Direct answer: the budget for enterprise risk management depends on three things: how far the organisational structure is built out, how many business units the risk inventory covers, and the external disclosure requirements. The timeline follows the board calendar, because the risk-management policy, the risk appetite and the annual report all need board approval. ISO 31000 is a guidance standard that is not used for certification, so the investment in ERM is about making governance actually work, not about obtaining a certificate.
The basis: the stock exchange's best practice principles
Under "Corporate Governance 3.0", the Taiwan Stock Exchange issued the Risk Management Best Practice Principles for TWSE/TPEx Listed Companies, drawing on COSO ERM 2017, ISO 31000:2018 and the risk-management best practice principles of the financial and insurance sectors. They cover policy, procedures and execution, and companies may adopt them as appropriate to their size, business and risk profile. The principles also require an organisational structure with a governance unit, a risk management committee and units that promote and execute risk management, and require the risk-management policy, organisational structure and operation to be disclosed on the company website or the Market Observation Post System.
Three factors determine the budget
| Factor | What it affects |
|---|---|
| Organisational structure | Whether a risk management committee reporting to the board is set up; the staffing and responsibilities of the promoting unit |
| Inventory scope | The number of business units, subsidiaries and overseas sites covered |
| Disclosure and reporting | The depth of disclosure in the annual report, the sustainability report and the Market Observation Post System, and the build-out of key risk indicators |
How to plan the timeline
- Current-state diagnosis: inventory existing risk-management practices and gaps.
- Policy and structure: set the risk-management policy, risk appetite and organisational structure, and submit them to the board for approval.
- Risk inventory and assessment: each unit identifies and assesses its risks and sets priorities.
- Monitoring and reporting: establish key risk indicators and a mechanism for regular reporting to the board, and complete external disclosure.
Steps 2 and 4 both have to align with board meeting dates; that is the part that cannot be compressed.
How Winners approaches it
- Build the risk appetite, the three lines of defence and the board reporting mechanism in line with the stock exchange's principles, COSO ERM and ISO 31000.
- Process definition: who is responsible, what is done, when, and where the evidence of doing or not doing it is.
- VP- and director-level consultants guide the whole engagement; the team includes COSO ERM enterprise risk management specialists.
How to choose an ERM consultant in Taiwan Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.