These Regulations are adopted pursuant to Article 14-1, paragraph 2 of the Securities and Exchange Act, Article 97-1, paragraph 2 of the Futures Trading Act, and Article 93 of the Securities Investment Trust and Consulting Act.

A service enterprise establishing an internal control system shall do so in accordance with these Regulations and the rules prescribed by the competent authority; provided that where another act or regulation provides otherwise, the provisions of such act shall prevail.

The term "service enterprise" as used in these Regulations includes securities exchanges, over-the-counter securities markets, futures exchanges, central securities depositories, securities firms, futures enterprises, securities finance enterprises, securities investment trust enterprise, securities investment consulting enterprises operating discretionary investment services for customers (hereinafter, “securities investment consulting enterprise”), credit rating agencies, and any other service enterprises in the securities or futures market designated by the competent authority.

The internal control system of a service enterprise is a management process designed by management, passed by the board of directors, and implemented by the board of directors, management, and other personnel, with the aim of promoting sound corporate operations and providing reasonable assurance regarding the achievement of the following objectives:
1. Effectiveness and efficiency of operations.
2. Reliability, timeliness, transparency, and regulatory compliance of reporting.
3. Compliance with applicable laws, regulations, and bylaws.
The objective of effectiveness and efficiency of operations referred to in subparagraph 1 of the preceding paragraph includes objectives such as profits, operating performance, and safeguarding of assets.
The reporting referred to in subparagraph 2 of paragraph 1 includes internal and external financial and non-financial reporting of a service enterprise. The objectives of external financial reporting include ensuring that financial statements for external purposes are prepared in accordance with the regulations governing the preparation of financial reports prescribed for individual service enterprises and with generally accepted accounting principles, and that transactions are made with proper approval.

A service enterprise shall document its internal control system, including internal audit implementation rules, and have them passed by the board of directors. If any director expresses a dissenting opinion, where stated in minutes or in a written statement, the service enterprise shall submit the dissenting opinion to each and all supervisors, together with the internal control system that has been passed by the board of directors. The same shall apply to any amendment thereto.
Where a service enterprise has established the position of independent director, when it submits its internal control system for discussion by the board of directors pursuant to the preceding paragraph, the board of directors shall take into full consideration each independent director's opinion; where an independent director has an objection or reservation, the objection or reservation shall be recorded in the minutes of the meeting of the board of directors.
Where a service enterprise has established an audit committee in accordance with the Securities and Exchange Act, any adoption of or amendment to its internal control system shall be subject to the consent of one-half or more of the entire membership of the audit committee and be submitted to the board of directors for a resolution.
Any matter under the preceding paragraph that has not been approved with the consent of one-half or more of the entire membership of the audit committee may be adopted with the consent of two-thirds or more of the entire board of directors, and the resolution of the audit committee shall be recorded in the board of directors meeting minutes.
The term "entire membership of the audit committee" as used in paragraph 3, and the term "entire board of directors" as used in the preceding paragraph, shall be calculated as the number of members actually in office.
The board of directors of a service enterprise shall recognize operational risks, supervise operational results, and be ultimately responsible for ensuring that an adequate and effective system of internal controls is established and maintained.