ERM for the CEO: what to settle first on the board, the internal control statement and personal liability?

What is the CEO's role in ERM, and how is work divided with the board and the risk management committee?

Under the TWSE Risk Management Best Practice Principles for Listed Companies, the division of work is:

Article 23 of the Corporate Governance Best-Practice Principles for TWSE/TPEx Listed Companies also requires that the duties of the chairman and the CEO be clearly divided, and that the two roles should not be held by the same person. The CEO's practical job is to appoint the promotion unit, require every unit to assess risk with one method, and bring the results into management decisions. Companies that are not public companies are not covered by either set of principles and can use them voluntarily.

After a major loss, how does a CEO show that they exercised due care?

Start with the framework for judgment:

• Company Act, Article 8(2): a manager of a company is also a responsible person of the company within the scope of their duties.
• Company Act, Article 23: a responsible person shall perform their duties loyally and with the care of a good administrator, and is liable for damages if a breach causes loss to the company; if a breach of law in conducting company business causes loss to others, they are jointly liable with the company.
• Securities and Exchange Act, Article 20-1 (public companies): those who signed or sealed the financial reports are liable for damages, unless they can show they exercised due care and had reasonable grounds to believe the content contained no false statements or omissions.

What ERM leaves behind is a record of the process: the board-approved policy, the risk register, KRIs and each report, showing when the company knew which risks, how it assessed them and what it decided. Whether those records are enough to show due care is for legal counsel to judge case by case; this page does not draw that conclusion for you.

The CEO issues the internal control statement together with the board. How does ERM relate to internal control?

Under Taiwan's internal control regulations for public companies, the self-assessment is the main basis for the board and the CEO to issue the internal control statement; the statement is approved by the board and filed within three months after the end of the financial year (Articles 22 and 24).

The service page draws the line this way: internal control deals with the effectiveness of control activities; ERM deals with strategic-level risk and opportunity, and the two complement each other. In practice:

• Feed the internal audit results of the security, continuity and anti-bribery management systems into the basis for the annual self-assessment
• When the ERM risk register adds a risk, check whether each internal control cycle has a matching control point
• Put findings into the existing corrective action tracking instead of a second process

The internal control statement and financial reporting matters are for the external auditor to judge. These regulations apply to public companies; companies that are not public companies are not covered and can use them voluntarily.

With a limited budget and security, privacy, AI, continuity and anti-bribery all arriving at once, what should the CEO do first?

Rank them on one risk map instead of letting each department compete for budget:

1. Classify: under Article 18 of the risk management principles, place each requirement in strategic, operational, financial, information, compliance, integrity or other emerging risk.
2. Assess impact: penalty ceilings are a reference point, for example GDPR at up to 4% of worldwide annual turnover or EUR 20 million, and the EU CRA essential requirements at up to EUR 15 million or 2.5%; customer requirements, market access and reputational loss usually hit earlier than fines and belong in the same assessment.
3. Check against risk appetite: the appetite approved by the risk management committee decides what comes first; the board allocates resources under Article 13.
4. Build the shared backbone first: for example, use ISO 27001 as the backbone so ISO 27701, 22301 and 42001 share one management system and later timelines get shorter.

A ranking built this way goes straight into the board report.

Do we need a CRO? Who should the risk management promotion unit report to?

• The principles have no CRO title: Article 12 of the TWSE Risk Management Best Practice Principles requires companies to designate or set up an appropriate risk management promotion and execution unit; other functional committees or working groups may also take the place of the risk management committee (Article 11).
• Banks and financial holding companies differ: under Article 21 of the implementation rules on internal control and audit for financial holding companies and banks, they set up a dedicated risk management unit reporting to the president and appoint a chief risk officer at senior vice president level or above, or with equivalent duties.
• Small companies: the service page suggests that a small company that is not yet a public company, with a single business and risk concentrated in a few items, can start with one risk register and a quarterly review under the ISO 31000 process, without a committee.

Whether to appoint a dedicated head depends on size, industry and what the board expects; companies that are not public companies are not covered by these principles and can use them voluntarily.

How do we account to the ESG evaluation and shareholders, and how soon can we make the first board report?

• ESG evaluation G-18 (same wording in the 2026 and 2027 editions, AA item): risk management overseen by the audit committee or a board-level functional committee, board-approved risk management policy and procedures, disclosure of the organisation, procedures and operation, and a report to the board at least once a year; companies that meet the criteria get one extra point overall. The evaluation covers listed companies; companies that are not public companies are not evaluated.
• External disclosure: Article 28 of the principles calls for disclosure of the risk management policy, organisation and operation on the company website or the Market Observation Post System.
• Timeline (as listed on the service page): four phases, usually 4–6 months: diagnosis and governance design, policy, appetite and method, risk assessment and KRIs, then reporting, disclosure and handover; the first board report usually comes at the end of month 3. Companies with several ISO management systems or a group COSO framework take about 3–4 months.

How does Winners Consulting help a CEO with ERM?

This is Winners Consulting's own description; hold us to the questions above.

• Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced
• One risk map: COSO's five components organise the board report and the ISO 31000 process unifies the method, bringing security, continuity, AI and privacy risk onto one risk map
• Mapped to the articles: every deliverable maps to the article numbers of the principles and the evaluation indicators; no thick reports the board will not read
• Division of work: we build the system, method and reports; the internal control statement and financial reporting matters stay with the external auditor, and legal opinions with partner lawyers
• After go-live: 90-day follow-up and an annual review
• Named client: Taiwan Stock Exchange (TWSE) (internal control system integrated with ISO 9000 and ISMS)
• First step: the first mechanism diagnosis is free

Go deeper: ERM consulting, Choosing an ERM consultant, ERM budget and timeline, CRO role page, CFO role page