How should a CFO measure the return on digital transformation, and what must be set before implementation?
Start from the operating metrics you want to improve, not from the systems you want to buy. Before implementation, answer four questions:
- Which processes and metrics will this transformation improve?
- What is the baseline?
- How is it measured, and from which system does the data come?
- How often is it reviewed?
A CFO can track benefits in three groups: operating metrics (chosen by the company), cost (including licences and operations after go-live), and risk (disruption, security and personal data incidents). The approach listed on the service page is to build a digital KPI measurement mechanism so that results are quantifiable.
What items belong in a digital transformation budget, and what is often missed?
What is often missed is everything outside the systems. Budget structure (no amounts):
| Item | Content |
|---|---|
| Current-state diagnosis and roadmap | Digital maturity assessment, digitalisation risk assessment |
| System selection and implementation | ERP, MES, IoT, AI |
| System integration | Connecting to existing ERP, MES and equipment data; handling legacy systems |
| Information security | Bringing new cloud, data and equipment assets into ISO/IEC 27001 scope |
| OT security | Zones and conduits under IEC 62443 |
| Data governance and personal data | Data quality, access rights and retention |
| Business continuity | Keeping shipments going during cut-over or outages |
| Change management | Moving staff processes and skills |
Which ERP, cloud SaaS and in-house system costs can be capitalised?
Framework (Taiwanese public companies prepare financial reports under IFRS as endorsed by the Financial Supervisory Commission):
- Recognising an intangible asset: future economic benefits are probable and cost can be measured reliably (IAS 38 paragraph 21).
- Internal development: research expenditure is expensed when incurred (paragraph 54); development costs need all the paragraph 57 conditions demonstrated, including technical feasibility, the intention and ability to complete and use or sell the asset, how it will generate probable future economic benefits, and adequate technical and financial resources; if the phases cannot be distinguished, treat it as research (paragraph 53).
- Cloud SaaS: a 2021 IFRS Interpretations Committee agenda decision says that where the customer only receives the right to access the supplier's software over the contract term, configuration or customisation costs are usually not recognised as an intangible asset; distinct services are expensed when the supplier provides them, otherwise over the contract term.
- Training: expensed when incurred (paragraph 69).
The conclusion is for the statutory auditor based on the contract and facts.
If cut-over or connected equipment causes downtime, how should a CFO estimate the loss and prepare?
Digital transformation carries two kinds of disruption risk: an outage during cut-over or after go-live that affects shipments, and a larger attack surface from connecting equipment and integrating systems. Financially, the business impact analysis (BIA) in ISO 22301 assesses disruption losses and the maximum tolerable period of disruption, which supports budget and insurance decisions:
- Set recovery and shipment continuity plans before cut-over
- Build security controls at each stage, rather than digitising first and patching later
- Check whether existing policies cover business interruption and cyber incidents; your broker confirms against the policy terms
How should digital transformation be reported to the board and audit committee, and what goes in the annual report?
Report structure: KPI progress against baseline, budget execution, risks and responses. On the rules side (the annual report regulations and the internal control regulations apply to public companies; companies that are not public are not covered by them and can use them voluntarily):
- Article 18, item 6 of the annual report regulations: cybersecurity risk management framework, policy, concrete programmes, resources invested, and losses, possible effects and responses for major cybersecurity incidents
- Article 20, item 6 of the annual report regulations: the impact of technological change (including cybersecurity risk) on finances and operations, and the response
- Article 9 of the internal control regulations: controls over cybersecurity inspection
New systems and data from the transformation should go into these three existing processes, not a separate report.
If we only adopt cloud accounting or attendance software, do we need a consultant?
Not necessarily. When you implement a single packaged application, the process itself does not change, and no production equipment connectivity or cross-system integration is involved, help from the software vendor is usually enough. A CFO should still confirm three things:
- Contract: where data is stored and whether you can exit later
- Personal data: whether each batch of data is collected, processed and used for a specific purpose with a legal basis (Articles 19 and 20 of Taiwan's Personal Data Protection Act)
- Accounting: treatment of SaaS configuration costs (see the IAS 38 question above)
Plan the whole programme when production connectivity, multi-system integration or process redesign is involved.
How does Winners Consulting help a CFO drive digital transformation?
- Diagnosis and roadmap: assess digital maturity, carry out a digitalisation risk assessment in parallel, and set a risk-controlled transformation roadmap
- Integration with security built in: help select and implement ERP, MES, IoT and AI, building OT/IT security architecture alongside, mapped to ISO 27001
- Data governance: a governance framework for data quality, data security and data sovereignty
- Business continuity: bring enterprise risk management, information security and business continuity management into the transformation plan together
- Results: quantifiable digital indicators
- Who leads: VP- and director-level consultants throughout, never outsourced; the advisory period listed on the service page is usually 7 to 12 months or more
More: Digital transformation consulting, How to choose a digital transformation consultant in Taiwan, How to choose an AI transformation consultant in Taiwan, CFO role page. Request a free mechanism diagnosis
How other roles see this service
Other services for this role
- CFO implementing ERM: what to prepare for board reports, annual report risk items and the ESG evaluation
- CFO view of ISO 27001: annual report cybersecurity disclosure, ESG bonus points and budgeting
- CFO implementing ISO 37001: financial controls, integrity disclosure and cross-border bribery exposure
- CFO view of trade secrets and ISO 56001: protecting R&D value and earning ESG bonus points
- CFO implementing ISO 22301: disruption losses, RTO investment and budgeting
- CFO view of DORA: contract clauses and penalty exposure with EU financial clients
- CFO view of GDPR and ISO 27701: fine provisions, cross-border transfers and budgeting
- CFO view of the EU CRA and EU AI Act: EU revenue risk, penalties and budgeting
- NIS2 for CFOs: fine caps, management liability and provisions
- AI transformation for CFOs: ROI, penalty exposure, capitalisation
Official sources
- IFRS Foundation:IAS 38 Intangible Assets 準則全文
- IFRS Interpretations Committee:Configuration or Customisation Costs in a Cloud Computing Arrangement(2021 議程決議)
- IFRS Interpretations Committee:Training Costs to Fulfil a Contract(2020 議程決議)
- 金管會主管法規共用系統:財務報告編製準則第 3 條
- 公開發行公司年報應行記載事項準則(全國法規資料庫)
- 公開發行公司建立內部控制制度處理準則(全國法規資料庫)
- ISO:ISO/IEC 27001 資訊安全管理
- 個人資料保護法(全國法規資料庫)