Putting this into practice
Winners Consulting helps organizations turn this concept into workable policies, processes and audit readiness.
Step 1 of 3
You looked up “Design for Sustainability”. Which situation is closest to yours?
Common situations behind “Design for Sustainability” and the first step
- A listed company must meet the risk management practice guidelines and governance evaluation：Set up risk policy, structure and reporting so the board sees strategic risks
- Investors or ESG ratings ask for risk management evidence：Build disclosable risk records based on COSO ERM or ISO 31000
- You want one view of risks across departments：Check that the advisor links risk with operations, security and compliance in one system
Winners Consulting provides ISO 31000 enterprise risk management consulting. Vice-president and director-level consultants lead the work end to end with no outsourcing, and one set of evidence answers several laws and customer requirements.
Before choosing a consultant or budgeting: decision guides
Use these guides as a checklist when comparing consultants and estimating budget and timeline.
- How to choose an enterprise risk management (ERM) consultant in Taiwan: seven criteriaWhen choosing an ERM consultant, look for one who can turn the risks scattered across departments into a structure the board can decide on, and keep monitoring it with key risk indicators.
- Enterprise risk management (ERM) for listed companies: how to plan budget and timelineThe Taiwan Stock Exchange's Risk Management Best Practice Principles for TWSE/TPEx Listed Companies draw on COSO ERM 2017 and ISO 31000:2018. The budget depends on organisational structure, the scope of the risk inventory and disclosure requirements; the timeline follows the board calendar.
- How to choose an ISO 37001 consultant in Taiwan: ten criteriaWhen choosing an ISO 37001 consultant, first confirm the work follows the 2025 edition and that a 2016 certificate can be transitioned by 28 February 2027; then check that the bribery risk assessment covers agents, overseas markets and cross-border bribery under Article 11 of the Anti-Corruption Act, and that the consultant is honest that certification is not a legal defence.
- A CEO's regulatory priorities: 12 requirements, and the three decisions we recommend you make firstFrom the standpoint of your accountability to the company and the board, this page sets out what proof European customers expect, how fines are calculated, your personal legal liability, and the impact and suggested order of 12 requirements, to help you decide who owns each one and what resources to allocate.
- The General Counsel's regulatory priorities: 10 requirements by liability and contracts, and four decisions we suggest you make firstGiven your duty to protect the company in investigations and claims, what matters is evidence that it did its duty to prevent harm. This page explains 10 requirements in plain language, including anti-bribery, trade secrets, GDPR, the EU CRA and the EU AI Act: the impact of inaction, a suggested order, and the decisions worth your attention first.
- The CRO's board risk report: 11 requirements in priority order, and a framework for your decisionsFrom the standpoint of your accountability to the board, this page sets out ERM, business continuity, anti-bribery, trade secrets, security, AI, and the fine exposure under GDPR, NIS2, the EU CRA and DORA: how to bring them onto one risk map, a suggested order of priority, and how to report to the board.
- Compliance investment priorities for CFOs: ERM, ISO 27001, the EU CRA and 8 more, and the three decisions we suggest you make firstGiven your responsibility for the financial reports you sign, the budget and disclosure, here in plain terms is how 11 security, risk and compliance requirements affect your financial reports, annual report disclosure, the TWSE ESG evaluation and the budget, which to do first, and how they fit your existing internal control.
Need help with compliance implementation?
Request Free Assessment