Can COSO ERM or ISO 31000 be certified? How does a listed company show it has ERM?

There is no standalone certificate: COSO ERM 2017 and ISO 31000:2018 are not certifiable standards. What has to be done is what the TWSE Risk Management Best Practice Principles describe: a board-approved risk management policy, a risk committee and promotion unit, reporting at least once a year, and disclosure on the company website or the Market Observation Post System under Article 28.

How does risk management affect the TWSE ESG evaluation?

Indicator G-18 asks for risk management overseen by the audit committee or a board-level functional committee, board-approved policies and procedures, disclosed organisation and operation, and reporting to the board at least once a year; it is an AA item worth one extra point overall (2026 and 2027 indicators).

Must a listed company in Taiwan appoint a CRO?

The TWSE Risk Management Best Practice Principles have no CRO title; they regulate a risk management promotion and execution unit and recommend a risk management committee under the board (which another functional committee may replace). Banks and financial holding companies must appoint a chief risk officer at vice-president level or above, or of equivalent responsibility.

Which risk categories do the risk management principles list?

Article 18 lists strategic, operational, financial, information, compliance and integrity risk, and other emerging risks (such as climate change or infectious disease).

How long does ERM take, and when is the first board report?

Four phases, usually 4–6 months; the first board report usually comes at the end of month 3. About 3–4 months for organisations with several ISO management systems or a group COSO framework.

How should a CRO put EU penalties into the impact assessment?

Use the maximum fines as a reference for the lower bound of impact: GDPR up to 4% of worldwide annual turnover or EUR 20 million; NIS2 essential entities EUR 10 million or 2%; EU CRA breach of essential requirements EUR 15 million or 2.5%; EU AI Act prohibited practices EUR 35 million or 7%. Assess the effect on customer requirements and market access at the same time.

We have a business continuity plan. Do we still need ISO 22301?

A BCP alone is not enough. ISO 22301 includes the BIA, strategy, plans, exercises and continual improvement; without BIA-derived RTOs and exercise records, the plan effectively does not exist in audits and customer reviews.

Does ISO 37001 certification remove legal liability for bribery?

It cannot be put that way. ISO 37001 itself states that conformity cannot guarantee that no bribery occurs; whether the "adequate procedures" defence under section 7 of the UK Bribery Act succeeds is decided by the court case by case. Certification shows the system is working, not that risk is zero.

We have signed confidentiality agreements. Are our trade secrets protected?

Not enough. Article 2 of the Trade Secrets Act requires secrecy, economic value and reasonable confidentiality measures at the same time; a confidentiality agreement alone is not enough, and grading, confidentiality marking, access logs and limiting who knows are also needed.

Which risks should a CRO put in the board report? 9 requirements explained one by one

Direct answer: a CRO's board report covers more than financial and operational risk. Article 18 of the TWSE Risk Management Best Practice Principles for Listed Companies groups risks into strategic, operational, financial, information, compliance, integrity and other emerging risks; Winners Consulting's nine consulting services fall into these categories: business continuity (ISO 22301), integrity and anti-bribery (ISO 37001), trade secrets, information security (ISO 27001), AI risk (ISO 42001, the EU AI Act), and EU laws with penalties (GDPR, NIS2, the EU CRA). The CRO's job is to assess them with one method, show them on one risk map and report them to the board in one report, rather than run a separate exercise for each. Risk management also scores extra in the TWSE ESG evaluation: indicator G-18 is an AA item worth one extra point overall. Two things to know first: the principles have no "CRO" title, and what they regulate is the "risk management promotion and execution unit"; ERM itself cannot be certified; neither COSO ERM nor ISO 31000 has a certificate, and the result is shown through board-approved policies, operating records and disclosure.

Which risk category each of the 9 requirements belongs to

Requirement	Risk category (Article 18)	What it means for the CRO	Is there a certificate?
ERM (COSO ERM, ISO 31000)	All	The backbone of risk appetite, assessment method, KRIs and board reporting	No
ISO 22301	Operational	Disruption losses, maximum tolerable period of disruption and recovery order	Yes, third-party certification
ISO 37001	Integrity, compliance	Bribery risk assessment, third-party due diligence, legal exposure to cross-border bribery	Yes, third-party certification
Trade secret protection	Operational, compliance	Whether a court will find reasonable confidentiality measures if core technology leaks	No
ISO 27001	Information	Information security controls and evidence	Yes, third-party certification
ISO 42001	Other emerging	AI system inventory, AI risk and impact assessment	Yes; not EU AI Act compliance
GDPR	Compliance	Fines up to 4% of worldwide annual turnover or EUR 20 million	No
NIS2	Compliance, information	The management body must approve and oversee security measures	No
EU CRA	Compliance	Non-compliant digital products may not be placed on the EU market	No standalone certificate; conformity assessment by product category, then CE marking

TWSE ESG evaluation: indicators the CRO prepares

The ESG evaluation replaced the corporate governance evaluation from 2026 and covers listed companies. The indicators below have the same wording in the 2026 and 2027 editions, except S-7 as noted.

