LEVICK | June 3rd, 2019

Your due diligence as a CEO or board member

As social media networks grow, so too does the potential for a type of hyper-democracy to spread among the world’s businesses. When a determined group of people are able to change the path of a company without being part of the board or even customers, and with the government beginning to take a much closer look at the actions of the board and C suite when analyzing business wrongdoing, what’s a board member or executive to do to protect themselves? To understand what you need to be doing if you’re a CEO or shareholder, we spoke with Shawn Wright, partner at Blank Rome; Ayman Rizkalla, partner at Akerman; and Richard Levick, founder and CEO of Levick.

ABERMAN: Let’s level set, and let’s begin. I’ve just been asked to become the CEO of a public company, or the director of a public company. Should I be doing the victory dance, or should I be considering it more carefully? Shawn, I’ll start with you.

WRIGHT: So I think you, Jonathan, you should really do a victory dance. It’s very prestigious to be asked to be on a public company board, or to be in the C suite of a public company. But along with that victory dance, you have to do your due diligence, and you have to do your homework. You have to know what that compliance structure of the company is, what your team looks like, what your obligations are, and what does this mean for you, in your individual capacity.

RIZKALLA: You know, that’s true. I mean, one of the first questions you should ask is, how much does your D&O insurance? Because the bigger the company, the bigger your exposure. And depending on the area, you may want at least 100 million, or more. So, that’s one of the first questions you should do after your victory dance.

ABERMAN: I’ll come back to the insurance matters in a moment. Richard, From your standpoint having worked with lots of CEOs and boards that suddenly find themselves in hot water, what should I be thinking about going in?

Subscribe to the What’s Working in Washington podcast on iTunes.

LEVICK: Well you know, because you’ve got me on the air, Jonathan, you know I’m gonna be the existentialist here, and the existential question that one board member from a Fortune 50 company asked me recently was: are boards still relevant? That is, not only do we have the liability, not only do we have this tsunami of laws and regulations, but we also have a speed that means that when boards are meeting quarterly, or twice a year, it’s very hard for them to be in a position where they’re going to make a substantial difference.

ABERMAN: Well, let’s talk about that, because you say, are boards still relevant? The answer, I think, from the standpoint of how this corporation is structured, is you have to have boards, because boards are supposed to represent the interests of the shareholders, or maybe broader constituencies. I often joke that corporations may be the last bastion of democracy in our society. One share, one vote, one director, one vote. So, I think they’re relevant. To my mind, the question you’ve just identified, you jokingly got to it with a D&O, but the issue to my mind is, directors are supposed to exercise oversight, which creates personal liability for them. How does that work?

RIZKALLA: You know, it’s been well settled that as a director, you have oversight obligations. You need to know what your C suite is doing, and you’re supposed to oversee it. And so, it helps to have some background in the area. For example, you may not necessarily want to take somebody that’s an athlete, and put him on the board of directors of a healthcare company. That’s fine, if you choose to do that, but you need to educate yourself about the area, because you have to have oversight. How can you have oversight of a company if you don’t know what the business is?

WRIGHT: And I think that adds to your fiduciary responsibilities, so you understand that when you join a board, it’s not just on the board. I now have a responsibility, and you have many different people that your responsible for. You have your management, you have your shareholders, you have a lot of people that you are responsible to. So, when you’re taking on that role, you’re taking on, as Ayman said, this obligation to have that oversight, and to pay attention. And I think also, sometimes, why boards are relevant, you need boards to kind of level-set your organization, and make sure your management is doing what they should be doing. Because again, when you have these stakeholders, one being your shareholders, who is going to look out for them if it’s not that board?

RIZKALLA: And as public corporations get larger and larger, and they have separate business units, the board acts as almost as an oversight to make sure that all the business units, all information from business units, are flowing into one central location, i.e. the C suite, and management, that they’re not acting in conflict with one another. I mean, you have these multinationals with hundreds of thousands of employees. The right hand may not know what the left hand is doing, but one of the roles of the board is to make sure that they’re all communicating, and that everything is being done for the interests of the shareholders.

ABERMAN: So communications, Richard, must be very important. If I don’t communicate with my people, I have no way to ever exercise oversight.

LEVICK: Well I think there are several fundamental issues here that have changed, certainly over the last couple of decades, and particularly since Al Gore invented the Internet. You know, we’ve got two things happening here. First of all, we’re in this hyper democracy. That is, we are used to, in Wall Street or K Street, but businesses and government largely controlling the narrative. Top down, if you will. Now, we’re an environment where almost everything starts from the grassroots, and moves its way up, which means, to the point about are boards still relevant, so many challenges are coming from either state regulators, or coming from grassroots.

