Director’s Duty of Oversight & Internal Control in South Korea: Four Supreme Court Rulings
Internal Control in South Korea
Contents
- 1. A CEO Receives a Call — After a Cartel Fine of KRW 32 Billion
- 2. What Is a Director’s Duty of Oversight in South Korea?
- 3. The Leading Case: What Did Supreme Court Decision 2017Da222368 Decide?
- 4. Supreme Court Decision 2006Da68636 — The Foundation of Internal Control Liability
- 5. Supreme Court Decision 2007Da31518 — Does the Same Duty Apply to Statutory Auditors?
- 6. Supreme Court Decision 2021Da279347 — How Far Does an Outside Director’s Duty Extend?
- 7. What Are the Core Legal Principles Running Through All Four Decisions?
- 8. Practical Implications — What Should Companies and Directors Do Now?
- 9. Frequently Asked Questions
In December 2014, a former CEO of a South Korean steel manufacturer received a lawsuit. His company had been fined KRW 32 billion for price-fixing — yet he had never personally ordered, or even been briefed about, a single cartel meeting. Could he escape liability?
The short answer is no. The Supreme Court of Korea held that a CEO who fails to build a reasonable internal control system — or who deliberately turns a blind eye to the duty to monitor business operations — is liable for the resulting damages under Article 399(1) of the Commercial Act, even without specific knowledge of the wrongdoing (Supreme Court Decision 2017Da222368, November 11, 2021). “I didn’t know” is not a defense.
Atlas Legal advises corporate clients and foreign-invested companies across Incheon Songdo and the broader Seoul metropolitan area. In that work, we encounter the director oversight issue more often than clients expect — frequently in contexts where no one anticipated personal liability. This article analyzes the four Supreme Court decisions that form the legal framework, drawing exclusively from the published texts of those decisions.
A CEO Receives a Call — After a Cartel Fine of KRW 32 Billion in South Korea
When the Korea Fair Trade Commission issues a cartel fine, the corporate legal team asks two questions immediately: how large is the penalty, and what is the personal legal exposure for the directors? In listed companies where a shareholder derivative suit is possible, the answer to the second question depends almost entirely on whether the directors discharged their duty of oversight.
Article 399(1) of the Commercial Act provides that a director who, willfully or negligently, violates any statute or the articles of incorporation, or who neglects their duties, shall be jointly and severally liable to the company for any resulting damages. When this provision is combined with the duty of oversight, a CEO who “didn’t know” about the cartel faces a serious liability risk.
What Is a Director’s Duty of Oversight in South Korea?
Under Korean corporate law, a director is not only responsible for their own assigned duties — they also bear an obligation to monitor the business execution of other managing directors. The CEO, in particular, holds authority over all aspects of the company’s business (Commercial Act, Articles 389(3) and 209(1)) and therefore bears a duty to supervise all employees as well as to monitor and control the overall business execution of every other director on the board.
The practical difficulty is that no CEO of a large organization can realistically be aware of every business decision made at every level. Cartel conduct is typically carried out at the operational level, over an extended period, and in a manner specifically designed to avoid escalation to senior management. The Supreme Court introduced the concept of an “internal control system” precisely to address this structural reality.
The director’s duty of oversight is not simply a question of whether the director personally knew about the misconduct. It is a question of whether the director put in place a system through which such misconduct could have been known — and took steps to ensure that system actually worked.
The Leading Case: What Did Supreme Court Decision 2017Da222368 Decide?
Supreme Court Decision 2017Da222368 (November 11, 2021) is the current leading authority on a CEO’s obligation to build an internal control system in South Korea. The facts are as follows.
Supreme Court Decision 2017Da222368 — Summary of Facts
Union Steel Co., Ltd., a steel manufacturer, received three cartel fines totaling approximately KRW 32 billion from the KFTC in 2013 for price-fixing in galvanized steel, cold-rolled steel, and color-coated steel. The cartel conduct ran from November 2004 through November 2010 — nearly six years — and was carried out through systematic meetings among managing officers and sales team leaders.
