금융기관의 내부통제제도 강화를 위한 법적 개선방안 - 은행을 중심으로 -

This paper examines the current internal control systems of the financial institutions with the main focus on banks in Korea. Weak risk management and internal control systems have been widely considered as fundamental problems of the global financial crisis from 2007. To address the defects of the risk management and internal control systems, the legislative efforts to improve companies’ corporate governance have been made in many countries. To keep abreast of these global financial regulatory reforms, the Financial Services Commission proposed tentatively named "The Financial Institutions' Corporate Governance Act". In the wake of the financial crisis in 1998, the Korean government enacted new legal initiatives requiring that banks, mutual savings banks,insurance companies, financial investment businesses, and specialized credit financial businesses establish internal control guidelines and procedures, and maintain at least one compliance officer. Nevertheless, the Woori Bank case(2009) and Kyungnam Bank case(2010)reaffirmed deficiencies of the risk management and internal control systems. In September 2009, the Financial Services Commission imposed a harsh penalty on Woori Bank and its former CEO for the bank’s investments in CDO and CDS in excess of its risk tolerance and risk appetite. Weak risk management and internal control systems were identified as key problems in this case. To address these weaknesses, comprehensive risk management systems should be adopted by financial institutions to tackle excessive risk-taking. Banks should establish a board risk management committee and a Chief Risk Officer(CRO). Apart from financial supervisory regulations, there is no current law requiring risk management committees in financial institutions. Given the increasingly important need for risk oversight in financial institutions, risk management committees and CROs ought to be mandated under Banking Act. Risk management committees and CROs would help prevent senior management from taking excessive risks to pursue firms’ short-term performance. To ensure effective risk management and internal control systems, risk management committees should comprise a majority of outside directors.