Paris Runs Through Delaware: Climate Litigation and Directors’ Duties, 2020 UTAH L. REV. 313, 372 (2020). 166 Jennifer Hiller & Svea Herbst-Bayliss, Engine No. 1 Extends Gains with a Third Seat on Exxon Board, REUTERS (June 2, 2021), https://www.reuters.com/business/energy/engine-no-1-win-third-seat- exxon-board-based-preliminary-results-2021-06-02/ [https://perma.cc/PRK4-SXGM]. 167 Savitt et al., supra note 113; see also Benjamin, supra note 165, at 361 (compiling additional examples). 168 The Enhancement and Standardization of Climate-Related Disclosures for Investors, SEC Release No. 33-11042, 87 Fed. Reg. 21334 (proposed May 12, 2022) (proposing to amend Regulations S-K and S-X, so that they will require more expansive climate-related disclosures). For an analysis of the criticisms and a critique of the criticisms of that proposal, see George S. Georgiev, The SEC’s Climate Disclosure Proposal: Critiquing the Critics (Emory Legal Studies, Working Paper No. 22-8, 2022), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4068539. 169 Barker et al., supra note 25. 170 Note: my focus here is not on behaviors such as illicit dumping of hazardous materials, which would have fit squarely within Caremark’s scope even before recent developments. Rather, my focus is on the more corporate-responsible-behavior angle of being proactive in limiting the company’s impact on climate change. 778 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 Williams and her co-authors answer in the affirmative.171 Pertinently here, Williams and co-authors argue that Caremark is relevant not just for clear violations of climate regulations (legal risk), but also for cases of board inattention to climate-related business risks.172 They reason that today, the links between climate change and financial and systemic risks have become too evident and inextricable for boards to ignore.173 From this vantage point, climate-related risks are a worse fit for the Caremark framework than the abovementioned risks of, say, cybersecurity or sexual misconduct.174 For one, climate risks present much thornier causation issues: it is hard to establish that company X not being attentive to climate issues is what caused an adverse climate event that in turn harmed company X. Put differently, to succeed in a Caremark claim here, shareholders would have to show that directors were warned that a specific action by the company could cause direct climate-related harms to it and chose to ignore the warning; a tall task, by all accounts.175 Further, the finance and accounting literatures have long documented that the reputational ramifications of corporate misbehavior toward the environment are negligible.176 It 171 Barker et al., supra note 25, at 5–6. For an early account reaching similar conclusions, see Rapp, supra note 60, at 164. 172 Barker et al., supra note 25, at 33. 173 Id. at 14, 33. 174 See also Kevin LaCroix, Climate Change-Related Breach of Fiduciary Duty Lawsuits?, THE D&O DIARY (Oct. 26, 2021), https://www.dandodiary.com/2021/10/articles/climate-change/climate- change-related-breach-of-fiduciary-duty-lawsuits/ [https://perma.cc/TY5Y- 2MZH] (suggesting that the chances of fiduciary duty claims in this area are low). 175 McDonnel et al., supra note 7, at 407; Luh Luh Lan, Director’s Duties and Climate Change Risk – Standard of Care Foreseeability and Enforceability, OXFORD BUS. L. BLOG (Jul. 8, 2021), https://www.law.ox.ac.uk/business-law-blog/blog/2021/07/directors-duties- and-climate-change-risk-standard-care-foreseeability [https://perma.cc/5TBS-YR9J]. 176 Jonathan M. Karpoff, Does Reputation Work to Discipline Corporate Misconduct?, in THE OXFORD HANDBOOK OF CORPORATE REPUTATION 361 (Barnett & Pollock eds., 2012) (reviewing the empirical literature). No. 2:732] MISSION CRITICAL ESG 779 would be tempting to assume that this result no longer holds in today’s era, when stakeholders are supposedly more aware of, and care strongly about, climate risks; but recent empirical studies keep replicating and reiterating the same result.177 In fact, companies themselves seemingly believe that climate- related risks matter less for their success compared to other ESG concerns, as companies incorporate other ESG criteria (such as diversity and inclusion) into their executive pay packages much more than they incorporate environmental factors.178 Accordingly, perhaps only directors of “carbon majors” face a realistic threat of oversight liability for climate change- related risks.179 For this narrow group (about one hundred companies around the world180), the issue of carbon emissions is planted firmly in the “mission critical” zone.181 At the same time, carbon majors are already under (and soon to be under more) regulatory requirements limiting their levels of emissions, and so the relevant Caremark claim against them may be the straightforward one of failure of legal compliance oversight.182 177 Jacob Brady, Mary F. Evans & Eric W. Wehrly, Reputational Penalties for Environmental Violations: A Pure and Scientific Replication Study, 57 INT’L REV. L. ECON. 60 (2019); Serafeim & Yoon, supra note 9. 178 Borneman et al., supra note 164. 179 Cf. McDonnel et al., supra note 7, at 391. “Carbon majors” are the big oil, coal, and gas producers that are responsible for the majority of overall carbon emissions. Who Are the Carbon Majors?, CLIMATE JUST. PROGRAMME https://climatejustice.org.au/carbon-majors-1 [https://perma.cc/TBD8-5EMJ] (last visited Jan. 14, 2023). Whether the recent (March 2022) proposed climate disclosure rules by the SEC changes the environment—that is, makes climate-related risks “mission critical” to all publicly traded companies—remains to be seen. 180 Lan, supra note 175. 181 Martin Lipton, Carbon Zero and the Board, HARV. L. SCH. F. CORP. GOVERNANCE (Oct. 29, 2021), https://corpgov.law.harvard.edu/2021/10/29/carbon-zero-and-the-board/ [https://perma.cc/7GCS-8K7U]; Barker et al., supra note 25, at 21; Brian M. Wong & Suz Mac Cormac, The Climate is Changing: What Every Board Member Needs to Know, ASS’N CORP. COUNS. 50 (2019). 182 Allison Herren Lee, Keynote Address by Commissioner Lee on Climate, ESG, and the Board of Directors, HARV. L. SCH. F. ON CORP. 780 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 It seems that, in the area of climate change, the more promising avenue for holding managers accountable is claims of overpromising. More and more companies these days are making public commitments to reduce carbon emissions and move to greener production. This, in turn, exposes the companies to consumer and regulatory enforcement actions when it turns out that their walk does not match their talk.183 Even then, shareholder derivative actions face an uphill battle for various reasons,184 including that the time horizon for the lofty environmental goals that companies set for themselves is usually far away.185 When Ford commits to being carbon GOVERNANCE (Jun. 30, 2021), https://corpgov.law.harvard.edu/2021/06/30/keynote-address-by- commissioner-lee-on-climate-esg-and-the-board-of-directors/ [https://perma.cc/K4QH-52YU]. 183 Back in 2012, the FTC issued “Green Guides” specifically warning companies from marketing themselves as greener than they actually are. 16 C.F.R. § 260.13 (2022). For private consumer actions in this area, see, for example, Organic Consumers Ass’n v. Tyson Foods Inc., D.C. Case No. 2019-CA-004547, 2021 WL 1267807 (D.C. Super. Mar. 31, 2021); Beyond Pesticides v. Exxon Mobil Corp., Civ. No. 20-1815 (TKJ), 2021 WL 1092167 (D.D.C. Mar. 22, 2021). For corporate and securities laws actions, see Jason Halper et al., “Sustainable” Companies Face Increased Pressure, HARV. L. SCH. F. ON CORP. GOVERNANCE (Dec. 26, 2021), https://corpgov.law.harvard.edu/2021/12/26/sustainable-companies-face- increased-pressure/ [https://perma.cc/TRX9-X4RT]. 