NOTE IN SEARCH OF THE CAREMARK JUNCTION: CONCEPTUALIZING THE CORE OF CAREMARK LIABILITY Brian Zharov* In recent years, Caremark claims have taken center stage in corporate law discussions. With more Caremark claims proceeding past the motion to dismiss stage, some argue that Caremark liability has evolved into a conduit between corporate governance and public policy. Much ink has been spilled debating whether Caremark claims should play this conduit role. Rather than add to the ink-spillage on this normative question, however, this Note takes a different approach; it employs a descriptive analysis of Caremark liability to establish a new framework for portraying and analyzing Caremark claims. In particular, by conceptualizing Caremark liability through the lens of shareholder versus third-party interests, this Note will peel the layers behind a Caremark claim, scrutinizing it until it reaches its core. And at the core, what this Note finds is quite remarkable and what it neologizes as the “Caremark Junction”: a rare point of overlap between shareholder and third-party interests concerning the scope and intensity of a board of director’s oversight behavior. This Note explores how to reach the Junction, dissecting its necessary conditions and analyzing its broader implications—all with the aim of grasping the true nature of Caremark liability as a distinct, though overlapping, concept from general oversight liability. *J.D. Candidate 2024, Columbia Law School; B.A. 2020, University of Michigan. My deepest thanks to Professor Zohar Goshen for supervising this work, and to the editorial board and staff of the Columbia Business Law Review for their thoughtful comments and meticulous edits. I would also like to thank my family for their unwavering support, which has been a steadfast pillar in my educational journey. 1068 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 I. Introduction ............................................................. 1068 II. BackGround on Law ................................................ 1073 A. The Derivative Claim ........................................ 1074 B. The Evolution of the Caremark Duty ................ 1076 C. Business Risk vs. Legal Risk, and the Positive-Law Regulation Requirement ................................... 1082 III. The Caremark Junction ........................................... 1087 IV. The Caremark Junction: Case Law ......................... 1094 A. “Successful” Caremark Claims .......................... 1095 1. Marchand ..................................................... 1095 2. In re Clovis Oncology .................................... 1100 3. In re Boeing Co. Derivative Litigation ......... 1104 4. Tying the Cases: Conceptual Requirements Are Met ......................................................... 1109 B. Unsuccessful Caremark Claims ........................ 1111 1. In re Citigroup Inc. Shareholder Derivative Litigation ...................................................... 1111 2. In re Qualcomm Inc. FCPA Stockholder Derivative Litigation .................................... 1113 3. City of Detroit Police and Fire Retirement System v. Hamrock ....................................... 1116 V. Conclusion ................................................................ 1119 I. INTRODUCTION Since the Delaware Chancery Court’s 1996 Caremark1 decision, establishing a director’s fiduciary duty to in good faith oversee her company’s operations, the literature has been swarmed by many writings on so-called Caremark claims. Over the past few years in particular, there has been an uptick in legal scholarship on the interplay between Caremark claims and a wide array of external obligations, such as a director’s oversight duties pertaining to E.S.G.,2 1 In re Caremark Int’l Inc. Derivative Litig., 698 A.2d 959 (Del. Ch. 1996). 2 See, e.g., Leo E. Strine, Jr., Kirby M. Smith, & Reilly S. Steel, Caremark and ESG, Perfect Together: A Practical Approach to No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1069 cybersecurity,3 and D.E.I.4 programs, arguing that perhaps the Caremark claim is a tiger in deer’s clothing, ready to address society’s most pressing issues.5 Unsurprisingly, the Chancery Court has also seen in uptick in such claims on its docket.6 If such a fiduciary duty is considered “undoubtedly ‘[o]ne of the most important court decisions in th[e] area’ of corporate governance and compliance,”7 then it is reasonable to expect it to encompass such facets of public policy. However, how is this reconciled with the observation that Caremark claims related to E.S.G., cybersecurity, and D.E.I. fail to progress beyond the motion to dismiss stage?8 In fact, why Implementing an Integrated, Efficient, and Effective Caremark and EESG Strategy, 106 IOWA L. REV. 1885 (2021). 3 See, e.g., H. Justin Pace & Lawrence J. Trautman, Mission Critical: Caremark, Blue Bell, and Director Responsibility for Cybersecurity Governance, 2022 WIS. L. REV. 887, 938 (“[T]he reinvigoration of Caremark and the rise of cyberthreats combine to create a serious danger of director liability. Directors who fail to censure that the corporation addresses cybersecurity at the board level are exposing themselves to liability.”). 4 See e.g., Chris Brummer & Leo E. Strine, Jr., Duty and Diversity, 75 VAND. L. REV. 1, 86 (2022) (“Failure to try to ensure that the company complies with core antidiscrimination laws not only exposes the company to fines and other regulatory harm if there are violations, but also exposes fiduciaries to Caremark suits in Delaware . . . .”). 5 For a general overview of the “soft law” power of Caremark claims, see Claire A. Hill, Caremark as Soft Law, 90 TEMP. L. REV. 681 (2018). 6 See, e.g., Constr. Indus. Laborers Pension Fund ex rel SolarWinds Corp. v. Bingle, C.A. No. 2021-0940-SG, 2022 WL 4102492, at *1 (Del. Ch. Sept. 6, 2022) (“Caremark claims, once relative rarities—have in recent years bloomed like dandelions after a warm spring rain . . . .”). See also Roy Shapira, A New Caremark Era: Causes and Consequences, 98 WASH. U. L. REV. 1857, 1866 (2021) (particularly after Boeing, Delaware corporate law has entered into “a systematic change in failure-of-oversight litigation. A new Caremark era.”); Roy Shapira, Max Oversight Duties: How Boeing Signifies a Shift in Corporate Law, 48 J. Corp. L. 119, 129, 130 (2022). 7 Todd Haugh, Caremark’s Behavioral Legacy, 90 TEMP. L. REV. 611, 646 (2018) (citing MARTIN T. BIEGELMAN, BUILDING A WORLD-CLASS COMPLIANCE PROGRAM: BEST PRACTICES AND STRATEGIES FOR SUCCESS 72 (2008)). 8 See, e.g., Ontario Provincial Council of Carpenters’ Pension Tr. Fund v. Walton, 294 A.3d 65, 86 (Del. Ch. 2023) 1070 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 have almost all Caremark claims failed to proceed past the motion to dismiss stage?9 To an outsider analyzing the failure rate of such claims, it would appear that a Caremark claim is merely a “toothless tiger,”10 even if the tiger is hiding in deer’s clothing. Despite the above oft-cited claims, some contend that “evidence now suggests that an interpretive drift is occurring in Caremark claims.”11 To understand this “drift,” however, two interrelated foundational questions arise, both of which underpin a Caremark claim and its role in corporate law: What, doctrinally, are oversight claims, and why are they so difficult to plead and prove? Much of the ink spilled on the topic has all been using the same color: liability in the broad sense, which can implicate some external law and thus legal liability. Yet, by conceptualizing12 Caremark liability through the lens of shareholder versus third-party interests, this Note will illustrate how this approach is conceptually misguided. (noting that, “the relative importance of cybersecurity risk has not yet led to a Caremark claim surviving a motion to dismiss, although someday it might.”). For another case that does not directly concern Caremark claims but highlights similar challenges in matters related to E.S.G. and D.E.I., see Simeone v. Walt Disney Company, 302 A.3d 956, 958 (Del. Ch. 2023) (rejecting a Disney shareholder’s books and records request and observing that “Delaware law vests directors with significant discretion to guide corporate strategy—including on social and political issues.”). 9 See Robert C. Bird & Julie Manning Magid, Toward a Systems Architecture in Corporate Governance, 24 U. PA. J. BUS. L. 84, 113 (2021) (“Both courts and commentators have noted that Caremark claims rarely succeed…”). 10 Anne Tucker Nees, Who’s the Boss? Unmasking Oversight Liability Within the Corporate Power Puzzle, 35 DEL. J. CORP. L. 199, 234 (2010) (metaphorically describing, as of 2010, courts’ treatments of Caremark claims as a “toothless tiger…a threat without any enforcement mechanism.”). 11 Bird & Magid, supra note 9, at 11. 12 See, e.g., Kenneth Einar Himma, Conceptual Jurisprudence: An Introduction to Conceptual Analysis and Methodology in Legal Theory, 26 REVUS: J. CONST. THEORY & PHIL. L. 65, 67 (2015) (defining legal conceptual analysis as one that “will explicate the content of each concept and locate them among a general conceptual framework that guides both our linguistic practices regarding the relevant concept-words and our legal practices themselves.”). No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1071 There is a difference between violating an external law due to poor compliance and a director violating her fiduciary duty of good faith — a difference between effective general oversight to try to prevent an illegality and effective Caremark compliance, the latter requiring a much more stringent standard. Indeed, a corporation may have effective Caremark compliance but may still violate an external law due to ineffective,13 general oversight.14 To understand the difference between effective general compliance and effective Caremark compliance, this Note will observe differences between shareholder and third-party interests as proxies to reverse engineer and peel the layers behind a Caremark claim to define what it actually is and why it is so difficult to plead. This Note aims to do so descriptively, not normatively, through establishing a new framework for portraying and analyzing Caremark claims. Part II will explore the background literature of and explain the case law pertaining to Caremark’s layers: its derivative nature, its legal standards, and its application to legal risks. Section II.A will underscore how Caremark claims are to be brought derivatively, and so the harm that shareholders allege is one to the corporation as a whole. Understanding that Caremark claims can only be brought derivatively is important in understanding the relationship and tension between shareholder and third-party interests. The Boeing case15 is a stark example of this: At what point could shareholders sufficiently plead a Caremark claim? Through emphasizing that Caremark claims are fiduciary duty claims, the harm to the corporation sufficient to plead a potential derivative action was the drop in stock value, but only when such decrease in stock price resulted from a failure 13 Ineffective here implies that a “better” oversight or compliance program would have prevented the unlawful activity. 14 See Firemen’s Ret. Sys. ex rel Marriott Int’l, Inc. v. Sorenson, C.A. No. 2019-0965-LWW, 2021 WL 4593777, at *18 (Del. Ch. Oct. 5, 2021) (“[T]he difference between a flawed effort and a deliberate failure to act is one of extent and intent.”). 15 In re Boeing Co. Deriv. Litig., C.A. No. 2019-0907-MTZ, 2021 WL 4059934 (Del. Ch. Sept. 7, 2021). 1072 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 to exercise proper oversight with respect to a “mission critical” corporate function or issue. Put more frankly, shareholders would not have been able to bring a Caremark claim but for the decrease in stock value, while there still could have been other suits and other liabilities pertaining to the 734 MAX airplane crash— and there were.16 Despite the differences between effective, general compliance and effective Caremark compliance, there is still some connection between what both types of compliance aim to achieve. Section II.C will peel the next layer, briefly exploring the interplay of federal law and regulation and Delaware corporate law. Part III will synthesize Part II’s two layers that materialize behind Caremark claims: (1) its derivative nature and (2) its role in the interplay between federal law and state corporate law. Through intertwining (1) and (2), Caremark’s true nature emerges, and what happens is a rare moment—a convergence between shareholder and third-party interests in terms of how to achieve a goal, rather than on what the goal itself is. Third-party interests focus on how the corporation aims to comply with some external law that affects them, regardless of the cost, while shareholders would want a compliance program that is reasonable in proportion to how far away it is from a “corporate trauma.” Indeed, when—or rather, if—the “corporate trauma” occurs, the corporation is at a very rare moment, for which this Note neologizes the “Caremark Junction”: a point of overlap between shareholder and third-party interests regarding the scope and intensity of a board of director’s oversight behavior. At this moment, there is a sufficient nexus between some external force in the form of legal liability facing the corporation and a breach of the duty of good faith to trigger a successful Caremark claim—and this is no “toothless tiger.” But before a corporation reaches 16 See e.g., United States v. Boeing Co., No. 21-cr-5-O, 2022 WL 13829875, at *5 (N.D. Tex., 2022) (internal quotation marks omitted) (citing 18 U.S.C. § 3771(e)(2)(A)) (finding that victims’ family members and representatives were “directly and proximately harmed as a result of the commission of [Boeing’s conspiracy to defraud the United States.]”). No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1073 the Caremark Junction, there must have been some type of legal liability or potential breach of a positive-law regulation. Part III will illustrate a model of the Caremark Junction as a conceptual