Scope
This guide examines board-level oversight duties under the Caremark standard following the Delaware Court of Chancery's August 14, 2026 dismissal of claims against Boeing directors. It's intended for board members, corporate secretaries, and governance advisors who structure reporting systems and assess when compliance information necessitates board action. This guide does not address officer-level operational duties or securities disclosure obligations.
Key Concepts and Definitions
Caremark Duty of Oversight
A two-part obligation requiring directors to (i) establish reasonable reporting and monitoring systems for legal compliance and critical risks, and (ii) not ignore clear warnings of illegal conduct or wrongdoing that may harm the corporation.
Bad Faith Standard
Intentional dereliction of duty or conscious disregard for responsibilities. Gross negligence or recklessness doesn't meet this threshold. Directors who believe they're reasonably performing their duties satisfy the baseline standard, even if outcomes prove inadequate.
Red Flag
Under the Boeing court's interpretation, a red flag requires detailed information about persistent noncompliance, presented directly to directors, and connected to the specific harm that occurred. Regular reports indicating management is addressing ongoing risks may demonstrate the reporting system is functioning rather than signal board inaction.
Business Judgment Deference
Once a board establishes and monitors a reporting system, its decisions about how to respond to risk information receive judicial deference. Evaluating business risk is a core board function; courts won't second-guess these decisions absent evidence of bad faith.
Requirements Breakdown
Baseline System Requirements
Your board satisfies the first Caremark prong when you've established:
Committee Structure
Designate specific committees with clear mandates for compliance oversight. In Boeing, the Audit Committee and Aerospace Safety Committee each had defined roles covering manufacturing compliance risks. Committee charters should specify which legal and operational risks fall within each committee's purview.
Regular Reporting Cadence
Committees must meet regularly and report findings to the full board. Boeing's committees met consistently, with safety updates at every board meeting. Document the frequency in committee charters and board calendars.
Expert Composition
Populate oversight committees with directors who have relevant expertise. Boeing's Aerospace Safety Committee comprised independent directors with engineering, manufacturing, aviation, or safety backgrounds. Match director qualifications to the risks being monitored.
Defined Information Channels
Create multiple reporting mechanisms for critical risks. Boeing's Aerospace Safety Committee used several specific channels to review incidents and operational performance; the Audit Committee received annual Compliance Risk Management reports outlining key manufacturing risks and mitigation efforts.
Response Threshold Requirements
The second Caremark prong focuses on board response to information received:
Attention Standard
Pay "substantial attention" to critical risks, even if mitigation efforts haven't achieved full compliance. The Boeing court emphasized that directors were actively engaged with safety issues through committee work and board discussions.
Documentation of Deliberation
Record board and committee consideration of compliance reports. Boeing's regular safety updates at board meetings, committee minutes, and annual CRM reports demonstrated ongoing engagement. Your minutes should reflect what information directors received, what questions they asked, and what follow-up they requested.
Iterative Management Response
When reports show management is "working up and iteratively addressing" a risk, that constitutes an acceptable response under business judgment protection. You're not required to achieve perfect compliance immediately; you must show continuous effort.
Conscious Decision Prohibition
You cannot deliberately decide to violate laws or delay addressing noncompliance. The Boeing court found no evidence directors made conscious decisions not to comply with safety regulations. Your minutes should never reflect acceptance of ongoing illegality as a business strategy.
Implementation Guidance
Structuring Your Reporting System
Map Risks to Committees
Identify your organization's critical legal and operational risks. Assign each category to a specific committee. For regulatory-heavy industries, consider whether a single Audit Committee can adequately cover all compliance domains or whether specialized committees (like Boeing's Aerospace Safety Committee) are warranted.
Define Reporting Content
Specify what information committees receive. Boeing's committees got incident reviews, operational performance metrics, and compliance risk assessments. Your reporting should include:
- Specific violations identified (regulation citations, not just summaries)
- Root cause analysis of compliance failures
- Management's remediation plan with timelines
- Progress metrics on prior remediation efforts
Establish Escalation Triggers
Define when an issue moves from management reporting to requiring board action. The Boeing court suggested that regular reports of ongoing risks being addressed by management don't automatically trigger board intervention. However, you should document criteria for escalation, such as repeat violations of the same regulation, regulatory enforcement actions, or failure to meet remediation milestones.