184 Granted, securities law claims (§ 10b claims) in this area face an uphill battle, but there are several examples of successful claims in the past couple of years. For a summary of successful public (SEC) enforcement actions in this area, see Kevin LaCroix, Attention: The ESG Cops are on the Beat, THE D&O DIARY (May 24, 2022), https://www.dandodiary.com/2022/05/articles/regulatory-enforcement- 2/attention-the-esg-cops-are-on-the-beat/ [https://perma.cc/EHS2-JBYH]. For a summary of successful private actions in this area, see Lauren Aguiar, Anita Bandy & Tansy Woan, Recent ESG Litigation and Regulatory Developments, HARV. L. SCH. F. ON CORP. GOVERNANCE (Jul. 25, 2022), https://corpgov.law.harvard.edu/2022/07/25/recent-esg-litigation-and- regulatory-developments/ [https://perma.cc/RP8N-7J6V]. 185 Benjamin, supra note 165, at 352–53. No. 2:732] MISSION CRITICAL ESG 781 neutral by 2050, it is hard to hold the company or its directors accountable for not doing enough in the 2020s.186 D. Factors that Apply Across All ESG Risks The recent oversight cases analyzed above provide only limited guidance: they show that product safety is critical to a manufacturing company (following Marchand and Boeing), and that data privacy is probably critical to a company that handles massive amounts of private data (following Marriott). Beyond that, it becomes harder to predict whether the courts are likely to apply heightened scrutiny and grant inspection requests for given ESG issues. This Section highlights three factors that could be relevant to all future ESG cases. First, the Section explains how companies’ disclosures and their peers’ conduct may trigger heightened scrutiny of ESG oversight. Second, the Section spotlights the understudied question of how courts evaluate board oversight of ESG: individually or collectively. To the extent that courts evaluate oversight efforts of the board as a whole, the recent trend of nominating ESG-competent directors could help the incumbent directors escape Caremark liability. Finally, the Section identifies budding ESG trends that are likely to fall within Caremark’s scope in the coming years (if they have not done so already), namely, political spending and AI bias. 1. Factors that May Trigger Heightened Scrutiny Caremark cases usually succeed in one of two scenarios: (1) plaintiffs manage to convince the court that the risk in question is “mission critical,” and so the lack of documentation of board discussions of it serves as a pleading-stage indication that directors breached their fiduciary duties (prong one); and/or (2) plaintiffs manage to locate in the internal documents that they inspect indications of red flags that directors were aware of but did not act on (prong two). Across 186 Jill Fisch, Can and Should Corporations Commit to a Voluntary Carbon Tax?, OXFORD BUS. L. BLOG. (Jul. 6, 2021), https://www.law.ox.ac.uk/business-law-blog/blog/2021/07/can-and-should- corporations-commit-voluntary-carbon-tax [https://perma.cc/9KLD-Z9PT]. 782 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 all ESG risks, these two types of indications can come from the company’s own disclosures, or from the company’s peers’ disclosures and actions. When a company identifies a certain ESG issue as “major risk” in its Form 10-K disclosure, courts could view it as an indication that said ESG issue is “mission critical” for oversight duty purposes.187 The court could then hold lack of documentation on board oversight of this issue against directors. The Chou case illustrates this: the directors claimed that they were not aware of rule violations in a tiny subsidiary of the company, but the court pointed out that the board signed a Form 10-K disclosure recognizing a DOJ subpoena on the matter, and used it as an indication that the directors ignored warnings that they had to have known about.188 A much thornier question is whether courts can use what the company’s peers were doing and disclosing as indications of criticality or red flags. Industry custom has long been considered relevant to Caremark cases.189 However, I would 187 It is interesting to note that in the debate about what counts as “materiality” for securities law purposes, the U.S. adopts a “single materiality” concept, which focuses on what is material for investors. By contrast, the E.U. recently adopted a “double materiality” approach, which requires company to disclose not just financially material (how it impacts investors), but also socially material (how it impacts society) information. Kristina Wyatt, US and European Climate Reporting: Is the Distinction Between Single and Double Materiality Overblown?, PERSEFONI (Aug. 18, 2022), https://persefoni.com/newsletter/us-european-climate-reporting [https://perma.cc/64YZ-QKF8]. For an analysis of how this different concept may end up affecting also American boardrooms, see Luca Enriques & Matteo Gatti, The Extraterritorial Impact of the Proposed EU Directive on Corporate Sustainability Due Diligence: Why Corporate America Should Pay Attention, OXFORD BUS. L. BLOG (Apr. 21, 2022), https://www.law.ox.ac.uk/business-law-blog/blog/2022/04/extraterritorial- impact-proposed-eu-directive-corporate [https://perma.cc/FQP9-RR2K]. 188 Teamsters Loc. 443 Health Servs. & Ins. Plan v. Chou, No. 2019- 0816-SG, 2020 WL 5028065, at *24 (Del. Ch. Aug. 24, 2020). 189 Writing shortly after the Caremark decision, former Chief Justice Veasey noted that “the custom of the time” is a factor that should be considered when evaluating board oversight efforts. E. Norman Veasey, An Economic Rationale for Judicial Decisionmaking in Corporate Law, 53 BUS. LAW. 681 (1998). See also Barker et al., supra note 25. No. 2:732] MISSION CRITICAL ESG 783 caution against viewing industry custom as a deciding factor in ESG oversight cases. In Marriott, for example, the plaintiffs showed that Marriott’s cybersecurity protocols fell below then- current industry standards, and used it as evidence that the directors did not try hard enough to engage in cyber-risk oversight. Vice Chancellor Will rejected that argument, noting that “non-compliance with non-binding industry standards is hardly on par with non-compliance with legal requirements, as far as Caremark scrutiny is concerned.”190 Still, I conjecture that, in future Caremark cases, the courts could benchmark boards’ oversight efforts against well- accepted, global reporting frameworks.191 One framework in particular that I view as becoming a factor in determining the scope and intensity of judicial scrutiny is that of the Sustainability Accounting Standards Board (SASB). The SASB breaks down the materiality of various ESG issues across seventy-nine different industries.192 Its framework both reflects and further solidifies market expectations for companies. Empirical studies find that the market reacts strongly only to those ESG issues that the SASB identifies as financially material for a given industry.193 And BlackRock recently asked its portfolio companies (read: everyone) to ensure that they prepare and disclose ESG information in line with SASB’s guidelines.194 The SASB is therefore a good proxy for predicting what ESG issues can be considered “critical” for oversight duty purposes. 