From Stepping-Stones to Throwing Stones: Officers’ Liability for Corporate Compliance Failures after Cassimatis

A The Current Enforcement Environment

Regulatory policy, including enforcement policy, is never formed in a vacuum. It cannot be understood separate from its broader economic, political and societal context. That context informs the current debate over officers’ liability generally. Arguably, media and political pressure on regulators to hold individual officers publicly to account in connection with corporate compliance failures increased after the GFC. ²³ Justifiably or otherwise, there was a perception that wealthy and powerful individuals enjoyed the upside of corporate risk-taking but failed to take appropriate responsibility when it resulted in significant negative externalities. ²⁴ A decade later in Australia, the widely televised proceedings of the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (‘BFRC’) ²⁵ in 2018 brought the failure of prominent financial institutions to obey the law, and the failure of regulators to respond effectively, to public prominence and put faces to those failures. In response, ASIC announced a ‘renewed and re-invigorated’ enforcement approach that included ‘[w]hen appropriate, proceeding against both the corporation and the individual corporate officers responsible for the contravening actions of the company’ as its ‘primary objective’. ²⁶

Also following the BFRC, two law reform measures were floated to increase individual officers’ legal liability in connection with corporate compliance failures. The terms of reference for the Australian Law Reform Commission (‘ALRC’) inquiry into corporate criminal responsibility, issued in April 2019, included an examination of ‘mechanisms which could be used to hold individuals (eg senior corporate office holders) liable for corporate misconduct’. ²⁷ Proposal 9 in the ALRC discussion paper, released in November 2019, was to amend the Corporations Act so that, when a body corporate commits a relevant criminal offence or engages in conduct covered by a relevant offence provision, ‘any officer who was in a position to influence the conduct of the body corporate in relation to the contravention is subject to a civil penalty, unless the officer proves that the officer took reasonable measures to prevent the contravention’. ²⁸ This proposal, which included reversing the burden of proof in favour of the state, was subsequently abandoned by the ALRC following sharp criticism in submissions. ²⁹

The second law reform measure was the proposed expansion of individual liability for finance industry officers and executives beyond the existing BEAR, ³⁰ to cover all financial sector entities regulated by ASIC or the Australian Prudential Regulation Authority (‘APRA’) (not just banks) and to create civil penalty liability for individuals who breach their ‘accountability obligations’. ³¹ Neither of these changes was among the BFRC recommendations. ³² Work on this proposed reform was suspended as part of the Treasury response to the COVID-19 pandemic. ³³

Professor Baxt asked in the late 1990s whether the directors’ duty of care depends on ‘the swing of the pendulum’. ³⁴ In the initial phase of the pandemic, there were signs that the pendulum may swing away from greater legal liability for individual corporate officers, as part of a broader deregulatory agenda. ³⁵

Of course, legal liability is not the only way to make individuals accountable. Institutional and other investors may expect senior corporate officers to accept something akin to old-style ministerial responsibility, ³⁶ falling on their swords when problems emerge in the part of the business over which they have managerial responsibility. ³⁷ Subject to normal employment and other contractual considerations, this can be a form of ‘soft’ accountability imposed by social or market forces, rather than legal tools. This swing of the pendulum may see the government postponing or jettisoning measures to expand legal liability, but it remains to be seen whether it will be persuaded to wind back existing settings, for example, through amendments to s 180 or the creation of new defences to liability. ³⁸

B Scope

The statutory duty of care is imposed on any person who is an ‘officer’ of a corporation. The definition in s 9 of the Corporations Act relevantly includes a director or secretary of the corporation and any person ‘(i) who makes, or participates in making, decisions that affect the whole, or a substantial part, of the business of the corporation; or (ii) who has the capacity to affect significantly the corporation’s financial standing; or (iii) in accordance with whose instructions or wishes the directors of the corporation are accustomed to act’. ³⁹ The High Court’s 2020 decision in Australian Securities and Investments Commission v King makes it clear that, in order to come within the definition, it is not necessary that the person holds or occupies a named office or a recognised position with rights and duties attached to it. ⁴⁰ What matters is the actual influence or control the person has; in corporate groups, a senior executive of the parent company may have significant capacity to influence the conduct of the affairs of the entire group, including a particular subsidiary. ⁴¹ However, a single (non-executive) director on the board of the parent but not the subsidiary is unlikely in the ordinary course to exert the kind of individual influence over other group entities to bring that person within the definition.

An important policy question, to which we return briefly in Part IV, is whether senior managers who are responsible for significant business functions—but whose involvement in broader corporate management falls short of that required to bring them within the statutory definition of an officer—should be within the regulatory net. The ALRC’s revised position on individual accountability ‘confirm[ed] its view that there is an “accountability gap” in relation to holding senior managers of the largest corporations liable for corporate misconduct’. ⁴² The existing BEAR, and the Financial Accountability Regime proposal, both extend accountability obligations to senior managers who are not officers of the corporation in the relevant sense. ⁴³ A related question is whether the legal responsibilities of non-executive directors should be framed differently from those of executive officers.

