This post covers the core fiduciary duties, how uncertainty amplifies risk across each of them, and what boards can do right now to govern with confidence rather than scramble in hindsight.
Key Takeaways
- Directors owe three core fiduciary duties — care, loyalty, and good faith — regardless of market conditions or business complexity.
- The duty of oversight (a Caremark-era extension of care) is increasingly enforced and increasingly relevant as technology risks grow more material.
- The business judgment rule protects informed, independent directors acting in good faith — but that protection is earned through process, not assumed.
- Boards with a stable risk dashboard, documented deliberations, and defined escalation thresholds are better positioned when decisions are challenged.
- Documentation discipline must be maintained before, during, and after a crisis — not reconstructed after the fact.
The Three Core Fiduciary Duties Every Director Must Understand
Directors control assets and make decisions on behalf of others. That reality creates the fiduciary relationship — and under Delaware law (which governs the majority of US public companies), DGCL Section 141(a) places the management of the corporation squarely in the board's hands. Two primary duties govern that responsibility: care and loyalty. Good faith has evolved as an inseparable component of loyalty.
Duty of Care
The duty of care requires directors to make decisions on an informed basis. That means staying current on material corporate developments, reviewing relevant materials before voting, asking probing questions, and reaching decisions a reasonably prudent person in the same position would make.
Directors are not expected to be omniscient. DGCL Section 141(e) explicitly protects directors who rely in good faith on reports from officers, outside counsel, financial advisors, and technical experts — provided that reliance is reasonable and the experts were selected with care.
What the duty of care does require is diligence in the process. Smith v. Van Gorkom remains the most instructive example of what failure looks like: the Trans Union board approved a major merger after a brief meeting, without prior notice, without adequate valuation data, and without a fully informed record.
The Delaware Supreme Court found the directors grossly negligent. The merits of the deal were never really the issue. The process was indefensible.
Duty of Loyalty
The duty of loyalty requires every board decision to prioritize the corporation's interests over any personal, financial, or affiliated interest of the director. This covers:
- Avoiding self-dealing transactions
- Refusing to exploit corporate opportunities for personal gain
- Fully disclosing any conflict before participating in a related decision
Breach of loyalty carries the most demanding judicial standard: the entire fairness test. Under Weinberger v. UOP, that test has two components — fair dealing (how the transaction was structured, negotiated, and disclosed) and fair price (the economic terms and intrinsic value). Both must be satisfied. That is a significantly harder bar than the business judgment rule — the protection most directors assume applies to their decisions by default.
Duty of Good Faith
Good faith is not a standalone fiduciary duty under Delaware law. Stone v. Ritter confirmed it is a component of loyalty — but that doctrinal placement does not reduce its practical force. Directors who intentionally fail to act in the face of a known duty, or who consciously disregard known risks, lose their protection. Conscious inaction is as exposing as conscious wrongdoing. Courts have made clear there is no safe harbor in deliberate blindness.
How Uncertainty Amplifies Fiduciary Risk
"Uncertain times" in modern governance means far more than a down market. It includes:
- Cybersecurity incidents — ransomware, data breaches, third-party vendor failures
- AI adoption — model errors, data exposure, unvetted employee use of AI tools
- Geopolitical exposure — supply chain concentration, sanctions risk, trade policy shifts
- Regulatory reversals — SEC disclosure rule changes, evolving state-level AI and privacy mandates
- Leadership transitions — gaps in executive knowledge transfer and oversight continuity
Each of these conditions creates the same underlying problem for boards: information asymmetry between management and the board, compressed decision timelines, and decisions with material consequences. This is precisely when duty of care failures are most likely to occur — and attract the most scrutiny.
Stakeholder Scrutiny Has Expanded
The Business Roundtable's 2019 Statement on the Purpose of a Corporation — signed by 181 CEOs and reaffirmed in 2024 — reflected a broader shift in expectations. Regardless of where a board lands on shareholder primacy versus stakeholder theory, boards in uncertain environments face heightened scrutiny from shareholders, regulators, employees, and the press simultaneously.
Passivity Has Become Indefensible
McKinsey's 2025 supply chain survey found that 82% of respondents said their supply chains were affected by new tariffs, with 20–40% of supply chain activity impacted. Boards are now expected to oversee scenario planning for trade disruptions, sanctions exposure, and concentration risk. Passivity in the face of documented, material macro risks is not a defensible posture under the duty of care.