2. Factors in Assessing Board Oversight Behavior Collectively I have focused thus far on the standard that will apply to board oversight of ESG risk. But in every fiduciary duty litigation there is an additional important question: how do 190 Marriott, C.A. No. 2019-0965-LWW, 2021 WL 4593777, at *37–38. 191 Moats & DeNicola, supra note 93 (explaining what these frameworks are). 192 Serafeim & Yoon, supra note 9, at 7. 193 Id. at 6. 194 Lipton et al., supra note 126. 784 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 the courts evaluate board behavior—individually or collectively?195 To generalize, courts tend to assess claims of breach of loyalty by looking at the behavior of each board member individually, whereas they tend to assess claims of breach of care by looking at the behavior of the board as a whole.196 Caremark claims seem to be an exception: while they are nestled under the duty of loyalty, courts evaluate them by looking at the board as a whole.197 This oft-ignored aspect of oversight liability interacts in interesting ways with the recent push to nominate ESG- competent directors. Consider, for example, the recent shareholder activist campaigns and academic proposals, which call on companies to replace incumbent directors with directors who will serve as official advocates for the environment.198 Having “green directors” on the board could help the remaining incumbent directors defend against Caremark claims. Having even a single green director on the board increases the chances that the Section 220 record will contain indications that the board discussed climate-related issues and was apprised of how the company manages them. That may be enough to dismiss the Caremark claim against all directors.199 The same logic extends to other ESG issues. 3. What the Future Holds: Caremark Liability for 195 Darian M. Ibrahim, Individual or Collective Liability for Corporate Directors?, 93 IOWA L. REV. 929 (2008). 196 Id. at 933. 197 Asaf Eckstein & Gideon Parchomovsky, Toward a Horizontal Fiduciary Duty in Corporate Law, 104 CORNELL L. REV. 803, 817 n.79 (2019). 198 For an example of an activist campaign, see Myles McCormick & Tom Wilson, Activist Group Follow This Launches Climate Campaign Against Big Oil, FIN. TIMES (Dec. 18, 2022), https://www.ft.com/content/c695432d-436a-4784-aa66-a06bfeec186d [https://perma.cc/8CN4-7X85]; for an example of an academic proposal, see McDonnell et al., supra note 7. 199 Theoretically, the courts could also decide to stop looking at a board engaged in oversight efforts as a unit and examine the bad faith of each director individually. No. 2:732] MISSION CRITICAL ESG 785 Political Spending and AI Bias? Societal expectations and the scope of Caremark are constantly evolving. I have focused thus far on some of today’s most salient issues, namely, cybersecurity, sexual misconduct, racial diversity, and climate change. But other issues that are less salient today could quickly become decidedly so, and thereby shift from being “nice to have” to being a “must” from a corporate governance perspective. To illustrate, consider the two rising ESG concerns of corporate political spending and AI bias. Like #MeToo in 2017 for sexual misconduct and George Floyd’s killing in 2020 for racial diversity, the January 6, 2021 attack on the Capitol has put a spotlight on corporate political spending. Indeed, in 2021, political spending was the dominant topic among all shareholder ESG proposals, receiving the highest support from shareholders and the least pushback from companies.200 Further, in the aftermath of the attack on the Capitol, many corporate leaders felt the need to speak out and made pledges regarding how company political donation dollars are going to be allocated from then on.201 Such pledges, in turn, exposed their companies to further criticism attacking the dissonance between their noble declarations and their not-so-noble actions on the ground.202 One could therefore argue that political spending practices and managers’ public stances on social issues have become a major source of reputational risk for companies and may 200 Andrew Ross Sorkin, The Rise of an Antitrust Pioneer, N.Y. TIMES (Mar. 10, 2021). 201 Cydney Posner, Survey on Corporate Political Activity for 2022, HARV. L. SCH. F. ON CORP. GOVERNANCE (Feb. 2, 2022), https://corpgov.law.harvard.edu/2022/02/02/survey-on-corporate-political- activity-for-2022/ [https://perma.cc/E4E7-CQQ5]. 202 Dorothy S. Lund & Leo E. Strine, Corporate Political Spending is Bad Business, HARV. BUS. REV. (Jan.–Feb. 2022), https://hbr.org/2022/01/corporate-political-spending-is-bad-business [https://perma.cc/8VBU-U3NR]. 786 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 therefore become a potential source of Caremark liability for directors.203 A more nascent (but fast-emerging) source of risk is the one stemming from AI bias.204 Legal scholars have recently spotlighted the potential pitfalls of increased usage of AI by for-profit corporations.205 Given how awareness of AI biases is building up, corporate boards should proactively identify how pervasive AI use is in their company, and how susceptible their AI use is to biases.206 The potential reputational risk here is hardly negligible: think, for example, of a scenario where a company makes public pledges regarding promoting racial diversity, but then news breaks out that the company’s main algorithm systematically discriminates. I emphasize that my discussion here is very preliminary and does not intend to exhaust the various considerations. For example, challenging board inaction on political spending could come with First Amendment hurdles, and challenging board inaction on AI bias may be realistic only for a certain subset of companies (think companies that rely heavily on facial recognition techniques). My intention here is simply to illustrate more generally how nascent issues that we may not think about now could quickly become salient and present major reputational risks, which in turn would put them on the Caremark radar. 203 Joe Nocera, Companies Are Stuck Between Their Workers and Politicians, N.Y. TIMES (May 7, 2022), https://www.nytimes.com/2022/05/07/business/dealbook/companies- abortion-florida.html [perma.cc/8PA4-78LG] (noting that the rise in employee activism creates pressures on business leaders to take strong public stands and real action, which, in turn, invites scrutiny from government, as was the case with the recent clash between Disney and Florida’s governor). 204 Robert Eccles, Board Responsibility for Artificial Intelligence Oversight, HARV. L. SCH. F. ON CORP. GOVERNANCE (Jan. 5, 2022), https://corpgov.law.harvard.edu/2022/01/05/board-responsibility-for- artificial-intelligence-oversight/ [https://perma.cc/7JNV-NQNL]. 205 See, e.g., Talia B. Gillis & Jann L. Spies, Big Data and Discrimination, 86 U. CHI. L. REV. 459 (2019). 