Who would imagine, when you would become a board member, that some online activist group, to be separated from shareholder activists, would make your picture, or your home address, or your cell phone number, public, and make you a personal target for not necessarily the products of the company, but someone who was all the way down the line, one of your providers? And so, there are challenges there. The other is that, what Ayman was talking, about in terms of the silos, that’s a model that worked for 70 years. You could have all these different silos that had different masters. But when a crisis occurs, when a challenge occurs, information has to move so quickly now, that it’s very hard, that silo model doesn’t really work very well anymore. We saw that at AIG, we see that at other companies. It’s very hard to move at the speed of crisis.

ABERMAN: As I listen to this, it sounds to me like the real gating issue then, is, how to evaluate whether or not a board is properly performing its oversight duties. A moment ago, Shawn mentioned fiduciary duties. Shawn, how would you describe them? What’s really relevant? How do we keep score, and know whether or not a board, traditionally, has been doing a good job?

WRIGHT: So, it’s always difficult, Jonathan, to keep score. But starting with kind of, the duty of care, the duty of loyalty, those traditional things. When you join a board, you have to pay attention to what’s going on, and it’s your responsibility to pay attention to what’s going on in the corporation. And what’s happened is, the regulators are coming to the boards to figure out, what did you know, what didn’t you know. So, those responsibilities, one, the breach of those kind of start with the need to have your D&O coverage, but you have to just make sure that you are engaged as a board member.

ABERMAN: So that’s really interesting to me that you said that, because my understanding is that relatively recently, meaning over the last 10 or 15 years, a general model was: boards were appointed to represent the interests the shareholders. Boards just needed to make sure that they were reasonably informed, and that they made a decision, right or wrong, based on reasonable information. Hire an investment bank, do the fairness opinion, make sure accounts are preparing the financial statements. But as long as they were careful, they didn’t have to worry. And it seems to me that what you’re saying now is, that’s changed. You now no longer have to worry just about, did I satisfy my shareholder obligations? I have to worry about a broader constituency. Ayman, is that what you’re seeing?

RIZKALLA: Definitely. I think what you’re seeing is, the regulators are coming in and asking for a lot more documents. They’re asking the board of directors, what did you know, when did you know it, and what did you do to analyze it? And then it’s not just, did you follow the rules? Social justice and social responsibility is becoming an issue. You’re seeing it with Congress issuing subpoenas. I mean, Facebook is one of your prime examples, now, that’s in the press. Congress is issuing subpoenas. What are you doing to protect your users? That’s not necessarily an issue for the shareholder, in terms of dollars, but it has severe consequences on the shareholder value. And so, what you’re seeing is, all the executives and the board members are taking a broader look at what their responsibilities are. It’s no longer, was this the right business decision, from a business perspective, but, how does it impact us in a public image perspective?

ABERMAN: But it sounds to me like what you’re describing is, I’m being looked at, if I’m a CEO or director, my conduct is being looked at with 20-20 hindsight, in a lot of circumstances. How am I supposed to deal with this, as a CEO, or as a director?

LEVICK: Well I think it gets much more difficult. Let’s first start at the board level. I think some years ago, it was pretty clear, from a communications point of view, what a company had to say. We care about our customers and our shareholders. That was pretty much the mantra. It’s much more difficult now. If AIG taught us anything, or the banking crisis of a decade ago taught us anything, it’s that you don’t have to be a customer, you don’t have to be a shareholder, to get involved and have an impact on the company. And that changes everything from a company’s perspective. And then from a regulatory perspective, I think we all grew up believing that mens rea, that some sort of guilty knowledge, was required, intent.

And we’re seeing that watered down. And you know, there’s the case of WellCare, and Todd Ferrer, who was the CEO, and spent approximately a year in prison, not because he did anything wrong or had mens rea, but because the court decided to interpret that he must have known somehow, that he should have known, so he must have been, quote, deliberately indifferent. And I think when CEOs start to have to worry about serving time not because they did anything wrong, not because there was any money that was lost, or ill gotten gains, but because, as you say, in retrospect, some overly aggressive prosecutor looks at this and says, here’s an opportunity to get headlines. That’s a problem.

ABERMAN: So I want to make sure that we define something clearly here, which is that what we’re talking about is: if a board exercises its ordinary duty of care, then even if the company is liable, the board members individually don’t face liability, generally. Because it’s ordinary negligence, and D&O insurance that Ayman mentioned would apply. But what I really care about as a director, personally, from a financial standpoint is, if I’m somehow grossly negligent, or willfully negligent. Richard, you pointed out I have to be so out to lunch that the judge and the jury are so offended, they say, you should have known. Come on, be real. Is it really unfair to say, if you’re a CEO or director, you really should avoid doing something that you know is willfully wrong? Seems fair to me.