analysis of Caremark liability through the proxies of shareholder versus third-party interests. Part III will then explain certain, necessary factors to achieve the Caremark Junction. Part IV will apply the Caremark Junction and its necessary factors and will graph them to the prevalent case law, first to three successful Caremark cases (Section IV.A), and then to three unsuccessful Caremark cases, emphasizing which of the factors were missing (Section IV.B). II. BACKGROUND ON LAW In a recently successful Caremark case, Vice Chancellor Glasscock explained the unusual and uncomfortable nature of Caremark liability: The facts of Caremark claims . . . often invoke judicial sympathies. Frequently, the facts of the case involve corporate misconduct that has led to material suffering among customers, or to the public at large. A judge in the Caremark context must be careful to remember the issues before her. At issue is not whether specific or society-wide victims may themselves receive a remedy for corporate misconduct. Instead, the issue is whether the corporation, whose directors have allegedly allowed it to commit bad acts, should itself recover damages that ultimately inure to the benefit of the corporate owners, its stockholders. This unusual posture raises the question of whether Caremark liability is merely a branch of fiduciary liability designed to make the beneficiaries of that duty whole for breach, or whether it should be seen also as a blunt but useful tool to encourage good corporate citizenship. That question is for academic discussion, not judicial resolution; again, a judge in equity must be mindful that it is the 1074 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 corporation, not that corporation’s victims, to whom any recovery will flow.17 Glasscock raises an important wrinkle in Caremark liability that hasn’t been explored much: the distinction between “society-wide victims” and the harm to the corporation itself. This Note will take up Glasscock’s invitation to answer this question and will address this distinction through a novel approach in analyzing Caremark claims: through the proxies of shareholder versus third- party18 interests regarding the duty a director has to oversee the company’s operations. Section A will first provide background on how a Caremark claim may be brought. Section B will provide an overview of the evolution of the duty of good faith. Section C will then summarize the major literature pertaining to the distinctions between business risks and legal risks. A. The Derivative Claim Section 141(a) of the Delaware General Corporation Law (“DGCL”) states, “The business and affairs of every corporation organized under this chapter shall be managed by or under the direction of a board of directors except as may be otherwise provided in this chapter or in [a corporation’s] certificate of incorporation.”19 Included in a corporation’s “business and affairs” is the ability to seek redress in the court 17 Teamsters Loc. 443 Health Servs. & Ins. Plan v. Chou, C.A. No. 2019- 0816-SG, 2020 WL 5028065, at *1 (Del. Ch. Aug. 24, 2020). 18 By third-party interests, this Note employs Freeman’s well-known definition of a “stakeholder”: “any group or individual who can affect or is affected by the achievement of the organization’s objectives,” R. EDWARD FREEMAN, STRATEGIC MANAGEMENT: A STAKEHOLDER APPROACH 46 (1984). 19 DEL. CODE ANN. Tit. 8, § 141 (2023). See also Aronson v. Lewis, 473 A.2d 805, 811 (Del. 1984), overruled on other grounds by Brehm v. Eisner, 746 A.2d 244 (Del. 2000) (stating that “[a] cardinal precept of the General Corporation Law of the State of Delaware is that directors, rather than shareholders, manage the business and affairs of the corporation.”). No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1075 system, and thus the ability to sue for harm caused to the corporation as a whole lies with the board of directors.20 However, what happens if the board is itself alleged to have harmed the corporation? Equity sniffed out this potential conflict of interest, and the “derivative claim” was born.21 In contrast to this equitable ground of standing, a “direct claim” is not one that implicates a corporation’s “business and affairs,” but rather one that directly harms its shareholder, who then may bring a lawsuit in her capacity as a shareholder. While any recovery in a direct claim goes directly to the individual shareholder, any such recovery in a derivative claim goes to the corporation.22 What is effectively happening in a derivative claim, then, is “a stockholder seeks to displace the board’s authority over a litigation asset and assert the corporation’s claim.”23 To bring a derivative suit, a stockholder must either “(1) make a demand on the company’s board of directors or (2) show that demand would be futile.”24 This demand requirement aims “to [e]nsure that a stockholder exhausts his intracorporate remedies, and then to provide a safeguard against strike suits,”25 and to “assure that the stockholder affords the corporation the opportunity to address an alleged wrong without litigation and to control any litigation which does 20 See Zapata Corp. v. Maldonado, 430 A.2d 779, 782 (Del. 1981) (footnote omitted) (“Directors of Delaware corporations derive their managerial decision making power, which encompasses decisions whether to initiate, or refrain from entering, litigation, from 8 Del. C. § 141(a).”). 21 See El Paso Pipeline GP Co. v. Brinckerhoff, 152 A.3d 1248, 1256 (Del. 2016) (describing the derivative claim as “a ‘creature of equity’ that was created to enable a court of equity to exercise jurisdiction over corporate claims asserted by stockholders ‘to prevent a complete failure of justice on behalf of the corporation.’” (quoting Schoon v. Smith, 953 A.2d 196, 208 (Del. 2008))). 22 See generally Tooley v. Donaldson, Lufkin & Jenrette, Inc., 845 A.2d 1031 (Del. 2004). 23 United Food & Com. Workers Union v. Zuckerberg, 262 A.3d 1034, 1047 (Del. 2021). 24 Id. 25 Aronson, 473 A.2d at 811–12. 1076 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 occur.”26 The demand-requirement is enshrined in Delaware Court of Chancery Rule 23.1.27 Caremark claims are to be brought derivatively, since the harm alleged is one caused by the board directly to the corporation—in particular, the harm alleged must have been caused by a board’s failure to implement an oversight program in good faith.28 What exactly the harm is in the context of a Caremark claim will be discussed in Part III, but for now it is sufficient to analyze the corporate harm with the backdrop of three key procedural requisites of a derivative claim: (1) Bringing any lawsuit on behalf of a corporation falls within a corporation’s “business and affairs,” so the default rule is for the board to have the sole power to bring such a claim; (2) either the corporation itself via its board or its shareholders are the only parties with standing; and (3) any potential relief sought would go directly to the corporation itself. B. The Evolution of the Caremark Duty29 In re Caremark expounded, in dictum, that a director’s obligation includes a duty to attempt in good faith to assure that a corporate info and reporting system, which the board concludes is adequate, exists, and that failure to do so under some circumstances may, in theory at least, render a director liable for 26 Kaplan v. Peat, Marwick, Mitchell & Co., 540 A.2d 726, 730 (Del. 1988). 27 DEL. CH. CT. R. 23.1(a) (requiring plaintiffs to “allege with particularity the efforts, if any, made by the plaintiff to obtain the action the plaintiff desires from the directors or comparable authority and the reasons for the plaintiff’s failure to obtain the action or for not making the effort.”). 28 See In re Walt Disney Co. Deriv. Litig., 906 A.2d 27, 67 (Del. 2006) (holding that “[a] failure to act in good faith may be shown . . . where the fiduciary intentionally acts with a purpose other than that of advancing the best interests of the corporation . . . .”). 29 This Section will provide only a general overview of the legal principles underlying a Caremark claim. See Part IV for the facts of the important Caremark case law. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1077 losses caused by non-compliance with applicable legal standards.30 This idea of board-level oversight liability was reaffirmed a decade later, when the Delaware Supreme Court held that, to successfully plead such an oversight claim, the plaintiff must plead particularized facts to satisfy at least one of two prongs: Either (1) “the directors utterly failed to implement any reporting or information system or controls”; or (2) “having implemented such a system or controls, [the directors] consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention.”31 The two adverbs—”utterly” for prong-one and “consciously” for prong-two—were not exaggeratory; Stone requires that “the directors knew that they were not discharging their fiduciary obligations.”32 In other words, a plaintiff must prove scienter. Stone also clarified that the duty of good faith is neither its own category of fiduciary duties nor part of the duty of care, but rather a sub-set of the duty of loyalty.33 But what does “in good faith” mean? Mere months before Stone was decided, the Delaware Supreme Court had heard a case pertaining to an executive’s severance package, in which the Court tried to provide a definition of “good faith” in the context of a director’s fiduciary duties.34 The Court noted that the three “most salient” examples of bad faith include: [1] where the fiduciary intentionally acts with a purpose other than that of advancing the best interests of the corporation, [2] where the fiduciary acts with the intent to violate applicable positive law, or [3] where the fiduciary intentionally fails to act in 30 In re Caremark Int’l Inc. Derivative Litig., 698 A.2d 959, 970 (Del. Ch. 1996). 31 Stone v. Ritter, 911 A.2d 362, 370 (Del. 2006) (emphasis added). 32 Id. (emphasis added). 33 Id. at 369–70 (internal citations omitted) (“The failure to act in good faith may result in liability because the requirement to act in good faith ‘is a subsidiary element [,]’ i.e., a condition, ‘of the fundamental duty of loyalty.’”). 34 In re Walt Disney Co. Derivative Litig., 906 A.2d 27 (Del. 2006). 1078 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 the face of a known duty to act, demonstrating a conscious disregard for his duties.35 The Chancery Court has continually emphasized that pleading bad faith is necessary when asserting a Caremark claim.36 Walt Disney made clear that gross negligence is insufficient to establish bad faith, which falls under the duty of care.37 Importantly, “the lack of a system of controls with respect to a particular incarnation of risk does not itself demonstrate bad faith; the lack of such system must be the result of action or inaction taken in bad faith.”38 With respect to the first Caremark prong, also referred to as a “Reporting-Systems Claim”39 and, more recently, an “Information-Systems Claim,”40 “a director may be held liable if she acts in bad faith in the sense that she made no good faith effort to ensure that the company had in place any system of controls.”41 Indeed, Caremark has “a bottom-line requirement . . . : [T]he board must make a good faith effort—i.e., try—to put in place a reasonable board-level system of monitoring and reporting.’”42 In particular, [T]he Board has a rigorous oversight obligation where safety is mission critical, as the fallout from the Board’s utter failure to try to satisfy this bottom-line 35 Id. at 67. 36 See Segway Inc. v. Cai, 2023 WL 8643017, at *1 (Del. Ch. 2023) (“Despite a proliferation of modern jurisprudence, bad faith remains a necessary predicate to any Caremark claim.”) 37 In re Walt Disney Co. Derivative Litig., 906 A.2d at 64–65. 38 Constr. Indus. Laborers Pension Fund , C.A. No. 2021-0940-SG, 2022 WL 4102492, at *9. 39 Lebanon Cnty. Emps.’ Ret. Fund v. Collis, 287 A.3d 1160, 1176 n.1 (Del. Ch. 2022). 40 In re McDonald’s Corp. S’holder Derivative Litig., 291 A.3d 652, 676 (Del. Ch. 2023). 41 Hughes v. Hu, C.A. No. 2019-0112-JTL, 2020 WL 1987029, at *14 (Del. Ch. Apr. 27, 2020) (quoting Marchand v. Barnhill, 212 A.3d 805, 822 (Del. 2019)). 42 In re Boeing Co. Derivative Litig., C.A. No. 2019-0907-MTZ, 2021 WL 4059934, at *25 (Del. Ch. Sept. 7, 2021) (citing Marchand v. Barnhill, 212 A.3d 805, 821, 824 (Del. 2019)). No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1079 requirement can cause material suffering, even short of death, among customers, or to the public at large, and attendant reputational and financial harm to the company.43 Although whether a risk is “essential” or “mission critical” can be quite fact-intensive, depending on factors like industry norms and the nature of the corporation, the question boils down to whether the compliance issue or risk is “intrinsically critical to the company’s business operation,” such that the court can infer “that the board has not made the good faith effort that Caremark requires.”44 The second Caremark prong, also referred to as a “Red- Flags” claim,45 holds that “the fact that the company’s product facially satisfies regulatory requirements does not mean that the board has fulfilled its oversight obligations to prevent corporate trauma.”46 A plaintiff must “plead [particularized facts] that the board knew of evidence of corporate misconduct—the proverbial ‘red flag’—yet acted in bad faith by consciously disregarding its duty to address that misconduct.”47 Delaware courts have stressed that “red flags are only useful when they are either waived in one’s face or 43 Id. at *26, *33 (citations omitted) (internal quotation marks omitted). 44 Marchand, 212 A.3d at 822. Indeed, the Chancery Court has provided some examples of when a risk is essential. See Ontario Provincial Council of Carpenters’ Pension Tr. Fund v. Walton, 294 A.3d 65, 86 (Del. Ch. 2023) (when the company “[h]as an enterprise risk management system and has identified a risk”; “[h]as a mission statement or set of policies that call out an issue as a priority for the company”; or “[h]as touted the importance of and its proficiency in a particular area . . . .”). See infra note 55 (discussing the superficial distinction between “mission critical” and “central compliance”). 