206 Eccles, supra note 204. No. 2:732] MISSION CRITICAL ESG 787 IV. IS IT DESIRABLE TO EXTEND CAREMARK TO ESG? After focusing on the state of Caremark law, it is time to shift from the positive to the normative. This Part evaluates whether extending Caremark to ESG is desirable from an overall societal perspective. The Part presents three categories of arguments against extending Caremark to ESG, in ascending order of strength. The first category consists of arguments, frequently made by corporate law practitioners and academics, that private litigation is a bad vehicle for addressing corporate externalities, that Caremark liability for ESG would impede board primacy, and that Caremark liability would push boards to overly invest in developing ESG expertise. Section A assesses these prevalent arguments and finds them all wanting. A second category consists of arguments that evaluate Caremark liability based on how it supplements other, non-corporate-law enforcement mechanisms. Section B concludes that the added value of Caremark litigation may be lower in the context of reputational risk oversight than in that of legal risk oversight, but that it is not negligible. Section C highlights the costs of hindsight bias, and explains why they are likely to be especially high in Caremark litigation over reputational risk oversight. All in all, the analysis here suggests that judges should adopt a more judiciable approach when scrutinizing board oversight of nonlegal risks. A. Prevalent (But Less Convincing) Arguments One common argument against extending Caremark to ESG issues is that private litigation is a bad vehicle for redressing corporate externalities.207 For one thing, the 207 Stephen M. Bainbridge, Don’t Compound the Caremark Mistake by Extending it to ESG Oversight, 77 BUS. LAW. 651, 669–70 (2022); William Savitt, Tectonic Forces to Watch in Corporate Litigation, HARV. L. SCH. F. ON CORP. GOVERNANCE (Jan. 30, 2020), https://corpgov.law.harvard.edu/2020/01/30/tectonic-forces-to-watch-in- corporate-litigation/ [https://perma.cc/G8MR-JWZP]; see also Stephen M. 788 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 argument goes, the remedy does not fit the victim: “under Caremark, the company does not compensate others but instead recovers funds itself.”208 But that argument loses traction if Caremark indeed applies only to corporate behaviors that pose a critical reputational risk to the company. If there is an expected reputational sanction for a certain behavior, the company has already internalized some of the costs of that behavior. To illustrate, if a company anticipates that consumers would stop purchasing from it if they found out that the company polluted, the costs of polluting are already internalized by the company. In that sense, Caremark litigation is not much different from other types of derivative actions meant to help shareholders mitigate agency problems: directors are under a duty to pay attention to critical ESG issues because it is good for shareholders.209 A better version of the private-litigation-is-a-bad-vehicle argument is that society should not put plaintiff attorneys in charge of enforcing broader societal concerns.210 Those ambulance-chasers only seek to maximize quick returns on their investment, and will not hesitate to file frivolous claims just to extract quick settlements, or so the argument goes. They can therefore not be counted on to promote noble causes such as racial inclusion or net-zero carbon emissions. The problem with this argument is that it is not about Caremark Bainbridge, Director Primacy: The Means and Ends of Corporate Governance, 97 NW. U. L. REV. 547, 585–91 (2002). 208 Savitt, supra note 207. 209 Other types of Caremark litigation can be construed as creating, rather than curbing, agency problems. This is the case when the company can engage in unlawful corporate behavior that benefits its bottom line while imposing greater costs on society, because the expected legal sanction is smaller than the expected benefits (as will be illustrated by our discussion of the DuPont case in the following paragraphs, see infra note 231). See also Jennifer Arlen, Evolution of Director Oversight Duties and Liability under Caremark: Using Enhanced Information-Acquisition Duties in the Public Interest (Working Paper, Aug. 28, 2022), https://ssrn.com/abstract=4202830/ [https://perma.cc/5UX5-47P6]. 210 Bainbridge, Don’t Compound the Caremark Mistake by Extending it to ESG Oversight, supra note 204, at 673. No. 2:732] MISSION CRITICAL ESG 789 or ESG. Even if plaintiff attorneys are indeed little more than bounty hunters, our entire system of investor protection relies on indirect protection by such bounty hunters (not just plaintiff attorneys, but also hedge fund activists, savvy speculators, and others).211 The question is therefore not whether to place enforcement of corporate governance in the hands of bounty hunters (we already do that). Rather, the question is how to calibrate the hunters’ incentives so that they receive bounties only when promoting the overall level of corporate governance in the market. In that regard, the revamped mode of Caremark litigation seems to be striking the right balance: plaintiff attorneys get to collect hefty fees only if they conduct thorough pre-filing investigations that yield new information tying the directors to the corporate trauma. In other words, hunters collect bounties only if they promote individual accountability on the part of top corporate managers. Recall the Boeing example: the plaintiff attorneys got a nice share of the biggest settlement ever in such cases, but not before they scoured 630,000 pages of internal documents and painstakingly detailed the roles of specific directors and officers in the debacle.212 Another argument against extending Caremark to ESG is that it impedes board primacy in ways that end up hurting both shareholders’ and stakeholders’ interests.213 Judicial scrutiny is bad for shareholders because it pushes boards to overinvest in ESG and underinvest in the company’s core businesses. And it also hurts stakeholders’ interests because it interferes with the delicate balancing act that is ESG risk management. Real engagement with ESG often involves prioritizing some stakeholder groups over others. For example, shifting to a greener mode of production may hurt (at least initially) workers’ and consumers’ interests.214 Such 211 See Holger Spamann, Indirect Investor Protection: The Investment Ecosystem and Its Legal Underpinnings, 14 J. LEGAL ANALYSIS 17 (2022). 212 Shapira, Max Oversight Duties, supra note 46. 213 Bainbridge, Don’t Compound the Caremark Mistake by Extending it to ESG Oversight, supra note 204, at 677. 214 Rupert Darwall, The E in ESG Means Cancelling the S and the G, EPOCH TIMES (Oct. 18, 2021), https://www.theepochtimes.com/the-e-in-esg- 790 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 balancing acts are usually not the kind of decisions one wants judges to interfere with, or so the argument goes. In fact, this is less of an argument against applying Caremark to ESG, and more of an argument about how to apply Caremark to ESG. The argument basically calls on judges to focus on the process, and to leave the merits of specific managerial choices alone. Coincidentally, this is exactly what Delaware courts are already doing. Under Caremark as it is currently construed, the courts refrain from interfering with the merits of the board’s choices on how to set up compliance systems and how to prioritize among different risks.215 It is hard to envision Delaware judges scrutinizing directors for prioritizing the environment over workers or vice versa. What judges do instead is focus on the process, and interfere only in cases where directors failed to even consider a critical factor. This is hardly an unworkable or novel concept in corporate law.216 A third common argument against extending Caremark to ESG emphasizes the direct costs to the company.217 The idea is that the threat of Caremark litigation will push directors to overinvest in developing in-house expertise and in hiring outside experts in various ESG areas, thereby ramping up the costs of operating. But it is unclear whether this is such a bad thing. It may actually be desirable to incentivize boards to err on the side of spending money to get expert advice on means-cancelling-the-s-and-the-g_4055215.html/ [https://perma.cc/T3MY- EMDA]. 