Corporate Governance

Delaware's Top Five Worst Shareholder Decisions for 2009 (#2): In re Citigroup

By J. Robert Brown

The Chancery Court in 2009 confronted the board's responsibility for the crisis plaguing the financial markets.  The crisis arose in part out of excessive risk taking by large financial institutions.  Few suffered more than Citigroup.  The financial conglomerate came close to failure and had to be rescued by a large capital infusion from the federal government.  In addition to purchasing non-voting preferred shares, the US government ultimately acquired around 34% of the voting shares of Citigroup.

Shareholders sued the board of Citigroup alleging that the board should have played a larger role in preventing the financial conglomerate from taking on so much risk.  The plaintiffs alleged that the board had plenty of "red flags" that alerted it to the problems in the subprime lending market yet took no steps to address the concerns. The board had staked out a role in assessing corporate risk having established an Audit and Risk Management Committee (ARM Commitee).  

The case involved two discrete issues.  The first was whether the board could be charged with awareness of the problems of excessive risk and, in the face of these concerns, had consciously disregarded the risks.  This issue turns on what the board knew and whether it had a duty to act.  The claim is grounded in bad faith.

The second was whether the board had a duty to know about the excessive risk taking.  It was more than a generic claim that boards had a duty to be informed about risk taking.  Plaintiffs claimed that the board failed to 'make a good faith attempt to follow the procedures put in place or fail[ing] to assure that adequate and proper corporate information and reporting systems existed that would enable them to be fully informed regarding Citigroup's risk to the subprime mortgage market.' Specifically, the plaintiffs asserted, among other things, that the ARM Committee had responsibility to:

• Discuss with management Citigroup's major credit, market, liquidity and operational risk exposures and the steps management has taken to monitor and control such exposures including Citigroup's risk assessment and risk management policies;

In short, plaintiffs alleged that the board had responsibility for risk oversight and failed in that responsibility.  

The case presented the Chancery Court with an opportunity to discuss the oversight responsibilities of the board.  It also gave the court an opportunity to define the types of information that ought to be reported to the board in order for it to fulfill its oversight function.  Nothing of the kind occurred. 

The court turned the case into something that it was not.  Instead of focusing on inadequate process, as plaintiffs alleged, the court characterized the cause of action as simply a hindsight attempt to impose liabilty for a decision that turned out badly. 

• When one looks past the lofty allegations of duties of oversight and red flags used to dress up these claims, what is left appears to be plaintiff shareholders attempting to hold the director defendants personally liable for making (or allowing to be made) business decisions that, in hindsight, turned out poorly for the Company.

In fact, it was nothing of the kind.  Indeed, the board never made a decision that could be reviewed under the business judgment rule.  Plaintiff's claim was one of faulty process, exactly what the court typically requires in these circumstances.  It was about whether the board should have considered the relative risks, having formed a board committee assigned the task of doing so.  Had the board considered the relative risks and made a decision to go forward, the decision almost certainly would have fallen under the business judgment rule and almost certainly would have been insulated from liability.

Even worse, the court actually limited Caremark to the oversight of fraudulent and criminal conduct by employees, specifically disclaiming any obligation of the board to participate in risk assessment. 

• There are significant differences between failing to oversee employee fraudulent or criminal conduct and failing to recognize the extent of a Company's business risk. Directors should, indeed must under Delaware law, ensure that reasonable information and reporting systems exist that would put them on notice of fraudulent or criminal conduct within the company. Such oversight programs allow directors to intervene and prevent frauds or other wrongdoing that could expose the company to risk of loss as a result of such conduct. While it may be tempting to say that directors have the same duties to monitor and oversee business risk, imposing Caremark-type duties on directors to monitor business risk is fundamentally different. Citigroup was in the business of taking on and managing investment and other business risks. To impose oversight liability on directors for failure to monitor 'excessive' risk would involve courts in conducting hindsight evaluations of decisions at the heart of the business judgment of directors. Oversight duties under Delaware law are not designed to subject directors, even expert directors, to personal liability for failure to predict the future and to properly evaluate business risk.

The analysis suggests that even if the board had red flags suggesting excessive risk taking, there was no duty or responsibility to act.  The suggestion contradicted longstanding and conventional wisdom that boards had a duty to act anytime they were put on notice of circumstances that could result in serious harm to the corporation.

The case was considered upon a motion to dismiss for the failure to make demand, a pre-discovery motion.  Thus, to escape dismissal, it was not enough to show the existence of a board risk oversight committee and an affirmative obligation to "monitor" risk exposure.  As a result, plaintiffs were never given the opportunity to explore what the board knew about the risks and what steps it had taken, if any, to address the concerns.  Ironically, this inabilty was in fact held against them.  As the court noted:  "Indeed, plaintiffs' allegations do not even specify how the board's oversight mechanisms were inadequate or how the director defendants knew of these inadequacies and consciously ignored them."  

In the end, the case may have a beneficial effect.  By essentially exonerating the board from any role in risk assessment, it provided considerable impetus for federal intrusion into the area.   The SEC has intervened, requiring companies to disclose 'the extent of the board's role in the risk oversight of the registrant, such as how the board administers its oversight function, and the effect that this has on the board's leadership structure.'  Item 407(h), 17 CFR 229.407(h).  Senator Schumer's Shareholder Bill of Rights mandates a role for the board in risk assessment.  

With all of that in mind, on to In re Citigroup.  As usual, we have posted primary materials on the DU Corporate Governance web site.

Full post as published by The Race to the Bottom on January 06, 2010 (boomark / email).