The coronavirus (COVID-19) has caused widespread deaths, months of lockdowns, and—for businesses—billions of dollars in lost revenue. Every day, companies across the country, small and large, are being forced to take drastic measures to stay solvent and mitigate risk. With no end in sight, corporate management is under increasing pressure to perform its obligatory fiduciary duties. Adherence to the tenets of good corporate governance and creation of an effective risk management program are now more important than ever.
It is axiomatic that corporate management is entrusted with the significant responsibility of managing a company for its shareholders. These responsibilities are known as fiduciary duties in both private and public companies, and include the duties of care and loyalty.
Duty of Care
Under the Duty of Care, shareholders and courts alike expect and require corporate management to be informed about business operations and make reasonable decisions—with proper purpose and 1) in good faith; 2) with the care an ordinarily prudent person in a like position would exercise; and 3) in a manner that corporate management reasonably believes to be in the best interests of the corporation. A breach of this duty, beyond harming the company, may subject corporate management to personal liability in litigation without corporate indemnification.
In the time of the coronavirus, the risks and consequences associated with this duty are heightened. Corporate management must continuously evaluate how the company is being affected by the pandemic. In more “normal” times, corporate management must take steps to manage prudently, which includes reviewing and understanding financial reports and being familiar with the company’s bylaws; in the current era, management will now also have to map out the road to recovery and generally take an even more active role than it otherwise may be accustomed to.
At the same time, corporate management cannot make rash or knee-jerk decisions, and must continue to keep the company’s best interests in mind. This may, in some cases, mean that “reasonable prudence” involves making short-term decisions that are harmful to the corporation and its management, but that ensure long-term survival, including informed decisions regarding layoffs and furloughs, and conserving financial resources. More than ever, companies will have to monitor liquidity issues and investigate potential avenues for additional fundraising. Even companies that are currently healthy or were financially solvent only months ago now face increased risk of insolvency as the pandemic drags on. The best interests of the company may also demand pre-emptive exploration of restructuring and sale options.
Duty of Loyalty
Corporate management must also adhere to the Duty of Loyalty, which means that any personal interests are set aside when running the corporation. Accordingly, corporate management must disclose certain information relating to transactions, including personal interests, the involvement of former associates, and any and all information material to a shareholder vote. Avoiding or disclosing conflicts of interest is of prime significance in evaluating duties of loyalty.
Although the Duty of Loyalty remains the same legal requirement during the current pandemic as in normal times, the importance and potential consequences stemming from the duty are even greater. Corporate management will face tighter scrutiny in transactions and actions taken during the emergency, since the effects of bad decisions are likely to be amplified many times over and could lead to litigation. Normally, a company may be able to unwind or recover from an unwise transaction, but the same transaction may now prove fatal. As another example, corporate management must now not only refrain from insider trading, but must also implement anti-insider-trading policies to prevent others in the company from doing so.
Proper corporate governance more important than ever
Good corporate governance, at the best of times, means actively searching for and managing risks. Although the COVID-19 pandemic is already here, there will be continuing risks concerning reopening and the potential for future outbreaks. For some companies, this will mean that good governance requires a fundamental shift in operations, such as a move online, which brings about a whole host of new risks. These includes ones that some businesses may not have been overly concerned with previously, including cybersecurity. In addition, state and federal responses to the pandemic are evolving on a daily basis; corporate management must carefully consider those changes and how they affect the business community.
Special issues for public companies
For public companies, management has even more responsibilities, such as 1) duty to shareholders; 2) duty to disclose books for public benefit; and 3) duty to comply with the SEC and other federal regulations and policies. Public companies also have enhanced issues concerning insurance, since they are costly to insure, generally receive narrower insurance coverage, and have higher deductibles. All of these issues have been amplified during the current pandemic, which means that management must be even more diligent, including with respect to awareness of and adherence to changing federal and state regulations and guidelines. This is especially crucial in regulated industries that have regulators who exist solely to seek out wrongdoing and will be heavily scrutinizing actions, disclosures, and compliance during the pandemic.
Enterprise risk management
Corporate management of both private and public companies must engage in effective enterprise risk management even under normal circumstances, which describes the process by which a business assesses risk, identifies issues that have an impact on the business, determines a response strategy, and implements a monitoring process. Current enterprise risk management procedures are assuredly no longer adequate during the pandemic. Such procedures must be updated in accordance with state and federal recommendations and address not only the damage caused so far, but the arduous task of reopening, and the potential for similar or greater crises down the line.
Management is well-advised to identify and develop risk management policies and procedures, and ensuring that senior executives implement those policies and resolve crises in a changing environment. This is especially important in relation to “red flags,” the ignoring of which will itself be strong evidence that the Duty of Care was breached. This is especially true during the current pandemic, in which the worsening conditions and potential dangers and timeline for recovery are well publicized and cannot be reasonably ignored. In particular, companies must have risk management policies and procedures updated for coronavirus in relation to:
- Possible industry-specific impacts
- Continuity of business issues
- Supply chain disruption
- Increased risk of litigation
- Decreased or impaired workforce
- Increased cybersecurity risks
Furthermore, under the current circumstances, corporate management cannot simply enact such risk management and step aside. Management is well-advised, for example, to set up COVID-19 subcommittees to report on a regular, if not daily, basis. Regular meetings, with minutes, must be held in response to the changing COVID-19 landscape to document the measures that are being taken, and the motivations for business decisions, to help stave off future regulator actions and derivative litigation.
Finally, corporate directors are entitled to rely on management and outside experts to provide advice regarding matters outside the board’s immediate knowledge or expertise. In certain circumstances, there is even a duty to consult such experts. The board may defend against a claim of breach of fiduciary duty, and even tort liability, based on such reliance. However, in the coronavirus crisis, companies are faced with a welter of different and even inconsistent advice from medical and legal experts, regulators, and government officials at all levels. How can a board avail itself of the “reliance on management and experts” defense in this context?
There is no easy answer, but some steps are clear. The board should ensure that management is appropriately monitoring the shifting COVID-19 landscape and constantly revising the company’s policies to meet the evolving consensus of best practices. Make sure responsibility and reporting are clear. Management should report about what it is doing, and what advice and guidance it is relying on.
Second, the board should put a procedure in place so management brings appropriate expert advice to the board’s attention. A presentation by an expert, inside or outside the company, will bolster the board’s record of diligence. Appropriate areas of expertise would include legal, medical, OSHA, accounting, financing, or—for many companies—restructuring. Doing something is better than doing nothing. The worst record for the board would be one of either inattention or ignoring red flags.
Third, the board should make sure that the coronavirus diligence process does not stand still. No “one size” of mitigation measures will fit all companies, and no size will fit even one company for very long because the information about the risks posed by the outbreak keeps evolving. Accordingly, more-frequent reporting by management is appropriate.
Finally, directors should ensure that a complete record is kept of the expert and other advice sought by board and management and how it was applied, to document the board’s and management’s diligence.
Due to the pandemic, the duties of good corporate governance are presently more important and visible, with greater impact, than they were just six months ago. The status quo has changed, and corporate management must rise to meet the new standard. Those who stay mindful of their duties of care and loyalty, make informed decisions, and enact properly targeted risk management policies may well survive to face the next crisis. Those who do not are at increased risk of not only dooming their companies and incurring costly litigation, but of incurring personal liability as well.