CFO view of trade secrets and ISO 56001: protecting R&D value and earning ESG bonus points

R&D output is a source of company value. How does a CFO confirm it is actually protected by law?

Article 2 of the Trade Secrets Act requires secrecy, economic value and reasonable confidentiality measures at the same time. Trade secrets have no standalone certificate and need no registration; signing confidentiality agreements alone is not enough to amount to reasonable measures. The CFO can ask to see:

• classification and confidentiality marking of information
• confidentiality agreements that specify their scope
• restricted access with access records
• confidentiality agreements before any external disclosure

In the Intellectual Property Office's compilation of judgments, drawings without confidentiality marks, agreements that did not specify their scope and documents without classification have all been grounds for courts to find that reasonable measures were not taken.

What does ESG indicator S-10 require, and which certification earns the bonus?

S-10 asks whether the company has set and discloses an intellectual property management plan linked to business goals and its implementation, reported to the board at least once a year; it is an A+ item. The bonus condition is implementing the Taiwan Intellectual Property Management System (TIPS), ISO 56001 or a similar standard with third-party certification, which adds one point overall.

A trade secret protection programme has no certificate and earns no bonus on its own; ISO 56001:2024 is a requirements standard that can be certified by a third party, on a three-year certificate cycle. The ESG evaluation covers listed companies; companies that are not listed or not public are not covered and can use it voluntarily.

How does a trade secret programme connect to the R&D cycle of internal control?

The R&D cycle in Article 7 of the internal control regulations covers product design, technology development, prototyping and testing. Trade secret classification, access control and pre-departure audits should map to the control points of that cycle, and:

• be included in the annual self-assessment and audit plan
• have findings tracked in the existing remediation follow-up

That way the operating records of trade secret measures also become a basis for the internal control self-assessment. The internal control regulations apply to public companies; companies that are not public companies are not covered and can use them voluntarily.

Budgeting: what drives the cost, and which costs sit outside the scope?

According to Winners Consulting's ISO 56001 budget guide, two factors drive it: which R&D and business units the innovation process covers, and the current state of confidentiality measures such as classification, access control and departure management. The commissionable work packages on the service page also state:

• unagreed technology R&D, product development and certification body fees are excluded
• patent agency, litigation, R&D execution and trade secret legal services need a separate scope
• external certification is quoted independently

This page lists no fees; Winners Consulting provides an estimate after the free mechanism diagnosis.

Timeline: how long do trade secret protection and ISO 56001 each take, and what cannot be compressed?

As listed on the service pages:

• Trade secret protection programme: inventory and identification (2–4 weeks), system design (4–6 weeks), rollout and training (4–8 weeks), verification and handover (2–4 weeks), usually 3 to 6 months
• ISO 56001: diagnosis and strategy, system design, pilot and rollout, audit and certification, usually 6–9 months; about 5–7 months for organisations with ISO 9001 or 27001

The ISO 56001 pilot phase must run 2–3 ongoing innovation projects through the full process, and that cannot be compressed. When run together, the trade secret timeline folds into that project.

How should the return be judged? Does ISO 56001 guarantee a return on investment?

No. The service page states that ISO 56001 does not replace the legal requirements for trade secrets or commercial success; performance indicators must have a data source and an owner, and no fictitious investment return is promised. Benefits that can reasonably be expected:

• complete trade secret lists, classification and access records, so the protected technology can be described precisely in licensing or partnership negotiations
• standardised decision records from innovation proposal to commercialisation, reducing dependence on individuals
• for listed companies, the S-10 third-party certification bonus

How does Winners Consulting help a CFO with trade secret protection and ISO 56001?

• VP- and director-level consultants lead the work end to end, never outsourced, under strict confidentiality agreements with academic support from NTUST
• Every measure maps to a failure pattern in the compilation of judgments or to a statutory requirement; ISO/IEC 27001 covers the technical side and ISO 56001 carries IP management
• At the end we simulate one departing employee taking data, run it from logs to evidence preservation, and fix the gaps
• Partner lawyers take over litigation and applications for investigation confidentiality orders; ISO 56001 certification is performed by a third-party body

Named clients: MediaTek and MPI Corporation (旺矽科技) — trade secret protection consulting. Read more: Trade secret protection programme, ISO 56001, Choosing a trade secret consultant, ISO 56001 budget and timeline, CFO role page. Request a free mechanism diagnosis