Practices Evaluation Approach

Before choosing a consultant or budgeting: decision guides

Use these guides as a checklist when comparing consultants and estimating budget and timeline.

• How to choose an enterprise risk management (ERM) consultant in Taiwan: seven criteriaWhen choosing an ERM consultant, look for one who can turn the risks scattered across departments into a structure the board can decide on, and keep monitoring it with key risk indicators.
• Enterprise risk management (ERM) for listed companies: how to plan budget and timelineThe Taiwan Stock Exchange's Risk Management Best Practice Principles for TWSE/TPEx Listed Companies draw on COSO ERM 2017 and ISO 31000:2018. The budget depends on organisational structure, the scope of the risk inventory and disclosure requirements; the timeline follows the board calendar.
• How to choose an ISO 37001 consultant in Taiwan: ten criteriaWhen choosing an ISO 37001 consultant, first confirm the work follows the 2025 edition and that a 2016 certificate can be transitioned by 28 February 2027; then check that the bribery risk assessment covers agents, overseas markets and cross-border bribery under Article 11 of the Anti-Corruption Act, and that the consultant is honest that certification is not a legal defence.
• A CEO's regulatory priorities: 12 requirements, and the three decisions we recommend you make firstFrom the standpoint of your accountability to the company and the board, this page sets out what proof European customers expect, how fines are calculated, your personal legal liability, and the impact and suggested order of 12 requirements, to help you decide who owns each one and what resources to allocate.
• The General Counsel's regulatory priorities: 10 requirements by liability and contracts, and four decisions we suggest you make firstGiven your duty to protect the company in investigations and claims, what matters is evidence that it did its duty to prevent harm. This page explains 10 requirements in plain language, including anti-bribery, trade secrets, GDPR, the EU CRA and the EU AI Act: the impact of inaction, a suggested order, and the decisions worth your attention first.
• The CRO's board risk report: 11 requirements in priority order, and a framework for your decisionsFrom the standpoint of your accountability to the board, this page sets out ERM, business continuity, anti-bribery, trade secrets, security, AI, and the fine exposure under GDPR, NIS2, the EU CRA and DORA: how to bring them onto one risk map, a suggested order of priority, and how to report to the board.
• Compliance investment priorities for CFOs: ERM, ISO 27001, the EU CRA and 8 more, and the three decisions we suggest you make firstGiven your responsibility for the financial reports you sign, the budget and disclosure, here in plain terms is how 11 security, risk and compliance requirements affect your financial reports, annual report disclosure, the TWSE ESG evaluation and the budget, which to do first, and how they fit your existing internal control.