The Context
On 19-20 March 2026, the United States Department of Justice unsealed an indictment against Yih-Shyan “Wally” Liaw, co-founder, Senior Vice President of Business Development, and a Board member of Supermicro. The charges allege a conspiracy to divert $2.5 billion worth of Nvidia GPU servers to Chinese customers, in direct violation of U.S. export controls. Liaw and two associates were arrested. The scheme involved falsifying internal purchase approvals, manufacturing thousands of non-functional “dummy” servers to deceive internal audits, and orchestrating a multi-layered shipment scheme via Taiwan to conceal the final destination in China.
The Risk
Liaw’s dual role as both a senior operational executive and a Board member creates a textbook case of personal director liability. He is charged with three federal counts, including conspiracy to violate the Export Controls Reform Act. This operational misconduct, conducted from a position of governance, may indicate a catastrophic failure of the duty of care and diligence. While the immediate charges are under U.S. law, the principles translate directly. Under the New Zealand Companies Act 1993, directors owe a duty to exercise reasonable care, diligence, and skill. A director who knowingly, or through gross negligence, permits the company to engage in unlawful conduct that causes severe financial and reputational harm may be found in breach of this duty. The personal exposure is not limited to corporate fines; it extends to criminal penalties and disqualification.
The Control
The board must immediately mandate and verify a forensic-level segregation of duties and independent oversight for all high-risk operational functions, particularly those involving regulated goods. Executive directors with operational portfolios must have their compliance controls audited by a function reporting directly to the independent board, not through their own management chain. This creates a necessary and documented check against the abuse of positional authority.
The Challenge
These are the critical questions you should be raising at the board table:
| For our executives who also sit on this board, what specific, auditable, and independent controls exist to prevent them from using their operational authority to bypass compliance protocols, and when were those controls last stress-tested? | |
| Can our internal audit function demonstrate, with evidence, that it has the mandate, resources, and courage to physically inspect and validate high-value inventory against shipping records, even when challenged by senior leadership? | |
| What is our documented process for escalating and investigating allegations of misconduct against a fellow director, and does the board as a whole have the will to enact it? |