215 See, e.g., Richardson v. Clark, C.A. No. 2019-1015-SG, 2020 WL 7861335, at *27 (Del. Ch. Dec. 31, 2020). 216 That is, corporate boards prioritize all the time, and corporate law judges practically never make them pay out of pocket for making the “wrong” substantive choice. See Bainbridge, supra note 63 (on the business judgement rule); Amir N. Licht, Stakeholder Impartiality: A New Classic Approach for the Objectives of the Corporation, in FIDUCIARY OBLIGATIONS IN BUSINESS (Arthur B. Laby & Jacob Hale Russell eds., 2021) (on the duty-of- impartiality doctrine in trust law, which does not impose particular requirements on how fiduciaries prioritize conflicting interests, and only requires them to consider different interests “within extensive margins”). 217 Bainbridge, Don’t Compound the Caremark Mistake by Extending it to ESG Oversight, supra note 204. No. 2:732] MISSION CRITICAL ESG 791 reputational risks, if one believes that boards’ natural tendency is to downplay them (as many practitioners seem to believe).218 Directors may find it intuitive to dedicate time and resources to manage a crisis that has already hit; but they are generally ill-equipped to identify potential crises and avoid them before they hit.219 When left to their own devices, boards may therefore tend to spend too little on reputational risk expertise, and so it may not be a bad thing to nudge them toward spending more. Even those who think that spending on ESG expertise is bad for the company have to acknowledge that such spending is already in motion, regardless of Caremark. For example, most large corporations already conduct “materiality assessments” that identify key ESG concerns in order to meet disclosure requirements.220 That is, corporate boards already pay both external and in-house professionals that help boards understand what and how to disclose.221 Whether the threat of Caremark liability is salient or not will not drastically change whether corporate boards invest in mapping and monitoring critical ESG risks. The ship of ESG-expertise costs has already sailed.222 In all, I find these existing arguments against extending Caremark to ESG to be less convincing.223 The two more relevant arguments concern the benefits of counterbalancing 218 Zoom Interview and email correspondences with Ed Coke, CEO, Repute Associates (Jan. 2022) (transcript on file with the Columbia Business Law Review). 219 Gadinis & Miazad, supra note 3, at 1461–64. 220 Id. at 1429; Moats & DeNicola, supra note 93. 221 Id. 222 Gadinis & Miazad, supra note 3, at 1422–23 (noting the increased ESG expertise among today’s board nominees). 223 I focused here on three common arguments, for the sake of brevity. There exist other potential arguments, such as the one about Caremark’s expressive effects. According to the expressive effects argument, couching serious societal issues such as racial discrimination or sexual harassment within the “harms to investors” framework of derivative actions could send the wrong message. For good treatments of this objection, see Hemel & Lund, supra note 23, at 1671. See also Brummer & Strine, supra note 105. 792 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 the flaws of other systems, and the costs of judicial hindsight bias. I turn to those now. B. Benefits: Balancing the Flaws of Other Enforcement Mechanisms Perhaps the biggest advantage of applying Caremark to oversight of legal requirements is that it nicely counterbalances the flaws of other enforcement mechanisms.224 First and foremost, Caremark holds the promise of balancing the “willful blindness” incentives. Top corporate insiders have strong incentives to remain ignorant of activities that put profits above all else. Profitable activities benefit the insiders via their stock-based compensation.225 And being willfully blind to how profits were achieved helps the insiders maintain plausible deniability and escape accountability when the adverse consequences of their company’s activities come to light.226 Caremark, in its revamped mode, emphasizes board-level documentation, and views a lack of documentation as pleading-stage inferences against the directors.227 That way, Caremark incentivizes upward flows of information, which in turn flush out illegalities and serve a prophylactic function. Beyond counterbalancing the flaws of internal corporate governance incentives, Caremark also counterbalances the flaws of external enforcement of legal requirements. For example, a well-documented problem of public enforcement is the inability to hold top-level individuals accountable.228 224 Shapira, supra note 8, at 1888–94. 225 John Armour, Jeffrey Gordon & Geeyoung Min, Taking Compliance Seriously, 37 YALE J. REG. 1, 5–6 (2020). 226 Jennifer Arlen, The Potentially Perverse Effects of Corporate Criminal Liability, 23 J. LEGAL STUD. 833, 859 (1994). 227 See Teamsters Loc. 443 Health Servs. & Ins. Plan v. Chou, No. 2019- 0816-SG, 2020 WL 5028065, at *2 (Del. Ch. Aug. 24, 2020); Hughes v. Hu, No. 2019-0112-JTL, 2020 WL 1987029 (Del. Ch. Apr. 27, 2020). 228 See generally JOHN C. COFFEE, CORPORATE CRIME AND PUNISHMENT: THE CRISIS OF UNDERENFORCEMENT (2020) (noting that not a single top executive has been prosecuted in the largest corporate debacles of the past No. 2:732] MISSION CRITICAL ESG 793 Caremark litigation, by nature, emphasizes just that: individual accountability. In its revamped mode, Caremark places powerful investigatory tools (Section 220) in the hands of sophisticated bounty hunters (institutional investors and their attorneys), and promises them a hefty bounty if they locate damning evidence on the role that directors played in the trauma. This type of advantage—counterbalancing the flaws of other enforcement mechanisms—arguably applies less forcefully in the context of Caremark litigation over the oversight of nonlegal risk. To understand why, consider that (1) the non-Caremark “enforcement mechanism” here is the prospect of reputational fallouts for behavior below that which stakeholders expect from directors, and that (2) Caremark- type enforcement becomes relevant here only when reputational risks rise to a “critical” status. It is hard to envision a scenario in which (2) applies, but (1) does not. If the reputational risk in question earned the “mission critical” designation (i.e., (2) applies), it probably means that said reputational risk is already salient and monitored closely by market actors, the media, and civil society organizations (i.e., (1) applies too). In other words, Caremark liability in this context kicks in only when the other “enforcers” (other market actors) are already on the case.229 Similarly, one could claim that directors have strong non- Caremark incentives to pay attention to critical reputational risks. Sudden-death reputational scenarios are bound to hurt directors’ current stock-based pay packages and their future labor market reputations.230 Further, the ability to argue “I did not know” is less valuable here: plausible deniability may be a strong defense against legal sanctions, but it matters less against reputational sanctions, as market discipline usually decade, and offering various explanations); Samuel W. Buell, The Responsibility Gap in Corporate Crime, 12 CRIM. L. PHIL. 471, 490 (2018). 