C Individual Liability Otherwise than For Negligence

Of course, officers implicated by act or omission in a corporate compliance failure can be personally liable through direct and indirect legal mechanisms or pathways other than for breach of s 180(1) of the Corporations Act. ⁴⁴ These are direct (including concurrent) liability, what the ALRC describes as ‘extended management’ liability (including deemed liability), and accessorial liability. Concurrent liability arises where, on the facts, the officer has contravened the law alongside their corporation. ⁴⁵ Deemed liability arises (in limited circumstances) where a person who is a director of a corporation that contravenes a Commonwealth law is deemed to have contravened the same law simply because of the office they hold. ⁴⁶

Accessorial liability ⁴⁷ for corporate contraventions of Commonwealth law typically arises under s 79 of the Corporations Act and its statutory analogues. ⁴⁸ Any person, not just an officer, can potentially be an accessory to a corporation’s contravention. But following Yorke v Lucas, ⁴⁹ accessorial liability (criminal and civil) generally requires both knowledge or awareness of the corporation’s contravening conduct and some active contribution to its furtherance. ⁵⁰ Something more than negligence is required on the part of an officer to make him or her an accessory to the corporation’s contravention. ⁵¹

A Application of the Business Judgment Rule

The statutory business judgment rule provides that, if certain elements are made out, an officer is taken to have met the duty of care under s 180(1) of the Corporations Act and their equivalent duties in law and equity. ⁷⁰ It only applies in situations where the officer ‘makes a business judgment’. ⁷¹ The failures that result in compliance breaches are generally considered not to involve business judgments in the relevant sense. ⁷² The conduct protected by the business judgment rule must involve a judgment and cannot be, for example, non-feasance; therefore, conduct that is an unconsidered failure to act on the part of directors is not covered by the business judgment rule. In Australian Securities and Investments Commission v Rich, Austin J said:

[T]he discharge by directors of their ‘oversight’ duties, including their duties to monitor the company’s affairs and policies and to maintain familiarity of the company’s financial position, is not protected by the business judgment rule, because the discharge or failure to discharge those duties does not involve any business judgment as defined. ⁷³

Unlike Delaware courts, ⁷⁴ Australian courts do not appear to defer to the commercial judgment of officers in relation to compliance risk management. This means that decisions about investment in compliance systems and controls—bluntly, whether to spend $100 or $1000 on non-financial risk management—may be treated as business judgments in Delaware but are not in Australia. ⁷⁵ This is relevant for compliance failures that fall into the second category—where compliance systems were present but failed. Similarly, commercial judgments about whether particular information about an entity ‘is information that a reasonable person would expect, if it were generally available, to have a material effect on the price or value of ED securities of the entity’ ⁷⁶ for the purposes of the Australian continuous disclosure laws are not treated as business judgments. ⁷⁷

This greatly limits the scope of s 180(2) of the Corporations Act in the stepping-stones context—a point to which we return in Part IV. In the Cassimatis Appeal, Greenwood J endorses the extra-curial view of Justice Geoffrey Nettle that ss 180(2) and 180(3) seem to be ‘of little, if any, practical utility’. ⁷⁸ This may be true in cases, like Cassimatis, where the corporate compliance failure was due to poor regard for compliance risk or failed compliance controls. ⁷⁹ But as Beach J indicates (in obiter) in Australian Securities and Investments Commission v Mariner Corporation Ltd (‘Mariner’), ⁸⁰ the position is different where the compliance failure results from a transaction unfolding otherwise than as intended. Because the risk of contravention in Mariner arose from a ‘business judgment’ made by the relevant officers, the safe harbour was potentially triggered. ⁸¹

E Balancing Risk and Benefits

The second reason for distinguishing between contraventions that might flow from a business failure, and those that flow from either a failure of the corporation’s compliance systems or a disregard for the potential legal and regulatory consequences of a business decision, concerns the way risks and benefits are balanced.

It is never open to a corporate officer to deliberately or recklessly cause or allow the corporation to contravene the law; to do so would be a breach of their duty under s 181(1)(a) of the Corporations Act to ‘exercise their powers and discharge their duties…in good faith in the best interests of the corporation’. ⁸² Compliance failures in the third group—where the officer has ignored or disregarded the legal and regulatory implications of a decision or action—may breach this duty. Knowingly causing the corporation to contravene the law would make the officer an accessory to the corporation’s contravention. ⁸³ Judicial statements about ‘balancing’ the matters and considerations that influence how an officer responds to a foreseeable risk of harm to the corporation flowing from a compliance failure must be understood in this light.