On regulatory risk: evolving SEC cybersecurity disclosure rules, state-level AI governance, and data privacy legislation create an evolving compliance challenge. Boards must track these changes — and document that they are tracking them.
The Duty of Oversight: The Modern Fiduciary Frontier
The duty of oversight emerged from In re Caremark International Inc. Derivative Litigation (Del. Ch. 1996): directors must implement and monitor reasonable information and reporting systems capable of detecting legal, operational, and compliance risks. Failing to do so — even without direct wrongdoing — can constitute a breach of the duty of care.
Stone v. Ritter later restated Caremark as two distinct failures that can trigger liability:
- An utter failure to implement any reporting or information system
- A conscious failure to monitor a system that was implemented
What Marchand and Boeing Made Clear
Marchand v. Barnhill (Del. 2019) raised the bar directly. The Delaware Supreme Court reversed dismissal of Caremark claims against Blue Bell Creameries' board because no board-level monitoring system existed for food safety — the company's most critical operational risk.
The Boeing derivative litigation applied the same logic to aviation safety. The court found a substantial likelihood of director liability based on four specific failures:
- No board committee charged with safety oversight
- Safety not a standing agenda item
- Management red flags not reaching the board
- A post-crash board call held with no minutes recorded
The principle now applies broadly: boards must actively oversee whatever risks are most material to their specific enterprise.
Technology and Cybersecurity as Mission-Critical Risk
For most modern enterprises, technology risk — data breaches, ransomware, third-party vendor failures, AI model errors — sits in the same category as food safety did for Blue Bell and aviation safety for Boeing. Courts, regulators, and institutional investors expect documented, board-level oversight of these risks.
A 2025 C-suite survey reported on Harvard Law School Forum found that only 32% of executives believed their boards had the appropriate skills mix for this oversight, and 40% of CIOs rated their boards' effectiveness as poor on technology risk. That gap is not a soft concern — it is exactly the kind of documented deficiency that plaintiffs' counsel will surface after an incident.
What Meaningful Cyber Oversight Actually Looks Like
Effective oversight is not a one-time briefing. It requires:
- Stable, trend-based dashboards — showing drift over time, not single-month snapshots that can mislead
- Defined escalation thresholds — specifying when management must surface an issue to the board, tied to business impact rather than technical severity
- Clear decision rights — separating what management owns from what requires board-level approval or notification
- Committee accountability — clear committee charter language assigning cyber oversight responsibility
- Regular cadence — monthly signals, quarterly deep dives on specific themes, annual tabletop exercises that include board-level decision scenarios
Boards that lack structured oversight programs face a dual exposure: the SEC's cybersecurity disclosure rules now require public companies to describe their board-level cybersecurity oversight processes in annual filings. Boards without a program face both regulatory vulnerability and fiduciary vulnerability at once.
When boards lack internal capacity to oversee technical risk — which is common — engaging an independent board-level cyber advisor or interim CISO can provide documented, inspectable oversight that stays independent of management. The goal is accountability that shows up in board materials, not delegation that disappears into the organization.
The Business Judgment Rule: Your Shield Requires Preparation
The business judgment rule, as formulated in Aronson v. Lewis (Del. 1984), creates a legal presumption that directors acted on an informed basis, in good faith, and with the honest belief that their decision served the corporation's best interests. Courts will not substitute hindsight for a director's judgment — but that protection only applies when the presumption remains intact.
What Defeats the Presumption
The presumption can be rebutted by evidence of:
- Self-dealing or undisclosed conflicts
- Failure to inform the board of material available information
- Bad faith or intentional disregard of known risks
- A process so inadequate it constitutes gross negligence (Van Gorkom)
In uncertain times, when outcomes are more likely to be questioned, the quality of the pre-decision process becomes the primary evidence of fiduciary compliance.
Process Is the Defense — Not the Outcome
The business judgment rule is a process defense. Outcomes — good or bad — are not the measure of fiduciary compliance. The process that produced the decision is.
Directors who received credible information, deliberated meaningfully, sought expert input where warranted, and documented their rationale stand on firmer legal ground — even when the decision turns out badly. Directors who made the identical call without that process record are exposed.
A defensible board record for any material decision should capture:
- The decision-ready materials presented before deliberation
- Questions asked and alternatives considered
- The decision, the rationale, and who owns follow-through
- For risk acceptance: the risk, the timeframe, the compensating controls, and the named owner
When Insolvency Enters the Picture
As a company approaches financial distress, the duty landscape shifts in one important respect: creditor standing. Under North American Catholic Educational Programming Foundation v. Gheewalla (Del. 2007), creditors of a solvent corporation — even one operating in the "zone of insolvency" — may not bring direct fiduciary duty claims against directors.
