How many hours of continuing education must an accounting head complete?

Under Article 6 of the regulations on qualifications and continuing education of accounting heads, 30 hours or more within the first year (including at least 3 hours of ethics and legal liability), then 12 hours or more every year, covering accounting, auditing, finance, financial regulation, corporate governance, ethics and legal liability.

What cybersecurity information must the annual report disclose?

Article 18, item 6 of the annual report regulations requires the cybersecurity risk management framework, policy, concrete programmes and resources invested, and the losses, possible effects and responses for major cybersecurity incidents in the latest year and up to the printing date.

Which certifications earn a bonus in the TWSE ESG evaluation?

In the 2026 and 2027 indicators, S-12 adds one point overall for ISO 27001, CNS 27001 or similar third-party certification; S-10 adds one point for TIPS, ISO 56001 or similar third-party certification; G-18 on risk management is an AA item worth one extra point.

What are the maximum fines under EU law?

GDPR: 4% of worldwide annual turnover or EUR 20 million; EU CRA essential requirements: EUR 15 million or 2.5%; EU AI Act: EUR 35 million or 7% for prohibited practices and EUR 15 million or 3% for other obligations; whichever is higher in each case.

How are consulting fees estimated?

They depend on scope, products and the maturity of existing systems; Winners provides a case-specific estimate after the free diagnosis. The budget guides for CRA, TISAX, ISO 27701, AI governance, ERM, ISO 22301 and ISO 56001 show the cost structure.

How should a CFO judge investment in security, risk and compliance? 8 requirements explained one by one

Direct answer: for a CFO, security, risk and compliance are more than a cost. Under Article 14 of Taiwan's Securities and Exchange Act, a public company's financial reports must be signed or sealed by the chairman, managers and the accounting head, with a statement that they contain no false statements or omissions; under Article 20-1, the signers are liable for damages unless they can show they exercised due care. The CFO also owns the finance-related cycles of internal control, the cybersecurity and integrity disclosures in the annual report, cybersecurity risk among the annual report's risk items, and the budget for compliance investment. Winners Consulting's services give a CFO three kinds of value: a system and evidence behind the annual report and ESG evaluation disclosures; EU penalties and market access risk translated into impact; and every compliance investment tied to a customer, a market or an evaluation bonus.

The CFO's responsibilities in the rules

Rule	Key wording	What it means for the CFO
Securities and Exchange Act, Article 14(3)	Financial reports must be signed or sealed by the chairman, managers and the accounting head, with a statement that they contain no false statements or omissions	The signers answer for the accuracy of the financial reports
Securities and Exchange Act, Article 20-1	Officers who signed or sealed the financial reports are liable for damages, unless they can show they exercised due care and had reasonable grounds to believe the content contained no false statements or omissions	"Due care" has to be provable with a system and records
Regulations on qualifications and continuing education of accounting heads, Article 6	A newly appointed accounting head completes 30 hours or more of training within one year (including at least 3 hours of ethics and legal liability), then 12 hours or more every year, with subjects including corporate governance	A statutory continuing education duty
Internal control regulations for public companies, Articles 7 and 8	Sales and collection, purchasing and payment, financing and investment cycles; controls over lending of funds, related-party transactions and financial statement preparation; listed companies also cover sustainability information	The finance cycles are where compliance systems must connect
Internal control regulations, Articles 22 and 24	The self-assessment is the main basis for the board and the president to issue the internal control statement; the statement is approved by the board and filed within three months after the end of the financial year	Audit and self-assessment results of new systems must feed the statement
Annual report regulations, Article 18, item 6	Disclose the cybersecurity risk management framework, policy, concrete programmes and resources invested, and the losses, possible effects and responses for major cybersecurity incidents	Security spending and incident losses must be explainable in financial terms
Annual report regulations, Article 20, item 6	Analyse the effect of major domestic and foreign policy and legal changes, and of technology change (including cybersecurity risk), on the company's finances and business, and the responses	EU law and cybersecurity risk belong among the annual report's risk items

TWSE ESG evaluation: indicators where third-party certification earns a bonus

The ESG evaluation replaced the corporate governance evaluation from 2026 and covers listed companies. The indicators below have the same wording in the 2026 and 2027 editions; the bonus points are the part of the return a CFO can quantify.

