Compliance
Compliance
What is compliance?
- A framework for managing compliance with laws and regulations
- Three pillars: code of conduct, reporting channel, training
- The foundation that supports the G in ESG
In organizations where compliance actually works, the order of decision-making changes. Before, sales won the contract first and legal cleaned up afterward. Now decisions such as selecting vendors, paying rebates, and settling subcontractor payments must go through prior approval and documentation before they are carried out. Things clearly slow down, but when a problem surfaces, there is a trail proving who reviewed what and when. The substance of the system is not a thick rulebook but this trail embedded in the everyday approval line.
The legal minimum varies by company size and industry. Listed companies with total assets of KRW 500 billion (≈ US$374,083,500) or more must appoint a compliance officer under the Commercial Act, fines for personal data breaches can reach up to 3% of total revenue, and the Serious Accidents Punishment Act has applied to workplaces with fewer than 50 regular employees since 2024. The five types of statutory mandatory training (sexual harassment prevention, personal data protection, occupational safety and health, disability awareness, and retirement pension) are only that floor. Unlike an audit, which examines what has already happened, compliance is a preventive function that stops violations before they occur, and that is where the two roles diverge.
When turning this into training, you need to separate a common course for all employees from advanced courses for high-risk roles. Purchasing and sales are mainly exposed to subcontract payments and improper solicitation, development and marketing to personal data consent and processing outsourcing, and executives to use of insider information and breach of trust, so one set of materials can't cover them all. Also, if you schedule training right after onboarding and role changes, you can give people a standard at the moment they have none to judge by. A single annual company-wide session misses exactly this.
The most common mistake in the field is treating a 100% completion rate as proof of due diligence. After an incident, investigators and regulators don't ask for completion screens. They ask for training logs, comprehension test results, and records showing that detected violations were actually met with disciplinary action. A single precedent of letting an executive off with a verbal warning is enough to undermine trust in the entire system. Internal reporting channels work the same way: once a reporter's identity leaks, tips dry up, and the company first hears about problems from an outside whistleblower. The moment compliance is pushed onto the legal team alone, the standard on the front line slides back to 'it's fine as long as you don't get caught.'
Jungmi AhnSkin care and beauty research and training specialist
Anna ChoOrganizational culture, coaching, emotional intelligence and customer service consulting specialistThe word comes from the English "comply," meaning to follow or obey, and became established as a management term through internal control and compliance monitoring systems in the U.S. financial industry. In Korea, it spread across all industries after financial institutions introduced the compliance officer system, and its importance has grown further alongside ESG management.
Consider a hypothetical case. Company A, an auto parts manufacturer with 480 full-time employees and annual revenue of about KRW 190 (≈ US$1) billion, was cited in a Fair Trade Commission written-contract survey on subcontracting last year and fined. The prevailing attitude was that compliance is something the legal team handles, and the compliance role was a side duty held by a single legal team manager. The CEO ordered the system rebuilt within six months.
- After the head of corporate planning spent three months reviewing business units, the review turned up 74 cases of missing written subcontracting documents and 12 cases of undisclosed privacy policies. The CEO was clear: 'This isn't one person's mistake. It's a structural problem.'
- The company moved compliance out of a side-duty role into two dedicated staff, and cut the 38-page code of conduct down to 19 scenario-based articles that every employee signed.
- The five statutory mandatory training courses were delivered online. For the 41 people on the purchasing team and 66 on the sales team, a separate 2-hour in-person course on the Subcontracting Act was added, using 74 anonymized issues cited in the survey as real case material.
- After the anonymous reporting channel was moved to an external provider, reports over six months rose from 3 to 21, and 4 of them were corrected internally before any external investigation. One production foreman said, 'People talk once they hear their names won't be recorded.'
- One year later, the rate of written subcontract documents issued reached 100%, the correct-answer rate on the scenario-based comprehension test rose from 54% to 87%, and Company A earned a B grade for the first time in the Fair Trade Compliance Program (CP) rating.