45 City of Detroit Police & Fire Ret. Sys. ex rel. NiSource, Inc. v. Hamrock, C.A. No. 2021-0370-KSJM, 2022 WL 2387653, at *19–20 (Del. Ch. June 30, 2022). 46 In re Boeing Co. Derivative Litig., 2021 WL 4059934, at *28. 47 Horman v. Abney, C.A. No. 12290-VCS, 2017 WL 242571, at *7 (Del.Ch. Jan. 19, 2017) (quoting Reiter ex rel. Cap. One Fin. Corp. v. Fairbank, 2016 WL 6081823, *8 (Del. Ch. Oct. 18, 2016)). 1080 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 displayed so that they are visible to the careful observer,”48 and that “the corporate trauma in question must be sufficiently similar to the misconduct implied by the red flags such that the board’s bad faith, conscious inaction proximately caused that trauma.”49 In particular, plaintiff must prove: (1) that the directors knew or should have known that the corporation was violating the law, (2) that the directors acted in bad faith by failing to prevent or remedy those violations, and (3) that such failure resulted in damage to the corporation.50 Tying both prongs together, “it is necessary to assess a director’s good or bad faith in connection with a plaintiff’s allegations before an oversight liability claim can be deemed viable.”51 There must be a causal link between the director’s alleged bad faith and how such bad faith manifests itself in the form of a failed oversight program (including a lack thereof).52 This causal link between scienter and the cause of action must correspond to a “corporate trauma.” What is sufficient to constitute a “corporate trauma,” however, is unclear, but because a Caremark claim is brought derivatively, the trauma is one to the corporation as a whole— 48 Wood v. Baum, 953 A.2d 136, 143 (Del. 2008) (quoting In re Citigroup Inc. S’holders Litig., 2003 Del. Ch. 61, No. 19827, 2003 WL 21384599, at *2 (Del. Ch. June 5, 2003)). 49 Okla. Firefighters Pension & Ret. Sys. v. Corbat, C.A. No. 12151- VCG, 2017 WL 6452240, at *15 (Del. Ch. Dec. 18, 2017) (internal quotation marks omitted). See also In re Caremark Int’l Inc. Derivative Litig., 698 A.2d 959, 971 (Del. Ch. 1996) (“[P]laintiffs would have to show either (1) that the directors knew or (2) should have known that violations of law were occurring and, in either event, (3) that the directors took no steps in a good faith effort to prevent or remedy that situation, and (4) that such failure proximately resulted in the losses complained of.”). 50 In re Qualcomm Inc. FCPA S’holder Derivative Litig., C.A. No. 11152-VCMR, 2017 WL 2608723, at *2 (Del. Ch. June 16, 2017). 51 Constr. Indus. Laborers Pension Fund v. Bingle, C.A. No. 2021-0940- SG, 2022 WL 4102492, at *9 (Del. Ch. Sept. 6, 2022). 52 Id. at *7 (stating that, even if the corporate harm involves a “mission critical” issue for or aspect of the corporation, there must also be “a sufficient nexus between the corporate trauma suffered and the Board for liability to attach.”). No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1081 one financial in nature that ties the lack of proper oversight to the particular external liability, which may or may not have been prevented but for the director’s bad faith.53 However, not all financial harm—or, all “corporate trauma”— caused by poor oversight or a violation of some law can trigger Caremark liability.54 In sum, Caremark claims demand a few requirements: (1) scienter (e.g., bad faith), such as through a lack of any oversight program with respect to a “mission critical” or “central compliance”55 issue or aspect of a corporation, or if 53 For example, in Boeing, the Court focused on how the company’s airplane “segment is by far the most lucrative, generating approximately 61.7% of the Company’s revenue in 2017 and 45% of its revenue in 2019. That decrease resulted from two fatal crashes involving Boeing’s 737 MAX airplane. . .” In re Boeing Co. Derivative Litig., C.A. No. 2019-0907-MTZ, 2021 WL 4059934, at *2 (Del. Ch. Sept. 7, 2021). See also In re Clovis Oncology, Inc. Derivative Litig., C.A. No. 2017-0222-JRS, 2019 WL 4850188, at *1 (Del. Ch. Oct. 1, 2019) (tying the company Roti’s “corporate trauma” to, as the plaintiffs characterized it to be, a “sudden and significant depression in market capitalization.”). 54 See, e.g., In re Citigroup Inc. S’holder Derivative Litig., 964 A.2d 106, 126–27 (Del. Ch. 2009) (holding that although “Citigroup suffered large losses and that there were certain warning signs that could or should have put defendants on notice of the business risks related to Citigroup’s investments in subprime assets,” such harm was not caused by bad faith, because such oversight was one pertaining to business risk, not legal risk.). 55 In a recent Chancery Court opinion, Vice Chancellor Laster stated (albeit as obiter dictum) that plaintiffs need not plead a second-pronged Caremark claim solely with regard to “mission critical risks.” In re McDonald’s Corp. S’holder Derivative Litig., 291 A.3d 652, 677 (Del. Ch. 2023). Noting how the “phrase has acquired talismanic importance” since Marchand, Laster explained how the Court in Marchand used the term regarding a prong-one, not a prong-two, Caremark claim, and that “it is also possible that some ‘central compliance risks’ may not reach the level of ‘essential and mission critical,’” yet may still constitute a Caremark harm. Id. at 677–678. Laster explained that there is, therefore, a distinction between “central compliance risks” and “mission critical risks,” with the former apparently more encompassing and less demanding for a plaintiff plead than the latter is. Id. at 678. However, the difference between the two terms seems irrelevant in actuality, particularly because of Caremark’s bad faith, scienter requirement. Indeed, if a risk isn’t “mission critical,” then it would be difficult if not impossible to prove bad faith rather than negligence, the latter being assessed under the business judgment rule. The Chancery 1082 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 such a program exists, a program ineffective to the point of constituting “bad faith” (e.g., purposefully or reasonably aware of breaking the law); and (2) the corporation as a whole is harmed (e.g., financial difficulty via drop in stock value). Section C delves into the issues regarding requirement (2), because this connection among bad faith, “mission critical,” and poor oversight overlaps with the type of risk. By particularly noting the controversial Caremark cases that were dismissed, the type of risk serves as a lynchpin.56 C. Business Risk vs. Legal Risk, and the Positive-Law Regulation Requirement As Section B illustrates, not all corporate traumas are sufficient to trigger Caremark liability. Although the Delaware courts have not provided a categorical rule on what type of traumas fall under the umbrella of a director’s good faith oversight duties, there are certain types of activities that fall beyond the scope of the umbrella. As In re Citigroup highlighted, Court noted this point in a later case. Ontario Provincial Council of Carpenters’ Pension Tr. Fund v. Walton, 294 A.3d 65, 86 (Del. Ch. 2023) (emphasis added) (“Outside of what intuitively registers as a central compliance risk, a plaintiff will have difficulty rebutting the business judgment rule when officers or directors have used a rational process to identify risks and made a good faith decision about the level of monitoring resources to deploy.”). Further, the red flag would likely have to be tied to a mission critical aspect of the company, for without which, there would unlikely be a sufficient “corporate trauma” to trigger standing for a derivative claim. Thus, while Laster’s distinction between “mission critical” and “central compliance” would work in theory, there is no difference through a conceptual lens since any “central compliance” risk would mean a “mission critical” risk. Put frankly, the former is likely just a euphemism for the latter. As such, this Note employs the “mission critical” language as used in Marchand. The distinction also doesn’t affect this Note’s analysis because this Note establishes what makes an actual Caremark claim sufficient to trigger a “corporate trauma,” not one that is just enough at the pleading stage. 56 See Adi Libson & Gideon Parchomovsky, Are All Risks Created Equal? Rethinking the Distinction Between Legal and Business Risk in Corporate Law, 102 B.U. L. REV. 1601, 1613–14 (2022) (“[A]ll motions to dismiss in cases involving commercial risks have been granted.”). No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1083 [T]he mere fact that a company takes on business risk and suffers losses—even catastrophic losses—does not evidence misconduct, and without more, is not a basis for personal director liability. . . . To impose oversight liability on directors for failure to monitor ‘excessive’ risk would involve courts in conducting hindsight evaluations of decisions at the heart of the business judgment of directors. Oversight duties under Delaware law are not designed to subject directors, even expert directors, to personal liability for failure to predict the future and to properly evaluate business risk.57 Thirteen years later, the Chancery Court clarified this discussion, warning that “[j]udicial post-hoc intrusion into the appropriate consideration of business risk, pre-trauma, is problematic . . . .”58 While the business judgment rule shields business risks, legal risks may trigger a director’s duty of good faith. This raises an important yet highly debated question: How does a board distinguish between a business risk and a legal risk?59 Although the distinction is far from a clear line, given the fact that Caremark liability requires scienter to constitute bad faith oversight, the director would have to know, or reasonably should have known (e.g., via “red flags”), that the company was violating a positive-law regulation. Focusing on the nuanced differences between business risk and legal risk can lead to confounding the trees for the forest, wherein the forest represents actual or reasonably likely knowledge of noncompliance with an external law. With this premise, then, what would constitute “business risk” is one that does not pertain to a violation of a positive-law regulation of which 57 In re Citigroup, 964 A.2d at 130-31. 58 Constr. Indus. Laborers Pension Fund v. Bingle, C.A. No. 2021-0940- SG, 2022 WL 4102492, at *1 (Del. Ch. Sept. 6, 2022). 59 The nuances between different types of business and legal risks and the normative justifications for these differences are beyond the scope of this Note. For a discussion on such topics, see Libson & Parchomovsky, supra note 56, at 1612 (comparing and critiquing different theories’ justifications for the legal-business risk distinction). 1084 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 directors have actual knowledge. And, Delaware courts’ focus on legal risk is by no means aberrant: Delaware law does not charter lawbreakers. Delaware law allows corporations to pursue diverse means to make a profit, subject to a critical statutory floor, which is the requirement that Delaware corporations only pursue “lawful business” by “lawful acts.” As a result, a fiduciary of a Delaware corporation cannot be loyal to a Delaware corporation by knowingly causing it to seek profit by violating the law. . . . [A director] must act in good faith to ensure that the corporation tries to comply with its legal duties.60 For Caremark liability, legal risk presupposes an obligation to comply with positive-law regulation—and as demonstrated by the procedural posture of the recently successful Caremark claims against directors, an alleged failure to comply with the positive-law regulation comes before the filing of the Caremark suit.61 Embedded within Caremark 60 In re Massey Energy Co., C.A. No. 5430-VCS, 2011 WL 2176479, at *20, 21 (Del. Ch. May 31, 2011) (internal footnote omitted). See also Asaf Raz, The Legal Primacy Norm, 74 FLA. L. REV. 933, 953-54 (2022) (“[B]ecause corporate law dictates that the corporation is a legal person, and because every person must obey the law, corporations are equally subject to the law as any individual.”) It is important to note, however, that not all violations of federal law—even those with bad faith intentions—are automatically within the realm of Caremark. Rather, the knowing violation of a law would trigger a so-called Massey claim. Although there are similarities between a Caremark prong-two claim and a Massey claim, there is a subtle difference: The former is triggered when “the fiduciary makes a conscious decision to ignore red flags,” while the latter is triggered when “the fiduciary makes a conscious decision to prioritize profit over legal compliance.” Lebanon Cnty. Emps.’ Ret. Fund v. Collis, 287 A.3d 1160, 1205 (Del.Ch. 2022). For purposes of the business versus legal risks distinction, the differences between these two claims are irrelevant. Yet, the differences can be important on whether the bad faith law-breaking activity is sufficiently tied to the corporate trauma, which Caremark requires. This recent gloss on Caremark also adds weight to the proposition that bad faith likely must always be tied to a “mission critical” function of or issue for the corporation, notwithstanding Laster’s dictum in In re McDonald’s. See supra note 55. 