A minority shareholder filed a derivative action against the CEO who had served from March 16, 2004 to March 15, 2011. The CEO argued that he had never personally directed or been briefed on any cartel activity.
The Supreme Court’s Decision — Reversed and Remanded
The Seoul High Court had dismissed the shareholder’s claim, finding no concrete evidence that the CEO had permitted or failed to prevent the cartel conduct. The Supreme Court reversed and remanded, articulating two core legal principles.
[Principle 1] Even in a large company where internal specialization makes it inevitable for each director to handle only their own area, that fact alone does not relieve directors of the duty to oversee one another’s business execution. If a director fails entirely to build a reasonable information, reporting, and internal control system, or deliberately ignores the duty to monitor the company’s overall operations, that director is liable for damages arising from the resulting failure to prevent misconduct by other directors. (Supreme Court Decision 2017Da222368)
[Principle 2] An internal control system must not be limited to accounting controls designed to prevent financial fraud. It must be structured to systematically monitor compliance with all laws applicable to the company’s business operations, and to enable immediate reporting and corrective action upon discovery of any violation. (Supreme Court Decision 2017Da222368)
The Supreme Court further found that Union Steel operated in an oligopolistic market where cartel risk was structurally elevated, that the CEO had taken no steps to build any compliance mechanism relevant to price-fixing risk, and that the internal controls the CEO pointed to — including an internal accounting management system, a code of ethics, and the appointment of outside directors — did not function as instruments for detecting, reporting, or preventing cartel conduct.
Supreme Court Decision 2006Da68636 — The Foundation of Internal Control Liability in South Korea
Supreme Court Decision 2006Da68636 (September 11, 2008) arose from the Daewoo accounting fraud and is the precedent explicitly cited by the 2017Da222368 court. Shinhan Bank brought a third-party damages claim against Daewoo’s directors under Article 401(1) of the Commercial Act.
Supreme Court Decision 2006Da68636 — Summary of Facts
Daewoo’s actual net equity in fiscal year 1997 was approximately negative KRW 10.07 trillion. Its executives falsified the financial statements to show positive net equity of approximately KRW 2.75 trillion. Shinhan Bank purchased Daewoo bonds in reliance on those statements and suffered losses when Daewoo collapsed. The bank sued Daewoo’s directors, including co-CEOs who had not personally directed the fraud.
The Supreme Court rejected the defense that the co-CEOs had not been officially informed of the accounting fraud. Daewoo had no reasonable information, reporting, or internal control system capable of detecting or preventing fraudulent financial reporting. The directors who were not directly involved in the fraud had nonetheless paid no attention whatsoever to the risk of fraudulent accounting. The Court also noted that board meetings had not been genuinely held — minutes had been fabricated and stamped with directors’ seals in their absence.
This decision also confirmed that third-party claims against directors under Article 401 of the Commercial Act are subject to the general ten-year limitation period under Article 162(1) of the Civil Act, not the three-year short-term limitation applicable to ordinary torts.
Supreme Court Decision 2007Da31518 — Does the Same Duty Apply to Statutory Auditors in South Korea?
Supreme Court Decision 2007Da31518 (September 11, 2008) arose from accounting fraud at Daewoo Heavy Industries and was handed down on the same day as 2006Da68636. Korea Life Insurance (now Hanwha Life) brought a third-party damages claim against Daewoo Heavy Industries’ officers. The decision is notable for expressly extending the internal control obligation to statutory auditors.
Supreme Court Decision 2007Da31518 — Key Holding on Statutory Auditors
In a highly specialized large corporation such as Daewoo Heavy Industries, the obligation to build a reasonable information and reporting system and internal control system, and to ensure that it functions properly, applies not only to the individual directors who constitute the board but also to the statutory auditor who is responsible for auditing their business execution. (Supreme Court Decision 2007Da31518)
The Court grounded this extension in the auditor’s statutory powers under the Commercial Act: the duty to audit directors’ business execution and to report violations to the board (Article 412), the right to request reports on business activities and to investigate the company’s affairs and financial position (Article 412(2)), and the duty to state opinions before the general shareholders’ meeting regarding any violation or material impropriety in the documents submitted by the directors (Article 413).