The Shirt calculus in the law of negligence involves a pragmatic recognition by courts that, in managing foreseeable risk, decision-makers must make resource allocation decisions in conditions of uncertainty. But risk and benefit can rarely be reduced to numbers in a ledger. A local council could manage a foreseeable risk that people might fall from a cliff by fencing off all cliffs, but the cost would be prohibitive, and it would adversely impact on community amenity. Against that, a local council must care about, and guard against, the risk of catastrophic injury to people who come onto its land because those people matter—not just because it wants to avoid damages claims. Similarly, corporate boards and senior executives must care about, and guard against, the risk of regulatory contraventions because contravening the law is wrong and is inherently corrosive to the purpose of a corporation which, as Edelman J points out, is to be used as a ‘vehicle for lawful activity’. ⁸⁴

In Vrisakis v Australian Securities Commission, Ipp J spoke of the need for corporate officers to balance risk and benefit in conducting legitimate entrepreneurial activity, noting that ‘the question whether a director has exercised a reasonable degree of care and diligence can only be answered by balancing the foreseeable risk of harm against the potential benefits that could reasonably have been expected to accrue to the company from the conduct in question’. ⁸⁵ In Australian Securities and Investments Commission v Maxwell (‘Maxwell’), Brereton J said that where there is jeopardy to the interests of the corporation because of ‘actual or potential exposure of the company to civil penalties or other liability’ under the Corporations Act, ‘it may no doubt be a breach of a relevant duty for a director to embark on or authorise a course which attracts the risk of that exposure, at least if the risk is clear and the countervailing potential benefits insignificant’. ⁸⁶

These passages should not be read as contemplating or condoning a deliberate trade-off of a small (but highly likely) compliance consequence and a large commercial benefit. ⁸⁷ In Cassimatis [No 8], Edelman J said of the passage from Maxwell that ‘[t]he qualification at the end of the paragraph is important’: ⁸⁸

The reference to ‘at least’ includes the obvious cases of contravention. At the other extreme, there are cases which can be easily excluded. For example, conduct by a director which subsequently causes a corporation to breach the law will not be a breach of a duty of care and diligence merely because it causes the corporation to breach the law if, at the time, no reasonable person holding the director’s office with the director’s responsibilities, acting reasonably, could ever have foreseen that the conduct would cause the corporation to breach the law. ⁸⁹

There is a commercial ocean between corporate conduct that will obviously contravene the law and individual conduct that no reasonable person in the defendant’s position could have foreseen would cause the corporation to contravene the law. Most stepping-stones cases lie somewhere in between. As Edelman J said, ‘the reference to “balancing” in the assessment of due care and skill in Vrisakis should not be taken literally. The factors to be considered are not to be balanced or weighed as though by a common metric’. ⁹⁰

The balancing required by the Shirt calculus is undertaken by the court, as the tribunal of fact, to determine what a reasonable person in the position of the officer at the relevant time would have done to manage the foreseeable risk to the corporation of adverse consequences flowing from a corporate compliance failure. It is not a cost/benefit analysis undertaken by the officer, where the ‘cost’ of noncompliance ignores the externalities or the public interest in corporations obeying the law even where it is inconvenient to do so. ⁹¹ In the Cassimatis Appeal, Thawley J said:

The balancing exercise is not necessarily confined to commercial considerations or to a comparison of monetary consequences, but extends to considering all of the interests of the corporation, including its continued existence and its interest in pursuing lawful activity. It is to be accepted that companies are often formed and operated to permit the taking of risks that individuals may not be willing to assume themselves and that it is of the essence of commercial activity to take risks. However, it must also be recognised that the company fiction did not evolve to facilitate unlawful risky activity without personal responsibility. ⁹²

As with all cases founded on principles of negligence, the focus must be on evaluating the reasonableness of the officer’s response to the foreseeable risk before the harm materialised. The fact that, in a particular situation, adverse consequences for the corporation from a compliance breach were foreseeable, and that measures were available to avert or avoid them, does not mean the officer was negligent in not implementing those measures. ⁹³ The only question to be answered is whether a reasonable person, in the position of the officer and knowing what they knew or ought to have known at the relevant time, would have implemented those preventative measures in the context of their role, the resources available to them and all the competing calls on those resources.