61 See, e.g., Transcript of Telephonic Hearing, In re Facebook, Inc., (Del. Ch. May 10, 2023) (No. 2018-0307-JTL). Facebook entered into and later No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1085 liability, then, there is an interplay between two types of law: federal regulatory law and state corporate law. This interplay is not just specific to Caremark liability, but also to corporate governance in general.62 This interplay is particularly prevalent in the Caremark jurisprudence.63 Indeed, because of the substantive nature of violated a 2012 consent order with the FTC regarding Facebook’s sharing users’ information with third parties. Id. Walmart, as an opioid dispenser, failed to comply with its obligations under the Controlled Substances Act. In 2011, Walmart and the DEA entered into a settlement, which “required Walmart to implement and maintain a compliance program for all of its pharmacies.” Further, in 2016 and 2017, “Walmart faced a barrage of lawsuits based on its roles as a dispenser and distributor of prescription opioids. By the end of 2017, thousands of plaintiffs had filed cases against Walmart.” Also in 2016, the U.S. Attorney for the Eastern District of Texas conducted a criminal investigation into Walmart. In 2020, the DOJ sued Walmart. Ontario Provincial Council of Carpenters’ Pension Tr. Fund v. Walton, C.A. No. 2021-0827-JTL, 2023 WL 3093500 (Del. Ch. Apr. 26, 2023), at *8, *20, *24. Boeing violated federal aviation laws. DOJ opened a criminal investigation into whether Boeing defrauded the FAA when it had obtained the 737 MAX plane certification. In re Boeing Co. Derivative Litig., C.A. No. 2019-0907-MTZ, 2021 WL 4059934 (Del. Ch. Sept. 7, 2021). In Teamsters Loc. 443 Health Servs. & Ins. Plan v. Chou, the company violated FDA rules pertaining to, among other things, its handling of syringes. In 2012, there were two separate qui tam actions against the company for its illegal program. In 2017, the U.S. government intervened in part of those actions. Teamsters Loc. 443 Health Servs. & Ins. Plan v. Chou, C.A. No. 2019-0816- SG, 2020 WL 5028065 (Del. Ch. Aug. 24, 2020). Clovis “[v]iolat[ed] both internal clinical trial protocols and associated FDA regulations.” The FDA launched an investigation into Clovis and its clinical trial program. In re Clovis Oncology, Inc. Derivative Litig., C.A. No. 2017-0222-JRS, 2019 WL 4850188, at *1 (Del. Ch. Oct. 1, 2019). See also Marchand v. Barnhill, 212 A.3d 805, 809 (Del. 2019) (“From 2009 to 2013 several regulators found troubling compliance failures at Blue Bell’s facilities . . . .”). For a more in- depth discussion on this pattern, see Section IV.A. 62 See e.g., Mark J. Roe, Delaware and Washington as Corporate Lawmakers, 34 DEL. J. CORP. L. 1, 6 (2009) (“When a big corporate business issue arises, Washington either takes the issue over or threatens to do so. Delaware sometimes reacts, but it sometimes watches as the lawmaking flows to Washington.”). 63 See, e.g., Carliss Chatman & Tammi Etheridge, Federalizing Caremark, 70 UCLA L. REV. 908, 919 (2023) (exploring how Caremark and its progeny illustrate a “symbiotic relationship between state breach of loyalty claims and federal regulations”). 1086 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 Caremark liability—oversight and compliance—there is overlap with federal law on two fronts: (1) a positive-law regulation that a director has knowledge of, and (2) general federal compliance laws. In regard to the latter, it is well- established how the Caremark case has had a “substantial role in expanding the compliance function in most companies.”64 In regard to the former, given its scienter requirement, Caremark liability presupposes that the lack of oversight ties to the external law—malum prohibitum—and so, knowledge of its (alleged) violation would trigger a breach of the fiduciary duty, so long as the other Caremark requirements are met.65 Caremark spurred a new font of corporate compliance, one that derives from Delaware, not just Washington, although it still conceptually depends on Washington’s role, given the scienter requirement. Indeed, given the fact that a Caremark duty is implicated with a finding of bad faith and knowledge of a potential law violation, such a liability is still inherently intertwined with and reliant on federal laws. 64 Todd Haugh, Caremark’s Behavioral Legacy, 90 TEMP. L. REV. 611, 612 (2018). See also Todd Haugh, The Criminalization of Compliance, 92 NOTRE DAME L. REV. 1215, 1229 (2017) (“[The Organizational Guidelines’] breadth only increased when the Delaware Court of Chancery indicated that corporate directors might violate their fiduciary duties by failing to adopt compliance programs consistent with the Organizational Guidelines. Every company—and every director—was now on the hook for implementing a guidelines-based compliance program.”). 65 For instance, Asaf Raz argues that Caremark claims arise from what he calls the “legal primacy norm,” whereby a company’s “purpose is the lawful pursuit of profit—with the ‘lawful’ element always preceding the ‘profit’ one . . . .” Raz, supra note 60, at 977. In particular, “breaking the law is outside the broad range of open-ended adventures that corporations are meant to pursue.” Id. at 938. Accordingly, “[t]he legal primacy norm—of which Caremark is an important manifestation—does not impinge upon directors’ freedom to make business decisions; rather, it conveys that breaking the law is not a business decision at all.” Id. at. 989. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1087 III. THE CAREMARK JUNCTION Circling back to Glasscock’s discussion in Teamsters,66 the distinction between “society-wide victims” and the harm to the corporation itself clears up a bit through noting certain, necessary characteristics behind a Caremark claim. The first truism, as Section II.A explained, is that a Caremark claim may only be brought derivatively. This is conceptually important for two reasons. First, as a fiduciary duty claim, only two types of parties may have standing to sue: (1) directors, or (2) if demand is futile, shareholders acting on behalf of the corporation, not as individual shareholders. Thus, the harm arising from the “corporate trauma” is to the corporation. The issue of standing is important, for although Caremark claims intertwine with federal law,67 third parties—those who not just are affected by the corporation’s illegal actions, but also may have standing to sue the corporation arising from said actions, ranging from the federal government to a representative of a victim’s estate— may never bring a Caremark claim. This latter point ties to the second Caremark truism: Because Caremark liability has a scienter requirement, particularly of a violation of some external law—either actual violation or potential in the form of pending litigation— directors must be aware of what in fact the potential illegal action is. As Section II.C underscored, business risk falls beyond the scope of Caremark liability, so the duty of good faith is tailored to only legal risk. This is conceptually significant because although third parties can never have standing to sue a director under a Caremark claim, they and their interests are still necessarily implicated, since the “corporate trauma” derives, in part, from the violation of some external law. Marchand and Boeing are two glaring examples of such implication, with third parties dying.68 Based on these Caremark truisms, what surfaces is not just a direct harm to a corporation—financial or likewise— but also an indirect harm to third parties through violating 66 See supra Part II. 67 See discussion supra Section II.C. 68 See infra Section IV.A.1 (Marchand) and Section IV.A.3 (Boeing). 1088 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 some external law. However, the latter victims may never bring a Caremark claim, despite the fact that such third parties’ harm both occurs before the corporation is harmed and can serve to bolster a shareholder’s Caremark claim. This is because such third parties may have standing to sue the corporation due to an alleged violation of the law, even without a “corporate trauma” that directly harms the corporation and that arises from a failure to put in place board-level oversight on a “mission critical” function of or issue for the corporation.69 Accordingly, there is a gap between when third parties may sue the corporation for a violation of a law and when shareholders may sue the corporation under Caremark.70 Although it can be common for both shareholders and third parties to agree on what an effective compliance program aims to achieve— for instance, in Boeing,71 both shareholders and third parties would reasonably characterize Boeing’s end, or “mission critical,” goal as airplane safety— these interests diverge on how to achieve such a goal in terms of resources. Third parties would reasonably focus on how the corporation aims to comply with what directly affects them and their own interests vis-à-vis promulgated, external law—in Boeing, such a third-party interest serves as a proxy for external laws implicating airplane safety, such as 18 U.S.C. § 371, “Conspiracy to Defraud the United States”72—and so, their interests don’t directly relate to share values. Third parties would want a more robust compliance program for corporations to achieve, ab initio, regardless of whether it 69 See, e.g., supra note 16. 70 For a more normative exposition of this “gap,” see Elizabeth Pollman, Corporate Oversight and Disobedience, 72 VAND. L. REV. 2013, 2030 (2019) (arguing that Caremark liability serves as “a failsafe for egregious violations, rather than an effective and fine-tuned mechanism for the bulk of instances, which are left for other regulators and enforcers”). 71 In re Boeing Co. Derivative Litig., C.A. No. 2019-0907-MTZ, 2021 WL 4059934 (Del. Ch. Sept. 7, 2021). 72 See U.S. DEP’T OF JUST., Boeing Charged with 737 Max Fraud Conspiracy and Agrees to Pay over $2.5 Billion (Jan. 7, 2021), https://www.justice.gov/opa/pr/boeing-charged-737-max-fraud-conspiracy- and-agrees-pay-over-25-billion [https://perma.cc/C2YB-7CHC]. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1089 reaches the heightened threshold of a breach of a duty of good faith. In contrast, in order for a shareholder to bring a Caremark claim, there must be a direct harm to the corporation sufficient to trigger a breach of duty of good faith, so shareholders would want the board to spend reasonably in proportion to how far away the corporation is from a “corporate trauma.” Shareholders may not want directors to be overly cautious and spend more money or resources than is needed, as their decision hinges on the probability of the corporate trauma occurring.73 And, once the “corporate trauma” occurs, the corporation is at a unique moment, which this Note calls the Caremark Junction: a point of overlap between shareholder and third- party interests regarding the scope and intensity of a board of director’s oversight behavior: 73 There can be a numbers of reasons why shareholders may not want this over-deterrence. See, e.g., Libson & Parchomovsky, supra note 56, at 1617 (“Shareholders will bear a significant loss from [an] overly careful policy. . . . If a business strategy involves exposure to a remote legal risk associated with a small expected loss and a large potential gain, the shareholders may want the company to adopt it.”). See also Aneil Kovvali, Essential Businesses and Shareholder Value, 2021 U. CHI. LEGAL F. 191, 208 (“A costly investment in precautions would reveal to stock market participants that the firm’s managers believed that the company faced substantial regulatory risks.”). 1090 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 The point at the Caremark Junction is paradoxical: It is only when the corporation faces a “corporate trauma,” as defined as a harm directly caused by a breach of good faith in oversight, do the interests of shareholders and third parties converge. At the Caremark Junction, there is a sufficient nexus between the external legal liability (potentially) facing the corporation and a breach of a duty of good faith to trigger a successful Caremark claim. Yet, before a corporation reaches the Junction, there must be some form of legal liability or potential breach of a legal regulation. Before this happens, though, the amount of money, time, or resources shareholders would want to spend on preventing such occurrence is less than what third parties would; this latter disparity arises from diverging monetary interests between shareholders and third parties. Note how third-party interests begin with high intensity despite being far away from the “corporate trauma,” and that such interests remain constant overtime. This is likely because third parties don’t have the financial interest at stake, and so would not care as much as shareholders might about whether a director spends too much money on compliance programs or if such compliance programs affect stock price in any way. Without any financial stake, third parties would not rationally internalize any costs associated with the trade-off between overdeterrence or optimal deterrence. Similarly, the intensity a third party would desire would reflect what, in fact, the external law is. For instance, one would expect that, with respect to a law that directly affects consumers’ physical safety, such as aviation-safety regulations under the purview of the FAA, or their health, such as food safety regulations under the purview of the FDA, No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1091 third-party interests would unsurprisingly have a higher intensity of oversight. This serves in contrast to shareholder interests, whose interest in how much time and/or money the board spends on oversight is directly affected by how close the corporation is to the “corporate trauma,” which is itself affected by intermediate factors. Accordingly, shareholders would rationally care about whether a compliance or oversight program is excessive or optimally efficient. Implicitly, then, while external laws directly affect third parties in their interests in a corporation’s board oversight programs, such laws only implicitly affect shareholder interests: Their effects can grow in intensity overtime, if the corporation becomes linked in some way to those laws, and as the link grows stronger, so too does the external law’s effect on shareholders regarding their opinion on how much time and/or money the board should spend on compliance/oversight. A conceptual understanding of Caremark liability highlights the distinction between general effective oversight liability and Caremark liability. The former may result in positive-law regulation suits brought by third parties, while Caremark liability only arises when shareholders have standing to sue for harm caused at the Caremark Junction. At this point, shareholders finally would want effective oversight at the board level to prevent the violation of the positive-law regulation; yet, the corporation is now at the Caremark Junction, so it is too late. This is the paradox underpinning of Caremark claims; for, without the Caremark Junction, there cannot be a breach of duty of good faith. By the time shareholder and third-party interests align—or are as close as reasonably possible— the board reasonably should have had ample opportunity to have oversight that is both in place and effective. Through synthesizing the Caremark truisms and the conceptual analysis of the Caremark Junction, a few necessary conditions to trigger the Junction materialize, particularly for prong- two Caremark claims. None of these is sufficient in and of itself. Additionally, given the fact- intensive, ex post nature of Caremark liability, there is no 1092 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 particular order among the factors in (1), although it is always the case that (1) must occur prior to (2). Applying the above 1(a), 1(b), and 2 to the Caremark Junction, an example of when a corporation might be at the Caremark Junction may look something like this74: Plotting these necessary conditions onto the graph is difficult for a few reasons. One reason is that time serves as a central yet unfixed variable. Time is particularly important between 1(a) and the “corporate trauma,” for although a company may face liability due to the occurrence of 1(a), its 74 This sample Caremark Junction graph applies all three factors. As mentioned, however, 1(a) and 1(b) aren’t necessarily both required. Yet, particularly for prong-two Caremark claims, it would be during 1(b) that there is a “red flag” sufficient to trigger scienter and bad faith. See, e.g., infra Section IV.A.2. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1093 board may still have to, in good faith, implement an effective compliance program to avoid a corporate trauma. This is both because of the bad faith, scienter requirement, and because the corporation is still not at a “corporate trauma” to trigger Caremark liability.75 Another reason for this difficulty is that 1(a) might not have been caused by a bad faith oversight program—or lack thereof—of which directors had actual knowledge. Coincidingly, it is during that time when 1(b) may play an important role. Indeed, 1(a) and 1(b) both don’t necessarily have to occur, but at least one must. 1(b) wouldn’t typically be required in a prong-one scenario: complete lack of oversight to constitute bad faith, which caused 1(a) and, shortly thereafter, 2.76 Furthermore, if the corporation actually violated an external law, directors would have to have acted quite promptly to remedy the situation, assuming the violation had not been caused by their own bad faith, failure to monitor.77 This period of 1(b) could last anywhere from being on the same day as 1(a), to months or years later,78 or even, if the directors had known about the legal violation, preceding 1(a).79 Third, the financial harm to the corporation can occur at any time between the first occurrence of any potential law violation—e.g., drop in stock price due to a pending lawsuit— up until right before the Caremark Junction, e.g., corporation had to close down for a bit due to numerous lawsuits throughout the period of 1(b). Still, 2 must occur before the Caremark Junction, since this is the harm directly to the corporation to trigger standing for the derivative action. The 75 See, e.g., infra Section IV. A.3 (noting how Boeing’s 2015 lawsuits should have served as a nascent warning to the Board, responses to which could have prevented the “corporate trauma” sufficient to trigger Caremark liability). 76 See, e.g., infra Section IV. A.2. 77 See, e.g., infra Section IV.B.3 (emphasizing how the Board’s knowledge pertained to a similar though unrelated past explosion). 78 See, e.g., infra Section IV.A.3 (noting how, while the red flags with respect to Caremark liability likely became prominent post-2018 crash, Boeing had faced numerous enforcement proceedings 4 years prior). 79 See, e.g., infra Section IV.A.2 (Clovis’s Caremark Junction graph has 1(b) preceding 1(a)). 1094 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 “corporate trauma” is different under Caremark than from under violating an external law that was caused by a good faith compliance program; yet, the same law itself might have been violated in both instances. Although a violation of an external law is insufficient to trigger Caremark liability— since it has additional requirements, i.e., scienter— because of the embedded connection between external liability and Caremark liability, the former law violation plays an imperative role in pleading and proving a breach the fiduciary duty of good faith. Despite these difficulties, the Caremark Junction provides an important illustration of the conceptual nature of Caremark liability—a way to balance Caremark’s paradoxes and nuances through the lens of shareholder versus third- party interests. IV. THE CAREMARK JUNCTION: CASE LAW This Part will apply Part III’s Caremark Junction model to a handful of Caremark cases, first to those that have proceeded past the motion to dismiss stage, IV.A, and then to those that have been dismissed, IV.B. This Part explores the key events leading up to the cases.80 Almost all Caremark cases have failed to proceed past the motion to dismiss stage. And, even though there has been a recent uptick of Caremark claims on Delaware courts’ dockets and “more” Caremark claims against directors have survived the motion to dismiss stage since Marchand in 2019, this number is still very small,81 while the number of Caremark cases that have been dismissed is significantly higher. Given the high number of cases dismissed, this Note carefully and 80 For an overview of holdings and substantive legal rules, see supra Section II.B. 81 See supra note 9. Although the successful Caremark cases are quite limited in number, such a small number may be hiding a hungry tiger, that is, Delaware courts’ hunger (or willingness) to allow more Caremark claims to proceed past the motion to dismiss stage, especially with the recent expansion of Section 220 books and records requests. See generally Roy Shapira, Corporate Law, Retooled: How Books and Records Revamped Judicial Oversight, 42 CARDOZO L. REV. 1949 (2021). No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1095 purposefully selected three cases that had failed to proceed. Each of these cases underscores at least one of the important Caremark truisms required to trigger the Caremark Junction. A. “Successful” Caremark Claims 1. Marchand82 As Professor Shapira characterizes it, Marchand was the first of the “quadfecta of successful Caremark cases,” reinvigorating and putting spotlight on such claims.83 The facts of Marchand can serve as an archetype of Vice Chancer’s apposition between “society-wide victims” and the harm to the corporation itself.84 The Court in Marchand similarly described this apposition in its summary of the facts: “Three people died as a result of the listeria outbreak. Less consequentially, but nonetheless important for this litigation, stockholders also suffered losses because, after the operational shutdown, Blue Bell suffered a liquidity crisis that forced it to accept a dilutive private equity investment.”85 Between 2009 and 2013, there were numerous regulatory issues at the company’s facilities.86 The Court cited a number of these alleged failures from plaintiff’s complaint, mainly pointing to instances between 2009 and 2013, when the FDA and state health departments found health and safety issues in the Texas, Alabama, and Oklahoma facilities.87 82 Marchand v. Barnhill, 212 A.3d 805 (Del. 2019). 83 See Shapira, Max Oversight Duties: How Boeing Signifies a Shift in Corporate Law, supra note 6, at 132. See also Bird & Magid, supra note 9, at 109 (characterizing Delaware law, post-Marchand, as “a gradual shift in Caremark cases from a reliance on gatekeeping unworthy plaintiffs who merely challenge the effectiveness, and not the existence, of compliance controls, toward an emphasis on perceiving compliance as a holistic system with attendant responsibilities for the board of directors”). 84 See supra Part II. 85 Marchand, 212 A.3d at 807. 86 Id. at 811. 87 See id. at 811–12. 1096 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 In addition to the above failures, by 2013, the Company had five confirmed listeria tests, and by 2014, ten confirmed tests.88 Over that year, the Board never discussed the tests.89 Even after the Company, on March 23, 2015, was forced to recall products, the Board did not meet until two days later, and even during that meeting only vaguely adopted a resolution “express[ing] support for Blue Bell’s CEO, management, and employees and encourag[ing] them to ensure that everything Blue Bell manufacture[s] and distributes is a wholesome and good testing [sic] product that our consumers deserve and expect.”90 Less than a month later, the Company “instituted a recall of all products,” but by then, the CDC had already been investigating the Company and its connection to certain listeria outbreaks, and discovered that a listeria outbreak occurring in Kansas “was caused by Blue Bell’s Texas and Oklahoma plants,” the same plants the FDA and state agencies had found compliance failures in in previous years.91 This whole fiasco led not only to the death of three Kansas individuals, with two other Kansas and three other Texas individuals sick from listeria, but also to Blue Bell’s stock drastically falling, leading to a liquidity crisis.92 The timeline of events leading up to the Caremark “corporate trauma” makes it clear that the Caremark Junction had been reached. What is interesting with the Court’s reasoning, though, is that the Court relied mostly on a prong- one claim— that the Board lacked any “system of board-level compliance monitoring and reporting.”93 There was “no board committee that addressed food safety,” and “no regular process or protocols that required management to keep the 88 Id. at 812. 89 Id. For example, minutes from a January 2014 board meeting “reflect[ed] no report or discussion of the increasingly frequent positive tests that had been occurring since 2013 or the third-party lab reports received in the preceding two weeks.” Id. 90 Id. at 814. 91 Id. 92 Id. at 814–15. 93 Id. at 822. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1097 board apprised of food safety compliance practices, risks, or reports.”94 Further, the Court, in relying on the fact that “food safety was essential and mission critical” to Blue Bell’s business,95 noted how the Company had “no schedule for the board to consider on a regular basis, such as quarterly or biannually, any key food safety risks existed.”96 Taking the above analysis, the Court notably held, As a monoline company that makes a single product— ice cream—Blue Bell can only thrive if its consumers enjoyed its products and were confident that its products were safe to eat. That is, one of Blue Bell’s central compliance issues is food safety. Despite this . . . Blue Bell’s board had no committee overseeing food safety, no full board-level process to address food safety issues, and no protocol by which the board was expected to be advised of food safety reports and developments.97 Although the Caremark Junction is likely more compatible with a prong-two claim (given the role of “red flags” in 1(b)), the conceptual analysis is still applicable here, especially given Blue Bell’s “monoline” nature— as an ice-cream company, Blue Bell’s compliance programs ought to have been narrowly tailored to its “mission critical” function/issue: food safety. Yet, there was no such compliance program at the board level. With respect to the Caremark Junction, to know when the Caremark claim became actionable, it is necessary to state which of the Caremark conditions are present, and to note them through the proxies of shareholder versus third-party interests. First, it is necessary for the external factor(s)—as stated in Factor 1(a)—to occur before the internal factor— as stated in Factor 2—which is the case here. This is particularly true regarding the investigations and discoveries between 2009 and 2013, as well as the CDC and DOJ investigations. 94 Id. 95 Id. at 824. 96 Id. at 822. 97 Id. at 809. 1098 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 Further, here, both shareholders and third parties would share the same definition or scope of what Blue Bell’s compliance program should aim to achieve: food safety. This fact is clear, given the company’s monoline structure. And given the monoline-structure, those third parties who have an interest in the company’s oversight programs can be narrowed in scope through the positive-law regulations that are implicated. Most of the laws implicated are under the scope of the FDA and its regulations pertaining to food safety, as well as laws under states’ department of health guidelines. These federal and state regulations would serve as proxies for third- party interests.98 Third parties would want a particularly robust compliance program, since such laws implicate their physical health and safety. Third parties would want as robust of board-level oversight as possible, regardless of the probability of any potential health effects, and regardless of the amount of money or resources such oversight might require. For shareholders, they also would want the Board to attain the company’s mission-critical function of food safety, both for financial reasons and for their own health concerns. Yet, the scope of a board-level oversight program to achieve the goal changes drastically overtime, especially during investigations between 2009 and 2013, and more so by 2014, when the company had ten confirmed listeria tests. Up until the company recalled all of its products, shareholders’ interests in a robust, board-level oversight program exponentially grew, coincidingly with the multiple lawsuits. As the Company moved closer to the corporate trauma, shareholders’ interests in board-level compliance dramatically increased. Yet, it is not 98 For example, see 21 U.S.C. § 331(a), which prohibits “the introduction or delivery for introduction into interstate commerce of any food, drug, device, tobacco product, or cosmetic that is adulterated or misbranded.” In May 2020, Blue Bell pled guilty to this law (and other laws) stemming from the listeria outbreak. See U.S. DEP’T OF JUST., Blue Bell Creameries Ordered To Pay $17.25 Million In Criminal Penalties In Connection With 2015 Listeria Contamination (Sept. 17, 2020), https://www.justice.gov/opa/pr/blue-bell-creameries-ordered-pay-1725- million-criminal-penalties-connection-2015-listeria [https://perma.cc/DH87-XYJN]. