Where does compliance risk sit in ERM, and how do the general counsel and the risk management unit divide the work?
| Rule | What concerns the general counsel |
|---|---|
| Regulations Governing Establishment of Internal Control Systems by Public Companies, Article 3 | Internal control objectives include compliance with applicable laws and regulations |
| Risk Management Best Practice Principles, Article 18 | Risk categories include compliance, integrity and information risk, among others |
| Same Principles, Articles 13 and 15 | The board approves the risk management policy; the risk management unit compiles and reports implementation at least once a year |
| Same Principles, Article 11 | A risk management committee under the board is recommended, and may be replaced by another functional committee |
Division of work: the general counsel owns the content of compliance risk (laws, obligations, penalties, cases); the risk management unit owns the method and reporting (assessment scales, the risk map, consolidated reporting). The Principles do not use a CRO title; they refer to the unit that promotes and executes risk management. The internal control regulations apply to public companies and the Principles are for listed companies to reference; non-public companies are not subject to these rules and may adopt them voluntarily.
How does a regulatory inventory become a cell on the risk map? How do we rate likelihood and impact?
A regulatory inventory answers which laws apply; a risk map must answer which one is most likely to go wrong and how badly. Framework:
- Applicability: decide for each law whether it applies, and to which legal entity and business line
- Impact: use the maximum penalty as a reference point, then add market access, customer contracts and reputation
- Likelihood: look at current controls, past deficiencies and audit findings
- KRIs: for example, the number of regulatory changes not yet assessed and the number of overdue corrective actions
| Law | Maximum penalty (whichever is higher) |
|---|---|
| GDPR | 4% of worldwide annual turnover or EUR 20 million |
| NIS2 Article 34 | Essential entities EUR 10 million or 2%; important entities EUR 7 million or 1.4% |
| EU CRA Article 64 | Breach of essential requirements: EUR 15 million or 2.5% |
| EU AI Act Article 99 | Breach of prohibitions: EUR 35 million or 7% |
With a regulatory investigation or litigation under way, how do the risk register, the financial statements and the annual report tell the same story?
The same case appears in three places, and the account must be consistent:
- Risk register and board report: case status, the range of possible outcomes and responses (Article 15 of the Principles).
- Financial statements: Taiwanese public companies prepare financial statements under IFRS as endorsed by the FSC. The IAS 37 framework: is there a present obligation as a result of a past event; is an outflow of resources probable (more likely than not); can the amount be estimated reliably? If all three are met, a provision is recognised; if an outflow is not probable, it is a contingent liability, disclosed in the notes unless the possibility is remote.
- Annual report: Article 20, item 6 of the Regulations Governing Information to be Published in Annual Reports of Public Companies requires an analysis of the effect of important domestic and foreign policy and legal changes on the company's finances and business, and the responses.
Conclusions are for the auditor and legal counsel to reach case by case; the general counsel makes sure all three draw on the same case assessment. The annual report regulations apply to public companies; non-public companies are not subject to them and may adopt them voluntarily.
How do we prove that the compliance programme is effective? What do regulators and prosecutors look at?
Having documents or a certificate does not make a programme effective. Two official frameworks are useful:
- U.S. Department of Justice Criminal Division, Evaluation of Corporate Compliance Programs (updated September 2024): prosecutors ask three fundamental questions: is the programme well designed; is it applied earnestly and in good faith, in other words adequately resourced and empowered to function effectively; and does it work in practice? Effectiveness is assessed at the time of the offence and at the time of the charging decision.
- UK Ministry of Justice guidance on the Bribery Act: six principles describe adequate procedures without prescribing a particular management system; whether the defence succeeds is for the court to decide case by case.
- ISO 37001 itself states that conformity does not guarantee that no bribery will occur.
Evidence the general counsel can prepare: compliance risk assessments, resources and authority (headcount, budget, a reporting line to the board), training and whistleblowing records, audit findings and corrective actions, and records showing the programme was adjusted after cases and regulatory changes.
In financial holding companies and banks, how do the chief compliance officer and the chief risk officer divide responsibilities, and to whom do they report?