In the stepping-stones cases, the distinction we drew above—between corporate compliance failures that arise from business plans not coming to fruition and those that arise from disregard of law or failure of a compliance system or control—may be relevant. In Mariner, where the corporation’s breach occurred because of the failure of the planned takeover, Beach J said:

The countervailing benefits to Mariner well exceeded the theoretical risks. The modest financial consequences of these theoretical risks were well outweighed by the benefits that could be achieved by Mariner. The present case is not of a type discussed in Australian Securities and Investments Commission v Cassimatis (2013) 220 FCR 256 at [172] where it was said that to argue that financial benefits could be offset against a possible breach of the law offended public policy. In the present case, the upside benefit was not of a kind where one was profiting from one’s wrongdoing. ⁹⁴

In the Cassimatis actions, the corporation’s breach was the result of failure to ensure that the service it provided was legally compliant. Storm was a financial advice firm based in Townsville that held an Australian Financial Services Licence (‘AFSL’) issued by ASIC under pt 7.6 of the Corporations Act. Storm recommended a highly-leveraged investment approach to its clients in the years before the GFC; it was accepted by the court that it contravened the financial services laws by recommending this approach to a group of clients for whom it was unsuitable, although Storm itself was never prosecuted. ⁹⁵ The commercial effect was that Storm profited from selling the Storm model to a wider class of customers than it should have. Greenwood and Thawley JJ in separate judgments upheld the first instance decision of Edelman J that Mr and Mrs Cassimatis, owners and executive directors of Storm, ⁹⁶ had contravened s 180(1) of the Corporations Act because, through their negligence, they exposed Storm to a foreseeable risk that it would be harmed by regulatory or legal action arising from such a failure. ⁹⁷

At first instance, Edelman J had concluded that the defendants fell short of the required standard of care ‘by exercising their powers in a way which caused or “permitted” (by omission to prevent) inappropriate advice to be given’, when ‘[t]he consequences of that inappropriate advice would be catastrophic for Storm (the entity to whom the directors owed their duties). It would have been simple to take precautionary measures to attempt to avoid the application of the Storm model to this class of persons’. ⁹⁸ The defendants’ negligence lay in their failure to take ‘some alleviating precautions to prevent the giving of that advice’. ⁹⁹

On appeal, Greenwood J held that ‘reasonable directors, with the responsibilities of Mr and Mrs Cassimatis, standing in Storm’s circumstances, ought to have guarded against’ the foreseeable risk of harm to Storm’s interests; ¹⁰⁰ his Honour considered that ‘plainly enough the directors could have taken steps to ensure that the subject matter of the advice was properly considered and investigated, reasonable in all the circumstances relevant to each of the individual 11 vulnerable investors, and appropriate to each of them having regard to the consideration and investigation which ought to have occurred but did not’. ¹⁰¹

The balancing exercise undertaken by Edelman J at first instance was between the commercial benefit Storm would derive from selling the Storm model to a wider group of potential clients, and the foreseeable risk of adverse consequences for Storm of being found to have sold to clients for whom the model was unsuitable. ¹⁰²

In cases where the corporate compliance failure is the result of a business judgment that turned out otherwise than as planned, such as Mariner, the balancing exercise is easier. But in cases where the failure is due to a misunderstanding or disregard by the corporation of the legal consequences of its action, ¹⁰³ or the failure of a compliance system or control, the balancing may be more nuanced.

A An Arcane Theory of Liability

In dissent in the Cassimatis Appeal, Rares J concluded that ASIC’s case employed s 180(1) of the Corporations Act ‘in an arcane and backdoor fashion’, ¹⁰⁴ a conclusion with which the other members of the Court disagreed. ¹⁰⁵ The strategy is ‘arcane’ in that it requires ASIC to establish a duty ‘not merely to prevent the contraventions of [the relevant law] at all, but to guard Storm against the likely or possible regulatory consequences of the discovery of those contraventions’. ¹⁰⁶ For Rares J, the problem for ASIC’s case was that ‘it was unwilling to prove that it would have so acted’. ¹⁰⁷ Because the strategy requires ASIC to frame its case in this way, a court must balance the cost and practicality of taking preventative measures against the (secondary) consequences of a corporate compliance breach, rather than the (primary) fact of a breach.

The circularity of the case theory is evident when ASIC has not prosecuted the corporation for the breach. It relies on ASIC alleging that the director failed to act to prevent the breach in the face of a foreseeable risk of material harm, being ASIC’s own assertion that it would have taken enforcement action with serious consequences. The fact that ASIC could have taken such action should not be sufficient to establish a contravention of s 180(1) of the Corporations Act by the director; instead, the theory should require ASIC to prove that it was likely to do so at the relevant time. That ‘proof’ is likely to lack force when ASIC did not in fact take action. Under this theory, the risk the officer must guard against is the risk of detection and enforcement. Taken to its extreme, this would suggest that officers are not negligent in permitting the corporation to contravene the law if they are confident that the corporation’s internal systems make the breach undetectable, or that the regulators are asleep at the wheel, or that any regulatory action is unlikely to harm the corporation.