Indicator	Content	Bonus	Service
G-18	Risk management overseen by the audit committee or a board-level functional committee (such as a risk management committee), with board-approved risk management policies and procedures, disclosed organisation, procedures and operation, and reporting to the board at least once a year	AA item, one extra point overall	ERM
S-7	A board-approved integrity policy, a dedicated or part-time unit promoting integrity, its implementation explained, and reporting to the board at least once a year (2027 wording; split into S-7 and S-8 in 2026)	—	ISO 37001
S-9	A whistleblowing system for insiders and outsiders on illegal (including corruption) and unethical conduct, disclosed in detail on the company website	—	ISO 37001
S-10	An intellectual property management plan linked to business goals, its implementation disclosed, and reporting to the board at least once a year	One extra point overall for TIPS (Taiwan Intellectual Property Management System), ISO 56001 or a similar standard with third-party certification	Trade secret protection, ISO 56001
S-12	A disclosed cybersecurity risk management framework, policy, concrete programmes and resources	One extra point overall for ISO 27001, CNS 27001 or similar with third-party certification	ISO 27001

Penalty exposure: the numbers a CRO uses when assessing impact

Law	Maximum fine (whichever is higher)
GDPR	4% of worldwide annual turnover or EUR 20 million
NIS2 Article 34	Essential entities: EUR 10 million or 2% of worldwide annual turnover; important entities: EUR 7 million or 1.4%
EU CRA Article 64	Breach of essential requirements: EUR 15 million or 2.5% of worldwide annual turnover
EU AI Act Article 99	Prohibited practices: EUR 35 million or 7% of worldwide annual turnover; other obligations: EUR 15 million or 3%

Fines are only part of the impact. Customer requirements, market access and reputational damage usually come earlier than fines and belong in the same impact assessment.

Requirement by requirement: what the CRO decides, how it goes onto one risk map, how long it takes

ERM enterprise risk management

Decide first: whether a board-approved risk management policy, a risk committee and a promotion unit are in place, and the rhythm of reporting to the board at least once a year.
Limits of certification: COSO ERM 2017 and ISO 31000:2018 are not certifiable standards; ISO 31000 states it is not intended for certification. Where third-party certification is needed, combine with certifiable standards such as ISO 27001 and ISO 22301.
How it works: organise board reporting around the five COSO components and unify the method with the ISO 31000 process; build a dynamic risk register updated quarterly with automatic KRI alerts, and a board dashboard.
Timeline (as listed on the service page): four phases, usually 4–6 months: diagnosis and governance design, policy, appetite and method, risk assessment and KRIs, reporting, disclosure and handover; the first board report usually comes at the end of month 3. About 3–4 months for organisations with several ISO management systems or a group COSO framework.
Go deeper: ERM consulting, Choosing an ERM consultant, ERM budget and timeline

ISO 22301 business continuity management

What it means for the CRO: the business impact analysis (BIA) assesses disruption losses and the maximum tolerable period of disruption (MTPD) and sets the recovery order; RTOs and RPOs are derived from the BIA, not decided in advance.
Limits of the certificate: ISO 22301 can be certified by a third party, on a 3-year cycle. A BCP alone is not enough: without BIA-derived RTOs and exercise records, the plan effectively does not exist in audits and customer reviews.
Timeline (as listed on the service page): four phases, usually 4–7 months; about 3–5 months with 27001 in place. The BIA and the exercises cannot be compressed.
Go deeper: ISO 22301, Choosing an ISO 22301 consultant, ISO 22301 budget and timeline

ISO 37001 anti-bribery management system

Decide first: which situations the bribery risk assessment must cover, such as hospitality and gifts, commissions, agents and distributors, dealings with government and overseas markets. Under Article 11 of Taiwan's Anti-Corruption Act, bribing officials of foreign countries, mainland China, Hong Kong or Macau in matters of cross-border trade, investment or other business activities is also punishable.
Version: the current version is ISO 37001:2025; UKAS in the UK and SCC in Canada have announced that certified organisations must transition by 28 February 2027.
Limits of the certificate: ISO 37001 itself states that conformity cannot guarantee that no bribery occurs; whether the "adequate procedures" defence under section 7 of the UK Bribery Act succeeds is decided by the court case by case.
Timeline (as listed on the service page): typically one to two quarters to build the system and run the internal audit, then certification.
Go deeper: ISO 37001, Choosing an ISO 37001 consultant

