For years, incorporation offered a familiar assurance: the company was liable for its actions, while its shareholders, directors and officers enjoyed the protection of separate legal personality and limited liability. That principle remains fundamental to corporate law. But it does not give individuals a licence to disregard their responsibilities.

Across jurisdictions, regulators and courts are increasingly looking beyond the corporate entity to the individuals who authorised, facilitated, tolerated or failed to prevent misconduct. The question is no longer confined to what the company did. It increasingly includes who knew, who should have known, who had the authority to intervene and what they did about it.

For directors and senior executives in Uganda, this shift has practical consequences. Corporate misconduct can carry personal criminal and civil consequences, even where the company itself has accepted responsibility. Understanding where that liability arises, and how to manage it, is becoming an essential part of effective corporate governance.

Why the corporate veil no longer tells the whole story

There’s a familiar – though much dreaded – sequence in corporate life. An internal or external audit identifies a regulatory breach. Management, working with in-house and external counsel, engages the relevant regulator. Mitigation is presented and, where a formal finding of culpability is unavoidable, responsibility is placed at the lowest appropriate level within the organisation.

The company pays the fine and issues a carefully worded statement of contrition. The Board is notified and, at its next formal meeting, notes the infraction, expresses regret and approves a change in policy. The directors move on to the next item on the agenda.

The institution has suffered. But what of the people who made, tolerated or failed to interrogate the decision that caused the breach?

For much of modern commerce, this outcome was treated almost as part of the bargain of incorporation. The company absorbed the consequences, while the individuals behind the decisions remained largely untouched.

The corporate form is, without doubt, one of capitalism’s most important legal inventions. This ingenious fiction pools capital, separates ownership from management and allows businesses to take commercial risks without exposing every shareholder to personal ruin. But a legal structure designed to distribute commercial risk was never intended to abolish individual responsibility.

A company can enter into a contract and own property. It cannot, however, form a dishonest intention, ignore a warning or decide that a suspicious payment is too profitable to question. Human beings make those decisions.

That distinction is shaping regulatory enforcement to a greater and greater degree. Regulators want more than the company’s cheque in settlement of a fine. They want the emails, committee minutes, escalation reports and records showing who received information about the breach and what they did with it.

The questions are increasingly direct:

The economic consequences help explain this shift. Corporate entities operate in sectors that affect the lives and livelihoods of large sections of the population, including financial services, construction, healthcare and fast moving consumer goods.

A breach in these sectors can have consequences far beyond the company concerned, ranging from financial loss and environmental damage to loss of life. Where corporate decisions expose the public to serious harm, it is un-surprising that Parliament and regulators increasingly seek to hold the individuals responsible to account. The central issue is not whether the corporate veil should exist. It’s whether it should protect individuals whose conduct contributed to the company’s wrongdoing.