This is where Rares J took issue with the plurality. His Honour was not satisfied that ASIC had established that it was reasonably foreseeable that the provision of inappropriate advice, where ASIC’s case relied on demonstrating Storm’s contravention in relation to only 11 of its thousands of clients, would have harmful consequences for Storm, and certainly not of the type that would have been ‘catastrophic’. ¹⁰⁸

B A Backdoor Method of Imposing Liability

Rares J also concluded that the strategy was ‘a backdoor way of creating liability on Mr and Mrs Cassimatis as accessories to Storm’s substantive contraventions’. ¹⁰⁹ Greenwood J and Thawley J disagreed, ¹¹⁰ relying on the frequently cited comment of Brereton J in Maxwell that the directors’ duties provisions ‘do not provide a backdoor method for visiting, on company directors, accessorial civil liability for contraventions of the Corporations Act in respect of which provision is not otherwise made. This is all the more so since the Corporations Act makes provision for the circumstances in which there is to be accessorial civil liability’. ¹¹¹

The position adopted by the plurality is clearly correct at law—s 180(1) of the Corporations Act does provide a separate and freestanding basis for the state to impose penalties, over and above any private law right of recovery available to the corporation, on officers whose negligent acts or omissions implicate them in corporate compliance failures. But this disregards the broader question of whether the practical effect is to impose accessorial-type liability on those caught up in corporate compliance breaches, including where:

the corporation has contravened a statutory provision that, on its terms, creates accessorial liability but:

In the Cassimatis Appeal, Rares J considered it ‘unlikely that the Parliament intended that s 180(1) [of the Corporations Act], as a general provision, would displace, modify or affect a specific statutory duty or power conferred on a director or officer, including a duty to obey, or not to contravene or be involved (within the meaning of s 79) in a contravention of, a specific provision of the Act’. ¹¹⁴ His Honour concluded:

It is important to appreciate that the result at which I have arrived is the consequence of the artificial way in which ASIC sought to establish its case, by inference and not direct evidence, as to what it would have done. That case employed s 180(1) in an arcane and backdoor fashion. ASIC did not seek to prove directly that merely because of Mr and Mrs Cassimatis’ roles, as principals or accessories, in Storm’s actual contraventions of s 945A(1)(b) and (c), they had breached a duty under s 180(1). Instead, ASIC deliberately eschewed such a case and relied on the arcane argument that an indirect consequence of the contraventions was that it was likely that ASIC would have pursued a severe regulatory outcome, when it was unwilling to prove that it would have so acted. ¹¹⁵

Nevertheless, Greenwood J dismissed as misconceived criticisms that stepping-stones gives rise to ‘some sort of dystopian accessorial liability’. ¹¹⁶ This rhetorical flourish, while running a close second to ‘wagyu and shiraz’ as the judicial phrase of the year, disregards the following concerns.

First, it is only because s 180 of the Corporations Act carries a civil penalty for negligence that these cases are run at all. They would not be run if the objective were merely to seek compensation for the company, demonstrated by the fact that ASIC rarely seeks compensation orders in these cases. Instead, s 180 of the Corporations Act gives ASIC an ability to secure penalties in relation to corporate contraventions where the directors have not been knowingly involved in the contravention.

Second, it is only because of the company’s contravention or alleged contravention that the behaviour of the directors is impugned. The stepping-stones cases look to attribute fault to directors with double hindsight bias: first, it is established that the company breached the law or was likely to do so (whether or not the company has been found by a court to have done so) and then, but only then, does the regulator ask the court to consider whether the breach can be attributed to a negligent act or failure by the board. These cases have all the hallmarks of accessorial liability, and the decided cases demonstrate that it is rare for directors to escape stepping-stones liability where they were merely aware or should have been aware of the circumstances in which it was reasonably foreseeable that the contravention would or would be likely to occur, and would cause harm to the company. No actual involvement is necessary: the critical elements of accessorial liability are irrelevant.

Third, these cases create an increased exposure to penalties only for a particular class of individuals. This unique feature of stepping-stones cases cannot be ignored. The law has long-established principles by which individuals can be found directly liable for their involvement in a contravention, either based on fiduciary obligation or under rules applicable to accessorial liability. As a consequence of the stepping-stones cases, the test for individual liability in connection with a breach of the law by a corporation differs depending on the office held. A person who merely breaches a duty of care to the company, thereby causing the company to breach the law and suffer harm, but who is not subject to s 180(1) of the Corporations Act, cannot be penalised by the state. However, if the person is an officer, the lower test of negligence applies with not dissimilar consequences.