229 The flip side also holds: if the expected reputational sanction for a given ESG issue is low ((1) does not apply), said issue would probably not qualify as “critical,” and the threat of Caremark liability becomes irrelevant ((2) also does not apply). 230 Lipton, supra note 6, at 530 (in the context of ESG disclosures). 794 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 does not have a mens rea requirement. The threat of reputational sanctions—that is, the threat that other market actors will reduce their willingness to do business with inattentive directors going forward—already creates incentives for directors to remain informed, or so the argument goes. To illustrate these differences between the incentives to remain ignorant of critical legal risks and the incentives to remain ignorant of critical reputational risks, consider the case of chemical giant DuPont. In the process of manufacturing Teflon, DuPont emitted an extremely toxic chemical dubbed C8 for six decades.231 DuPont ended up paying huge fines in regulatory (public) enforcement and private litigation. But Luigi Zingales and I showed that polluting could actually have been the rational decision for DuPont’s directors and its shareholders from an ex ante perspective.232 The reason is the time lag. The crucial decision to continue polluting without investing in abatement was taken back in 1984, while the huge fine was imposed only in 2017. At the company level, such a time lag greatly reduces the deterrent power of legal sanctions: when you factor in the time value of money, a $1 billion fine in 2017 is worth roughly $100 million in 1984 dollars.233 At the individual director level, such a time lag greatly dilutes the deterrent power of reputational sanctions. When news about C8 emissions finally broke, most of the 1984 directors had already died or retired, 231 Leach v. E.I. Du Pont de Nemours & Co., No. 01-C-608, 2002 WL 1270121, at *3 (Cir. Ct. W. Va. Apr. 10, 2002). The case was depicted in the 2019 popular movie DARK WATERS. 232 Roy Shapira & Luigi Zingales, Is Pollution Value-Maximizing? The DuPont Case (NBER, Working Paper No. 23866, 2017), https://ssrn.com/abstract=3046380/ [https://perma.cc/ZT2N-FUZP]. To emphasize: the decision can be considered rational from an ex-ante perspective, even though we know that the company anticipated in real time that they would have to pay huge fines down the road. Leach, 2002 WL 1270121, at *3. 233 Roy Shapira & Luigi Zingales, Is Pollution Value-Maximizing? The DuPont Case, at Appendix A. No. 2:732] MISSION CRITICAL ESG 795 and the few that were still in business were never mentioned in media coverage of the debacle.234 Interestingly, when Zingales and I researched DuPont’s internal decision-making processes, we found out that, in the same years that the company was behaving badly by emitting C8, it was behaving well and being a leader in other areas, such as nuclear energy and the ozone layer.235 What explains this variation? Zingales and I conjectured that the answer has to do with public saliency. Back then (in the 1980s and 1990s), nuclear energy and the ozone layer were the leading ESG issues, widely covered by the media and at the top of the political agenda. Behaving badly on such salient issues came with the prospect of significant reputational fallouts for the companies and individuals involved. Indeed, DuPont’s directors prioritized these issues and won many accolades for being a force for positive change.236 DuPont’s top directors thus had strong incentives to remain ignorant or passive with regard to activities that were profitable to the company, even if they violated key legal requirements. At the same time, they had strong incentives to remain informed and active regarding activities that were salient and came with the risk of public backlash, even if they were not required by law. The upshot for our purposes is straightforward: Caremark liability for how the company used nuclear energy or impacted the ozone layer was not needed to incentivize DuPont’s directors to put these issues on their agendas, but it could have helped to incentivize directors to study the negative effects of C8 emissions and report them to the regulator and the public. 234 Id. at Table 2. 235 Id. at 24; Stephen Miller, Former DuPont CEO Aided Safety Efforts, WALL ST. J. (Jan. 21, 2010), https://www.wsj.com/articles/SB10001424052748704320104575015522736 060774 [https://perma.cc/MVV4-RJVS]. 236 See, e.g., Chad Holliday, Sustainable Growth, the DuPont Way, 79 HARV. BUS. REV. 129 (2001) (underscoring how DuPont’s CEO and the company itself were widely considered the gold standard on green production). 796 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 Still, I should not overstate the argument that Caremark liability is superfluous in the context of salient ESG issues. It is not. The fact that the market identifies certain behaviors as “best practices” does not necessarily mean that corporate boards will adopt them. We witness all the time corporate boards failing to adopt management best practices, for various reasons.237 These reasons—ranging from cognitive and informational limitations to executive compensation benchmarks that make directors downplay the long term— could also hinder boards from giving reputational risks proper attention.238 Directors’ time horizons may be too short for them to care about long-term reputational risk. And directors’ individual reputation concerns may not be enough to push them to cater to societal demand. Because of the collective aspects of corporate and board reputation, when bad news breaks, it is not uncommon for certain directors to emerge from the crisis unscathed, without having their names dragged through the mud.239 The existing incentives for boards to be attentive to ESG concerns are therefore very imperfect. And there is reason to believe that Caremark can nicely balance the flaws of the other accountability mechanisms in this area as well.240 Consider the following three oft-invoked accountability mechanisms: securities law’s disclosure requirements, systematic stewardship by common owners, and reputational fallouts. Disclosure requirements are a very imperfect mechanism, if only because they tend to have a one-size-fits-all quality, lumping together different ESG issues and different 237 George Serafeim, ESG: Hyperboles and Reality, at 7 (Harv. Bus. Sch. Working Paper No. 22-031, 2021), https://ssrn.com/abstract=3966695; Benjamin, supra note 165, at 350 (noting that the financial impact of climate risks, even when clearly relevant to companies, tends to be a blind spot for boards). 238 Ho, supra note 7, at 253. 239 See generally Jean Tirole, A Theory of Collective Reputations, 63 REV. ECON. STUD. 1 (1996). 