The CRO Can Be Invaluable in Decision-Making

Key Takeaways

• The CRO's Role: Chief risk officers can improve decision-making by helping executives compare competing investments using a consistent measure of their potential business impact.
• Resource Allocation: Organizations must weigh investments in growth, operational efficiency, compliance, and cybersecurity when capital is limited.
• Limitations of Risk Ratings: Traditional ratings such as "High Risk" provide limited value when executives need to compare risks against potential business opportunities.
• Enterprise Objectives: Evaluating how investments affect the likelihood of achieving enterprise objectives can provide a common basis for comparing financial and nonfinancial risks.
• AI Decision-Making: Four AI assistants identified insufficient information in the hypothetical investment scenario but recommended different allocations when pressed to make a decision.

Deep Dive

In this article, Norman Marks examines how chief risk officers can help executives make better decisions when competing investments demand limited resources. Using a hypothetical capital budgeting scenario and responses from four AI assistants, Marks argues that traditional risk ratings offer little help when comparing opportunities across cybersecurity, compliance, operations, and business growth. He makes the case for evaluating investments according to their potential impact on achieving enterprise objectives, giving decision-makers a consistent basis for weighing their options.

How Chief Risk Officers Can Improve Business Decisions Beyond Traditional Risk Ratings

There are several ways a risk practitioner can make a significance difference to the quality of decision-making. This post is about one of them.

In Risk Management for Success (which builds on the thinking in World-Class Risk Management), I shared this example of a (hypothetical) real-life decision.

It describes a situation where three proposals are competing for limited resources, and the CEO has to make a tough decision. That’s what makes it real-life: money spent on one source of risk and opportunity cannot also be spent on another. Most business decisions, especially strategic ones, have to consider more than a single source of risk, whereas most risk guidance and frameworks address risks one at a time.

I am reminded of the best CEO I had the privilege of working with, Tom O’Malley of Tosco. He reflected that the total investment opportunities he and the board needed to consider was more than the annual revenue of the company!

How does the CEO decide where to invest limited resources?

I gave the challenge to four different AI assistants and will share their responses after the example. Then I will tell you what I said in the book and ask for your thoughts.

Imagine Jane, our indomitable CEO, chairs a meeting of the Capital Budgeting Committee. Her CFO, Joe, and others join her in this meeting to discuss how to allocate their limited capital budget among competing proposals.

Joe tells her that the agenda for today’s meeting is a discussion of three proposals. Each is requesting $15 million, but they can only afford one unless they raise additional capital and the board has already indicated its unwillingness to do so.

First up is the Vice President, Manufacturing. He is seeking $10 million to replace old equipment in the St. Louis factory that is already out of warranty. There is an estimated 40% likelihood (based on industry-accepted reliability modeling methods) that they will fail within three months, and 80% within a year. The factory would then have to cut production by 25%, with that same effect on sales. The loss of revenue is estimated at $2 million per month. The remaining $5 million is to purchase the equipment needed for the new product that is being introduced in Q4 and is projected to deliver an additional $1 million in annual revenue with a gross profit of 35%.

This project is strongly supported by both Sales and Marketing. The COO indicates that any loss in manufacturing capacity could be addressed by the Detroit factory but at an additional cost of $500,000 per month.

Next to speak is the CIO. He explains that he needs $15 million for three projects, each of which will cost $5 million. The IT Steering Committee has approved all three, but additional approval is needed for the capital to be allocated.

• The new web platform needed by Sales to support the rollout of the new product. Sales has said that without the platform, revenue is likely to be reduced by 10%.
• A new Ethics Certification and Training software solution needed by the Chief Compliance Officer. This will replace spreadsheets and other less reliable methods to ensure all employees receive mandatory ethics and compliance training, pass a test, and then re-certify annually. The internal auditors and the regulators have both called for improvements to be made in this area.
• Advanced Analytics, with Machine Learning and other capabilities, that has been requested by the CFO and COO. It will be used to identify and then drive operational improvements, improving efficiency and cutting costs by an estimated $2 million in the first year.

As expected, the sponsors of each of the three confirm the costs and benefits, voicing their support.

The CISO explains why $15 million is needed to upgrade cyber defense and response capabilities. He reports that his team has followed international standards in assessing cyber risks and has identified several risks that are rated as High. He shares a report that lists information assets, such as the Sales, Finance, and Manufacturing support systems and all are rated as High Risk.

At this point, there is some heated discussion.

Manufacturing, Sales, and Marketing all point out that their projects will drive revenue and profits. There is a high degree of certainty about the results and there should be certainty about project approvals.

They contrast that certainty with the possibility of a cyber breach. They make a point that they can handle a disruption and their business is not one where the release of customer data would be devastating.

Joe, the CFO, says that while he respects and to some degree has to agree with their argument, a significant cyber breach that was reported by the media would upset the board and the investors. It could well have an effect on the share price, although that would probably be temporary.

So What Did the Four AI Assistants Say?

On one thing they were all agreed. There is insufficient information. They all demanded that the people making their proposals go back to the drawing board.

How do you compare opportunities when they are not measured the same way?

When I insisted that they had to make a decision, which is what faces most real-life executives, they had different ideas.

This is why the CRO can fill an important gap and help people make the right decisions for success.

ChatGPT: I would allocate $10 million to replacing the aging manufacturing equipment and $5 million to advanced analytics.

Claude: I fund three things and say no to the rest.

1. Analytics, $5M.
2. Ethics and compliance software, $5M.
3. Cyber, $5M, scoped.

Google AI: Allocate $10 million immediately to replace the failing St. Louis equipment within the next 90 days, and deploy $5 million to finalize the Q4 product manufacturing line.

Copilot: Approve the Manufacturing proposal.

What Did I Say in the Book?

Jane listens and asks Joe how these three options can best be evaluated. How can the value to the business, whether protecting or enhancing it, be calculated so she can determine which is best?

This is where a risk practitioner can help. He or she can work with the CISO to change from a simplistic and not very useful High Risk rating to an assessment of the potential impact on the achievement of enterprise objectives.

He or she can also work with the CIO and Chief Compliance Officer to similarly evaluate the value of the Ethics software.

It’s only when you are comparing apples to apples that you can determine which would be the more fruitful investment.

In Making Business Sense of Technology Risk I explained that while you can often calculate the relative value of different options in monetary terms (or use financial calculations such as ROI or IRR), I prefer showing how each would affect the likelihood of achieving objectives. It works better for areas like cyber, compliance, and other non-financial sources of business risk and opportunity.

So What Do You Think?

Do you agree that using the same measure, the effect on the likelihood of achieving enterprise objectives, is the best way to compare investment options?

Are you surprised that the AI assistants came up with different answers?

I am encouraged that they all realized that there wasn’t sufficient information. Your thoughts?

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey