In late 2021 and 2022, the Supreme Court of Korea rendered two decisions strengthening corporate directors’ compliance and monitoring obligations. In the context of corporate investigations, this has resulted in an increased focus on ensuring that directors take appropriate measures in connection with internal investigations or other corporate compliance matters, so that directors are not unduly exposed to liability. The trend of focusing on directors’ duties in the compliance context, which is seen has having been influenced by US corporate law and global standards, is expected to continue to be a major issue in the fields of corporate compliance and governance.
 
Supreme Court Decisions on Directors’ Duties Relating to Internal Controls
 
In recent years, the Supreme Court issued a series of decisions that, in effect, strengthened the corporate directors’ legal duty to monitor compliance.
 
In a November 2021 decision, the Supreme Court held that directors’ duties include the obligation to ensure that the company implement and effectively operate a system of internal controls in areas where there is a high legal risk, taking into consideration the purpose and size of the company, the nature of its business, and regulatory requirements (Supreme Court Decision 2017Da222368, November 11, 2021).
 
Then, in a May 2022 decision, the Supreme Court made clear that directors, including outside directors, can be held liable for (i) breaches that occur in the absence of a system of internal controls, if the directors do not make any effort to encourage the implementation of a system of internal controls; and (ii) breaches that occur when there is an internal controls system but there is a reason for the directors to believe it is not being operated properly, and they do not make any efforts to address such deficiencies (Supreme Court Decision 2017Da222368, May 12, 2022). Applying this principle to the case before the court, the Supreme Court found that the directors were liable for failure to ensure proper implementation and operation of the company’s internal controls, even if they had not, and could not have, known of or suspected the misconduct. The Supreme Court also found that merely conducting training sessions and adopting compliance policies were insufficient to constitute an appropriate “internal controls system,” when there was no means to monitor suspicious activity, deter attempted misconduct, or report any suspected or actual misconduct to the directors.
 
The Supreme Court’s recent trend of strengthening compliance obligations appears to be in part influenced by developments in US corporate law. This includes the Caremark test, set forth by the Delaware Court of Chancery to establish when a director’s lack of oversight may breach their fiduciary duty of loyalty: “(a) directors utterly failed to implement any reporting or information system or controls; or (b) having implemented such a system or controls, consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention.” (In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996).) Subsequent Delaware court decisions have held that the supervisory function of the board of directors should be more stringent for “mission critical” areas of the company; and if it is to be argued that an internal controls system was adequately established at the board of directors level, it is necessary to show that relevant measures were actually taken (e.g., process to report matters to the board of directors, periodic and detailed review of matters, and implementation of necessary measures) (e.g., Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), In re Clovis Oncology Derivative Litigation, 2019 WL 4850188 (Del. Ch. Oct. 1, 2019), In re The Boeing Co. Derivative Litigation, No. 2019-0907-MTZ (Del. Ch. Sept. 7, 2021)). We expect the Korean courts to consider these principles as well when assessing whether directors should be liable for oversight failures.
 
Further, we expect the Korean courts and Government enforcement agencies to act in a manner consistent with this trend of enhanced director liability, especially as it is in line also with ESG standards emphasizing directors’ compliance and monitoring obligations – the “Governance” element of Environmental, Social, and Governance.
 
Implications
 
With this increased focus on director liability and effective internal controls, companies should review their internal controls systems in Korea to ensure that they are effective and directors know how these systems work, and implement measures to regularly monitor their efficacy. The Supreme Court decisions make clear that ensuring the existence and efficacy of internal controls systems is a fundamental aspect of a director’s duty, and directors need to be well-informed of this fact. The systems themselves should be constructed in a manner that allows directors to assess whether the internal controls are effective.
 
And when compliance issues do arise, it’s also important for directors to undertake (and properly document) efforts to address suspected misconduct, as part of a well-running internal controls system. Systems and protocols should be in place to ensure any suspected misconduct is reported to the directors, and the directors continue to be apprised of the subsequent investigation and remediation, with the directors providing input and exercising decision-making authority where appropriate.