Fourth, it is disingenuous to proceed to decide these cases on the basis that responsibility for harm suffered by a corporation as a consequence of a breach of the law is no different from harm suffered by a company as a result of other causes which may be attributed to a breach of the duty of care and diligence by the directors, and therefore that the stepping-stones cases are not actually a form of accessorial liability. The state has determined that it is in the public interest to impose and enforce the law breached by the corporation. It has also determined that it is in the public interest for accessories and defaulting fiduciaries to be accountable for that breach. There is no basis to assert that, with respect to a particular law applicable to the company, the state has determined as a matter of public policy that officers should also be accountable to the state for that breach if caused by negligence short of the requirements of accessorial or fiduciary liability. As noted above, Rares J observed that ‘[i]t is unlikely that the Parliament intended that s 180(1)…would displace…a specific statutory duty…not to contravene or be involved…in a contravention of, a specific provision of the Act’. ¹¹⁷

Fifth, stepping-stones involves ASIC making an ‘end run’ around s 79 of the Corporations Act, and those provisions of the Corporations Act that provide defences to directors who may otherwise have been found to be involved in a company’s contravention, such as s 674(2B). ¹¹⁸

For these reasons, the public interest objectives concerning s 180 of the Corporations Act as a civil penalty provision need to be reconsidered, especially when used to lower the bar for accessorial-type liability of directors and officers for corporate contraventions. Consideration of the public interest, the need for certainty when imposing a statutory norm, and suggestions for law reform, are considered below.

C A Widening Expectation Gap

A separate criticism is levelled at stepping-stones by the business community. It is that the selection of cases by ASIC and the disposition of those cases—particularly in the Federal Court—is contributing to a widening expectation gap over what individual officers can and should do to ‘ensure’ corporate compliance. ¹¹⁹ The gap is between what the community sees as a responsibility of corporate directors and other officers and what an individual officer can practically achieve in relation to compliance. It is acknowledged that boards and senior management are expected to manage non-financial as well as financial risk in corporations; the question is about the actual nature of their respective roles. ¹²⁰

For example, in a review of board governance commissioned by a major bank in relation to significant breaches of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), released in June 2020, ¹²¹ the experienced reviewers ¹²² said:

Assessing whether a board has done well or poorly is substantially determined by views about what boards can and cannot be expected to do. This is a something of an ‘elephant in the room’ issue. It is rarely discussed but is central to our considerations. And here we see society’s steadily increasing expectations, which are not necessarily well founded, on what boards are set up to achieve…

Discussions about the responsibilities of board members rarely touch on what is realistically feasible for them to achieve. In risk management, are they an additional line of defence conducting detailed diligence; or rather a high level overseer of risk management strategy and policy and a high level monitor of risk management competence and effectiveness? To what extent can boards be expected to pick up major mistakes deep inside their company? ¹²³

The question raised by the Board Governance of AML/CTF Obligations at Westpac: The Advisory Panel Review (‘Westpac Review’) panel about the proper role of the board may be intended as rhetorical, but it does point to ongoing confusion in the business community about what the law requires of it. In advising boards, corporate lawyers typically take the view that the board has an active and collective duty of oversight over management’s risk and compliance practices and accountabilities. This is consistent with orthodox guidance for compliance and risk management frameworks, including the ‘three-lines-of-defence’ model. ¹²⁴ The presence of red or amber flags, indicating for example that a known compliance problem is persisting or that regulators or others have compliance concerns, will trigger the need for more active inquiry and if necessary intervention, including by individual officers. ¹²⁵

The vulnerability of the oversight governance model is, of course, in the quality of the information flowing to the board. This was identified by the Westpac Review panel ¹²⁶ and has been a factor in both compliance-related and disclosure-related stepping-stones cases. The extent to which individual officers (particularly non-executive directors) are required to look beyond assurances from management was at issue, for example, in Australian Securities and Investments Commission v Vocation Ltd (in liq) and in Australian Securities and Investments Commission v Flugge & Geary, ¹²⁷ and is not easily resolved by reference to ss 189 and 190 of the Corporations Act.

For boards and their advisers, part of the problem with stepping-stones as an enforcement strategy is that the decided cases provide little by way of guidance on how directors and officers in general should behave in future. Each decision is highly fact-dependant and idiosyncratic. For example, the degree of control that Mr and Mrs Cassimatis had over the Storm business—which was central to the liability finding—would never be present outside a founder-controlled business. ¹²⁸ The decision provides no meaningful lessons for the wider director community on what their responsibilities are.

