CFO implementing ERM: what to prepare for board reports, annual report risk items and the ESG evaluation

Why should a CFO own ERM, and how does it relate to liability for signing the financial reports?

Under Article 14(3) of the Securities and Exchange Act, financial reports must be signed or sealed by the chairman, managers and the accounting head, with a statement that they contain no false statements or omissions. Under Article 20-1, the signers are liable for damages unless they can show they exercised due care and had reasonable grounds to believe the content contained no false statements or omissions.

• "Due care" has to be provable with a system and records
• Article 20, item 6 of the annual report regulations requires an analysis of how major domestic and foreign policy and legal changes, and technology change (including cybersecurity risk), affect finances and business, and the responses

ERM is the framework that assesses these risks methodically, reports them regularly and keeps the records. The annual report regulations apply to public companies; companies that are not public companies are not covered by them and can use them voluntarily.

What does ESG indicator G-18 require? Can the audit committee oversee risk management?

Yes. G-18 asks whether risk management is overseen by "the audit committee or a board-level functional committee (such as a risk management committee)", and whether the company:

• has risk management policies and procedures approved by the board
• discloses its risk management structure, procedures and how they operate
• reports to the board at least once a year

G-18 is an AA item: a company meeting the scoring conditions gets one extra point overall in addition to the dimension score; the wording is the same in the 2026 and 2027 editions. The ESG evaluation covers listed companies; companies that are not listed or not public are not covered and can use it voluntarily.

ERM has no certificate. How does a CFO prove to the board, investors and auditors that it works?

Neither COSO ERM 2017 nor ISO 31000:2018 is a certifiable standard; ISO 31000 states that it is not intended for certification. What a listed company actually does is follow the TWSE Risk Management Best Practice Principles for listed companies:

• a board-approved risk management policy
• a risk committee and an executing unit
• reporting to the board at least once a year
• disclosure on the company website or the Market Observation Post System under Article 28

Where third-party certification is needed, ERM can be combined with certifiable standards such as ISO 27001 or ISO 22301. These principles are addressed to listed companies; companies that are not public companies are not covered and can use them voluntarily.

Budgeting: what drives the cost of ERM?

According to Winners Consulting's ERM budget guide, three factors drive the budget:

This page lists no fees; Winners Consulting provides a case-specific estimate after the free mechanism diagnosis.

Timeline: how soon is the first board report, and why must it follow the board calendar?

As listed on the service page, the four phases usually take 4–6 months, or about 3–4 months where several ISO management systems or a group COSO framework already exist:

1. Diagnosis and governance design (3–4 weeks)
2. Policy, risk appetite and method (4–6 weeks)
3. Risk assessment and KRIs (6–8 weeks)
4. Reporting, disclosure and handover (3–4 weeks)

The first board report usually comes at the end of month 3. The risk management policy, risk appetite and annual report all need board approval, so the steps tied to board meeting dates are the least compressible.

How does ERM connect to the internal control self-assessment, the internal control statement and annual report disclosure?

Do not build a second system; connect to the existing processes:

• Internal control regulations, Articles 22 and 24: the self-assessment is the main basis for the board and the president to issue the internal control statement, which is filed within three months after the end of the financial year; include the audit results of each management system in the basis for the self-assessment
• Annual report regulations, Article 20, item 6: add the financial effect of EU law and cybersecurity risk, and the responses, to the existing risk analysis
• Corporate governance: add it to the risk management policy and the board's regular reporting items, and fold the disclosure into the annual report

Both sets of regulations apply to public companies; companies that are not public companies are not covered and can use them voluntarily.

How does Winners Consulting help a CFO with ERM enterprise risk management?

• VP- and director-level consultants lead the work end to end, never outsourced
• Board reporting is organised around the five COSO components and the method unified with the ISO 31000 process, bringing cybersecurity, business continuity, AI and personal data risks onto one risk map
• A dynamic risk register updated quarterly with automatic KRI alerts and a board dashboard; every deliverable maps to the article numbers of the principles and the evaluation indicators
• 90 days of follow-up after go-live, plus an annual review

Named client: Taiwan Stock Exchange (TWSE) — internal control system integrated with ISO 9000 and ISMS. Read more: ERM consulting, ERM budget and timeline, Choosing an ERM consultant, CFO role page, CRO role page. Request a free mechanism diagnosis