WRIGHT: You know what’s interesting about that Jonathan, it’s what Richard alluded to, is the term willful blindness. So, you have that duty of care, you have that fiduciary responsibility, and it means that you have to be more proactive and aggressive about that. You can’t just say, well, I looked at all the documents they gave me as a board member, and I didn’t see anything wrong. But nowadays, where you have conduct that the government is reaching and looking at, they’re starting at the higher levels, they’re looking at your CEO. And as they’re looking at your CEO, then they’re going to want to know, well, what did the board know? Were you exercising the care, were you doing more than just showing up at the board meetings? And to Rich’s point, how did you not know? So I think it’s, as people are looking, as the government’s looking, they’re putting more onus on the board to do more than just show up.

ABERMAN: How much of this do you think is due to, when corporations themselves are liable, like Wells Fargo, or the Libor rate cases, that the judgments, as large as they are, become a cost of business? Are people just trying to find some place in the corporation where somebody will actually say uncle? Is that why they’re going after directors more?

WRIGHT: No, I think, even going back to the Yates memo, which was not really a shift, but at least was more enhanced with the Department of Justice looking at individual liability. So when you, again, you have a corporation, and a corporation can be criminally liable with all the laws of Congress and everything, that helped us establish respondeat superior. The Justice Department’s said we want more than that, because you can’t imprison a corporation. So, let’s get to the individuals. Let’s get to the individuals whose conduct has led to this violation of criminal laws, and then for the Department of Justice, excuse me, you then go higher up. It’s not just the low level person. Is there more people higher up? And that’s part of them trying to make their name, the higher up in the entity that knew about this, that should have known about this, and that should have been proactive in trying to prevent this from occurring.

ABERMAN: Like a Volkswagen for example.

WRIGHT: Exactly like Volkswagen. And I’ll give you an example, some of the stuff that’s happening in the Me Too movement, where you’ve got your CEOs kind of enthralled in sexual harassment. What did the board know? Are your C suite people not informing your board enough, that now it’s giving your board liability, because they’re not even asking the right questions?

RIZKALLA: And if they are asking the right questions, are they asking the follow up questions? It’s not that first level questioning, the government expects the board to dig deeper. You don’t take what the CEO, or the C suite, is presenting to you at face value. Do you ask those follow up questions? That’s what they want to see, and they want to see documentation of it.. Ten years ago, 15 years ago, the government would accept much more verbal statements. But now, it’s reached a point where everything must be documented. You can say oh no, we did discuss this issue, but the prosecutor is going to turn to, show me where you discussed this, and the board is going to have to demonstrate they asked all the follow up questions.

LEVICK: You know, if you look at our lifetimes, we’ve gone from, on the spectrum, caveat emptor, buyer beware, which is what initiated the Nader movement, if you will, in the 60s and 70s, to now, guilt by association, where so many CEOs or board members are assumed to have knowledge or evil intent.

RIZKALLA: It’s reached the courts, even. I mean, there was a recent 6th Circuit opinion where a judge basically said, you know, the fact that this person was making a lot of money, and billing a lot, that raises an inference of guilt, that something was wrong. And so, you’re seeing that perception of the drive to succeed sometimes being held against the CEO, and pushing your people to hit their numbers, and so forth. It can raise an inference, as far as the government is concerned, of wrongdoing.

WRIGHT: And if I can add, that’s why you’re seeing in more corporate boards, you’re getting counsel already in place, especially to represent independent directors. And so, they need to have their own counsel to protect themselves. They’re going in already knowing that, OK, I need to have a lawyer that, if something happens, this lawyer’s not associated with management, but will help help advise me on what my duties are, so that I can then minimize or prohibit any kind of criminal risk.

LEVICK: But think about what that does to managing communications, if there is an alert of risk. We saw that with Martha Stewart. You had the board, different law firms. Martha Stewart, with four different communications firms. And then, you wonder why these things sort of spiral out of control, because there is no singular gate post for individual messages.

ABERMAN: This is really important interesting conversation. It also sounds to me like a lot of this is being driven by social policy and politics. If I’m of a certain political viewpoint listening to this conversation, I’m saying, well, good. I want CEOs and board members to be worried about broader social issues. This sounds to me like politics is finding its way into corporate governance, in a way, that whether it’s good or bad, it’s it’s here now.

LEVICK: Jonathan, I think that’s absolutely correct and in fact, what we’ve seen in traditional politics is year round politicking. We now cover the midterms about a week and a half after the presidential, and vice versa on the presidential after the midterms, because it’s become entertainment. I didn’t say it was good entertainment, and you know, I miss Ed Sullivan more now than ever before. But I think that what we’re seeing now is the same thing in the boardroom, the same thing in companies, which it’s becoming increasingly politicized, we’re seeing highly sophisticated activist investors.

