When Rules Exist But No One Follows Them
I recently had
the chance to give a lecture on internal controls. While pulling together
materials for that talk, I noticed something that says a lot about how
compliance actually works in Korea.
The problem
isn't that rules don't exist. It's that they exist and still aren't followed.
Most Korean
organizations already have plenty of internal regulations. In some cases, there
are so many internal rules, guidelines, and detailed procedures that even the
staff responsible for applying them can't keep track of them all.
You would
expect that with this much rule-making in place, things would run smoothly and
problems would be rare. In reality, that's not what happens. The rules sit on
paper while day-to-day work keeps following old habits and informal shortcuts.
In the end, the rules simply stop having any real effect.
Looking into
actual internal-control failures in Korea, I found that a missing rule was
rarely the real cause. Far more often, a rule existed, but people either
stretched its wording past any reasonable reading of it, or quietly kept doing
things the old way and left the rule as a formality.
The Real Lesson from The Promises of Giants
What is
actually going on here? I found a compelling answer in John Amaechi's book The
Promises of Giants.
The real issue
was the absence of a compliance culture. In other words, the culture itself was
the problem.
As Amaechi
puts it, failing to push back against even the smallest rule violation lets
that kind of behavior become routine, and eventually it produces serious
consequences. Over time, the violation stops looking like a violation at all —
it simply becomes "how things are done," woven into everyday
practice. Once that happens, it becomes extremely hard to undo, because it now
feels as though the organization has always operated this way and always will.
In my view,
the lack of a genuine compliance mindset in Korean society is a serious
problem, and it's even more serious when it starts at the top. When an
organization's leaders have a weak or nonexistent sense of compliance, the
people below them tend to pick up on it almost intuitively and follow suit, so
the same lack of a compliance mindset spreads downward. That's how a culture
without compliance takes hold across an entire organization.
Why Leadership Sets the Tone
When this
absence of compliance spreads through an organization and deepens over time, it
eventually leads to incidents like breach of trust or embezzlement. These
things almost never start big. They typically begin with something small — a
manager using a corporate card for personal expenses, for example. But once
that kind of practice becomes entrenched, it can escalate all the way to
someone treating the company itself as their personal property. What sits at
the center of this progression is a failure of internal control, and it
ultimately ends in cases of breach of trust and embezzlement.
Punishing the Individual Isn't the Same as Fixing the
Culture
The trouble is
that no one recognizes the culture itself as the problem until an incident has
already occurred. Most of the time, once something happens, the matter is
considered resolved simply by punishing whoever was directly involved. But if
you ask whether punishing that one person actually removes the problem from the
organization, I don't think it does. The culture that allowed compliance to
lapse in the first place is still there. And as long as it remains, a similar
problem can — and likely will — happen again.
