The Expert in the Room series part 1: How the Expert got a seat

Part 1: How the Expert got a seat

Before we dive in, it is worth being precise about the governance questions we are addressing here. Rather than debating whether a board should recruit a director with deep domain expertise in a fast-moving area, our focus is on allocation and individual duty. In other words, once such a specialist director is present, how should oversight and responsibility be distributed, what does each remaining director retain in terms of legal and practical responsibility, and what are the potential consequences for boardroom dynamics?

Governance history is a useful starting point for this consideration.

The passive board

In 1995, Barings Bank collapsed. A single trader running the Singapore futures desk, Nick Leeson, hid unauthorised positions in the Nikkei equity market for over 2 years. The losses (c.£827m, around twice the bank’s capital) became unrecoverable after the Kobe earthquake moved the market against him. The board and senior management had failed to segregate oversight of trading and settlement, ignored an internal audit that flagged that specific risk, happily accepted outsized profits from a supposedly low-risk arbitrage book and, in January and February 1995 alone, transferred c.£742 million in margin funding to Singapore without properly understanding what it was for. The 233-year-old institution was sold to ING for £1, wiping out bondholders and shareholders.^[1]

The punishment for the directors was civil and modest. Proceedings were brought under the Company Directors Disqualification Act (1986)^[2] , with disqualifications ranging up to six years. Three chose to contest the case, which produced the legal outcome known as the Barings principles. Jonathan Parker J held that “directors have, both collectively and individually, a continuing duty to acquire and maintain a sufficient knowledge and understanding of the company’s business to enable them properly to discharge their duties as directors.”^[3] He held that while directors could delegate certain functions to those below them in management, delegation did not absolve them of supervising how those functions were discharged. The UK Court of Appeal approved the formulation,^[4] and many common law jurisdictions adopted it, establishing that delegation and abdication are legally distinct, as measured by supervision.

The audit committee

Another useful historical anchor is the 1992 Cadbury Report.^[5] Set up in the wake of several scandals, including Polly Peck, Coloroll, BCCI and - whilst the committee was sitting - Maxwell’s raid on the Mirror Group pensions, it produced the UK’s Code of Best Practice, 19 provisions across four areas: the board of directors, non-executive directors, executive directors and reporting and controls.

The Cadbury Committee framed non-executive responsibilities in terms of independence of judgement applied to strategy, performance, resource and standards of conduct, emphasising calibre rather than specialism. However, the report did introduce one specialism: the requirement for UK listed companies to establish an audit committee of at least three non-executive directors.^[6] The report’s lasting innovation was the enforcement mechanism: comply or explain. Listed companies had to state in their annual report whether they complied with the Code and explain any departure. This model spread to the EU, the Commonwealth and the OECD Principles.^[7]

The report also gave the standard definition of corporate governance; “the system by which companies are directed and controlled”.^[8]

When Enron collapsed in December 2001, an accounting professor and former Dean of Stanford Business School chaired its audit and compliance committee, and the board included former regulators and CEOs.^[9] However, despite arguably having the requisite skills, they failed to stop what was then the largest corporate bankruptcy in US history. Enron’s reported profits were largely fictional. Its mark-to-market accounting, approved by the SEC in 1992, let it book the projected lifetime value of long-term contracts as current income. A web of off-balance-sheet special purpose entities hid debt and manufactured earnings. And the board twice waived its own code of conduct so that the chief financial officer, Andrew Fastow, could run the LJM partnerships, supposedly independent entities that did deals with Enron, and helped move poorly performing assets and losses off its books. Fastow was therefore effectively sitting on both sides of transactions between Enron and LJM, creating an extraordinary conflict of interest.

The Senate Permanent Subcommittee on Investigations devoted an entire report to the role of the board.^[10] The regulatory response was to codify expertise, with the Sarbanes-Oxley section 407 requiring disclosure of whether the audit committee includes a financial expert^[11] and revised New York Stock Exchange listing standards requiring every audit committee member to be financially literate and at least one member to have accounting or related financial management expertise.^[12] It is worth noting the irony that the ‘designated expert’ enters governance architecture as a formal category in response to a failure that a designated expert had failed to prevent!

The risk committee

The Walker Review,^[13] in the wake of the 2007/2008 financial crisis, continued the requirement for more specialisation. It concluded that bank boards needed deeper financial industry knowledge, more time, and dedicated risk management tools. It recommended that NEDs of FTSE 100 listed banks and life insurers commit between thirty and thirty-six days a year to the role, and required the establishment of a board-level risk committee chaired by a non-executive director.

Interestingly, subsequent academic research by Minton, Taillard and Williamson^[14] found that whilst financial expertise among independent directors of US banks was weakly associated with better performance in the run-up to the global financial crisis, it was also associated with higher risk-taking over the same period, and it was strongly related to lower performance during the crisis. The conclusion is that whilst expertise can be valuable, there is a risk in a board deferring to a specialist who may not be neutral in their perspective.