Some of the things we’re seeing in Korea are going to come here. I think it’s very interesting in terms of how they’re using the Internet, how they’re cornering companies, and that’s going to become, we’re going to see more and more of a challenge. The Internet is going to bring hyper democracy to companies, which are only going to raise more and more challenges. And as you said earlier, a lot of both regulation and response is based on social policy, or what we think is social policy. And that only makes capitalism more of a challenge.

WRIGHT: And you’re also going to see, I think, your corporate directors, or people who are looking to join corporate boards really doing more due diligence. That’s what I would advise. If you’re about to join a board, let’s do some due diligence, so you have a better understanding of what the company is about, what your C suite team looks like, and how you’re going to show up in the boardroom, in order to protect yourself as a board member.

ABERMAN: I’ve often heard that described in shorthand as a culture of compliance. Is that what you’re getting at?

WRIGHT: Absolutely. And it has to be kind of going in, first and foremost. And I know you have a lot of business people who think, well, how are we going to do the business? We are in business to generate revenue, but compliance can’t be separate and apart from revenue. And historically, compliance is kind of on a shelf. We’ve got it. Here’s what it looks like. We’ve got the policies, we’ve checked the box, we’re done. And now I think what’s happening, and what we’re doing, Ayman and I are just more advising clients about how to integrate compliance in your business operations. How do you use that to generate your revenue, and stay away from the regulatory landscape in the criminalization?

ABERMAN: So what kind of things should I look for, if I’m a new CEO?

RIZKALLA: One of the things, just actually about two weeks ago, on April 29, the Department of Justice issued new guidelines for companies about what to look for in a compliance program. Because any time the government comes knocking on a company’s door, the first thing they’re going to ask is: what’s your compliance program? And they decided, because there’s been a lot of debate on what constitutes a good compliance program, they issued their guidance. It’s about 19 pages, but it includes about one hundred and fifty one questions that a company needs to be able to answer. And I think whether you’re in the C suite or on the board, one of the things that they’re going to expect you to do is take that guidance, and ask 151 questions.

Can you, as a company, answer all hundred fifty one? And they range from, did you do a risk assessment when you developed this program? How is it working in practice? Are you protecting your employees that want to blow the whistle? Because I mean, a lot of government investigations start with a whistleblower. I mean, you see them, and they’re incentivized. You see some of these awards to whistleblowers, they’re in the millions, tens of millions of dollars. And so, how are you protecting them? Because there’s sometimes, the government’s perception, and it’s not incorrect, that a lot of times there’s retaliation. I mean, there’s a real fear of retaliation. But that’s as a new board member. Ask, you know what, can you, the compliance department, answer these hundred fifty one questions? And the Department of Justice has done a nice job of laying them out in a document that was just published.

ABERMAN: Is it fair to say that, as you look at questions like this, it would put somebody on notice if they were joining a company like a Volkswagen, or maybe what we’re seeing right now with Boeing, or with Uber. Are these questions really designed to help somebody make an informed decision about whether or not this is a company worth joining?

RIZKALLA: Well I think one of the challenges you’re going to have is whether the company is going be willing to give you the answers to these questions before you join.

ABERMAN: That may be an answer in itself, though. Richard, what about you? As we think about how to advise somebody, coming in and evaluating before they join as a C suite or board member.

LEVICK: That question ultimately is for the lawyers who are here in the studio, and obviously for the company’s private lawyers. I think for what we see, there are a few challenges here. I mean, you really just touched on an issue. The incentivized whistleblower, the monetization of identifying wrongdoing. And we’re now in a gotcha society, and whether it’s H.R., whether it’s the whistleblower, whether it’s activists, it’s incredibly challenging. You know, I spent an immense amount of time in both U.S. and U.K. prisons, I used to work for the U.S. Federal Bureau. But I but I do think, that meant that I spent a lot of time looking into the eyes of criminals. And I’ll never forget listening to Andy Fastow, the former CFO of Enron. And he has a great speech, and he talks about, I’m not trying to absolve myself of any guilt, I just want to point out the fact that through the entire process, I went to the best lawyers, the best accounts, and followed their advice every single step of the way. And still look what happened to me!

ABERMAN: And with that, I’ll end this panel. I’ve really enjoyed having you here. Ayman Rizkalla, thank you very much for joining us.

RIZKALLA: My pleasure. Thank you for having me.

ABERMAN: Shawn Wright, thank you.

WRIGHT: Thank you, Jonathan.

ABERMAN: And Richard Levick, as always, it’s great to have you here. And by the way, thanks for helping to arrange another great panel here for our show.

LEVICK: Thank you so much, Jonathan.