We often hear that hardly anyone wants to sit on corporate boards anymore and that public companies struggle to attract outside directors. Their reluctance to serve has several causes, including the increased workload imposed by new corporate-governance rules and the risk of a damaged reputation if problems arise. The primary concern, however, is that a lawsuit could oblige outside directors to dig into their own wallets—even if they do their jobs well.

Nevertheless, both experience and an analysis of the relevant legal rules suggest that this concern over personal liability isn't justified. As long as outside directors of a public company refrain from enriching themselves at its expense, they face only a minute risk of having to pay damages or legal fees out of their own pockets—in the United States as well as in less lawsuit-happy countries.¹

Not that outside directors of public companies can take it easy and let executives do as they please. Even without the threat of out-of-pocket liability, directors have significant incentives—financial and otherwise—to do a good job. The incentives are imperfect, but increasing the risk of out-of-pocket liability would not necessarily do much to improve the vigor of board oversight. On the contrary, making this risk significantly more threatening would likely have adverse consequences, including the justified unwillingness of good candidates to serve.

It looks scary, but reality is less frightening

Consider the United States first. Outside directors of public companies face a daunting array of legal obligations. Under federal securities law, directors are potentially liable whenever a company makes misleading public statements. Under US corporate law, they can also be sued for a failure to oversee management adequately. Recent court decisions suggest that they can be liable under pension law as well if the company's retirement plan invests in the company's shares. To top matters off, procedural rules governing shareholder suits and the recovery of attorneys' fees make it easy for entrepreneurial lawyers to bring cases against directors.

Nonetheless, despite the litigious environment of the United States, outside directors almost never end up paying money out of their own pockets,² even in the many cases settled out of court, because the damages plaintiffs receive are almost always paid fully by the company, by a directors and officers (D&O) insurance policy, or both. Indeed, our research has uncovered only one case when outside directors made an out-of-pocket payment as part of a settlement.³ The details of settlements are sometimes confidential, but our extensive efforts—including consultations with many lawyers specializing in corporate and securities litigation—to track down instances of out-of-pocket liability suggest that they are rare indeed.

Even on the rare occasions when cases have gone to trial, the directors' pocketbooks have been spared. Under corporate law, only once since 1968 (as far back as we looked) has a US court ruled that a public company's outside directors were liable to pay damages: the famous 1985 Smith v. Van Gorkom case, in which a Delaware court found that the defendants had exercised insufficient care in approving a merger. The acquiring company still voluntarily paid the claims against the takeover target's outside directors. Under securities law, more than 3,000 suits, many naming outside directors as defendants, have been filed in US federal courts since 1990. Only three cases have gone to trial, however. Only one involved outside directors as defendants: it was unsuccessful, and the directors were protected by both indemnification and D&O insurance.

The rarity of out-of-pocket liability for outside directors is predictable. For starters, many lawsuits are screened out early in the litigation process. The corporate charters of almost all public companies eliminate director liability for breaches of the duty of care: the legal responsibility that governs a director's attentiveness and diligence (as opposed to the duty of loyalty, which governs self-interested behavior). Where this shield is absent, judges often invoke the business-judgment rule to dismiss a suit if a board has followed reasonable decision-making processes, even if they had a bad outcome. For securities suits, a judge is obliged under federal securities law to dismiss a case unless the plaintiffs—before they obtain access to company documents—present strong preliminary evidence of liability. Many fail to surmount this hurdle.

For lawsuits that make it through these initial screens, additional factors protect outside directors from out-of-pocket liability. In a securities suit, the company, if solvent, is always a more attractive defendant. Outside directors are liable only in proportion to their culpability relative to that of other defendants, including the inside managers, and their relative culpability is usually low. In contrast, the company is fully liable and has not only deeper pockets but also fewer defenses.

