Executive Summary

Delaware's Court of Chancery has formally extended the Caremark duty of oversight to senior corporate officers—not just directors. In LACERS v. Sanford (Del. Ch. 2026), the court ruled that C-suite executives (CEO, Chief Scientific Officer, CFO, COO) owe direct fiduciary duties to establish information systems and report "red flags" within their operational domains. The decision eliminates the "blind reliance" defense and creates personal liability exposure for officers who fail to report material risks in their area of control.

The Legal Shift: Caremark Duty Now Applies to Officers

Background: Traditional Caremark Framework

Under the landmark In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), directors owed a fiduciary duty to establish and monitor information and reporting systems within the corporation. Directors could not be held personally liable for ordinary business decisions, but they could face liability for failing to implement reasonable monitoring systems to detect misconduct or material risk.

For over 25 years, the Caremark duty applied exclusively to boards of directors. Corporate officers, while subject to duties of loyalty and care, were generally insulated from direct Caremark-style oversight liability—the assumption being that the Board, not individual officers, bore the duty to monitor organizational systems.

The Sanford Decision: Officers Now Liable

In LACERS v. Sanford, the Delaware Court of Chancery rejected this distinction. The court held that:

• Officers owe a direct duty of oversight within their operational domain. The CEO cannot delegate away responsibility for knowing material risks in the organization; the same principle applies to the CSO, CFO, and other officers with domain-specific authority.
• "Blind reliance" is no longer a defense. If an officer knows (or should know) of a material risk in their area—such as regulatory "red flags," compliance failures, or operational risks—they cannot claim they relied on other executives' summaries to filter what they reported to the Board.
• Non-discretionary reporting is required. If a risk is "mission-critical," the reporting system must be formal, documented, and mandatory—not dependent on executive judgment about whether the Board "needs to know."

Application: Claims Sustained Against CEO and CSO; CFO Dismissed

In Sanford, plaintiffs alleged that the company failed to disclose known FDA regulatory violations and compliance risks to the Board. The court:

• Sustained claims against the CEO for failing to implement a formal escalation process for FDA "red flags" and relying instead on discretionary reporting through management subordinates.
• Sustained claims against the Chief Scientific Officer for knowing of FDA compliance issues within her domain (product quality, regulatory affairs) and failing to report them directly to the Board, either in person or via documented escalation protocol.
• Dismissed claims against the CFO because the regulatory and product-quality risks fell outside the CFO's core operational domain (financial reporting, capital structure, tax compliance). The court emphasized that the duty is domain-specific: an officer cannot be liable for failing to report risks outside their area of responsibility.

The court's reasoning: fiduciary duty tracks operational control. If you control a domain, you own the duty to report material risks in that domain. If you don't control a domain, you can't breach a duty you don't have.

Materiality & Liability Exposure

Personal Liability to Officers

Under Sanford, officers face direct shareholder derivative and class action exposure for:

• Failure to establish formal reporting systems for material risks in their domain
• Discretionary silence on known "red flags"
• Reliance on informal channels or executive discretion instead of documented protocols
• Absence of Board-facing escalation records (emails, meeting minutes, committee reports)

The court suggested that the absence of documented escalation is itself evidence of breach. If a risk was material and known, but no formal report to the Board exists, the officer cannot claim they "tried to report it informally" or "thought management would tell the Board."

Implications for Directors

Directors remain liable under Caremark if they fail to monitor whether officers have established these mandatory reporting systems. In other words:

• The Board now has a duty to audit whether the C-Suite has non-discretionary escalation protocols for mission-critical risks.
• Board committees (Audit, Risk, Compensation) must verify that officers are following these protocols.
• If the Board discovers that an officer is filtering or discretionarily withholding material risk reports, the Board has a duty to act (retraining, accountability, or removal).

Immediate Board Action (90-Day Window)

Week 1–2: Map Officer Risk Domains

Define which officer owns escalation responsibility for each material risk category:

Risk Category	Primary Officer	Escalation Trigger	Reporting Cadence
Regulatory/Compliance	General Counsel, CSO, Chief Compliance Officer	Known violation, enforcement action, imminent penalty	Monthly to Audit Committee
Cybersecurity/Data	Chief Information Officer, Chief Risk Officer	Breach attempt, system vulnerability, data loss	Monthly to Risk Committee
Product Quality/Safety	Chief Operating Officer, Chief Scientific Officer	Customer injury claim, regulatory warning, recall consideration	Monthly to Risk Committee
Financial/Tax	Chief Financial Officer	Audit findings, tax exposure, accounting restatement trigger	Monthly to Audit Committee
Market/Competition	CEO, Chief Strategy Officer	Major deal failure, customer loss, competitive threat	Quarterly to Board

Key requirement: Each officer signs off on their domain escalation protocol and confirms understanding of non-discretionary reporting obligations.

Week 3–4: Formalize Escalation Protocols

Draft written escalation procedures for each domain that specify:

• What triggers escalation? Define "material" and "red flag" for each risk category (e.g., FDA warning letter, data breach affecting >1,000 customers, loss of top 5 customer).
• Who escalates? The primary domain officer must submit the report, or sign off on a subordinate's report, ensuring direct accountability.
• How? Formal memo, email with Board cc, or in-person brief at committee meeting. Informal chat is insufficient.
• When? Timeline (within 5 business days of discovery, or at next scheduled committee meeting).
• Documentation? Every escalation must be logged (timestamp, subject, recipient, officer signature).

Week 5–6: Board Audit & Approval

• Audit Committee reviews proposed protocols and interviews each officer on their understanding.
• Board approves the formal escalation framework and documents approval in Board minutes.
• Distribute to C-Suite; each officer signs acknowledgment of duty and protocol compliance.

Week 7–8: Quarterly Audit of Escalation Adherence

• Audit Committee requests a quarterly log of all escalations filed by each officer.
• If any material risk was discovered but not escalated, investigate why and document the Board's assessment of materiality.
• Board minutes should reflect: "Management reported X risk in domain Y and escalated in accordance with protocol on [date]."

Risk If No Action Taken

Implementation Checklist (Next 90 Days)

Legal Sources & Citations

• LACERS v. Sanford, Del. Ch. 2026 [Delaware Court of Chancery decision extending Caremark duty to officers]
• In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996) [foundational duty of oversight for directors]
• Delaware General Corporation Law § 102 (officer duties of care and loyalty)
• Akin Gump Strauss Hauer & Feld LLP, "Algorithmic Oversight & Caremark Analysis" (2026)

Next Steps

Board Governance Committee

Should schedule a 60-minute session with General Counsel to:

• Review Sanford decision in detail
• Audit current escalation protocols (if any) against the new standard
• Approve revised protocols by month-end
• Brief the C-Suite on new fiduciary obligations

General Counsel

Should:

• Prepare a memo to each officer explaining the Sanford ruling and their domain-specific obligations
• Draft model escalation protocols for Board review
• Establish a log/tracking system for all escalations filed

Audit Committee

Should:

• Add "Officer Escalation Protocol Compliance Review" to quarterly agenda
• Request monthly escalation logs from each officer starting Q3 2026
• Report to full Board on adherence and any gaps