Direct answer: the value of an enterprise risk management consultant lies in turning the risks scattered across departments into a structure the board can read and decide on, and in keeping it running. ISO 31000 is a guidance standard and cannot be used for certification, so choosing an ERM consultant is not about whether you can "get a certificate" but about whether the system actually enters management decision-making.
Seven criteria
| Criterion | A question you can put to any consultant |
|---|---|
| Choice of framework | How are COSO ERM and ISO 31000 combined? |
| Risk appetite | How is the board's risk appetite set and used? |
| Three lines of defence | How are responsibilities divided among departments, risk management and audit? |
| Continuous monitoring | How are risks tracked? |
| Who leads | Who actually runs the engagement? What are their qualifications? |
| Named cases and reference customers | Can you provide named cases or reference contacts in my industry and at my scale? |
| Clarity of the quote | Which deliverables are included? Which are not? How are extras charged? |
How Winners addresses these criteria
What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.
- Choice of framework: the two are combined according to your corporate governance needs
- Risk appetite: a risk management policy and risk appetite are established and connected to decision-making
- Three lines of defence: the roles of the three lines and the board reporting mechanism are clarified
- Continuous monitoring: key risk indicators (KRIs) provide continuous monitoring
- Who leads: VP- and director-level consultants guide the whole engagement and nothing is outsourced; the team includes COSO ERM enterprise risk management specialists
When you may not need a consultant
If you only have a single risk topic (for example information security or foreign exchange), a specialist consultant in that field may be the more direct route.
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.