Know the risks - Zurich

• Reviewing how appropriate financial and operational information is provided tosenior management and board members• Evaluating the overall effectiveness of the board“Typical lawsuits broughtagainst directors of depositoryinstitutions for breaching theirduty of care include:1. Failure to supervise2. Failure to implementappropriate complianceprograms3. Negligent lending andreserving practices4. Failure to respond towarnings or criticismsfrom regulators, auditorsand others”Directors are entitled to rely on information, opinions, reports or statements,including financial statements or other data, prepared by employees, legal counsel,public accountants or other experts or professionals, or committees of the board ofdirectors if the directors reasonably believe that such sources merit confidence. Ofcourse, directors may not rely upon these people if they have knowledge of facts orinformation that would make this reliance unwarranted.Examples of lawsuits typically brought against directors of depository institutions forbreaching their duty of care include the following:1. Failure to superviseDirectors have a duty to supervise other directors, as well as the institution’s officers.While a director may not be directly involved in fraud or embezzlement, the directormay be liable if he or she failed to establish or follow adequate internal controls.State and federal regulators may pursue directors for failing to exercise adequatesupervision. Most notably, regulatory agencies will often sue directors of an insolventdepository institution for negligence and breach of fiduciary duty, as well as breachof various statutory duties, based on the directors’ failure to supervise or adequatelydirect management after unsafe practices have been called to the directors’ attention.The supervisory role of directors is of particular importance as depository institutionsexpand into new lines of business. The decision to enter a new line of business mustbe carefully considered. Acquisitions and entries into new lines of business should beundertaken only after development and analysis of a business plan prepared with theassistance of consultants or advisors with established expertise in the new business.Managing the new business may require special skills or expertise unavailable amongexisting personnel, and the depository institution may be exposed to market factorsand risks of a nature and magnitude different from those affecting the institution’straditional operations.2. Failure to implement appropriate compliance programsA director’s duty of care includes a duty to establish internal compliance programsto identify and curtail misconduct by an institution’s employees and agents, as wellas a duty to monitor those programs to be sure they are effective.Courts used to be reluctant to require directors to take affirmative steps to implementinternal compliance programs – unless, of course, there were obvious problems ofwhich the directors should have been aware. No more. It is now clear that a director’sduty of care includes an affirmative obligation to establish and maintain programs tomonitor whether the institution is complying with applicable law.3. Negligent lending and reserving practicesMany cases brought against depository institution directors have involved improper,unauthorized, excessive or badly documented loans or overdrafts. One recurrentproblem is the lending of excessive amounts to one borrower or an affiliated group5Financial institutions guide