In other words, the stepping-stones cases are often of little precedent value. This leaves the statutory norm inchoate. The duties contained in pt 2D.1 of the Corporations Act, including s 180, derive their content from their general law analogues but have a fundamentally different character. On one view, the ‘duty’ of care in the law of negligence is a principle for the just allocation of loss or damage ex post that incentivises optimal precautions to prevent that loss or damage, not an instruction to a defendant about how to behave in a particular situation ex ante. The transposition of a private law liability principle into a statutory norm is only effective and consistent with the rule of law if the obligation it creates is sufficiently certain that a regulated person can adjust their behaviour ex ante to comply with it. As Lee J recently observed in another context:

Civil penalty provisions are justified on the basis that they prevent or punish public harm. Given that a punitive sanction can flow from a breach of such provisions, one would expect that any norm which, upon contravention, attracts a civil penalty, should be expressed with clarity to ensure that those regulated are left in no doubt as to what they are required to do (or not do). ¹²⁹

Added to this is a perception that ASIC selects stepping-stones cases based on the notoriety of the corporation’s conduct, rather than the blameworthiness of the individual defendant’s conduct. When, as in the stepping-stones cases arising out of compliance failures at AWB and Storm, the corporation has behaved in a way that attracts significant public opprobrium, ASIC reaches for an action against one or more corporate officers under s 180(1) of the Corporations Act as a basis for satisfying public demands for someone to be accountable, particularly where enforcement action against the corporation itself is not possible. Because a ‘bad’ outcome occurred, the temptation is to formulate the duty of care ‘retrospectively as an obligation purely to avoid the particular act or omission said to have caused loss, or to avert the particular harm that in fact eventuated’. ¹³⁰ But as Gummow and Hayne JJ point out in a different context in Graham Barclay Oysters Pty Ltd v Ryan, this is ‘of its nature likely to obscure the proper inquiry as to breach’. ¹³¹

D A Problematic Application of the Principles of Negligence

A related concern, to which Rares J’s dissenting judgment in the Cassimatis Appeal draws attention, is with the way in which the two constituent parts of negligence—reasonable foreseeability and the Shirt calculus—are addressed by ASIC in their case selection and applied by the Federal Court in its disposition of these cases.

The question of whether the risk was reasonably foreseeable is answered having regard to what the person knew or ought to have known at the time, without the benefit of hindsight. And the risk must be reasonably foreseeable to the defendant. As the Review of the Law of Negligence (‘Ipp Review’) pointed out (in the personal injury context) in 2002, in negligence the concept of reasonableness ‘is concerned with how much knowledge about risks it is reasonable to attribute to people. It does not follow from the fact that someone knows about a risk that it would be reasonable to expect everyone to know about the risk and be able to foresee it.’ ¹³²

Risk management—including compliance risk management—in any corporation requires its officers to make judgments about future matters. Most business transactions and processes carry with them a level of compliance risk, and inherent in that risk is a prospect that the financial or other interests of the corporation would be damaged by a compliance failure. So, the first question—whether a risk of harm to the corporation was foreseeable—is often quite a low bar. ¹³³ But it is a bar nonetheless.

As Rares J points out in the Cassimatis Appeal, the question is whether it was reasonably foreseeable in 2007 that a failure to comply with s 945A of the Corporations Act in respect of a small number of Storm clients would derail the entire business (with or without the GFC). His Honour points to reasons why no reasonable person in the position of the defendants before December 2008 would have foreseen the possibility of ‘catastrophic’ consequences being visited on Storm by ASIC because of the advice failures. ¹³⁴ And it must be established that a reasonable person in the position of the individual defendant would have known of the facts pointing to this as a risk. His Honour said that:

while Mr and Mrs Cassimatis were responsible by their (unintended) negligence for Storm’s contraventions of [the financial services law], I am not satisfied that a reasonable director in their position in all of the circumstances came under a duty under s 180(1) to prevent the contraventions for the reason that the primary judge found: namely, that ‘the consequences of that inappropriate advice would be catastrophic for Storm’. I am not satisfied that he or she should have perceived a risk, or likelihood, of ASIC taking action to suspend or cancel Storm’s AFSL or the imposition of a banning order and then that he or she should have acted, for that reason, to prevent that action occurring. ¹³⁵

Crucially, establishing that a risk was reasonably foreseeable is only the first stage of the inquiry. The second part of the inquiry—applying the Shirt calculus—is undertaken once it has been determined that the risk in question was foreseeable. The calculus ‘provides a framework for deciding what precautions the reasonable person would have taken to avoid the harm that has occurred and, hence, what precautions the defendant can reasonably be expected to have taken’, having regard to the four components of the calculus. ¹³⁶

Here we arrive at the nub of the problem, which is the same one identified by the Ipp Review in the context of personal injury law. It is that courts may jump from deciding that, because a risk was foreseeable, ipso facto it was negligent for an officer not to take precautions against it. The Ipp Review pointed to

[the] danger, perceptible in some judicial pronouncements, that the concepts of foreseeability and probability may be conflated. The problem with this is that a court may jump from the proposition that a risk is foreseeable as a not insignificant possibility, to the conclusion that the reasonable person would have taken precautions against it. But…foreseeability is merely a precondition of liability for negligence. The fact that a risk is foreseeable (even as a not insignificant possibility) does not, by itself, justify the conclusion that the reasonable person would have taken precautions against it. ¹³⁷

In the corporate context, the concern is that the regulators and the courts are increasingly falling into this trap in the stepping-stones cases. The allegation that a corporation may have contravened the law, if accepted by the court, is used as a basis to conclude that such a contravention (and the resulting detriment to the corporation) must have been foreseeable to the defendant. And this is bootstrapped into a conclusion that failure to take measures to avert the risk was negligent, without the regulator (in deciding to instigate civil penalty proceedings) or the court (in deciding whether to make a declaration of contravention) paying proper regard to the Shirt calculus.