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1099 until after the recall of products and death of consumers, did the shareholders have standing to bring a Caremark claim; for, the financial harm to the corporation is what triggers the derivative harm, and as a result, the ability of shareholders, if demand is futile, to bring such claim.99 Tying the above, Blue Bell’s Caremark Junction could look something like this100: Based on the Caremark Junction, Blue Bell had ample opportunity to implement a board-level oversight program aimed at food safety. Even in 2013, after numerous investigations had showed several compliance failures, the Company did not reach the Junction, and so could have ex post tried to implement oversight at that moment going forward. This point is important because it illustrates the distinction 99 See generally supra Part II. 100 What is different here from the model Caremark Junction in Part III, is that in Marchand’s conceptual model, there is an increase, though much more consistent than for shareholder’s, in third parties’ interest. This is likely due to the monoline-structure of the company and its possible effects on consumers’ health. In particular, as the number of investigations into Blue Bell’s facilities increased, many of which showing compliance deficiencies, third parties’ fear—reasonably so—that the corporate trauma would occur increases. Although third parties wouldn’t typically care if the corporate trauma is likely to happen, when such trauma could potentially affect their health and even kill them, there can be an exception. Put differently, although third parties may not care about the improbability of the corporate trauma’s occurring, they may care about the high probability of its occurring. 1100 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 between general, effective oversight and Caremark effective oversight: The former had failed, but the latter hadn’t occurred yet, not until the “corporate trauma” following the decline in stock prices. Put differently, even though in 2013 Blue Bell had failed to have board-level oversight on food safety, resulting in numerous compliance failures, that was insufficient to trigger Caremark liability due to the absence of corporate trauma via financial harm, as portrayed through the lens of shareholder interests (which, at that time, were lower than those of third parties, so the Caremark Junction had not yet been reached). 2. In re Clovis Oncology101 During the same year as Marchand, the Chancery Court heard another successful Caremark claim, also pertaining to a “monoline” defendant, Clovis Oncology Inc., a biopharmaceutical manufacturer developing drugs for cancer treatment; one such drug was Rociletinib (aka “Roci”).102 As is the case for all other drugs, the FDA is required to approve Roci in order for Clovis to lawfully distribute and sell the drug. Yet, as the shareholders alleged, “the Clovis board . . . breached their fiduciary duties by failing to oversee the Roci clinical trial and then allowing the Company to mislead the market regarding the drug’s efficacy.”103 The Company used the clinical trial protocol, RECIST, for its testing of Roci, “the most widely used system for assessing response in cancer clinical trials, and . . . the preferred and accepted system for use in new drug applications to regulatory agencies.”104 Under RECIST, Clovis was required to have a “criteria defining success,” called the “objective response rate” (“ORR”), which “measures the percentage of patients who experience meaningful tumor shrinkage when treated with 101 In re Clovis Oncology, Inc. Derivative Litig., C.A. No. 2017-0222, 2019 WL 4850188 (Del. Ch. Oct. 1, 2019). 102 Id. at *1. 103 Id. 104 Id. at *4 (internal citation omitted). No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1101 the drug,” calculations based on confirmed responses.105 Yet, Clovis was calculating ORR percentages based on at least some unconfirmed responses—and the Board knew that this was occurring, allegedly since June 12, 2014.106 Over the next year, Clovis continued to publicly state an inflated ORR percentage.107 Unlike in Marchand, here the Board not only explicitly discussed the company’s mission critical product and goal, but also signed off on the wrong ORR percentages. For example, on February 27, 2015, certain Board members “[w]ith hands on their ears to muffle the alarm… signed Clovis’ 2014 Annual Report… [, which] reaffirmed previous, inflated ORR reports and omitted that Clovis was relying on partially unconfirmed responses.”108 Further, while the Company continued to state to the public that Roci’s ORR percentage was at 60% on November 5, 2015,109 the Company told the FDA, in October 2015, that the percentage was between 28% and 34%.110 In addition to the flawed ORR reporting, “the Board was advised that Roci had serious, undisclosed side effects,” about which the Board did nothing.111 Additionally, on September 17, 2015, Clovis management identified a total of “238 protocol deviations.”112 On November 9, 2015, the FDA met with Clovis senior executives to discuss the ORR discrepancies between what Clovis was publicly stating and what Clovis was telling the 105 Id. at *5. 106 Id. at *6. 107 Id. For instance, “[o]n September 9, 2014, Clovis closed a critical $287 million private placement of convertible senior notes in order to finance ongoing operations. The Board relied heavily upon the market’s positive reaction to Roci’s publicly reported ORR to make its case for further investment in the Company.” Id. See also Complaint at 2, SEC v. Clovis Oncology, Inc., No. 18-cv-02381-CMA (D. Colo.). 108 In re Clovis Oncology, Inc. Derivative Litig., 2019 WL 4850188, at *7. 109 Id. 110 Id. 111 Id. at *8. 112 Id. 1102 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 FDA.113 The Board became aware of this meeting a week later.114 On November 16, 2015, Clovis issued a press release providing the accurate ORR percentage, which caused its stock to drop by 70%, “wiping out more than $1 billion in market capitalization.”115 On May 5, 2016, Clovis terminated RECIST trial for Roci.116 Clovis faced a number of lawsuits as a result of this flawed ORR reporting and other compliance issues.117 In contrast to Marchand, here the Court relied on a prong- two Caremark theory; shareholders alleged that “the Board ignored red flags that Clovis was not adhering to the clinical trial protocols, thereby placing FDA approval of the drug in jeopardy. With the trial’s skewed results in hand, the Board then allowed the Company to deceive regulators and the market regarding the drug’s efficacy.”118 As the Court noted, “ORR was the crucible in which Roci’s safety and efficacy were to be tested. Roci was Clovis’ mission critical product.”119 And, “the Board knew management was incorrectly reporting responses but did nothing to address this fundamental departure from the RECIST protocol. When Clovis’ serial non- compliance with RECIST was finally revealed to the regulators, Roci was doomed. And when the drug’s failure was revealed to the market, Clovis’ stock price tumbled.”120 In other words, the Court directly tied the Board’s ignoring of multiple red flags—in bad faith—to the drop in stock price. Drawing from the information above, the Caremark Junction could potentially look something like this: 113 Id. 114 Id. 115 Id. 116 Id. 117 Id. at *9. For instance, Clovis faced a number of securities fraud class actions, one settling for $142 million. Id. 118 Id. at *1. 119 Id. at *14. 120 Id. at *13. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1103 There are a few notable differences between Marchand’s Junction and Clovis’s. First, unlike in Marchand, here both 1(a) and 1(b) are present.121 This is because Clovis dealt with a prong-two Caremark claim, while Marchand dealt with only a prong-one claim. It would appear, then, that prong-two claims are potentially easier to graph—and with it, create a timeline of events mapping out the Caremark Junction—than are prong-one claims. Another difference is with respect to third party interests: While in Marchand, third party interests actually increased overtime, in Clovis, such interests remained more-or-less constant. This is likely because although both mission critical products could have severe health implications on the consuming public, Clovis’s cancer drug was still in clinical trials, and therefore, unlike Blue Bell’s ice cream, the drug was not yet in the stream of commerce, so consumers had not yet been able to use the drug to treat their lung cancer. This is clearer through using the external, federal laws in each case as proxies for third-party 121 Interestingly, 1(b) precedes 1(a). While this can seem counter- intuitive—since any investigation, like in Boeing, would typically serve as the impetus for the creation of red flags—in Clovis’s case, the Board appeared much more active in the ineffective oversight compliance. In fact, the Board seemed to be consciously violating the laws in the name of profit. As such, if not for 1(a), this most likely would not have even been a Caremark case, but rather a Massey one. See supra note 60. 1104 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 interests for board-level oversight/compliance. If the FDA had in fact approved Roci, and it had been used in the pharmaceutical market, then third party interests would be more similar to those in Marchand.122 3. In re Boeing Co. Derivative Litigation123 Boeing arose from two separate airplane crashes, both involving Boeing’s 737 MAX airplanes: The first crash, on October 29, 2018, killed all 189 passengers,124 and the second crash, on March 10, 2019, killed all 157 passengers.125 Echoing Glasscock’s discussion in Teamsters, VC Zurn explained, “Because the crashes’ second wave of harm affected Boeing as a company, the claim against its leadership belongs to the Company.”126 For almost a decade leading up to the 2019 Crash, although Boeing had five standing Committees concerning general oversight and compliance, there was no board-level oversight specifically for its mission critical function/issue: airplane safety.127 While the Audit Committee oversaw “compliance with related laws and regulations,” neither it nor any other Committee was “specifically tasked with overseeing airplane safety, and every committee charter was silent as to airplane safety.”128 Nor did Boeing have any board-level 122 In fact, third parties’ interests in this hypothetical would increase quite more drastically than in Marchand since there are obvious differences between a cancer drug and ice cream in terms of health risks. 123 In re Boeing Co. Derivative Litig., C.A. No 2019-0907-MTZ, 2021 WL 4059934 (Del. Ch. Sept. 7, 2021). 124 Id. at *12. 125 Id. at *16. 126 Id. at *1. See also Shapira, Max Oversight Duties: How Boeing Signifies a Shift in Corporate Law, supra note 6, at 124 (“The primary victims of the Max debacle are those 346 who died and the families they left behind. But from a corporate law perspective, it is notable that the crashes caused significant attendant harms to Boeing and its shareholders: a 20- month global grounding of its fleet, $20 billion in non- litigation costs, several additional billions in litigation costs, long-lasting reputational fallouts, and so on.”). 127 In re Boeing Co. Derivative Litig., 2021 WL 4059934, at *5. 128 Id. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1105 “means of receiving internal complaints about airplane safety.”129 Extensive investigations and lawsuits revealed that: the 737 MAX tended to pitch up due to its engine placement; . . . a new software program designed to adjust the plane downward depended on a single faulty sensor and therefore activated too readily; and . . . the software program was insufficiently explained to pilots and regulators. In both crashes, the software directed the plane down.130 In fact, “[i]n developing and marketing the 737 MAX, Boeing prioritized (1) expediting regulatory approval and (2) limiting expensive pilot training required to fly the new model.”131 This case can be divided into three main time frames: (1) pre-2018 Lion Air Crash; (2) between the 2018 Lion Air Crash and the 2019 Ethiopian Airlines Crash; and (3) post-2019 Ethiopian Airlines Crash. The lynchpin of oversight failures, as the Caremark Junction will illustrate, occurs during the pivotal period in (2). Among several general oversight failures occurring before the 2018 Crash, other key issues included a flawed angle-of- attack sensor that had been flagged and reported to the FAA in more than 216 incidents;132 Boeing’s claims from 2014 to 2017 that no flight simulator training was necessary;133 and an engineer’s unsuccessful attempt to raise safety concerns to a factory manager mere months before the 2018 Crash.134 Despite these warnings, “[w]hile some of these complaints made their way to senior management, none made it to the Board.”135 129 Id. at *7. 130 Id. at *1. 131 Id. at *8. 132 Id. 133 Id. at *9. 134 Id. at *11. 135 Id. at *12. 