Navigating risk in turbulent times

CFOs and chief information security officers are significantly misaligned when it comes to cybersecurity investment goals and priorities, a survey by cybersecurity firm Expel found.

The breakdown revolves around metric and decision-making mismatches, according to the report released this month. Security leaders typically make decisions based on industry best practices, compliance requirements and ease of integration, while finance chiefs zero in on areas such as cost avoidance and risk reduction.

“Rather than doubling down on metrics that their counterparts don’t value or can’t understand, CISOs and CFOs can both benefit from educating their counterparts,” the report said. “By bridging the knowledge gap, finance and security leaders work toward better alignment, clearer communication, and more strategic cybersecurity investments.”

The findings come as escalating threats are heightening pressure on organizations to make strategic cybersecurity investments, Expel said.

Cyberattacks are expected to surge this year as criminals continue exploring ways to capitalize on advancements in artificial intelligence.

“Now, new AI-driven threat vectors stand to increase the scope, frequency and cost of data breaches,” global information services firm Experian said in its 2026 data breach forecast report.

As cyber threats become more sophisticated and the financial impact of breaches rises, CFOs are taking a more proactive role in cybersecurity strategy and investment decisions, Jack McCullough, president and founder of the CFO Leadership Council, said in a recent blog post. 

“This extends beyond just approving budgets — it involves understanding the business continuity implications and ensuring the organization is adequately protected,” he said. “Success depends on collaborating with CISOs and IT leaders to translate technical risks into business language for boards and investors, maintaining transparency about vulnerabilities and incident response capabilities, and being agile in responding to emerging threats.”

Security and finance leaders report excellent collaboration, with 74% and 68%, respectively, saying they work together early and often, according to Expel’s report. Yet the research exposed disconnects.

Security leaders said they encounter obstacles including limited understanding of cybersecurity risk when trying to obtain funding from finance. Finance leaders, meanwhile, indicated they want specific, measurable data before approving cybersecurity investments, with 40% saying that quantified risk reduction would make it easier to justify a spending hike.

More than four in 10 finance executives said better translation of technical risk into financial terms would help improve collaboration between the two teams.

To get on the same page, the teams have to learn to speak the same language, according to Expel.

“This may require security leaders to translate metrics into measurements that resonate with finance leaders,” the report said. “For example, ‘ease of integration’ might turn into a time- or cost-based metric while ‘meeting compliance requirements’ might translate into avoiding fines.”

The report was based on a survey of 136 cybersecurity leaders and 164 finance executives, Expel said.

Between the continued evolution of technologies like artificial intelligence, macroeconomic uncertainty, and new regulatory developments, CFOs consolidating their strategies for 2026 are looking forward to a year that promises to be as full of challenges and complexity as ever.

To keep pace, finance chiefs need to ensure they have a full and accurate picture of all of the risks that could potentially impact their organizations — and more importantly, they need to be able to work in tandem with their risk teams to turn that view of risk into an effective plan of action, Tina Yeh, chief accounting officer for AuditBoard, a provider of audit, risk and compliance management software.

“When you're working with your finance teams and CFOs, it's, how do you translate that to the impact on overall margins and the bottom line at the end of the day?” Yeh told CFO Dive in an interview regarding risk management strategies. “Where are the trade offs?”

New tools, new blind spots

One of the challenges Yeh has observed over her career is the “difficulty in translating risk assessments into actionable conversations and how to invest resources into that,” she said.

Yeh “grew up in audit,” she said of her career path, beginning as an assurance associate during a five-year span at Big Four firm PricewaterhouseCoopers.

From PwC, she joined workforce software provider Cornerstone on Demand, where she held a number of roles including associate director, accounting, according to her LinkedIn profile. She joined the Cerritos, Calif.-based AuditBoard eight years ago and has served as its CAO since September.

The ability to move from risk assessment into action has only grown more critical as the amount of risks that need to be assessed continues to swell. For example, introducing AI into one’s organizational processes has the potential to free up more time and resources for employees to focus on more strategic work — but the technology also comes with “new blind spots,” especially for finance functions and teams who “really don't yet have clear oversight of how AI is being used,” she said.