If outside directors do end up on the hook to pay legal expenses or damages, US public companies routinely indemnify them for legal costs and, in securities cases, for damages as well. Indemnification requires a company's directors to have acted in "good faith," in the sense of not engaging in self-dealing or exhibiting extreme inattentiveness bordering on intentional neglect. In addition to indemnifying directors, US public companies invariably purchase D&O insurance, which provides a crucial final layer of protection to outside directors as long as their actions don't exclude coverage because they made illegal profits or engaged in deliberate fraud.

As a pivotal byproduct of these protections, defendants and insurers have strong incentives to settle suits before trial, on terms that leave the outside directors' personal assets untouched. Except in rare cases, a company's assets and D&O insurance are the pots of gold targeted in lawsuits. Especially when a trial could expose directors to the risk of out-of-pocket liability, they welcome settlements funded entirely by companies and insurers. The plaintiff's lawyers will be similarly inclined, since a trial is risky and time-consuming—particularly in the event of an appeal, which is sure to be filed if outside directors face out-of-pocket payments.

If a company is insolvent and thus unable to pay damages or indemnify directors, the incentives to settle within D&O policy limits actually increase. The defendants' motive to do so is obvious: the insurer pays and they don't. For the plaintiffs, going to court is always risky because they might lose and end up with no payment at all. Moreover, if a case is litigated, the D&O policy will cover the defense costs of the directors for both the trial and, if they lose, the likely appeal. Thus, taking a case to trial can substantially diminish the principal deep pocket—the D&O policy—from which the plaintiffs hope to collect. A settlement avoids this risk.

Insurers will likely go along: for both legal and public-relations reasons, they rarely reject settlements negotiated by plaintiffs and defendant directors. Indeed, we are aware of no shareholder suits since 1990 (as far back as we looked) that insurers have forced to trial. Insurers can predict the frequency and expected amount of settlements and set premiums high enough to cover these payouts. Shareholders ultimately bear the cost of high insurance premiums but haven't objected to date.

Without a 'perfect storm,' outside directors have little reason to fear that they will have to pay personally

The bottom line is that only an unlikely convergence of conditions could make outside directors face any out-of-pocket liability: (1) significant evidence of their culpability; (2) an insolvent company with inadequate D&O insurance, either because the insurer can plausibly deny coverage or because the potential damages greatly exceed the policy limits; and (3) one or, better yet, several seriously wealthy outside directors, who thus constitute sufficiently attractive targets to offset the costs and risks of taking a case to trial. Without this sort of "perfect storm," outside directors have little reason to fear that they will have to pay personally as a result of litigation.

Are things changing?

This state of affairs isn't likely to change. The Sarbanes-Oxley Act of 2002 is a source of concern, since it imposes additional duties on outside directors, especially audit committee members. Sarbanes-Oxley may bring additional risk, but it doesn't create new ways for shareholders to sue. Moreover, a failure to fulfill the new obligations constitutes carelessness or perhaps a disclosure infraction, and indemnification and D&O insurance would still cover misconduct of this sort. Suits against directors are thus likely to be handled much as they have been so far.

Concerns about liability under corporate law have been raised by a recent ruling in an ongoing case against the Walt Disney Company's directors, who were accused of conscious inattention to the rich severance package awarded to former Disney president Michael Ovitz. But the ruling involved a preliminary motion, when the judge was required by law to assume that the plaintiffs' characterization of the facts was true. The directors' story, which is likely to create some shades of gray, has yet to be heard. Moreover, even if the case proceeds to trial and the directors lose, any damages should be covered by Disney's D&O insurance.⁴

Liability concerns have also cropped up during the past few years because some insurers, alleging that companies supplied false financial statements when purchasing insurance, have threatened to rescind D&O coverage on grounds of application fraud. By and large, however, these insurers have ultimately negotiated lower coverage limits instead of walking away entirely. What's more, insurers are now offering noncancelable policies that protect outside directors against future claims of application fraud.