Evaluating Red Flags
The Boeing decision narrows what constitutes a red flag requiring board action:
Specificity Test
Reports must contain sufficient detail about the noncompliance. General statements that "safety risks persist" don't meet the threshold. You need specific violations, affected systems, and measurable gaps.
Presentation Test
Information must be "waved in front of" directors, not buried in appendices or technical reports. If a compliance issue is critical, it should appear in executive summaries and committee chair reports to the full board.
Causal Connection Test
The alleged red flag should relate to the specific harm that occurred. In Boeing, the court found many alleged red flags pertained to general safety risks rather than the door plug installation process that caused the incident.
Management Action Test
If reports show management is actively working on remediation, that may satisfy your oversight duty even if compliance gaps persist. Document what management is doing, not just what problems exist.
Common Pitfalls
Mistaking Reporting Volume for Red Flags
Boeing's Plaintiffs cited 95 pages of allegations drawn from regular committee reports. The court held that frequent reporting on an ongoing risk demonstrates the system is working, not that directors ignored red flags. Don't assume every compliance report creates liability exposure.
Confusing Business Risk with Legal Violations
The Boeing court distinguished "ordinary safety-related business risks" from violations of positive law. Your board can apply business judgment to operational safety decisions; you cannot apply business judgment to deciding whether to comply with regulations. Clarify in your minutes which discussions address business risk tolerance versus legal compliance gaps.
Failing to Document Belief in Reasonableness
Directors who "believed they were reasonably performing their duties" satisfied the bad faith standard in Boeing. Your minutes should reflect the board's rationale for concluding that management's response to compliance issues is adequate. Record the evidence you relied on: expert reports, audit findings, regulatory feedback, or industry benchmarking.
Creating Conscious Disregard Through Minutes
Never record statements suggesting the board is aware of illegal conduct and choosing not to address it. Phrases like "we'll accept this compliance gap for now" or "the cost of full compliance isn't justified" create evidence of bad faith when tied to legal violations.
Overlooking the Distinction Between Effort and Results
The Boeing board had spent years overhauling safety systems following two catastrophic crashes, yet violations persisted. The court found the effort satisfied Caremark duties despite imperfect results. Your board isn't liable for inadequate outcomes if you're making good-faith efforts to improve compliance. Document those efforts comprehensively.
Quick Reference Table
| Requirement | What It Means | Evidence You Need |
|---|---|---|
| Reasonable reporting system | Designated committees with defined mandates, regular meetings, expert members | Committee charters, meeting calendars, director qualification matrices |
| Information channels | Multiple mechanisms delivering compliance data to committees and board | Annual CRM reports, incident reviews, operational metrics, audit findings |
| Substantial attention | Regular board discussion of critical risks, even if mitigation is incomplete | Board and committee minutes showing ongoing engagement, questions asked, follow-up requested |
| No conscious disregard | No deliberate decisions to violate law or delay addressing noncompliance | Minutes reflecting compliance as priority, remediation plans approved, resources allocated |
| Business judgment protection | Board decisions on how to respond to risk information receive deference | Documentation of deliberation process, expert input considered, rationale for approach |
| Red flag specificity | Detailed information about violations, presented clearly, causally connected to potential harm | Specific regulation citations, measurable gaps, executive summaries highlighting critical issues |
| Management response | Evidence that management is iteratively addressing compliance gaps | Remediation timelines, progress metrics, root cause analyses, resource commitments |
| Good faith belief | Directors believe they're reasonably performing duties | Minutes showing reliance on expert reports, audit confirmations, regulatory feedback, industry standards |
The Boeing decision doesn't eliminate board oversight liability, but it resets the threshold for what constitutes actionable bad faith. Your board satisfies Caremark duties when you've built a functioning reporting system, paid substantial attention to the information it delivers, and documented your good-faith efforts to address compliance gaps, even when those gaps persist longer than you'd prefer.
