Caremark Round II: Beware Red Flags in Drug Development

As described in our June 2019 alert, the Delaware Supreme Court recently revived a similar claim in Marchand v. Barnhill — a case brought against the directors of an ice cream company who allegedly failed to set up a system to oversee the company’s compliance with “mission critical” food safety regulations for the single-product company. Blue Bell Creameries, the company in Marchand, suffered a major setback after a listeria outbreak connected to Blue Bell’s ice cream product. As the Supreme Court observed in Marchand, and as the Delaware Court of Chancery reiterated in Clovis, “a Caremark claim is among the hardest to plead and prove” because plaintiffs must allege that directors knew that they were not discharging their fiduciary obligations. Yet for the second time in a little more than three months, a Delaware court has held that plaintiffs sufficiently alleged just that.

The courts in Marchand and Clovis reached their results under different circumstances and based on two different prongs of the Caremark test, which requires directors to use good faith both to implement an oversight system and then monitor it. To properly allege a fiduciary duty Caremark claim, a plaintiff must allege specific facts that either (1) “the directors completely fail[ed] to implement any reporting system or information system or controls” or (2) “having implemented such a system or controls, consciously fail[ed] to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention.” A plaintiff also must allege that directors knew that they were acting inconsistently with their fiduciary duties. 

In Marchand, the Delaware Supreme Court held that plaintiffs had alleged that the ice cream company did not “make a good faith effort — i.e., try — to put in place a reasonable board-level system of monitoring and reporting.” In Clovis, by contrast, the Court of Chancery found that “it is difficult to conceive how Plaintiffs would prove” the absence of such an oversight system where a board committee was specifically charged with “compliance oversight” and the full board reviewed detailed information about the company’s clinical trials. Instead, the allegations in Clovis were sufficient based on the board’s alleged conscious failure to respond to the red flags that the oversight system yielded. The Clovis court also noted that it is reasonable to distinguish the board’s oversight of management of business risk inherent in its business plan from the board’s oversight of the company’s compliance with “positive law — including regulatory mandates.”

The court found that plaintiffs sufficiently had alleged at this stage that the Clovis board ignored several red flags waved before it. The red flags related to a clinical trial of one of Clovis’ three drugs in development, Rociletinib (Roci), which was designed to treat lung cancer. The clinical trial incorporated a commonly used protocol called “RECIST” (Response Evaluation Criteria in Solid Tumors), which established that the trial’s criteria for success would be an objective response rate (ORR) of a certain percentage of patients who experienced meaningful tumor shrinkage when treated with Roci. Under the RECIST protocol, the initial observation of tumor shrinkage would have to be observed in a subsequent confirmation scan before it could be incorporated into the calculation of ORR. Plaintiffs alleged that the Clovis board understood that only confirmed responses — as opposed to unconfirmed initial observations — were meaningful to investors and relevant to the FDA’s decision whether to approve Roci for commercialization.

The court credited at least five sets of alleged red flags for the board that Clovis was including unconfirmed responses in its calculation of Roci’s ORR, each juxtaposed against public statements touting the ORR data:

1. Around the same time Clovis publicly disclosed a 58% ORR at a medical conference, management reported to the board that this ORR would improve “as patients get to their second and third scans,” meaning to the court that the ORR “by definition” was partly based on unconfirmed responses.
2. As Clovis was repeating the 58% ORR in a press release and on analyst calls, the board viewed another report signaling that Clovis management was incorporating unconfirmed responses into the ORR calculation and that only 80% of unconfirmed responses converted to confirmed responses.
3. Another board presentation from the same period designated Roci’s ORR as “*Unconfirmed.”
4. While Clovis’ public statements about Roci remained upbeat — i.e., “similar response rate” to a competitor drug and a disclosed ORR of 67% — the board viewed a report that the ORR would soon drop below 60% and could be less than 50% as Clovis was waiting on “data maturity.”
5. Clovis continued to publicly cite an ORR of 60% while management presented to the board an ORR of 46% that was “(Unconf + Conf).”