Different countries, same conclusion

Outside the United States, the legal terrain differs considerably from country to country. The bottom line, however, is the same: outside directors of public companies have only a remote chance of paying anything out of pocket. Our study of three common-law countries (Australia, Canada, and the United Kingdom) and three civil-law ones (France, Germany, and Japan) found that litigation against outside directors is rare and out-of-pocket liability very rare.

A common theme in these six countries is the way procedural factors do much to insulate outside directors from lawsuits. In a breach of duty under corporate law, for instance, usually only the company itself can sue, and shareholders have a much weaker right, compared with their US counterparts, to sue on its behalf. Procedural factors also discourage securities-law claims against directors. In the United States, almost all securities suits are brought as class actions on behalf of thousands of shareholders. But a US-style class action is impractical in most civil-law countries, including France, Germany, and Japan, because the technique is virtually unknown there. In Australia, the United Kingdom, and some Canadian provinces, securities class actions are permitted. But "loser pays" rules, which require plaintiffs to reimburse the legal costs of the directors if they are found not to be liable, discourage the common US strategy of suing all plausible defendants. Even when a company is insolvent and can't pay, plaintiffs often ignore directors and sue only auditors and other professional advisers.

Although public officials in all six countries can seek sanctions against directors for breach of legislative obligations, efforts to prosecute outside directors of public companies are rare in practice. One recent exception: In 2003 German prosecutors unsuccessfully brought criminal charges against two members of the Mannesmann supervisory board, which was accused of giving executives improper bonuses after the company had agreed to be acquired by Vodafone. At press time, the prosecutors were contemplating an appeal.

In our cross-border study, we did encounter isolated instances when outside directors personally paid damages or financial penalties. Still, two trends should ensure that the risk of out-of-pocket liability remains small. One is the expanded use of D&O insurance; more and more companies are purchasing policies and negotiating higher coverage limits. The other is legislation that responds to out-of-pocket liability risk by increasing the protection of directors. Japan offers a striking example: a couple of high-profile cases against inside directors led to a 2002 reform, which lets companies limit the legal damages that can be borne by outside directors to two years' compensation—perhaps $80,000 to $100,000. This amount is low enough to ensure that even if several outside directors could be sued, hardly anyone is likely to try.

Is this good policy?

The nearly complete insulation of outside directors from personal liability for conduct that falls short of self-dealing raises an important question: is this good policy? We believe that it probably is.

To begin with, outside directors have a number of strong reasons for doing their jobs conscientiously. Many own shares or hold stock options in the companies on whose boards they sit; these holdings can sometimes be a significant fraction of their net worth. Directors are also professionals who generally respect and observe the prevailing norms of proper boardroom diligence. Moreover, most will be keen to preserve and enhance their reputation for business acumen. Mismanagement or scandals that occur on their watch can harm that reputation, even if no lawsuits follow. The potential harm to it probably rises when a lawsuit results in a sizable settlement, with or without out-of-pocket liability. The former outside directors of Enron and Tyco, for example, haven't had to pay a dime to settle lawsuits, but they have been publicly shamed nonetheless. And directors are eager to avoid the time and aggravation a lawsuit entails.

Furthermore, from a policy perspective, a significant risk of out-of-pocket liability would impose large costs. Good candidates, especially wealthy ones, would no doubt regularly—more frequently than they are reported to be doing today—decline board seats. A shift toward personal liability would also cause boardroom fees to rise as directors demanded compensation for the additional risk. This higher compensation might in turn make outside directors hesitate to rock the boat if doing so could cost them their appointments. A greater liability might also lead directors to act defensively by rejecting sensible business gambles for fear of the consequences if things were to go badly. Paradoxically, then, greater out-of-pocket liability risk could lead to less independence and worse governance.

Scandals will of course continue to highlight the failings of directors. But since most of them are already reasonably vigilant, and greater personal liability would probably have important adverse consequences, the current system might not be so far from optimal after all.