1106 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 Among other oversight failures occurring between the 2018 Crash and the 2019 Crash, key failures and red-flags included CEO and Board Chairman Muilenburg’s delayed and limited updates to the Board, particularly only in response to negative press;136 an optional Board meeting with no minutes in January 2019;137 the launch of a DOJ criminal investigation “into whether Boeing had defrauded the FAA when obtaining certification of the 737 MAX”;138 and a Board decision to delay any investigation until the conclusion of regulatory investigations or until a time when the Board deems “appropriate.”139 After the 2019 Ethiopian Airlines Crash, key events included the FAA’s grounding of the 737 MAX;140 the Board’s first time “critically assess[ing] MCAS, the FAA certification process, and pilot training requirements”;141 and the Board’s terminating Muilenburg.142 As a result of these events, “the 737 MAX fleet was grounded for twenty months, until November 18, 2020. During that period, Boeing was federally mandated to cure the defects.”143 Moreover, “[i]n 2020, Boeing estimated that it had incurred non-litigation costs of $20 billion, and litigation-related costs in excess of $2.5 billion . . . . And in January 2021, Boeing incurr[ed] billions of dollars in penalties.”144 Tying the above together, the Caremark Junction could possibly look something like this: 136 Id. at *13. For instance, in response to a November 12 article, Muilenburg sent an email to the Board proclaiming the article “wrongly claims Boeing withheld from customers and flight crews information related to a pitch augmentation system that’s unique to the 737 MAX.” Id. 137 Id. 138 Id. at *15. 139 Id. 140 Id. at *17. 141 Id. at *18. 142 Id. at *19. 143 Id. at *20. 144 Id. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1107 Visualizing Boeing’s Caremark Junction is unique for two main reasons. First, unlike how Marchand was a prong-one claim or how Clovis was a prong-two claim, both claims are implicated here. Although it is not uncommon for a shareholder to plead both prongs, it is very unusual—in fact, before this case, unprecedented— for a court to sustain both claims. As the Chancery Court has noted, “[a] plaintiff who adopts that strategy typically loses on prong-one because the plaintiff must concede the existence of a board-level monitoring system to plead under prong-two that the board ignored red flags generated by that system.”145 Boeing appears 145 City of Detroit Police and Fire Ret. Sys. v. Hamrock, C.A. No. 2021- 0370-KSJM, 2022 WL 2387653, at *12 (Del. Ch. June 30, 2022). See, e.g., infra Section IV.B.3. 1108 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 to be an exception to this general rule, possibly because the red flags had been so prevalent, particularly given the scope and nationwide attention of the 2018 Crash, that the Board became aware of the oversight failures pertaining to airline safety even without a board-level oversight mechanism. Put differently and in terms of the Caremark Junction, the 2018 crash was such a watershed calamity that the Board became aware of (or reasonably should have become aware of) the effects on third parties—those who had died, and by extension, the external law claims implicated.146 This is depicted through the two crashes’ serving as vertical tangents to the graph’s curves, creating cusps on the lines. The effect of the 2018 Crash was so pronounced that even third-party interests’ gradual line experienced a cusp. The change in slope after the 2019 crash is particularly pronounced for shareholder interests because of the financial effects arising thereafter. The second unique aspect of the Junction is the role factor 1(a) plays. Although Boeing’s first, main regulatory lawsuit regarding the crashes was in January 2019, when the DOJ opened up an investigation, Boeing had faced numerous lawsuits over the years prior, lawsuits that pertained to the Company’s mission critical function/issue, airline safety, with confirmed investigations of issues pertaining to its oversight and compliance for airline safety.147 This fact serves two roles in the opinion: Explicitly, it highlights how the Board had “utterly failed to implement any reporting or information system or controls” that pertain to a well-known, mission critical function or issue.148 In other words, the previous lawsuits served as evidence that whatever was lacking in, for instance, Boeing’s 2015 lawsuits, was also lacking with respect to its 734 MAX airplanes. Implicitly, this also serves as, at a minimum, a nascent warning sign to the Board—if not 146 See, e.g., supra note 16. 147 See In re Boeing Co. Derivative Litig. at *4 (observing how in 2015, Boeing faced “thirteen separate pending or potential civil enforcement cases relating to quality control, safety protocol violations, and manufacturing errors in production lines.”). 148 Id. at *25 (emphasis added). No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1109 a full-out red-flag, then at least yellow flag— that there is some type of necessary oversight pertaining to the subject matter of the 2015 lawsuits. This is only further bolstered between 2018 and 2019, when the DOJ initiated an investigation. Further, it is important to stress how, of course, shareholders would want Boeing to prevent a crash by any means necessary. Yet, it would be an act of hindsight bias to claim that shareholder interest in the intensity of oversight would match third-party interest, both before and after the 2018 Crash. First, from a shareholder’s perspective, Boeing had five standing Committees, some of which explicitly dealing with general oversight and federal law regulations. Although there were issues regarding the 737 MAX’s software, these were not public, so a shareholder would not have known this. During this pre-2018 period, even a reasonable director would not have known this, due to the lack of board-level oversight on airplane safety. Furthermore, even after the 2018 Crash, although shareholder interests drastically increased, they were not reaching third-party interest level just yet. Many things could have been going on in a reasonable shareholder’s mind: Maybe that it was a freak accident, or that Boeing, as such a sophisticated company, will surely rectify the issue to make sure it will not happen again. The fact the 737 MAX planes were not grounded adds further weight to a potentially optimistic shareholder. In contrast, a third party, understanding her interest through the lens of the external laws, would have always wanted a company as wealthy and sophisticated as Boeing is to spend a very high amount of money and resources to guarantee no such accident will occur, without regard to a fear of overspending or overdeterrence. 4. Tying the Cases: Conceptual Requirements Are Met After analyzing Marchand’s, Clovis’s, and Boeing’s Caremark Junctions, a number of patterns arise, echoing Caremark’s truisms as explored in Section III. First, all defendants were within the purview of federal, regulatory 1110 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 agencies: Blue Bell and Clovis under the FDA, Boeing under the FAA. Hence, all three cases pertained to legal risks, not business risks; the agencies’ laws served as the lens through which to capture third-party interests. Third-party interests in terms of a defendant’s oversight increased more exponentially in Marchand than in Clovis, since the product in the former had already been in the stream of commerce, and thus third parties—particularly consumers—would have more direct contact with the product. This is also true in Boeing, where third-party interest was high, ab initio, primarily due to the inherent danger consumers could face if an airline violates certain federal aviation laws, but also due to the previous, numerous lawsuits Boeing had been facing pertaining to those airline safety laws in question. In contrast to Marchand, the death toll in Boeing is much greater, which could explain the cusp on the graph. This pattern also underscores the interplay between federal law and state corporate law, which is implicated in successful Caremark claims. Another checkmark is that, because Caremark claims indirectly harm third parties through violating some external law, such parties may bring non-Caremark-claim lawsuits against the defendants. In each of these three successful Caremark cases, there were such claims, either by harmed consumers or by government agencies. A third checkmark is that in all three cases, due to trauma resulting from a lack of oversight, the companies suffered substantial financial harm, which as Section III underscores, is the proximate step required to provide a shareholder standing to bring this derivative claim against the corporation. Without this financial harm, although the companies could still face lawsuits—and they all did—they could not face Caremark liability. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1111 B. Unsuccessful Caremark Claims 1. In re Citigroup Inc. Shareholder Derivative Litigation149 In Citigroup, shareholders brought a derivative suit against Citigroup directors, alleging that the directors had failed “to properly monitor Citigroup’s business risk, specifically its exposure to the subprime mortgage market.”150 Plaintiffs brought a prong-two Caremark claim, alleging that the directors had failed to “make a good faith attempt to follow the procedures put in place or fail[ing] to assure that adequate and proper corporate information and reporting systems existed that would enable them to be fully informed regarding Citigroup’s risk to the subprime mortgage market.”151 Plaintiffs relied on two alleged red flags to support their claim: “[A] majority of the directors (1) served on the Citigroup board during its previous Enron related conduct and (2) were members of the ARM Committee and considered financial experts.”152 The Court granted Defendant’s motion to dismiss, characterizing Plaintiff’s alleged red flags as mostly “statements from public documents that reflect worsening conditions in the financial markets . . . and the effects those worsening conditions had on market participants, including Citigroup’s peers.”153 The Court described Plaintiffs as “attempting to hold the director defendants personally liable for making (or allowing to be made) business decisions that, in hindsight, turned out poorly for the Company.”154 In fact, “[p]laintiffs do not contest that Citigroup had procedures and controls in place that were designed to monitor risk.”155 149 In re Citigroup Inc. S’holder Derivative Litig., 964 A.2d 106 (Del. Ch. 2009). 150 Id. at 123. 151 Id. at 123–24. 152 Id. at 124. 153 Id. at 114–15. 154 Id. at 124. 155 Id. at 127. 1112 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 Although “Citigroup suffered large losses and . . . there were certain warning signs that could or should have put defendants on notice of the business risks related to Citigroup’s investments in subprime assets,” such harm was caused not by bad faith, because such oversight was one pertaining to business risk, not legal risk.156 This reinforces the analysis in Section II.C: Although Citigroup experienced some of the necessary elements to trigger a Caremark junction, because no external law had been implicated, there is no option to prove either 1(a) or 1(b), since there is no nexus between a mission critical function/issue and a positive law regulation. As such, conceptually, there is no overlap between shareholder and third-party interests, since the latter is non- existent; there is no external law from which to use as a proxy for third-party interests. Likewise, the lack of an implicated external law runs counter to the embedded relationship between federal law and state corporate law that marks a typical successful Caremark claim. Additionally, this case illustrates the difference between general, effective oversight and Caremark effective oversight. The Court characterizes Plaintiff’s main premise—that “since the Company suffered large losses, and since a properly functioning risk management system would have avoided such losses, the directors must have breached their fiduciary duties in allowing such losses”—as mere “general ipse dixit syllogisms.”157 Plaintiffs’ claim relies solely on the connection between an alleged poor oversight and the financial harm suffered. However, as Section II.B explains, Caremark liability requires more than just claiming that ineffective oversight caused financial harm; it also necessitates a bad faith, scienter requirement. With respect to the Caremark Junction, this is shown by factors 1(a) and/or 1(b).158 Without 156 Id. at 126–27. 157 Id. at 128–29 (emphasis added). 158 For a similar but more recent case of a failed Caremark claim, see Constr. Indus. Laborers Pension Fund v. Bingle, C.A. No. 2021-0940-SG, 2022 WL 4102492 (Del. Ch. Sept. 6, 2022) (granting motion to dismiss on a prong-one and -two Caremark claim dealing with cybersecurity oversight). In this case, although cybersecurity was mission critical to the company, No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1113 an explicit showing of any legal risk, Plaintiffs’ claim was ill- fated from its initial filing. 2. In re Qualcomm Inc. FCPA Stockholder Derivative Litigation159 In Qualcomm, shareholders brought a prong-two Caremark claim, alleging that the Company’s board intentionally and in bad faith ignored red flags arising from “violations of the Foreign Corrupt Practices Act (‘FCPA’) and a March 2016 U.S. Securities and Exchange Commission (‘SEC’) cease-and-desist order [(2016 SEC Order)].”160 Plaintiffs cited to audit committee meetings in 2009 and 2010 regarding potential FCPA violations.161 Further, the 2016 SEC Order “show[ed] that the SEC found that Qualcomm violated the FCPA,” such as by “lack[ing] adequate internal controls to provide reasonable assurances that only authorized transactions were executed and that all transactions were accurately recorded. The order required that Qualcomm pay a penalty of $7.5 million[.]”162 The Court granted Defendant’s motion to dismiss, finding that Plaintiffs are merely trying “to second-guess the timing and manner of the board’s response to the red flags[.]”163 Plaintiffs allege neither “a board decision to cause Qualcomm to violate the FCPA,”164 nor “that the board consciously without any external law saying otherwise, oversight “efforts to avoid cybercrime by third parties” is a business risk, thus protected by the business judgment rule. Id. at *1, *7. Although most of the Caremark Junction’s requirements are present—financial harm, “mission critical,” poor oversight—the requirement of an explicit legal risk (and thus scienter) is still lacking. See also Ontario Provincial Council of Carpenters’ Pension Tr. Fund v. Walton, 294 A.3d 65, 85–86 (Del. Ch. 2023) (“Even [in 2023], the relative importance of cybersecurity risk has not yet led to a Caremark claim surviving a motion to dismiss, although someday it might.”). 