Clovis ultimately disclosed in a press release that Roci’s correct ORR (based on only confirmed responses) was as low as 28%–34%, resulting in a 70% drop in the company’s stock price and a loss of $1 billion in market capitalization. This disclosure led to the filings of securities class actions (one of which settled for $142 million), an enforcement action by the SEC (leading to the entry of an “onerous consent decree” requiring Clovis and its officers to pay more than $20 million in civil penalties), and an investigation by the FDA.

The Court of Chancery framed its analysis around its interpretation of Marchand: “As Marchand makes clear, when a company operates in an environment where externally imposed regulations govern its ‘mission critical’ operations, the board’s oversight function must be more rigorously exercised.” And “as Marchand makes clear, the careful observer is one whose gaze is fixed on the company’s mission critical regulatory issues.” Against this backdrop, the court held that plaintiffs alleged particularized facts supporting the reasonable inference that the board knew that management was publicly reporting unconfirmed responses in contravention of the RECIST protocol and FDA guidance:

ORR was the crucible in which Roci’s safety and efficacy were to be tested. Roci was Clovis’ mission critical product. And the Board knew, upon completion of the . . . trial, the FDA would consider only confirmed responses when determining whether to approve Roci’s [New Drug Application] per the agency’s own regulations. As pled, these regulations, and the reporting requirements of the RECIST protocol, were not nuanced. The Board was comprised of experts and the RECIST criteria are well-known in the pharmaceutical industry. Moreover, given the degree to which Clovis relied upon ORR when raising capital, it is reasonable to infer the Board would have understood the concept and would have appreciated the distinction between confirmed and unconfirmed responses. The inference of Board knowledge is further enhanced by the fact the Board knew that even after FDA approval, physicians (i.e., future prescribers) would evaluate Roci based on ORR.

Although defendants pointed to many of the same board-level documents to argue that the FDA actually had blessed Clovis’ plan to report unconfirmed responses and that FDA guidance was not as black-and-white as plaintiffs had alleged, the court drew all reasonable inferences in plaintiffs’ favor at this pleading stage of the case and rejected defendants’ arguments subject to development in discovery and potential resolution at the summary judgment stage. The court noted that it remains to be seen whether plaintiffs’ allegations in Clovis will hold up during the discovery, summary judgment, or trial phases of the case, but nevertheless allowed the case to move forward. For now, plaintiffs had “well-pled that the Board consciously ignored red flags that revealed a mission critical failure to comply with the RECIST protocol and associated FDA regulations.”  

Creating and Implementing Robust Board Oversight of Mission-Critical Risks

Like Marchand, this decision may be a case of “bad facts,” resulting in steep civil and regulatory penalties, making law under which directors face a heightened risk of a Caremark claim that cannot be readily dismissed early in a case. Boards of all companies operating in regulated industries should consider what risks are “mission critical” — a concept that drove the decisions in both Marchand and Clovis. Companies with limited products, such as clinical-stage biopharmaceutical companies that may be focused on the development of one or two potential drug therapies, should try to identify categories of “mission critical” risks and then consider what procedures are in place to ensure that boards are receiving sufficient information about those risks so that they can address as appropriate. 

Boards can consider options such as:

• Forming a risk committee;
• Placing compliance with significant clinical, regulatory, or other risks on the board’s agenda for each meeting;
• Engaging regulatory consultants to advise the board in addition to management;
• Paying attention to documenting robust board discussions; and/or
• Any appropriate way for the board to implement a system of controls and monitor them for significant, mission-critical risks.

Consider Board Composition and the Use of Experts

Highly regulated companies also might want to consider whether they have board members with adequate background to assess the mission-critical risks. For example, in the context of a life sciences company conducting clinical trials, directors with background in the clinical development of a comparable drug could work with a risk committee or other board committee to provide more targeted oversight of clinical trial protocols and results and regulatory guidance. Or boards can consider engaging consultants or specialists who could assist the board in better understanding specific clinical trial-related risks and their potential consequences, including by potentially reviewing clinical trial data and disclosures about that data.

*          *          *

There is no one-size-fits-all approach to board oversight of mission-critical risks and we do not believe that these cases stand for the proposition that boards should assume the role of detectives or undertake independent efforts to verify every public statement made by management. But Clovis (and Marchand before it) are indeed a call to action for boards to identify and increase their oversight of mission-critical risks, particularly in highly regulated industries.