A particularly important point: the Court held that where a large listed company has allowed certain officers to act arbitrarily without restraint, and where auditors’ access to material financial information is systematically blocked, the auditor’s duty of care is not reduced — it is substantially heightened. Difficulty of detection is not a mitigating factor; it is a warning sign that demands more active scrutiny.
Supreme Court Decision 2021Da279347 — How Far Does an Outside Director’s Duty Extend in South Korea?
Supreme Court Decision 2021Da279347 (May 12, 2022) arose from bid-rigging by Daewoo Engineering & Construction in the Four Major Rivers Restoration Project and other public infrastructure tenders. While 2017Da222368 focused primarily on the CEO’s obligation, this decision addressed the duty of all directors — including outside directors — and set out a more specific standard for when an outside director’s oversight failure gives rise to liability.
Supreme Court Decision 2021Da279347 — Standard for Outside Director Liability
A director who does not participate in the company’s day-to-day business execution — such as an outside director — may be found in breach of the oversight duty where: (i) no internal control system exists at all and the director has failed to urge its establishment; or (ii) an internal control system exists but there are grounds to suspect it is not functioning properly, and the director ignores those grounds and takes no remedial action. (Supreme Court Decision 2021Da279347)
The Supreme Court found that the following facts, taken together, established breach by the outside directors:
- Daewoo E&C had a code of ethics and corporate conduct guidelines, but these were abstract documents that provided no mechanism for detecting, reporting, or controlling bid-rigging activity.
- The bid-rigging was conducted at the level of individual business divisions without board reporting — meaning that the responsible employees faced no supervision or restraint from the directors.
- Daewoo E&C had been subject to multiple KFTC penalties for bid-rigging during the directors’ tenures, and the conduct had been widely reported in the media, providing more than sufficient grounds to recognize the need for a genuine compliance system.
- The Supreme Court had already announced the internal control obligation in 2008 (Decision 2006Da68636), yet none of the defendant directors took any steps to comply.
This decision also confirmed that courts may limit the amount of a director’s liability based on factors including the nature and circumstances of the breach, the director’s historical contributions to the company, whether the director personally profited, and whether an adequate risk management system was in place. The determination of the reduction ratio is within the trial court’s discretion, subject to the overriding principle of fairness.
What Are the Core Legal Principles Running Through All Four Decisions?
The table below compares the four decisions side by side.
| Decision | Background | Core Holding | Statutory Basis |
|---|---|---|---|
| Supreme Court 2006Da68636 (Sep. 11, 2008) | Daewoo accounting fraud (third-party claim) |
First declaration of directors’ obligation to build an internal control system; division of duties does not excuse oversight failure | Commercial Act Art. 401(1) |
| Supreme Court 2007Da31518 (Sep. 11, 2008) | Daewoo Heavy Industries accounting fraud (third-party claim) |
Same obligation extended to statutory auditors | Commercial Act Art. 401, 414 |
| Supreme Court 2017Da222368 (Nov. 11, 2021) | Union Steel price-fixing (shareholder derivative suit) |
Internal control must cover all regulatory compliance, not only accounting; CEO’s obligation strengthened | Commercial Act Art. 399(1) |
| Supreme Court 2021Da279347 (May 12, 2022) | Daewoo E&C bid-rigging (shareholder derivative suit) |
Oversight duty applies to all directors including outside directors; specific standard for outside director breach articulated | Commercial Act Art. 399(1) |
Three principles run through all four decisions:
- Division of duties is not a defense. No matter how reasonable the internal division of responsibilities within a large organization, it does not relieve any individual director of the duty to oversee the company’s overall operations.
- The obligation is to build and operate a system. Directors must create a reasonable information, reporting, and internal control system — and take steps to ensure it actually functions.
- Ignorance is not a defense where the system was absent. A director cannot escape liability simply by showing they had no specific knowledge of the misconduct, if the reason they lacked knowledge is that no adequate system existed to surface it.
Practical Implications — What Should Companies and Directors Do Now?
The Supreme Court’s decisions establish a clear standard, but translating that standard into organizational practice requires specific steps. Atlas Legal regularly advises corporate clients in South Korea on the following.
