Part 8: Practical risk and compliance

Chapter 29 Legal risk management for real estate projects

Legal issues A legal risk matrix is used to assess the likelihood and impact of risks throughout a project. Before buying land, the focus is on ownership, encumbrances, zoning and the community. During construction, it is on contractors, labour, safety and the environment. During sales and transfer, it is on contracts, advertising, quotas and payment documents. For international work, it is on the Foreign Business Act (FBA), nominees, transfer pricing, AML and sanctions.

What the developer must do Assign risk owners, mitigating measures, indicators and a reporting cycle to management. Link the assessment results to the contingency budget and timeline in the financial model. Set up a crisis response team that brings together management, legal, finance, operations and communications. When a crisis occurs, preserve evidence, notify the relevant parties as required by contracts and the law, control communications, and contact lawyers and insurers promptly.

Key risks A matrix prepared only once does not help manage risks that change. Likelihood ratings are qualitative judgements, so they must be reviewed against real data. In a crisis, such as a structural failure, criminal proceedings against a director or the revocation of a permit, an inadequate response in the first 48 hours can magnify the legal and reputational damage.

Chapter 30 Compliance framework and corporate governance

Legal issues A good compliance system uses the Three Lines of Defence, dividing responsibilities among operational staff, the compliance function and internal audit. Key issues are anti-corruption, the PDPA, ESG, whistleblowing channels and legal audits. The PDPA applies to the data of customers, employees and business partners, and a breach that poses a risk must be notified within 72 hours where the law requires. A juristic person should have internal controls to prevent bribery.

What the developer must do Prepare a code of conduct and a gifts policy, screen business partners and agents, train staff, and set up a whistleblowing channel that protects against retaliation. Prepare a privacy notice, a data inventory, data processing agreements and a data breach response plan. Carry out an annual legal audit covering the company, contracts, permits, tax, labour, data, AML, the environment and safety.

Key risks Dealing with government agencies through intermediaries without checks is a bribery risk. Leaked customer data may lead to liability and reputational damage. An ESG report without supporting data may be challenged. Compliance that exists only on paper and is not put into practice does not protect against liability. Penalties and duties should be checked against the current law.

Chapter 31 The role of the legal manager and legal team

Legal issues An in-house legal team must act as both risk controller and business supporter. The team structure depends on the size of the company. There should be a reporting line that provides independence, and a clear relationship with external law firms. Specialised work, litigation and second opinions usually require external lawyers. A large number of contracts must be managed through a system, not merely filed.

What the developer must do Define the scope of work, a template system and an approval matrix. Set up a law firm panel, define billing guidelines and choose a fee arrangement to suit the nature of the work. Use a contract management system to track key dates and contractual obligations. Measure KPIs such as contract turnaround time, dispute closure time, training and compliance incidents, and keep knowledge in a central system.

Key risks A team brought in too late becomes a follower that merely fixes problems. Reporting without independence may put pressure on the opinions given. Cutting the legal budget without considering risk may prove costly later. Contract templates that are not updated spread errors across the whole project. The budget figures and KPIs in the original document are only guidelines.