AI has continued to be top of mind for leadership over the past year, with finance and accounting teams mulling the best possible usage of the tool at the same time as they seek to guard against its associated risks, from siloed or unstructured data and cybersecurity troubles to the costs and challenges associated with upskilling or retraining employees on how to use it properly.

Identifying a clear strategy to utilize AI will be essential moving forward. CFOs who “think ahead and work with their risk teams on strong AI governance will be the ones that are ahead of the curve, on top of keeping compliant,” Yeh said.

To identify and open up those “blind spots,” both finance and risk leaders need to become more forward-looking in their risk management strategies, making a strong relationship between those two teams essential.

Last month, AuditBoard launched a scenario planning module aimed at addressing some of these challenges, according to a Nov. 18 press release. The module can act as a “facilitation of conversation between the risk teams and the CFOs to be able to get on the same page and speak the same language,” Yeh said.

The tool could be tapped to help organizations assess how ready they are for supply chain disruptions, for example, examining factors from potential material shortages, geopolitical events and cyberattacks to help define a risk scenario and its possible fallout, she said.

Driving the compliance to strategy shift

AuditBoard’s scenario planning module helps CFOs “gain clear visibility into the range of possibilities,” but much more critically, into their financial impact — facilitating “a much more robust conversation between risk leaders and finance,” she said.

That’s key for effective risk management, especially as the rate of change appears to be accelerating alongside the number of risks organizations need to track. The frequency of so-called “black swan” events is accelerating to the point where it’s becoming difficult to differentiate between typical challenges faced by companies, finance chiefs from companies including Hasbro and FedEx said during a panel at MIT Sloan’s CFO Summit in November.

Unlikely events are now becoming simply baked into potential strategies, ready to go when needed, Yeh said. As leaders confront more changes, more frequently, how they think about and respond to risk inside their organizations is also changing.

“We're continuing to see the evolution of risk management from being compliance driven to being a strategic tool for organizations, especially as change accelerates,” Yeh said.

Sponsored content

By Brown & Brown

Key Takeaways:

• Cyber threats create ripple effects that can disrupt entire industries. 
• Relying on a few key vendors may make businesses more vulnerable to major security failures. 
• Mapping risks, diversifying vendors and strengthening AI oversight helps build resilience. 

Cyber threats now extend beyond phishing attacks and stolen data to far-reaching events that can destabilize entire industries. As businesses increasingly rely on cloud platforms, automation, artificial intelligence (AI) and global supply chains, exposure to cyber risks grows. Many organizations aren’t aware of these hidden vulnerabilities until it’s too late.

Third-party Cyber Vulnerability: The Hidden Risk No One Sees Coming

Cybersecurity teams previously focused on securing their own networks. Today, organizations need to scrutinize third-party risk, too. A single vendor misstep can cause widespread operational disruptions, supply chain failures and financial instability.

Businesses often don’t recognize their exposure until a disruption unfolds. Mergers and acquisitions introduce hidden third-party risks, especially when a small but critical vendor is acquired — creating an overlooked single point of failure. Without proper cybersecurity due diligence, inherited vulnerabilities can expose an entire ecosystem, amplifying the impact of an attack or operational failure.

Proactively assessing vendor dependencies and integrating cyber risk assessments into M&A due diligence helps prevent unseen vulnerabilities from escalating into industry-wide disruptions. Strengthening visibility into third-party relationships helps ensure greater resilience and business continuity and can reduce the risk of cascading failures.

The Cloud Conundrum: When Convenience Becomes Weakness

Cloud technology has redefined how businesses operate, offering efficiency, scalability and cost savings. However, heavy reliance on a few dominant providers introduces systemic vulnerabilities.

A handful of vendors, including AWS, Microsoft and Google, support thousands of businesses. A disruption at any one of them can instantly cascade across industries. Many organizations are unaware of how deeply embedded these dependencies are within their own infrastructures.

For example, a company may contract with a managed service provider (MSP) for IT support, assuming security and stability are handled. But if that MSP relies on AWS for cloud hosting and CrowdStrike for endpoint security, a failure at any level directly impacts business operations.

