ERM for CROs: how do you build the risk map, KRIs and board reporting?

The principles have no CRO title. Where does the CRO sit, and must we set up a risk management committee?

The TWSE Risk Management Best Practice Principles for Listed Companies have no chief risk officer or CRO title; they regulate a "risk management promotion and execution unit". - Board: approves the risk management policy, procedures and framework (Article 13)

• Risk management committee: Article 11 recommends a risk management committee under the board, which another functional committee or working group may replace; the committee approves risk appetite (Article 14)
• Promotion and execution unit: compiles and reports on risk management at least once a year (Article 15)

Banks and financial holding companies must, under Article 21 of the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries, appoint a vice-president or above, or a person of equivalent responsibility, as chief risk officer. Companies that are not public companies are not covered and can use them voluntarily.

Which categories should the CRO's risk map cover, and how do we stop every department drawing its own?

Article 18 of the principles groups risks into strategic, operational, financial, information, compliance and integrity risk, and other emerging risks (such as climate change or infectious disease). The risks of each management system map like this:

The rule is one method of assessment, one risk map and one report to the board, rather than a separate exercise for each.

How should risk appetite and KRIs be set so they do not end up as a risk list nobody reads?

Under Article 14 of the principles, risk appetite (risk tolerance) is approved by the risk management committee. The common mistake is a risk list only: a hundred risks with no quantification, no prioritisation and no KRI monitoring, pulled out only at audit time. The approach listed on the service page:

• Quantify likelihood and impact with a risk matrix and set the order of treatment
• Build a dynamic risk register: quarterly updates, automatic KRI alerts and a board dashboard
• Feed maximum fines, market access and customer requirements into the impact assessment, not only financial loss

What does the risk management committee look at each year, and how does the annual report bring in the results of each management system?

Article 15 of the principles requires the promotion unit to compile and report on risk management regularly (at least once a year); Article 28 requires disclosure of risk management information on the company website or the Market Observation Post System. The CRO can use the output of existing management systems directly as material for the report, without extra work:

• ISO 27001 and ISO 37001 audit results → whether controls are effective
• ISO 22301 exercise records → whether disruption response works
• KRI trends and alerts → whether risk exceeds appetite

New risk governance content goes into the existing disclosure.

What evidence does TWSE ESG indicator G-18 need?

G-18 (same wording in the 2026 and 2027 editions): risk management overseen by the audit committee or a board-level functional committee (such as a risk management committee), board-approved risk management policies and procedures, disclosure of the risk management organisation, procedures and operation, and reporting to the board at least once a year. It is an AA item; companies that meet it get one extra point overall.

The matching evidence is: committee oversight records, the board-approved policy and procedures, disclosure of organisation and operation, and records of the annual board report. The ESG evaluation replaced the corporate governance evaluation from 2026; the 2026 evaluation period is 1 January to 31 December 2026, with results published by the end of April 2027. It covers listed companies; companies that are not public companies are not covered by the evaluation and can use it voluntarily.

How long does ERM take, and when is the first board report?

As listed on the service page: four phases, usually 4–6 months.

1. Diagnosis and governance design (3–4 weeks)
2. Policy, appetite and method (4–6 weeks)
3. Risk assessment and KRIs (6–8 weeks)
4. Reporting, disclosure and handover (3–4 weeks)

The first board report usually comes at the end of month 3; about 3–4 months for organisations with several ISO management systems or a group COSO framework. Policy approval and regular reporting must follow the board meeting calendar, which is the part that cannot be compressed. ERM has no certificate: neither COSO ERM nor ISO 31000 can be certified, and the result is shown through a board-approved policy, operating records and disclosure; where third-party certification is needed, combine it with certifiable standards such as ISO 27001 and ISO 22301.

How does Winners Consulting help CROs with ERM?

• One risk map: board reporting organised around the five COSO components and one method based on the ISO 31000 process, bringing cybersecurity, business continuity, AI and personal data risk assessments onto one risk map
• Mapped to articles: every deliverable is mapped to the article numbers of the principles and the evaluation indicators
• Who leads: vice-president and director-level consultants lead the work personally end to end, never outsourced
• After go-live: 90 days of follow-up and an annual review
• Named clients: Taiwan Stock Exchange (TWSE) (internal control system integrated with ISO 9000 and ISMS); Joint Credit Information Center (JCIC) (internal control system integrated with ISO 27001 and TPIPAS)

ERM consulting, Choosing an ERM consultant, ERM budget and timeline. Request a free mechanism diagnosis