Trade secret protection

What it means for the CRO: to be protected under Taiwan's Trade Secrets Act, information must meet all three elements of Article 2 at once: secrecy, economic value and reasonable confidentiality measures. Adding measures after a leak is usually too late.
Measures that can be seen: information is graded and marked confidential, confidentiality agreements state the scope specifically, the people who know are limited and access is logged, and confidentiality contracts are signed before external disclosure. A signed confidentiality agreement alone is not enough to amount to reasonable measures.
Timeline (as listed on the service page): four phases, usually 3–6 months; at the end, a departing employee taking materials is simulated from logs to evidence preservation, and the gaps are fixed.
Go deeper: Trade secret protection programme, Choosing a trade secret consultant

ISO 27001 information security management system

What it means for the CRO: controls and evidence for information risk. The audit focuses on the risk assessment and the Statement of Applicability, with the applicability of the 93 controls following the risk assessment; Winners builds the assessment framework in ERM risk language so information risk and enterprise risk use the same scale.
Timeline (as listed on the service page): typically 4–8 months.
Go deeper: ISO 27001 consulting, CISO role page

ISO 42001 and the EU AI Act: AI risk

Decide first: each AI system's role under the EU AI Act (provider or deployer) and its risk tier.
Limits of the certificate: ISO 42001 certification shows the organisation governs AI soundly but is not EU AI Act compliance; conformity assessment, EU database registration, an authorised representative and Article 50 transparency remain legal procedures.
Timeline (as listed on the service pages): ISO 42001 usually 4–6 months with 27001 in place, about 6–9 months from scratch; EU AI Act compliance for high-risk AI usually 6–9 months, 9–12 months together with ISO 42001 certification.
Go deeper: ISO 42001, EU AI Act

GDPR

Decide first: whether the company offers goods or services to people in the EU or monitors the behaviour of people in the EU.
How compliance is shown: there is no official certificate; compliance is shown through records of processing, DPIAs, processor contracts, SCC or BCR transfer mechanisms and notification records.
Timeline (as listed on the service page): baseline compliance usually 2–3 months; with ISO 27701 certification 5–8 months.
Go deeper: GDPR, Choosing a GDPR consultant

NIS2

What it means for the CRO: regulated entities must implement the ten minimum measures of Article 21, approved and overseen by the management body (Article 20); a supplier gets supply chain security requirements written into its customers' contracts.
Timeline (as listed on the service page): usually 4–6 months; 2–3 months with ISO 27001 in place.
Go deeper: NIS2

EU CRA

What it means for the CRO: from 11 December 2027, digital products that do not meet the essential cybersecurity requirements, or have not completed conformity assessment and CE marking, may not be placed on the EU market; the Article 14 reporting obligations have applied since 11 September 2026. This is a market access risk.
Go deeper: EU CRA compliance, Who leads CRA

How it fits the systems you already have

Listed companies in Taiwan already have the policy, organisation and reporting rhythm recommended by the TWSE Risk Management Best Practice Principles for Listed Companies; new risks should go into the same system rather than a second one. Under Article 1, listed companies should refer to these principles when setting their own risk management policies and procedures; companies that are not public companies are not covered by these principles and can use them voluntarily.

Article	What you already have	How the new risks fold in
Article 13: the board approves the risk management policy, procedures and framework	A board-approved risk management policy	Bring business continuity, bribery, trade secret, AI and EU law risks into the scope of the same policy
Article 14: the risk management committee approves risk appetite (risk tolerance)	Risk appetite and grading	Use maximum fines, market access and customer requirements as inputs to the impact assessment
Article 15: the promotion unit compiles and reports on risk management regularly (at least once a year)	An annual risk report	Fold the audit results, exercise records and KRIs of each management system into the same report
Article 18: risk categories include information, compliance, integrity and other emerging risks	A risk taxonomy	Map each requirement to an existing category, as in the table above
Article 28: disclose risk management information on the company website or the Market Observation Post System	Existing disclosure	Add the new risk governance content to the existing disclosure

Article 11 of the principles recommends a risk management committee under the board, which may be replaced by another functional committee or working group. Banks and financial holding companies must, under Article 21 of the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries, set up a dedicated risk management unit under the president and appoint a vice-president or above, or a person of equivalent responsibility, as chief risk officer.

How Winners Consulting works

This is Winners Consulting's own description; hold us to the questions above, just as you would any other consultant.

Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced
One risk map: board reporting organised around the five COSO components and one method based on the ISO 31000 process, bringing cybersecurity, business continuity, AI and personal data risks onto the same risk map; every deliverable is mapped to the article numbers of the principles and the evaluation indicators
One set of documents: ISO 37001 is implemented on the backbone of ERM risk language and shares its document system with existing internal controls
After go-live: 90 days of follow-up and an annual review
First step: the first mechanism diagnosis is free

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.