Enhancing Board Oversight of Compliance Programs: A Strategic Guide for Directors

Boards of directors matter to compliance and ethics (C&E) programs. I have seen a number of situations – usually smaller companies, but not always – where the program would have had very limited value were it not for a director stepping in to champion the effort. Even when senior leadership recognizes the importance of a strong C&E program, board support is necessary to ensure the program’s independence. Additionally, directors bring valuable objectivity and benchmarking insights. However, despite heightened awareness following the Delaware court rulings in Marchand v. Barnhill[1] and Boeing,[2] many boards remain hesitant to dig too deeply into C&E oversight. This reluctance often stems from a fear of crossing the line into management responsibilities – a fear which can create obstacles even for the best-intentioned directors.

Yet, the risks of not engaging deeply in C&E oversight are higher than ever. Regulators, investors, and other stakeholders are increasingly scrutinizing board effectiveness, and many boards struggle to grasp the complexities of C&E programs, align oversight with business strategies, and ask the right questions to ensure accountability.

In October, I had the pleasure of presenting at the National Association of Corporate Directors Summit, alongside the wonderful Steven Gyeszly, on the topic of effective strategies for board oversight of C&E programs. As we prepared for our remarks, and at Steven’s lead, we developed a Strategic Toolkit — a one-page (technically two, front and back!) guide that aims to maximize the board’s impact in this critical area.

Key Questions to Guide Effective Oversight

Directors often express uncertainty about how to engage effectively with C&E program leaders. Our toolkit includes key questions for directors to ask their CCOs, which are designed to facilitate informed discussions and probe the health and effectiveness of the C&E program. Here are a few examples:

1. What C&E issues should keep me up at night?
   This question helps identify the organization’s most pressing C&E risks. The Marchand v. Barnhill case underscored the need for board oversight of compliance systems in mission-critical risk areas. Understanding which risks are mission critical is the first step toward effective oversight in that regard.
2. How is the C&E Program aligned with the organization’s overall strategy?
   A strong C&E program should be integrated into the core business strategy, not treated as an afterthought. This question drives alignment and ensures that compliance efforts support broader corporate goals.
3. What are the strongest elements of the C&E Program? What needs improvement?
   Directors need a clear understanding of both the program’s strengths and areas needing enhancement. This transparency supports strategic decision-making and targeted resource allocation.
4. How does the organization measure the cultural impact of the C&E Program?
   Culture is a key indicator of compliance risk. Asking about metrics and KPIs used to assess cultural impact helps the board determine whether the program is fostering an environment of ethical behavior.
5. How does the organization encourage and protect those who raise good faith C&E concerns?
   Since the Caremark[3]decision nearly thirty years ago, boards have been expected to ensure effective channels for raising red flags. This question focuses on the organization’s mechanisms for protecting whistleblowers and addressing their concerns promptly and fairly.

Suggested Documentation to Support Oversight

Effective oversight requires more than just asking questions; it also involves formalizing the board’s role and documenting its involvement. (The adage that, if isn’t written down, it didn’t happen, certainly applies here.) The toolkit outlines key documents that can support and sustain board oversight, including:

• Board and C&E Program Charters: These documents clarify the scope, authority, and responsibilities of the board in overseeing the program. They also document the relationship between the CCO and the board, which protects the independence and authority of the program.
• Board Minutes Reflecting Oversight Discussions: Documenting the board’s engagement and decision-making on C&E issues is critical, especially if the company finds itself under regulatory or enforcement scrutiny.
• Escalation Protocols: Clear guidelines on when significant C&E matters should be escalated to the board ensure timely and appropriate notifications.

Trust but Verify: The Importance of Assessments

The toolkit highlights the importance of both internal and external assessments of the C&E program. Internal audits provide valuable insights, but independent, external reviews offer unbiased perspectives and help validate the program’s effectiveness. Benchmarking against industry peers and analyzing C&E culture survey results can also give the board a better understanding of employee perceptions of the program and how the program compares to best practices and evolving standards.

Access the Strategic Toolkit

Steven Gyeszly and I hope our Strategic Toolkit proves useful. You can access the toolkit here: Ideas and Answers posting of toolkit.

We look forward to hearing your feedback and continuing the conversation on enhancing board oversight of compliance.

[1]           Marchand v. Barnhill, 212 A.3d 805 (Del. 2019). 

[2]           In re The Boeing Co. Derivative Litig., C. A. 2019-0907-MTZ (Del. Ch. Sep. 7, 2021).

[3]           In Re Caremark Int’l Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996).