Financial holding companies and banks follow the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries:
| Role | Article | Requirement |
|---|---|---|
| Chief compliance officer | Article 16 | Set up a dedicated compliance unit under the president; appoint a person at senior vice president level or above, or with equivalent duties, as chief compliance officer; report at least every six months to the board (or council) and the supervisors or audit committee |
| Chief risk officer | Article 21 | Set up a dedicated risk management unit under the president and appoint a person at senior vice president level or above, or with equivalent duties, as chief risk officer |
The FSC's Financial Holding Company Examination Manual also checks whether a dedicated compliance unit under the president has been set up. Division of work: the compliance unit identifies laws, assesses compliance and trains; the risk management unit puts compliance risk into the same appetite and reporting as other risks, with both reports drawing on the same regulatory inventory and case list.
ESG evaluation and board reporting: how does the general counsel's compliance and integrity reporting fit in?
| Indicator | Content | What the general counsel provides |
|---|---|---|
| G-18 (AA type; one bonus point to the total score if met) | An audit committee or board-level functional committee oversees risk management; board-approved policy and procedures; disclosure of structure, procedures and operation; reporting to the board at least once a year | Compliance risk assessment results and major cases |
| S-7 (2027 evaluation wording) | Disclosure of a board-approved ethical corporate management policy, a dedicated (or part-time) unit and implementation, with reporting to the board at least once a year | Implementation of ethical management and anti-bribery |
| S-9 | Disclosure on the company website of the whistleblowing system for insiders and outsiders on illegal (including corruption) and unethical conduct | Whistleblowing system and handling procedures |
The ESG evaluation covers listed companies; non-public companies are not subject to it and may adopt it voluntarily. Combining the three into one annual report gives the board the full picture and stops three units from telling different stories.
How does Winners Consulting help a general counsel with ERM?
- One risk map: organise board reporting around the five COSO components and unify the method with the ISO 31000 process, bringing cybersecurity, business continuity, AI and personal data risks onto one risk map; every deliverable is mapped to the relevant article of the Principles and the evaluation indicators
- Dynamic risk register: quarterly updates, automated KRI alerts and a board-level dashboard
- Certification boundary: ERM cannot be certified, and ISO 31000 states it is not intended for certification
- Timeline (as listed on the service page): four phases, typically 4–6 months, with the first board report usually at the end of month 3
- After go-live: 90-day follow-up and an annual review
- Who leads: VP- and director-level consultants lead the work end to end, never outsourced. Named client: Taiwan Stock Exchange (TWSE) (internal control system integrated with ISO 9000 and ISMS)
More: ERM consulting, How to choose an ERM consultant, ERM budget and timeline, How to choose an ISO 37001 consultant. Request a free mechanism diagnosis
How other roles see this service
Other services for this role
- ISO 37001 for General Counsel: agent bribery, whistleblowing investigations and contract clauses
- Trade secrets for General Counsel: what to prepare for departing employees, lawsuits and evidence preservation
- GDPR and ISO 27701 for General Counsel: processor contracts, transfers and investigations
- EU CRA for General Counsel: manufacturer liability, reporting duties and ODM contracts
- EU AI Act and ISO 42001 for General Counsel: roles, AI contracts and liability
- NIS2 for the general counsel: jurisdiction, personal liability, investigations and customer clauses
- DORA for the general counsel: negotiating Article 30 contracts, audit rights and exit
- TISAX for the general counsel: OEM contracts, participation terms and sharing results
- ISO 27001 for the general counsel: security clauses, audit rights and incident liability
Official sources
- 上市上櫃公司風險管理實務守則（證交所法規分享知識庫）
- 公開發行公司建立內部控制制度處理準則（全國法規資料庫）
- 臺灣證券交易所公司治理中心：ESG 評鑑（115、116 年度指標）
- 金融控股公司及銀行業內部控制及稽核制度實施辦法（全國法規資料庫）
- 金管會：金融控股公司檢查手冊（115 年上半年異動版）
- U.S. Department of Justice：Evaluation of Corporate Compliance Programs（Updated September 2024）
- UK Ministry of Justice：Bribery Act 2010 guidance
- IFRS Foundation：IAS 37 Provisions, Contingent Liabilities and Contingent Assets