Visibility into vendor dependencies and infrastructure helps reduce exposure to these vulnerabilities. Backup strategies, diversification and alternative suppliers strengthen continuity when disruptions occur.

AI Cybersecurity Risks: The Next Big Threat

AI is transforming business operations, yet many organizations adopt it without fully understanding its risks. AI influences decision-making in healthcare, finance, legal services and cybersecurity, creating new vulnerabilities.

• Healthcare: AI-powered diagnostics and patient care decisions can introduce legal and liability risks if algorithms produce biased or inaccurate results.
• Legal and finance: AI-generated contracts and financial decisions may contain errors that lead to compliance violations or lawsuits.
• Cybersecurity threats: AI models can be manipulated by cybercriminals, introducing flaws in decision-making and operational risks that businesses struggle to detect.

Most AI systems are developed externally, making vendor oversight an important factor in managing risk. Businesses using third-party AI solutions benefit from a clear understanding of vendor responsibilities, data security practices and accountability for errors or biases. Without well-defined agreements and ongoing validation, AI risks can spread across an organization, increasing legal and operational exposure.

AI governance and human oversight help mitigate these risks. Organizations embedding AI into core operations gain more control through clear policies, vendor assessments and validation measures to support accuracy, security and accountability.

How to Build Cyber Resilience Against Systemic Threats

Instead of reacting to cyber threats, adopt a resilience-first approach that accounts for third-party failures, cloud dependencies and AI vulnerabilities:

• Map vendor risk: Identify critical technology providers, including third-party suppliers embedded within infrastructure.
• Reduce overreliance on any one technology solution (e.g., cloud provider, MSP, software, etc.): Search for and resolve single points of failure. If a vendor’s product or service goes down, what is your contingency plan?
• Enhance AI governance: Establish clear accountability and validation measures. AI can support decision-making, but it does not replace human judgment.
• Stress test cyber resilience: Reveal weaknesses in vendor dependencies and help refine continuity plans.
• Align cyber insurance with business needs: Ensure cyber policies extend beyond breaches to cover business interruption, third-party failures and AI-related liabilities.

The Future of Cyber Risk

Cybersecurity is no longer just an IT function; it is a business-wide issue that affects operations, financial stability and industry reputation. The consequences of vendor failures, AI vulnerabilities and infrastructure disruptions extend far beyond isolated data security incidents.

Understanding hidden digital dependencies, diversifying risk exposure and strengthening AI governance will help you navigate the next wave of cyber disruptions before they escalate into crises.

Yooz CFO John Gronen has decided against offering employees instant paycheck access next year, with the decision coming after he explored the potential new benefit and determined there was not sufficient interest to move forward.

The Dallas, Texas-based accounts payable software company’s finance chief told CFO Dive in July that he was weighing the advantages, costs, and potential unintended consequences of offering the new benefit, also known as earned wage access. At the time, Gronen acknowledged personal reservations that EWA tools could lower budgeting support that he believes traditional monthly or semi-monthly paychecks provide. 

“We decided to hold off for the next year on the EWA issue. No one was that excited about it here since most are reasonably well compensated,” Gronen said in a recent emailed response to questions. “We may revisit for 2027 if things have changed in the market or if there is more demand from our current staff.” ​​​

A growing number of states have begun passing laws friendly to EWA service providers since 2023, although the industry has also sparked controversy because of fees associated with some services, CFO Dive sister publication Payments Dive reported.  

Since the early 2010s, EWA companies have served employees directly or partnered with employers to give workers access to a portion of wages they’ve earned before payday, with the benefit gaining popularity in high-turnover industries like retail and hospitality for hourly workers, according to a June 2023 report from the Harvard Kennedy School. 

The offering’s advantages include liquidity “with minimal hassle,” while drawbacks include fees that can be similar to payday lending products and “the potential for overuse leading to a cycle of dependency that leaves workers worse off than when they started,” the report states. Advances can come with an average annual percentage rate of about 100%, but that’s below many payday loans which can be pegged to a rate of over 400%, The New York Times reported last year.

Gronen told CFO Dive in an interview over the summer that if he offered EWA, he believed the company should bear the cost. But he acknowledged he faced a kind of moral dilemma when considering it. 