240 Cf. Rapp, supra note 60, at 164. On the limits of other ESG- accountability mechanisms, see also Virginia Harper Ho, The Limits of Enlightened Shareholder Activism, INT’L J. FIN. SERVICES (2022). No. 2:732] MISSION CRITICAL ESG 797 companies.241 Systematic stewardship by common owners— the idea that giant index funds that hold the entire market portfolio will pressure companies to stop profiting from externalizing costs242—may look good on paper, but on-the- ground evidence paints a less sanguine picture.243 Stock prices do not accurately reflect externalities such as climate change, index funds give low weight to the distant future, and many corporate wrongdoers are shielded from index fund pressures due to their ownership structure.244 As for reputation discipline, there are two ways for companies to avoid reputational fallouts: they can either (1) improve their ESG behavior, or (2) manage their ESG appearance. Outsiders often find it hard to detect whether a company is doing (1) or (2).245 The Caremark framework can counterbalance some of these flaws. Unlike disclosure requirements, Caremark applies on a case-by-case basis and is context-sensitive. Unlike systematic stewardship, Caremark applies also to companies that are privately held or have a controlling shareholder. And Caremark can also facilitate more robust reputation disciplining. The revamped, Section 220-driven version of Caremark litigation conveys quality information to the market, in the form of internal documents to which market actors were not privy and interpretations of what went 241 On the flaws in ESG disclosure proposals, see Amanda M. Rose, A Response to Calls for SEC-Mandated ESG Disclosure, 98 WASH. U. L. REV. 1821 (2021); Christopher M. Bruner, Corporate Governance Reform and the Sustainability Imperative, 131 YALE L. J. 1217, at 1254–58 (2022). 242 See generally Madison Condon, Externalities and the Common Owner, 95 WASH. L. REV. 1 (2020); John C. Coffee, Jr., The Future of Disclosure: ESG, Common Ownership, and Systematic Risk, 2021 COL. BUS. L. REV. 602 (2021); Jeffrey N. Gordon, Systematic Stewardship, 47 J. CORP. L. 627 (2022), https://ssrn.com/abstract=3782814. 243 See Roberto Tallarita, The Limits of Portfolio Primacy (Working Paper No. 2022-7, 2021), https://ssrn.com/abstract=3912977. 244 See id. 245 Cf. Lucian A. Bebchuk & Roberto Tallarita, Will Corporations Deliver Value to All Stakeholders?, 75 VAND. L. REV. 1031 (2022); Lucian A. Bebchuk, Kobi Kastiel & Roberto Tallarita, Does Enlightened Shareholder Value Add Value?, 77 BUS. LAWYER 731 (2022). 798 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 wrong by well-respected arbiters (Delaware judges).246 Putting companies’ responses to ESG issues through the Caremark wringer could therefore improve the market’s ability to distinguish between companies that actually improved their behavior and companies that merely improved their appearance. All in all, we should view the argument about supplementing the other enforcement mechanisms as a relative rather than an absolute one: while Caremark litigation may provide more value in the context of legal compliance oversight, one cannot dismiss the value that it is likely to provide in the context of reputational risk oversight. Then the question becomes one of comparing these benefits with the costs of applying Caremark to ESG. The next section highlights one category of such costs, namely, judicial hindsight bias. C. Costs: Hindsight Bias Caremark litigation over reputational risk oversight may be prone to hindsight bias. The Caremark framework was intended from its inception as a two-step maneuver: it tells corporate directors to be more proactive about their oversight duties; and at the same time, it warns judges from interfering after the fact and concluding that if a corporate trauma happened, directors should have done more to prevent it.247 The way that courts traditionally safeguarded against hindsight bias was by refraining from telling directors what information they should have collected. Instead, the courts traditionally interfered only in the rare cases where they had indications that directors actually knew about the problems but neglected to act on that information.248 246 Shapira, A New Caremark Era, supra note 8, at 1883–87. 247 Jennifer Arlen, The Story of Allis-Chalmers, Caremark, and Stone: Directors’ Evolving Duty to Monitor (NYU Law and Economics Research Paper No. 08-57) (J. Mark Ramseyer ed., 2009) (interviewing Chancellor Allen). 248 Robert T. Miller, Wrongful Omissions by Corporate Directors: Stone v. Ritter and Adapting the Process Model of the Delaware Business Judgment Rule, 10 U. PA. J. BUS. & EMP. L. 911, 932 (2008). No. 2:732] MISSION CRITICAL ESG 799 This strategy to maintain a judiciable role faces a serious challenge these days. The Section 220 turn in Caremark litigation occasionally grants plaintiff attorneys access to mountains of internal documents, which means that they are bound to locate instances where board oversight can be framed in a negative light. And when plaintiffs submit super- detailed Caremark complaints to courts, judges have a hard time resisting the temptation to scrutinize the reasonableness of directors’ decisions regarding what information to collect or react to.249 Pertinently, the costs of judges giving in to the temptation are likely to be higher in the context of reputational risk than in the context of legal compliance. Compared to legal requirements, nonlegal requirements tend to be less easily identifiable, less predictable, and more of a moving target.250 A reputational risk that seems critical in 2022 may not be critical in 2024. A reputational risk that is critical in one geographic region is not in another. And within the same region, different stakeholder groups have different beliefs and expectations of companies. As a result, corporate boards have a hard time identifying and planning ahead for these risks. Planning for how stakeholders may perceive one’s company in hypothetical future scenarios involves predicting human behavior on a mass scale, under great uncertainty, and with many company-specific determinations. These are exactly the types of decisions that one normally does not want courts to interfere in with the benefit of hindsight.251 249 Shapira, supra note 53, at Part III (analyzing the potential hindsight bias in the Boeing decision). 250 Larcker & Tayan, supra note 11 (noting the problem of predictability); David F. Larcker, Brian Tayan, & Edward M. Watts, Seven Myths of ESG (Working Paper, Nov. 4, 2021), https://ssrn.com/abstract=3956044 (noting the problem of identifiability); Robert Eccles, Colin Mayer & Judith Stroehle, The Difference between Purpose and Sustainability (aka ESG), HARV. L. SCH. F. ON CORP. GOVERNANCE (Aug. 20, 2021), https://corpgov.law.harvard.edu/2021/08/20/the-difference-between- purpose-and-sustainability-aka-esg/ [https://perma.cc/ED75-SZWS]. 251 In re Citigroup Inc. S’holder Derivative Litig., 964 A.2d 106, 126 (Del. Ch. 2009). 800 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 All in all, the revamped mode of Caremark litigation is likely to prove desirable overall, and there is no reason to categorically avoid applying it to ESG. Still, there is reason to apply Caremark to ESG more judiciously than when applying it to classic illegalities. Caremark liability for ESG risk is and ought to remain the most difficult variant of Caremark claims.252 CONCLUSION Corporate purpose has reemerged as the hottest issue in corporate governance. This Article has focused on one way for shareholders to hold managers accountable for paying insufficient attention to broader societal interests, namely, corporate law’s director oversight duties. Corporate legal scholars have traditionally dismissed this conduit, reasoning that director oversight duties are never enforced. But over the past two years, Delaware courts have clarified that this is no longer the case. Oversight liability has turned into a highly relevant channel that the ESG literature should start considering more carefully. This Article represents a step in that direction. This Conclusion reemphasizes the Article’s implications for practitioners and policymakers, clarifies its contributions by juxtaposing them with the extant literature, and acknowledges its limitations. The analysis here carries important implications for corporate practitioners and policymakers. For practitioners, the Article identifies conditions under which directors face heightened risk of personal liability for their company’s ESG behavior. What can directors do to avoid such liability? The most important step for boards is to work with management to identify those ESG risks that are critical to the company.253 Once they have identified critical ESG risks, boards should 252 Cf. Bainbridge, supra note 60, at 990. 