Internal Control, Compliance Risk and the Compliance Officer's Duties
What this domain tests
The 내부통제기준 required by the Act on Corporate Governance of Financial Companies (금융회사 지배구조법) and the Insurance Business Act, and the independence and duties of the 준법감시인 (compliance officer) in a branch setting.
Core rules
- The compliance officer must be independent of business lines, must be able to attend board meetings, and cannot be removed without a board resolution and notification to the FSS. In a branch, the local 준법감시인 reports to the branch manager and to the parent's group compliance function.
- Duties include pre-review of new products, riders and advertisements; compliance risk assessment; monitoring and testing; regulatory change management; staff training; complaint analysis; and operating the whistleblowing channel.
- The three-lines model separates business (first), compliance and risk (second) and internal audit (third). Compliance may not substitute for audit, and audit may not be outsourced.
- Escalation to the board is mandatory for material breaches, and annual (or semi-annual) compliance reporting is expected.
Worked example
A branch plans to launch a critical-illness rider with a 30-day waiting period and an advertisement promising "guaranteed payout". Compliance pre-review finds the advertisement omits the waiting period and the exclusion for pre-existing conditions. The correct action is to block the advertisement until revised and to record the review in the product approval file - not to approve with a note, because advertising is a conduct rule item under consumer protection law as well as an internal-control item.
Traps that cost marks
- Treating compliance as a synonym for internal audit.
- A compliance officer who signs off on launches without documented evidence of review.
- Outsourcing compliance monitoring to a group function without local oversight.