“As a CFO, you want to make sure you’re doing the right thing for employees and kind of helping them not get into trouble,” Gronen sad. “There are a lot of benefits but the downsides scare me because some people get $1,000 or $100 today and they go spend it immediately and then when they get to the first of the month they no longer have money to pay the rent.”   

Gronen also said he proceeded to review the option over his own reservations because he believes benefits and employee satisfaction lead to higher retention rates. 

Finance chiefs are increasingly tasked with balancing risks and benefits tied to layoffs as they make difficult cost-cutting decisions in response to rising expenses from myriad pressures — including tariffs and digital spending. 

U.S. layoffs this year through July rose to 806,383 — a 75% increase year-over-year, marking the highest January-to-July tally since 2020, when pandemic shutdowns pushed up pink slips beyond 1.8 million, Newsweek reported, citing statistics from Challenger, Gray & Christmas and impacts from government downsizing, corporate restructuring and the growing effects of artificial intelligence.

“Facing lower economic growth forecasts, an elevated cost of capital and policy uncertainty, CFOs are turning to cost optimization programs to defend margins,” Gartner, a consulting firm, said in a recent report.

“However, CFOs face a difficult trade-off. They must ensure the margin-preserving cost optimization programs don’t inadvertently cut too deep into the human capacity and capabilities required to drive growth during the next cycle,” Gartner said. 

While layoffs are on the rise, they aren’t always productive, according to the report, written by Vaughan Archer, a senior director and analyst in Gartner’s finance practice. Common mistakes include avoiding conflict by spreading cost-savings goals evenly across functions, determining who will be laid off by adhering to inflexible rules like first-in-first-out, or failing to anticipate costs resulting from layoffs, such as the need for contractor hiring or overtime pay to complete essential with less staff. Such unanticipated problems result in “unsustainable cost creep.”

Vaughan’s report outlines some practical steps finance chiefs can take to help their firms make smarter decisions on workforce cost challenges and, if needed, layoffs: 

1. Help your firm exhaust non-personnel cost-cutting options. Payroll typically accounts for a big chunk of functional and operational spending: for example, it accounts for 74.6% of the average finance function budget, according to the report. But CFOs should give their firms a range of other cost-savings measures that don’t affect headcount or require restructuring charges before moving on to layoffs, Gartner said.
2. Forget across-the-board staff reductions. CFOs must keep in mind the strategic importance of functions or teams to the broader corporate strategy when making headcount cuts. “Not all personnel expenses are created equal, and by treating them as such, CFOs risk penalizing the more efficient parts of the organization and eroding important sources of value,” Gartner said. 
3. Give budget-holders tools and data to make layoff decisions. Some managers use backward-looking measures when developing a list of potential employees to be cut. Instead, employees should be segmented "according to how they align with the future business strategy and their direct impact on revenue or performance.” Also, CFOs need to give management information that will enable them to quantify salary and non-salary cost reductions associated with a layoff, as well as the upfront costs that include severance, prorated bonuses, and other expenses associated with certain cuts, Gartner said.  
4. Stick with cost-cutting: And set up tracking systems to ensure the company does. CFOs must guard against gains in cost reduction initiatives being eroded via new expenses such as overtime and aggressive rehiring. “Tasking FP&A, for example, with maintaining a rolling list of departments and roles where cuts have been implemented in the last two years will help monitor cost reemergence,” Gartner said. 
5.  Communicate to retain critical talent. CFOs must work with senior human resources leadership to clearly communicate the financial rationale of the layoffs and cost-cuts. “Communications must address two critical phases: preparing management for employee layoffs and ensuring retained employees — especially top performers — remain consistently engaged, focused and motivated post-layoff,” Gartner said.

The flare-up of an unforeseen “black swan” calamity is a bane of every CFO.

It’s also rare.

Yet in C-suites worldwide, a flock of such risks has come to roost this year as the Trump administration shakes up global trade, finance and post-World War II alliances.

The highest U.S. import duties since the 1930s risk stoking inflation and jumbling international supply chains. The whiplash from stop-start tariff announcements and Republican-backed legislation ballooning the federal debt have cast doubt on the dollar’s preeminence as a safe haven and reserve currency.