159 In re Qualcomm Inc. FCPA S’holder Derivative Litig., C.A. No. 11152-VCMR, 2017 WL 2608723 (Del. Ch. June 16, 2017). 160 Id. at *1. 161 Id. 162 Id. at *2. 163 Id. at *4. 164 Id. 1114 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 disregarded the red flags.”165 In fact, what Plaintiffs “cite as red flags also include planned remedial actions.”166 This case, like Citigroup, stresses the difference between general, effective oversight and Caremark effective oversight: “A corporation’s violation of the FCPA alone is not enough for director liability under Caremark . . . . Delaware law, not the FCPA, establishes the standard for director liability[.]”167 What the plaintiffs failed to plead was the bad faith necessary to tie Qualcomm’s FCPA violation to the harm it faced. With respect to the Caremark Junction, there are two additional missing factors that the Court didn’t explore. First, it is unclear whether Qualcomm faced sufficient financial harm to trigger a derivative claim. For a company as wealthy as Qualcomm is, a $7.5 million fine is likely insufficient to hurt the corporation as a whole; there is no evidence of a drop in stock value that would warrant a shareholder to bring a claim. Corporations face fines for violating laws all the time, and pleading a Caremark claim whenever this occurs would conflate general, ineffective oversight and Caremark ineffective oversight. Even assuming that all the fines imposed on Qualcomm in relation to its activity abroad are sufficiently high, there still lacks a nexus between those fines and a bad faith board-level action. Further, there is no evidence that any of the fines imposed relating to an FCPA violation caused any significant drop in stock value to trigger a derivative harm. The second factor missing is the tying of the FCPA to Qualcomm’s “mission critical” or “central compliance” function.168 Although any public company with international offices would be under the scope of the FCPA, it is unclear how this factor qualifies as a “mission critical” or “central compliance” risk.169 Qualcomm’s “mission critical”170 function would need to be defined or narrowed in scope, with something 165 Id. at *3. 166 Id. 167 Id. at *4. 168 Marchand v. Barnhill, 212 A.3d 805, 824 (Del. 2019). 169 Id. 170 Id. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1115 pertaining to software and technology.171 This bleeds into the lack of financial harm to trigger a derivative claim: The less a law pertains to a corporation’s “mission critical” function, the less the corporation should expect that a violation of such a law would harm it as a whole.172 Based on these three missing factors, using the FCPA as a proxy for third party interests, shareholder versus third-party interests can look something like this: As the above portrays, shareholder interests do not intersect with third-party interests, so the Company did not reach the Caremark Junction. While after the 2016 SEC Order, there would likely be an increase in shareholder interest in compliance with FCPA, shareholders would still not want a program as robust and/or expensive program as third parties would. The cost of implementing a program that third parties would want could exceed the fines resulting from such violation. Also, shareholders may think that Qualcomm will immediately rectify the issue by putting in place the lowest-cost yet effective program. Furthermore, in contrast to the laws in Marchand and Boeing, the FCPA lacks the harm necessary to accelerate shareholders’ interests in oversight. While the obvious difference is that a violation of the FCPA wouldn’t ordinarily cause death or physical injury, another difference is that the extent of Qualcomm’s FCPA violation wouldn’t likely cause such financial distress on the company, i.e., cause a dramatic 171 Thus, issues pertaining to cybersecurity would fall under the scope of Qualcomm’s “mission critical” risks. 172 Marchand, 212 A.3d at 824. 1116 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 decrease in stock price. Shareholders would focus primarily on both the likelihood of corporate trauma as a result of violating the FCPA and the scope of such trauma. While in a case like Boeing, the former and latter are more-or-less conflated, in Qualcomm, even if an FCPA violation occurs, shareholders may still prioritize limiting the amount to spend on oversight. And importantly, there still lacks any bad faith, scienter requirement to connect the violation of the law to the financial harm. Ex ante, because of the lack of any sufficient red flags, a reasonable shareholder would think the board is doing the best it can regarding FCPA compliance; the board’s responses were appropriate, ex ante, in terms of scope and intensity. 3. City of Detroit Police and Fire Retirement System v. Hamrock173 Hamrock resulted from a gas pipeline explosion in Lawrence, Massachusetts—the “Greater Lawrence Explosions”; the pipe “system became over-pressurized, resulting in fires and explosions that caused one fatality, injuries to 22 people, and damage to 131 structures[.]”174 Plaintiff alleged both prong-one and prong-two Caremark claims. Regarding the former claim, Plaintiff alleged that the directors “utterly fail[ed] to implement any reporting or monitoring system to oversee pipeline safety, which was ‘mission critical’ for NiSource’s gas businesses.”175 For its prong-two claim, Plaintiff alleged that, leading up to the explosions, “the Board knew generally about serious issues concerning compliance with recordkeeping requirements” arising under Part 192 of Title 49 of the Code of Federal Regulations (“Part 192”),176 which “sets forth minimum federal safety standards for transporting gas by pipeline, including extensive recordkeeping requirements.”177 173 City of Detroit Police and Fire Ret. Sys. v. Hamrock, C.A. No. 2021- 0370-KSJM, 2022 WL 2387653 (Del. Ch. June 30, 2022). 174 Id. at *1. 175 Id. 176 Id. at *20. 177 Id. at *4. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1117 Plaintiff also alleged that the Board “had specific knowledge of violations of Part 192 recordkeeping requirements involving other NiSource subsidiaries,” and “was aware, or at least should have been aware, that violations of Part 192 recordkeeping requirements as they relate to control lines posed risks specific to CMA.”178 The Court swiftly struck down Plaintiff’s prong-one claim by noting how its prong-two arguments were stronger and heavily relied on the premise that there was, in fact, an oversight program for pipeline safety.179 Plaintiff’s prong two- claim was stronger: “Plaintiff ha[d] adequately alleged that the Board and ES&S Committee were repeatedly informed that poor recordkeeping practices generally posed a significant risk to the Company,” that “[i]t is reasonably conceivable that these warnings were tied to Part 192’s requirements,”180 and that the Board had knowledge “of serious issues concerning violations of specific recordkeeping requirements under Part 192 at NiSource subsidiaries other than” at its Columbia Gas of Massachusetts (“CMA”) subsidiary, such as its Ohio and Indiana subsidiaries.181 In particular, the Board knew of a March 2015 pipeline explosion at its Ohio subsidiary, which “was caused by non-compliant recordkeeping.”182 Still, the Court held that Plaintiff had failed to prove “that the Board was aware of specific dangers at CMA posed by recordkeeping concerning control lines.”183 The Court rejected 178 Id. at *20. 179 Id. at *15. For instance, Plaintiff explicitly acknowledges how “the Board knew NiSource had critical safety problems related to compliance with Part 192’s documentation requirements in Massachusetts, where CMA operated, as material from the March 21, 2016 ES&S Committee meeting noted that ‘poor record[s]’ were the root cause of 18% of CMA’s damages during 2015.” The Court further cites fourteen different instances when the Board’s Environmental, Safety and Sustainability (“ES&S”) Committee engaged in explicit compliance pertaining to pipeline safety. See id. at *16– *17. 180 Id. at *21. 181 Id. at *22. 182 Id. 183 Id. at *23 (emphasis added). 1118 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 Plaintiff’s pointing to the two events—the 2015 “Operational Notice” of a “near miss” event and the 2016 “Taunton Event” caused by over-pressurization—as serving as red-flags, since the Board was unaware of either events prior to the Greater Lawrence Explosions.184 This case is a difficult one on whether the company had reached the Caremark Junction. The Court put a gloss on an important necessary condition: “General risks are not ‘red flags’ of a specific corporate trauma.”185 With regard to the 2016 Taunton Event, the Court held that “[i]t is not reasonably conceivable that incidents concerning different employees, in a different state, in unrelated projects or events would have placed a reasonable person on notice of the recordkeeping and weak engineering that led to the Greater Lawrence Explosions[.]”186 What makes this case an even closer call is that although the Board had direct knowledge regarding a similar, past explosion, this knowledge was not specifically related to the Greater Lawrence Explosions. There lacked a connection between the Taunton Event and the Greater Lawrence Explosions sufficient to rise to the level of bad faith among directors. The Taunton Event “had to do with a failure to follow internal documentation, not maintain proper documentation.”187 Compounding this with the fact that the ES&S Committee continually engaged in explicit compliance pertaining to pipeline safety leading up to the Greater Lawrence Explosions provides a further reason to defer to the Board’s decisions, ex ante. Facially, this case shares key features with the successful Caremark cases: a company that faced a catastrophe, causing injury and death due to flaws in its oversight program with regard to a mission critical function or issue and under the 184 Id. For instance, the Board likely only learned about the 2015 Operational Notice on February 26, 2020. 185 Id. at *24. at *25. 186 Id. at *26. 187 Id. No. 2] IN SEARCH OF THE CAREMARK JUNCTION 1119 purview of a regulatory law. Yet, what is lacking is bad faith/scienter. First, this case is distinguishable from Marchand since NiSource did in fact have a good faith oversight program. Further, regarding “red flags,” in contrast to the facts in Boeing, here the alleged red flag pertained to an accident regarding “different employees, in a different state, in unrelated projects or events,” and with different legal violations: It arose from “a failure to follow internal documentation,” while the Greater Lawrence Explosions arose from a failure to “maintain proper documentation.”188 Second, and quite important with respect to the Caremark Junction, is that there is no evidence of any sufficient financial difficulty—i.e., drop in stock price— to NiSource that would constitute a Caremark harm. It is likely that, especially after Hamrock, significant drop in stock value is a necessary, not just a sufficient, condition for financial harm under Caremark. Given the closeness of this case, it is difficult to visualize the relationship between shareholder versus third-party interests; but it might look something like this: V. CONCLUSION Understanding the true nature of the Caremark claim is one thing; the much harder part is actually using and applying it. While the Caremark Junction’s graph is mostly useful ex post, such as for a judge to analyze the case before her or for a plaintiff to establish an evidentiary record for its case, there is a third intended audience, who has been center- stage of this entire Note: directors. Indeed, this Note 188 Id. at *25, *26. 1120 COLUMBIA BUSINESS LAW REVIEW [Vol. 2023 responded to Vice Chancellor Glasscock’s invitation to pinpoint the distinction between the “society-wide victims” and the harm to the corporation itself. Now, this Note passes the torch and invites directors and counsel to apply the Caremark Junction, particularly those involved in businesses similar to those in the successful Caremark suits—businesses highly regulated by a federal agency—or when facts involve their businesses’ mission critical or “central compliance” function(s). Applying the Caremark Junction analysis, directors ought to make a timeline of events, pinpoint if any of the necessary requirements from Section III are met, and if so, for how long. Engaging in such an analysis could even save the directors down the road—ironically, against any Caremark claim, since such an analysis, if done properly, would suffice for board- level oversight. In this way, the Caremark Junction is not just a tool for judges to analyze ex post, but also a potentially strong evidentiary record that directors can rely on to either deem demand futile or dismiss a Caremark claim. By conceptually understanding their duties of good faith pertaining to oversight and compliance, directors are, ipso facto, engaging in good faith behavior regarding their fiduciary duties. Now more than ever, oversight and compliance serve as the sine qua non of a healthy corporation. If what the recent literature contends is true and the tiger has grown out its teeth, ready to burst out of its deer costume, then at least directors can use the Caremark Junction as both a shield— preventing the tiger from even attacking with good-faith, board-level oversight—and a sword—attacking the tiger in the courtroom. In search of the Caremark Junction, directors can be ready.