E Civil Penalties for Negligence

Finally, stepping-stones raises the policy question of whether it is appropriate to include s 180(1) in the civil penalty regime created by pt 9.4B of the Corporations Act.

The history of the Australian statutory duty of care is reviewed by Edelman J in the Storm directors’ duty litigation at first instance ¹³⁸ and in the case law and scholarly work to which his Honour refers. ¹³⁹ The possibility of state sanctions—first criminal, then criminal and civil—for breach of the duty of care dates back to the Companies Act 1958 (Vic); criminal penalties were removed as part of a broader project to simplify the law in 1999. ¹⁴⁰ As a result of the imposition of state sanctions, the duty of care imposed on corporate officers is, as Greenwood J observes in the Cassimatis Appeal,

normative and its burden is a matter of public concern not just private rights. It is an expression of the Parliament’s intention to establish an objective normative standard of the degree of care and diligence directors must attain or discharge in exercising a power conferred on them or in discharging a duty to be discharged by them. ¹⁴¹

While it is true that s 180(1) is a public duty and has been for many years, this is a different question from whether it should be. Certainly, it makes Australia a corporate law outlier. ¹⁴² Failure to take care in other occupations or fields of private endeavour does not usually attract a state sanction, at least in the absence of a positive ‘reasonable steps’ requirement to achieve a particular outcome, such as compliance with a specified law. An officer cannot insure against, or be indemnified for, a civil penalty incurred for a contravention of s 180(1) of the Corporations Act. ¹⁴³ And courts do not treat honesty or good faith as a basis for excusing a negligent director under s 1317S of the Corporations Act. ¹⁴⁴

There are a variety of possible rationales for allowing public enforcement action against individuals implicated in corporate wrongdoing, ranging from specific or general deterrence to ‘just deserts’. ¹⁴⁵ Civil penalties are typically used in relation to behaviours that are considered serious enough to justify public sanctioning, but not the opprobrium of a criminal conviction—the primary focus is on deterrence. ¹⁴⁶

Civil penalty provisions involve the use of the powers and resources of the state to prosecute individuals without those individuals having the benefit of the full rights, privileges and protections provided by the criminal law. ¹⁴⁷ As the ALRC observed in 2015, ‘[a] person may be denied their criminal process rights where a regulatory provision is framed as a civil penalty, when it should—given the nature and severity of the penalty—instead have been framed as a criminal offence’. ¹⁴⁸ If an officer is found, on the balance of probabilities, to have contravened a civil penalty provision and the contravention is serious, significant penalties (against which the officer cannot be insured) can be ordered, along with disqualification from holding corporate office. For individuals the subject of civil penalty proceedings—regardless of whether they are eventually found to have contravened the law or have a pecuniary penalty imposed—the detrimental financial, professional and personal impact of the proceedings (which typically take many years to resolve) is very significant.

Deciding whether breach of an officer’s duty of care should attract state sanctions—and not just liability to the corporation for any loss that results under the corresponding general law duties—involves weighing considerations of fairness and efficacy. Some argue that ‘there is a need for public enforcement of the duty of care and diligence, the adequate enforcement of which performs a critical function in maintaining good standards of corporate governance’. ¹⁴⁹ This argument is supported by evidence that s 180 of the Corporations Act is enforced by ASIC more often than other director liability provisions, and more often by ASIC than private plaintiffs. ¹⁵⁰ This may be true, but it does not answer the policy question. The policy question is whether, by bringing these enforcement actions arising out of s 180 of the Corporations Act, the regulator is improving the governance of Australian corporations overall. Research by the Australian Institute of Company Directors recently found that:

Directors continue to feel negative about the impact of legislation on director liability in the second half of 2019. 36% of directors feel that it has negatively affected their business decision-making, 40% on their willingness to continue on a board and 50% on their willingness to accept new board appointments. 70% of directors agree there is a risk-averse decision-making culture on Australian boards, and the main reason for this is the excessive focus on compliance over performance. ¹⁵¹

This suggests that the effect is otherwise, and that the perceived risk of facing a stepping-stones action (which may take many years and extract a significant financial and personal toll) is interfering with good governance.