What you need to know about personal Y2K liability.

Mishandling the millenium bug could put you personally at the mercy of the court. But there are some steps you can take to minimize the risks.

Okay, since directors and officers are stewards of the assets of the corporation they represent, it's their fiduciary duty to exercise care and diligence as reasonably as they can. But if Company A addresses the Y2K problem and its competitor, Company B, doesn't, Company B's negligent directors and officers could be held personally liable for their possibly harmful actions - or inactions. Therefore, directors and officers should make reasonable inquiry to determine the facts and take appropriate action to solve the problem.

Standards for acting in the best interest of the company will vary state by state, and the issues differ between public and private companies. Here's a primer.

If You're Public

Public companies have a long list of possible compliance requirements in connection to any Y2K problem. Some reporting requirements could include the annual report; SEC forms 8-K, 10-K, 10-Q; FASB 5; Sections 6(a) and 11(a) of the 1933 Securities Act; and Section 10(b) of the Securities Exchange Act of 1934. If the information in these isn't handled properly, directors and officers may face liability.

Disclosure is a central issue in addressing the millennium bug. Failure to disclose "material" information may create liability in connection to securities law. If the company has nothing material to disclose, it's a non-issue. It's reasonable to conclude, though, that public firms are likely to be materially affected by the Y2K problem. The corporation's size will influence the cost of having a Y2K-compliant company - and, relatively speaking, the cost could be material. The steps required to become Y2K-compliant and the effect they have on corporate functions could be material. Further, effects of non-compliance and the risk of non-compliance also could be material. Thus, if the information is material and not revealed, directors and officers face potential liability.

The SEC has stated it believes public companies may have an immediate obligation to reveal their Y2K status. Even if your firm is addressing the issue, it would appear you need to say so - and include a list of any concomitant problems. The SEC has indicated a company's year 2000 costs or consequences may reach a level of importance that prompts it to consider filing a Form 8-K, used to report material events as they occur. One could conclude the SEC deems the issue sufficiently critical to require independent disclosure, in lieu of waiting for quarterly or annual filing requirements.

FASB 5, "Accounting for Contingencies," will influence the disclosure of the cost of compliance - and any public company probably will have related costs. If they can't be accurately calculated or estimated, you still may need to disclose the problem in the corporation's financial statements. Even if a firm determines it's not likely to be completely compliant by the year 2000, it may be required to make this known to the public under FASB 5 and other reports.

If a public company fails to disclose its Y2K problem in its various reports or registration statements, and the price of its stock drops as a result of Y2K problems, shareholders may sue. In addition, civil or criminal enforcement by state and federal officials is possible. Many plaintiff attorneys already have written and computerized their legal complaint forms; they're just waiting for the price of a firm's stock to drop after 1/1/2000 to file a court action. These could come in the form of a shareholders derivative action for a breach of fiduciary duties or a shareholders class action securities fraud suit. Even if a company wins such an action, its defense costs could be substantial.

Another area of concern arises under Section 6(a) of the Securities Act. According to it, the principal officers and a majority of the board of directors must sign every registration statement. Each person who signs the document (and maybe those who don't) may be liable for any material misstatements or omissions to anyone who acquired securities based on the document. The directors and officers involved can plead a due diligence defense only if they didn't know of the falsity and couldn't have known if they had exercised reasonable care.

Finally, mergers and acquisitions present both opportunities and problems. A firm may be a candidate for a merger or acquisition because it can't solve its Y2K problem. The failure to evaluate properly and disclose Y2K problems in an acquired company could bring forth a directors and officers lawsuit for the failure to exercise due diligence. Even if the directors and officers exercised due diligence and unknown problems and costs crop up after the deal is done, someone could file a shareholders derivative or class action securities fraud suit.

If You're Private

Most Y2K ballyhoo deals with publicly held companies - but it would be wrong to conclude private companies have no exposure. Granted, there's no opportunity for class action securities litigation, and the degree of exposure may be lower. Still, the private company has exposure, the source of which is the use of internal computer systems and interaction with external computer systems. Areas of potential liability include product, environmental and contractual liability, misrepresentation and breach of fiduciary duty.

Product liability - If a private company manufactures or distributes a product that's not Y2K-compliant and it fails to function properly, product liability is possible. If the product is manufactured or distributed in significant numbers, it's reasonable to assume the defect exists across the board. This could lead to a class action lawsuit filed on behalf of all users of the product.

Product liability also may arise from production control computer systems that fail or turn out inferior products that don't perform as intended. These claims will resemble other product claims, but the user is likely to allege negligence and strict liability and seek to recover all costs that result from the defective product. These would include indirect or consequential damages.

Medical device manufacturers are especially vulnerable because many devices depend on date-sensitive software. Frequently, this sensitivity comes from an embedded chip; its failure could result in significant bodily injury.

Pharmaceutical and food product manufacturers also face product liability due to the potential release of products that have expired.

Contractual, misrepresentation and environmental liability - Big, small or mid-size, there are few manufacturing companies that don't depend on computer systems. They assist in the manufacturing process and track inventories. They track accounts receivable and payable and the place and time of shipping. Breach of contract claims are likely to come in the form of failure to deliver goods, failure to provide services or failure to pay debts. Some breach of contract suits may allege deceptive trade practices. These may lead to misrepresentation and fraud claims.

In addition, larger companies may experience problems if their smaller suppliers can't deliver the goods they've contractually agreed to. The supplier faces a possible contractual liability claim for the value of the larger manufacturer's lost production.

As the clock ticks on, increasing numbers of firms will (and should) ask their partners, suppliers and customers if they're Y2K-compliant. If these third parties say yes, and this later turns out to be inaccurate, the offended company is likely to conduct a careful search for previous statements that indicated compliance. Breach of contract claims, breach of fiduciary claims, negligence claims or misrepresentation claims could arise from these positive compliance statements.

Claims could also arise if the computer system in a manufacturing operation fails, releasing chemicals or other potentially damaging materials into the environment. The effect in this area doesn't differ between private or public companies. This type of claim could be catastrophic.

Breach of fiduciary duties - Private companies don't have to be as concerned about class action litigation involving securities. They do, however, have to be concerned about their partners and the fiduciary relationships between majority and minority stockholders. Thus, if the directors, officers and other principals of a firm fail to anticipate and manage risks adequately, the firm's value is likely to suffer. Consequently, responsible parties could be sued for a breach of their fiduciary duty.

This information isn't a substitute for sound legal, accounting and technical advice. But do document each step your public or private company takes to deal with the Y2K problem, so officers and directors can show they've exercised due diligence.

This is not to say those who undertake these activities will not get sued. In fact, the probabilities are reasonably high that directors and officers could face legal challenges. But documentation of their due diligence activities should bolster their defense.

Joel Campanella is vice president and financial products executive at Royal & SunAlliance USA. Dr. E.J, Leverett, CLU, CPCU, professor emeritus, founded the University of Georgia's program in risk and management and insurance.