Collective accountability

The UK’s Financial Reporting Council’s Guidance on Board Effectiveness (2011)^[15] shifted the argument back towards collective accountability. Although it recognised that committees need non-executives with the technical skills and knowledge relevant to their subject matter, it also made clear that an effective board depends on diversity of perspective and on challenge rather than on any one member’s expertise, and that executives should encourage their non-executive colleagues to test proposals against the non-executives’ wider experience outside the company. Where a decision relies on specialist knowledge, the guidance points boards to expert opinions and independent reports as inputs to their own judgement. Its closing position leaves no room for doubt: a board may use committees to assist its consideration of audit, risk and remuneration, but it retains responsibility for, and makes the final decisions on, all of them.

Courts make oversight failure actionable

Heading into the 2020s, failure in directorship duties by lack of appropriate information and reporting systems to watch key risks, began to carry real personal exposure under the law. In the United States, the duty itself was set out in In re Caremark (1996), in which the Delaware Court of Chancery held that directors must make a good-faith effort to ensure a corporate information and reporting system exists, and that a sustained or systematic failure to do so would expose them to liability. For over twenty years, the courts had dismissed almost every claim brought on these grounds. From 2019, that changed however, with courts beginning to let such claims proceed.

Blue Bell, a 108-year-old Texas creamery, had listeria in its plants for two years, with ten positive tests before an outbreak which was traced to their products left three people dead. The complaint alleged that none of this detail reached the board (it was never reported in board papers). The board argued that their regulators inspected the plants and the company had compliance systems. However, in Marchand v Barnhill (2019), the Delaware Supreme Court allowed the claim to proceed, holding that boards must make a good-faith effort to put in place a reasonable system of monitoring and reporting on the organisation's central compliance risks, and that regulation is not a substitute for the board's focus on business-critical risk.^[16]

Notably, this case exists only because a shareholder used a books-and-records request to read the minutes. Eleven years after the 2015 listeria outbreak, the Blue Bell directors are still in court. The claim that the board built no system for watching food safety went to a full trial in February and March 2026, the first oversight claim of its kind ever to reach the courts rather than settle. Seven directors and officers gave evidence. The judge pressed one director on why years of her own detailed board notes never mentioned listeria, and on why weekly production meeting minutes covering inspectors' findings were never sent to the outside directors. Closing arguments were heard on 28 July 2026. The estate of the original shareholder, who died in 2022, is seeking $346 million in compensation, and at mid-September 2026, judgment is still awaited.^[17]

In the 2021 In re Boeing case, this argument was extended to engineering safety, where the court noted that although the audit committee was charged with risk oversight, its function focused mainly on financial risks, and it never assessed the 737 MAX's safety risks.^[18] Given the board members' aerospace, defence, and regulatory expertise, the failure could be viewed as one of allocation and attention rather than experience and knowledge. The matter settled for $237.5 million, alongside governance changes that included adding a director with aviation or safety experience to the board.^[19]

The regulator declines to mandate the specialist

In 2022, the United States' Securities and Exchange Commission (SEC) proposed requiring disclosure of board cybersecurity expertise. However, it dropped the requirement from the final rule in 2023, acknowledging that effective cybersecurity processes are designed and administered largely at the management level, and that directors with broad-based skills in risk management and strategy often effectively oversee management's efforts without specific subject-matter expertise, as they do with other sophisticated technical matters.^[20] In reaching that view, the SEC credited commenters who argued that cybersecurity risk is not intrinsically different from other risks that directors assess with or without technical expertise, and that the requirement would pressure organisations to retain cybersecurity experts on their boards.^[21] The final rule instead requires disclosure of management's cybersecurity expertise, and of which board committee oversees the risk.

The same period offers another relevant case study – Silicon Valley Bank, which failed in March 2023. On 8 March, the bank announced it had sold its securities portfolio at a $1.8 billion loss and would raise capital. On 9 March, depositors withdrew $42 billion in about eight hours, with a further $100 billion queued for the next day. On 10 March, regulators closed the bank. A bank with around $210 billion of assets, the second-largest failure in US history at the time, stopped operating in just three days, at an estimated cost of $16 billion to the deposit insurance fund.^[22] Despite having a risk committee (but no chief risk officer for most of 2022), the Federal Reserve's own review concluded that the failure was tied directly to the failure of the board of directors and senior management, who did not build a governance and risk management framework that kept pace with growth. Specifically, the full board did not receive adequate information from relevant executives about risks, and the board did not hold management accountable for managing them.^[23] In other words, whilst the necessary governance structure existed, supervision was absent.

AI and the same question returns

These cases all share a common thread. In each, the courts and regulators asked whether the board had put in place a way to be informed about the risks that mattered most, and whether it then acted on what it learned. Board expertise was rarely the deciding factor. The second article, in this series, considers whether AI today changes that analysis or simply presents the same question in a new way.

Use of AI statement

This article was written by Julia Warrander, its human author. AI was used to research background sources, to check quotations and figures against the original documents, and to compile the footnotes. It did not write the argument, the interpretation or any of the original editorial. The article was reviewed and edited by Peggy Curley, Chief Communications Officer, and approved for publication under the NEDness Editorial Policy.