Red Flags Everywhere! – Ten Risks for Directors – Week 6

09 Apr 2026
Client Alert

Each week for the next 10 weeks, we will publish an installment of our Red Flags Everywhere! series, highlighting key risk areas that public companies and their board of directors should keep top of mind.

This series will serve as a lead up to MoFo’s upcoming Red Flags and Red Wine Tabletop program taking place in our Palo Alto office on May 7. Members of our Securities Litigation, Employment and Labor, and Capital Markets Groups will guide attendees through a ripped-from-the-headlines fact pattern designed to spark interactive discussion and practical analysis that will be valuable to every board advisor.

This week, we focus on internal investigations. Effective board oversight of internal investigations involves director engagement on the structure and management of the investigation, particularly where there is a potential for conflicts.

If you are interested in learning more about MoFo’s Red Flags Everywhere Tabletop event, please reach out to Deborah Argueta. See all the Red Flags client alerts.

Risk #6: Internal investigations. When complaints are elevated to the board, directors must carefully assess seriousness and credibility before determining whether and how to investigate. Where allegations implicate senior management, financial reporting, or other areas presenting potential conflicts, the board should consider whether to assign oversight to independent directors, such as the audit committee or a special committee. Other important factors include reporting to regulators or external auditors, impact on the business, and disclosure obligations. Good-faith oversight of internal investigations can reduce litigation and enforcement risk, while passive or conflicted oversight may increase it.

Delaware Lessons on Board Oversight in Internal Investigations

Internal investigations are often judged twice: first by what the investigation uncovered, and second by the process the board used in responding to the underlying complaint. Delaware oversight law requires directors to make a good-faith effort to ensure that reasonable reporting systems exist and to respond appropriately when red flags emerge. This standard calls for meaningful engagement when material compliance or misconduct issues reach the board and for the board to exercise its judgment in assessing the seriousness of the issue and how best to proceed. The board’s role is not to act as trial counsel, but to ensure a credible process for fact-finding, assessing remediation obligations, and enlisting appropriate advisors to assist the board and management in this process.

A recent Delaware Court of Chancery decision illustrates how closely courts scrutinize director oversight when serious complaints reach the board, and how outcomes can turn on the board’s response to those complaints. In Los Angeles City Employees’ Retirement System v. Sanford, C.A. No. 2024-0998-KSJM (Del. Ch. Jan. 16, 2026), Chancellor Kathleen McCormick denied motions to dismiss oversight claims against certain directors and officers of eXp World Holdings. The complaint alleged that repeated reports of serious sexual misconduct, including allegations of sexual assault at company events, were conveyed to senior management and the board through multiple channels, including internal reports, emails, and a whistleblower-director, over an extended period. In response to the allegations, the board had initiated an internal investigation but declined to follow outside counsel’s recommendation for an independent investigation. Instead, management led the investigation.

Stockholders sued the directors for breach of their duty of oversight. The court declined to dismiss the claims. In so ruling, the court focused on what the board knew, the seriousness and persistence of the alleged misconduct, and the board’s response once those issues were brought to its attention. The chancellor concluded that the complaint supported a reasonable inference that the board did not take meaningful steps to address what was alleged to be a systemic problem.

Sanford underscores that courts will closely examine director response to misconduct allegations. Where directors demonstrate a good-faith effort to understand the issue, test management’s response, and oversee remediation in a way that is credible and reasonably designed to protect the company, they are better positioned to protect themselves from liability.

Key Takeaways for Directors

Here are five practical tips for directors seeking to exercise their oversight duties in the context of misconduct allegations:

  1. Start with a disciplined assessment of seriousness and enterprise risk. Complaints that reach the board are typically escalated because they present potentially significant issues. Boards should assess whether the allegation signals a broader legal, compliance, cultural, financial reporting, or reputational risk. The more serious the allegation, the more important it is to demonstrate appropriate urgency and attention.
  2. Decide early who should lead and oversee the investigation. When allegations involve the CEO, CFO, other senior executives, directors, financial reporting, related-party dealings, or any issue where management may be conflicted, the board should consider whether to shift oversight to independent directors, often through the audit committee, another standing committee, or a special committee. The key question is whether those overseeing the investigation can make objective decisions about scope, witnesses, documents, discipline, disclosure, and remediation.
  3. Set the investigation structure at the outset. A credible investigation begins with a clear mandate: what issues are being investigated, who is responsible for conducting the work, who will receive updates, whether the final deliverable should be oral or written, what documents must be preserved, and what interim steps should be taken to reduce risk while facts are being developed. Directors need not run the investigation themselves, but they should ensure that the process is real, appropriately resourced, and designed to produce decision-useful information.
  4. Stay engaged through regular updates and focused questions. Board oversight is not satisfied by simply commissioning an investigation and waiting for a final memorandum. Directors should receive periodic updates and ask questions about what allegations have been tested, what evidence has been collected, whether the scope has changed, whether regulators or auditors may need to be informed, whether interim disclosure issues have arisen, and what immediate control failures or personnel risks need attention. The questions should be practical: Do we have the right scope? Are there conflicts? Are we moving fast enough? Do we need to widen the review? What do we know, what do we not know, and what decisions may need to be made before the investigation is complete?
  5. Focus on response and remediation, not just fact development. An internal investigation is not complete when the interviews end. Boards should ensure the company addresses what the investigation reveals. That can include personnel action, control enhancements, training, changes to reporting lines, repayment or clawback analysis, regulator engagement, auditor communications, and public disclosure decisions. Boards should also track whether promised remediation has been implemented. A process that identifies issues but fails to act can itself become the next red flag.

The prior Red Flags alerts are available here:

We are Morrison Foerster — a global firm of exceptional credentials. Our clients include some of the largest financial institutions, investment banks, and Fortune 100, technology, and life sciences companies. Our lawyers are committed to achieving innovative and business-minded results for our clients, while preserving the differences that make us stronger.

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Prior results do not guarantee a similar outcome.