253 Moats & DeNicola, supra note 93. In other words, boards should resist the temptation to take a one-size-fits-all approach that treats all reputational risks the same. This is not good for practice and will not help them with exposure to Caremark liability. Lipton et al., supra note 126. At the same time, boards need to ensure that they do not utterly miss an ESG issue that is critical to their company when prioritizing. No. 2:732] MISSION CRITICAL ESG 801 assign responsibility for oversight of the risks to the board committees. At the same time, directors cannot delegate oversight of these risks away: they need to make sure that they are regularly apprised of, and can assess the effectiveness of their company’s management of, ESG risks.254 Along these lines, boards should avoid leaning uncritically on management. For example, they should make sure that internal complaints can flow up to them when needed.255 Finally, boards should carefully document their discussions and actions regarding critical ESG concerns.256 For policymakers, the Article spotlights how the costs of hindsight bias loom larger in reputational risk cases, and so concludes that judges should be more conservative in how they grant inspection rights and how they draw inferences based on constructive knowledge in the pleading stage in such cases (compared to cases of legal risk oversight). The best way to clarify this Article’s contributions is by juxtaposing them with the extant literature. Much of the literature on corporate social responsibility has traditionally focused on whether directors should maximize something other than corporate profits (think of Milton Friedman’s famous maxim257). The corporate law branch of that literature has traditionally focused on whether the law enables directors to maximize something other than shareholder value.258 In recent years, given the acceleration in market expectations and the fact that ESG has become a major source of risk for companies’ reputations and financials, the literature has shifted its focus to whether the law requires managers to address ESG concerns. Within that strand of the literature, much of the focus has been on non-Caremark channels, such as contested board elections or SEC enforcement actions over misstating ESG information. This Article is situated within a smaller, nascent branch of that literature, which focuses on 254 Id. 255 LaCroix, supra note 81. 256 Id. 257 Milton Friedman, The Social Responsibility of Business is to Increase Its Profits, N.Y. TIMES, Sept. 13, 1970. 258 Williams & Conley, supra note 2, and accompanying text. 802 COLUMBIA BUSINESS LAW REVIEW [Vol. 2022 the possibility of fiduciary duty litigation as a mechanism for holding managers accountable for failing to address ESG concerns. The Article differs from other contributions within this branch in several important ways. For one, there is the simple issue of timing. When it comes to director oversight duties, articles that were published before 2021 have already become somewhat outdated, given the dramatic recent changes in how courts apply the Caremark framework. In fact, when it comes more specifically to oversight duties for ESG risks, even articles published in 2021 do not reflect many of the relevant developments discussed here, such as Boeing or Marriott. On the normative side, this Article wrestled with valid arguments for why corporate law courts should not extend Caremark to ESG.259 While I acknowledge that courts should scrutinize board oversight more cautiously when it comes to nonlegal risks, I believe that there are also benefits to today’s revamped approach to Caremark litigation, such as its role in mitigating the incentives for top managers to remain ignorant of decisions that puts profits over everything else. On the descriptive side, I wish to highlight two recent accounts that are closest to this one, namely, Williams and co- authors on climate change,260 and Brummer and Strine on diversity and inclusion.261 Both these accounts convincingly dispel the once-prevalent notion that directors cannot be sued for what they did or did not do regarding nonlegal requirements (such as not doing enough to combat climate change or not doing enough to promote racial diversity). But I am much more skeptical than them in regard to the likelihood of Caremark liability for diversity- or climate-related risks. It is much easier to envision scenarios that give rise to viable Caremark claims in areas such as cybersecurity or sexual harassment than in areas such as diversity or climate. While these two (super-thorough) accounts focus on a single ESG issue, it may be a useful exercise to compare various ESG 259 Bainbridge, supra note 207. 260 Barker, Williams & Cooper, supra note 25. 261 Hill, supra note 104. No. 2:732] MISSION CRITICAL ESG 803 concerns according to their relative exposure to Caremark liability. Not all ESG risks are created equal from a reputational or Caremark-liability perspective, and racial diversity and environmental sustainability are relatively low on that metric. Before we end, it is important to acknowledge this Article’s limitations. For one, we have seen just how much oversight liability is a dynamic area of law.262 It would therefore not be surprising if, two or three years from now, some of the claims made here about a given ESG issue being unlikely to face Caremark liability become outdated. What one needs to take away from this Article is therefore not one specific conjecture or another, but rather the general mode of inquiry that should be applied going forward: instead of asking whether a risk is legal or reputational, ask whether a risk is critical; instead of assuming that all ESG issues are critical, explore each issue’s impact on corporate reputation within a specific industry and a specific company; and instead of asking whether judges are likely to find directors liable, ask whether judges are likely grant broad inspection (Section 220) requests. Further, nothing in the analysis here suggests that corporate boards can be expected to eliminate reputational risk (or any other type of risk, for that matter). Even a perfect calibration of Caremark duties would not cure all ills that stem from corporate misbehavior. My analysis should therefore be read more modestly, as suggesting that directors who are not mindful of ESG risks that are critical to their company’s success are breaching their fiduciary duties. The Caremark channel, however imperfect, could serve to supplement (not substitute) other mechanisms for holding corporations accountable. 262 Veasey, supra note 189, at 692.