Once a corporation is actually insolvent, however, creditors gain standing to bring derivative claims on behalf of the corporation.
Delaware courts recognize two tests for insolvency:
- Balance sheet test: total liabilities exceed assets at fair valuation
- Equitable test: the corporation cannot pay debts as they come due
Determining which threshold has been crossed requires current, accurate financial data — and often outside advisor input. Boards that operate without real-time financial visibility face both fiduciary and practical risk.
For directors of financially distressed companies, the board's response should include:
- Increase oversight cadence and document decisions more thoroughly
- Verify D&O insurance coverage is adequate for the current exposure profile
- Ensure outside legal and financial counsel have been appropriately engaged
- Understand that the business judgment rule's good-faith standard still applies — but courts will scrutinize whether decisions were informed, deliberate, and contemporaneously documented
Building a Defensible Board Record in Uncertain Times
In uncertain environments, how a board governed is often more legally determinative than what outcome resulted. When a decision is challenged, courts look for evidence of the process — not just the result.
What Courts Are Looking For
Marchand and Boeing both demonstrate what courts examine when oversight is questioned:
- Did a board committee have explicit responsibility for the relevant risk?
- Was the risk a regular agenda item, or did it surface only after a crisis?
- Did management red flags actually reach the board?
- Are there minutes reflecting substantive deliberation — not just procedural logistics?
- Was there follow-through on decisions made?
Boards that cannot point to these structures when litigation arrives have little ground to stand on — and courts have shown little patience for reconstructed oversight after the fact.
Documentation Before, During, and After
Satisfying those court expectations requires a record built in real time — not assembled after a crisis surfaces:
Before a deliberation:
- Decision-ready materials stating the risk in business terms, options with costs, and timing
- Pre-read materials distributed with adequate lead time
During a deliberation:
- Minutes capturing what was decided, why, and who owns execution
- For risk acceptance: formal documentation of the risk, the acceptance rationale, the timeframe, and compensating controls
After a deliberation:
- Approved decision rights and escalation thresholds
- Named executive owners per top risk with due dates
- Exception tracking with approval dates and expiry dates
Boards that rely on memory to reconstruct their decision-making process in litigation face a hard disadvantage. The NACD's Director's Handbook on Cyber-Risk Oversight is unambiguous on this point: regulators cannot credit good-faith oversight if there is no documentation that it occurred.
Frequently Asked Questions
What are the three main fiduciary duties of corporate directors?
Directors owe duties of care (make informed decisions), loyalty (prioritize the corporation's interests over personal ones), and good faith (act with honest intent and don't consciously disregard known risks). All three apply at all times, regardless of business conditions or market environment.
How does the duty of oversight differ from the duty of care?
The duty of care governs the quality of any single decision. The duty of oversight — rooted in the Caremark doctrine — is an ongoing obligation to implement and monitor systems that detect risk and compliance failures across the enterprise. The question isn't whether any one vote was sound, but whether the board has built a functioning oversight structure.
What is the business judgment rule and when does it protect directors?
The business judgment rule is a legal presumption that directors acted on an informed basis, in good faith, and in the corporation's best interests. It protects directors from personal liability for decisions that turned out badly — but only when they can demonstrate a sound deliberative process, not simply a favorable outcome.
Do fiduciary duties change when a company is in financial distress?
The duties themselves don't change, but the stakeholder class with standing to assert claims expands. Once a company is actually insolvent, creditors gain standing to bring derivative claims that shareholders ordinarily hold. Directors should respond by increasing oversight cadence, engaging advisors, and documenting decisions more thoroughly.
Can directors face personal liability for cybersecurity failures?
Yes. If a board fails to implement any meaningful oversight of cybersecurity risk — particularly where it is a mission-critical operational risk — courts may find a Caremark-style breach. Marchand established the template; post-Boeing courts have applied it broadly. SEC disclosure requirements add a regulatory layer on top of the fiduciary obligation.
What steps can boards take right now to strengthen their fiduciary posture?
Four high-leverage actions:
- Establish a stable, trend-based risk dashboard that surfaces drift over time
- Define decision rights and escalation thresholds before a crisis requires them
- Seek independent expert input where the board lacks technical competency
- Document deliberations with enough specificity to reconstruct the process if challenged
