Legal and HR leads running a South African subsidiary or regional hub tend to assume global policy has already covered most of the risk. It usually hasn’t — not because the global framework is wrong, but because it wasn’t built for this jurisdiction.
Here’s where that gap tends to actually sit.
Local governance obligations don’t disappear because a global framework exists
South African company law imposes its own director duties, board and secretarial requirements, and reporting obligations, regardless of what’s already documented at head office. The real cost usually isn’t drafting a new policy from scratch — it’s the local legal team not knowing what can simply be adopted from global policy versus what genuinely needs local work.
King IV sits in a grey zone that’s easy to get wrong in either direction
King IV isn’t binding legislation, but funders, auditors and boards increasingly treat it as the reference standard regardless of formal obligation. Adopting all of it reflexively wastes effort; ignoring it entirely creates a credibility gap with exactly the stakeholders who expect to see it. Getting the level right depends on ownership structure, funding relationships, and board maturity — not a blanket policy either way.
Compliance obligations built for a different jurisdiction leave real gaps here
Exchange control, transfer pricing, sector-specific licensing, and local reporting obligations rarely show up in a compliance framework built at head office for a different regulatory environment. This is where “we assumed this was covered” most often turns into an actual finding.
Policies without a named owner and a review date drift out of date silently
A policy, a procedure, and a compliance framework serve different functions, but the more common failure isn’t confusing the three — it’s a policy that was correct when written and has quietly gone stale because no one owns keeping it current. Review frequency needs a fixed date and a named person attached, not a vague intention.
Employment law here changes often enough to outdate a compliance position within a year
A compliance check confirmed twelve months ago can already be behind the current legal position. This is the area most worth a standing, diarised review rather than a one-off check — and it’s consistently where the highest volume of genuine business questions land.
Recruitment risk usually traces back to a missing joiner, mover, leaver framework
Without a structured process for the legal and compliance steps triggered at each stage of employment — onboarding, role change, exit — legal risk around hiring and termination gets handled ad hoc, matter by matter. That’s exactly the pattern behind most of the recruitment delays and disputes we see.
POPIA and GDPR aren’t interchangeable, even when the parent company assumes they are
A GDPR-compliant global policy usually needs local adaptation to satisfy POPIA, not just relabelling. Cross-border transfer of personal information and the role of a locally appointed information officer are the two questions that come up most often for subsidiaries specifically — and the two most likely to be assumed away rather than actually checked.
The trigger point for fractional legal support is usually earlier than businesses expect
There’s no fixed headcount threshold, but the ratio of employees supported per in-house lawyer has been trending upward across the industry — which is precisely the gap a fractional or on-demand model is built to close, without committing to a full-time hire before the workload justifies it.
A practical way to use this
Most of what’s above traces back to the same fix: a short audit of what’s genuinely local-only versus what can be adopted from global policy, with clear ownership assigned to whatever’s left. That’s a faster and cheaper starting point than a full legal function review.
Bottom line: for multinational subsidiaries, the biggest legal risk usually isn’t an unfamiliar law. It’s an assumption that global policy already covers a gap that only local counsel can actually close.