Indicator	Content (summary)	Bonus	Service
S-12	Cybersecurity risk management framework, policy, concrete programmes and resources	One extra point overall for ISO 27001, CNS 27001 or similar third-party certification	ISO 27001
S-10	An intellectual property management plan linked to business goals, reported to the board at least once a year	One extra point overall for TIPS, ISO 56001 or similar third-party certification	Trade secret protection, ISO 56001
G-18	Board-level committee oversight of risk management, reported to the board at least once a year	AA item, one extra point overall	ERM

Requirement by requirement: what the CFO looks at, how to budget, how long it takes

ERM enterprise risk management

What it means for the CFO: the risk items under Article 20, item 6 of the annual report regulations and ESG indicator G-18 both need a working risk management system. Neither COSO ERM nor ISO 31000 has a certificate; the result is shown through board-approved policies, operating records and disclosure.
Timeline (as listed on the service page): four phases, usually 4–6 months; the first board report usually comes at the end of month 3.
Go deeper: ERM consulting, ERM budget and timeline, CRO role page

ISO 27001 information security management system

What it means for the CFO: the annual report must disclose the resources invested in cybersecurity; Article 9 of the internal control regulations requires controls over cybersecurity inspection; ESG indicator S-12 adds one point for third-party certification.
Timeline (as listed on the service page): typically 4–8 months; implemented against ISO/IEC 27001:2022.
Go deeper: ISO 27001 consulting, CISO role page

ISO 37001 anti-bribery management system

What it means for the CFO: a typical implementation includes financial controls and approval design and third-party due diligence; the annual report must disclose how integrity management is carried out; ESG indicators S-7 and S-9 look at the integrity policy, the responsible unit and the whistleblowing system.
Limits of the certificate: ISO 37001 itself states that conformity cannot guarantee that no bribery occurs; the current version is ISO 37001:2025, and certified organisations must transition by 28 February 2027 (as announced by UKAS in the UK and SCC in Canada).
Timeline (as listed on the service page): typically one to two quarters to build the system and run the internal audit, then certification.
Go deeper: ISO 37001, Choosing an ISO 37001 consultant

Trade secret protection and ISO 56001

What it means for the CFO: R&D output is a source of company value; to be protected as a trade secret, information must have secrecy, economic value and reasonable confidentiality measures at the same time (Trade Secrets Act, Article 2). ESG indicator S-10 adds one point for TIPS or ISO 56001 third-party certification.
Timeline (as listed on the service pages): a trade secret protection programme usually takes 3–6 months; ISO 56001 usually 6–9 months.
Go deeper: Trade secret protection programme, ISO 56001, ISO 56001 budget and timeline

ISO 22301 business continuity management

What it means for the CFO: the business impact analysis (BIA) assesses disruption losses and the maximum tolerable period of disruption, which is the basis for estimating the financial impact of an outage.
Timeline (as listed on the service page): usually 4–7 months; about 3–5 months with 27001 in place.
Go deeper: ISO 22301, ISO 22301 budget and timeline

DORA Digital Operational Resilience Act

What it means for the CFO: DORA has applied since 17 January 2025, directly to the EU financial entities listed in Article 2(1); Taiwanese ICT providers serving them take on contract clauses on audit rights, data portability, business continuity and exit strategy.
Timeline (as listed on the service page): preparing an ICT provider's contractual obligations usually takes 2–3 months; a full framework for a financial institution usually 6–9 months.
Go deeper: DORA

GDPR and ISO 27701

What it means for the CFO: a Taiwanese company that offers goods or services to people in the EU, or monitors their behaviour, is covered; fines reach 4% of worldwide annual turnover or EUR 20 million.
Timeline (as listed on the service page): baseline GDPR compliance usually 2–3 months; with ISO 27701 certification 5–8 months.
Go deeper: GDPR, ISO 27701 budget

EU CRA and the EU AI Act

What it means for the CFO: breaching the EU CRA essential requirements can cost up to EUR 15 million or 2.5% of worldwide annual turnover; from 11 December 2027, digital products without conformity assessment and CE marking may not be placed on the EU market. Under the EU AI Act, prohibited practices can cost up to EUR 35 million or 7%, other obligations up to EUR 15 million or 3%.
Go deeper: EU CRA compliance, CRA budget, AI governance budget

How it fits the systems you already have

Public companies already have an internal control system, an annual self-assessment and an annual report disclosure process; new compliance requirements should connect to them rather than form a second system. The internal control regulations and the annual report regulations apply to public companies; companies that are not public companies are not covered by them and can use them voluntarily.

Rule	What you already have	How the new requirements fold in
Internal control regulations, Articles 7 and 8: finance cycles and controls	Control points in the sales and collection, purchasing and payment, financing and investment cycles	Map ISO 37001 financial controls, approvals and supplier due diligence to existing control points in the purchasing and payment cycle
Internal control regulations, Articles 22 and 24: self-assessment and the internal control statement	The annual self-assessment and the board-approved statement	Include the internal audit results of each management system in the basis for the annual self-assessment
Annual report regulations, Article 18, item 6: cybersecurity management	The annual report's cybersecurity section	Disclose resources, programmes and certification results with one set of numbers
Annual report regulations, Article 20, item 6: risk items	The annual report's risk analysis	Add the financial effect of EU legal change and cybersecurity risk, and the responses, to the existing analysis

How Winners Consulting works

This is Winners Consulting's own description; hold us to the questions above, just as you would any other consultant.

Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced
One body of evidence: ERM risk language links the management systems, and audit results and KRIs go into the same board report
Fees: depend on scope and the maturity of existing systems; an estimate follows the free diagnosis, and the budget guides show the cost structure of each service
First step: the first mechanism diagnosis is free

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.