Audit the Substance of Your Compliance Program
A code of ethics or conduct guidelines on paper is not enough. The Supreme Court explicitly characterized such documents as “abstract and general guidelines” that do not constitute an adequate internal control system. Each material legal risk area — price-fixing, bid-rigging, anti-bribery, data privacy — must have a specific detection, escalation, and remediation mechanism built around it.
Document Board-Level Oversight of Internal Controls
The board must receive regular reports on the status of the internal control system and those discussions must appear in the minutes. In litigation, the minutes are the primary evidence that directors discharged their oversight obligations. Undocumented discussions do not exist for litigation purposes.
Focus Resources on High-Risk Business Areas
The Supreme Court specifically noted that the internal control obligation is most demanding where the company’s activities carry a structurally elevated legal risk. Companies operating in oligopolistic markets, participating in public procurement, or engaged in cross-border transactions should have reinforced compliance mechanisms in those areas.
Ensure Outside Directors Have Adequate Information Access
Outside directors cannot discharge their obligation to urge the establishment or proper operation of an internal control system unless they are provided with the information necessary to evaluate it. Pre-meeting materials and briefings should be structured to enable outside directors to ask substantive questions — not merely to ratify management decisions.
Frequently Asked Questions
Q. Can a CEO in South Korea be held liable for misconduct they were unaware of?
A. Yes. The Supreme Court held that a CEO who fails to build a reasonable internal control system, or who deliberately ignores the duty to monitor corporate operations, is liable for damages suffered by the company under Article 399(1) of the Commercial Act — even without specific knowledge of the misconduct (Supreme Court Decision 2017Da222368, November 11, 2021).
Q. Does an internal control system in South Korea need to cover more than accounting?
A. Yes. The Supreme Court clarified that an internal control system must not be limited to accounting controls. It must systematically monitor compliance with all applicable laws governing business operations and provide a mechanism to detect, report, and remedy violations (Supreme Court Decision 2017Da222368).
Q. Are outside directors in South Korea subject to oversight duties regarding internal controls?
A. Yes. The Supreme Court confirmed that outside directors are subject to the same supervisory duty and may be found in breach if they fail to urge the establishment of an internal control system when none exists, or if they ignore clear signs that an existing system is not functioning (Supreme Court Decision 2021Da279347, May 12, 2022).
Q. Can a director in South Korea be excused from oversight liability by pointing to division of duties?
A. No. The Supreme Court consistently held that the internal division of duties within a large corporation does not relieve individual directors of their duty to oversee the business as a whole. This principle is consistent across all four decisions addressed in this article.
Q. Does a statutory auditor in South Korea also bear internal control obligations?
A. Yes. In the Daewoo Heavy Industries case, the Supreme Court extended the obligation to build and maintain a reasonable information, reporting, and internal control system to statutory auditors in addition to directors (Supreme Court Decision 2007Da31518, September 11, 2008).
Q. Can a director’s liability be reduced by the court in South Korea?
A. Yes. The Supreme Court confirmed that courts may limit the amount of damages payable by a director, taking into account the nature of the breach, the director’s historical contributions to the company, whether the director personally profited, and whether adequate risk management systems were in place. However, the determination of the reduction ratio rests within the discretion of the trial court (Supreme Court Decision 2021Da279347).
Q. What is the statute of limitations for a third-party damages claim against a director under South Korean law?
A. Ten years. The Supreme Court held that a third party’s damages claim against a director under Article 401 of the Commercial Act is subject to the general ten-year limitation period under Article 162(1) of the Civil Act, not the three-year short-term limitation for tort claims (Supreme Court Decision 2006Da68636, September 11, 2008).
For advice on director liability, internal control systems, shareholder derivative suits, and corporate compliance in South Korea, please contact Atlas Legal in Incheon Songdo: +82-32-864-8300 or info@atlaw.kr.
This article is intended for general informational purposes only and does not constitute legal advice. Readers should consult a qualified attorney regarding their specific circumstances. All case descriptions are based on the published texts of the decisions cited.