The White House includes on its to-do list the stuff of Hollywood fiction, such as the U.S. annexation of Canada, Greenland and the Panama Canal.

The upshot: Risks to CFO planning are bigger — and more frequent and inter-woven — than ever before, often spreading across global markets, according to Richard Chambers, senior advisor at AuditBoard, a provider of audit management software.

The shake-up in U.S. policy this year “is the next page in the chapter of perma-crisis that we’ve been living through since 2020” and the start of the pandemic, Chambers said in an interview.

“Foundational rules for risk management have been fundamentally altered forever,” according to Chambers, the former CEO of the Institute of Internal Auditors.

Before President Donald Trump took office in January, CFOs faced an array of severe risks that loomed outside direct federal control, including cyberattacks, climate change, the outbreak of a new pandemic or the spread of fighting in Ukraine and the Middle East.

This year many new hazards for CFOs stem from government policy shifts by a single decision maker — Trump.

“What is surprising is how quickly and how aggressively they’re all being implemented simultaneously,” Chambers said.

Federal Reserve Chair Jerome Powell has repeatedly said that proposed changes to U.S. trade, immigration, fiscal and regulatory policies create a degree of uncertainty that has stymied forecasters and prompted the central bank this year to forgo cutting borrowing costs.

In April, uncertainty over U.S. economic policy hit the highest level in four decades, surging nearly five times from just before the November national election until shortly after the “Liberation Day” announcement of tariffs on April 2, according to an index from the St. Louis Fed.

The index, which has declined with the easing of U.S.-China trade tensions, measures the frequency of news articles mentioning economic uncertainty and policy, and disagreement among forecasters over future inflation and government spending.

Many companies have taken a “wait-and-see” stance, postponing investments and hiring, New York Fed President John Williams recently said, echoing findings of the Conference Board and other surveys.

“We are truly getting to paralysis, and nothing goes well there,” Rimini Street CFO Michael Perica, said, referring to capital deployment decisions by top finance executives.

“We’re all driven to simply cut costs, hunker down,” Perica said in an interview, noting the need to preserve capital given the prospect of higher inflation and below-trend economic growth.

Yet delaying potentially profit-boosting investment poses its own set of risks. As the pace of innovation accelerates in artificial intelligence and other technologies, CFOs who wait for more clarity may fall behind their bolder, more nimble rivals, CFOs and risk management experts said.

“Just a couple of years back, for the first time we heard of ChatGPT, large language models, generative AI,” Tredence CFO Pratap Daruka said in an interview. “Now we’re talking about how agentic AI is changing the world.”

As in prior periods of upheaval, CFOs should draw up a range of scenarios and use them to stress test their planning, undergird business strategy and ensure they stay within their risk tolerance, the CFOs and risk management experts said. Such efforts will help them quickly respond to low-probability adversity.

Without such analysis, companies may suffer losses similar to those of the multinationals that abandoned operations in Russia after its 2022 invasion of Ukraine, they said.

While pursuing traditional scenario planning, CFOs can also curb perma-crisis risks by taking seven other steps:

1. Build resilience

Persistent shape-shifting in federal policymaking calls for flexible planning and nimble operations, the finance chiefs and risk management experts said.

Possible changes to “reciprocal” tariffs as soon as July 9 will require careful scenario planning for altering prices and prior consultation with suppliers and customers, they said.

CFOs can build resiliency by diversifying supply chains and shifting into markets that are least disrupted by tit-for-tat import duties, they said.

“There is a lot of geopolitical risk, so diversify that geopolitical risk,” Daruka said, noting that Tredence has expanded in the past five years to the U.K., Canada and the Middle East, and is scoping out other locations mindful of currency risk and taxation.

By expanding outside the U.S., a company also taps into a broader pool of talent, Perica said. “We are fortunate that we have an extensive global reach and there’s talent everywhere,” he said.

2. Sharpen the focus on external risks

The turbulence from Trump administration policy shifts underscores a lesson CFOs learned from the pandemic — the imperative to vet external risks outside their control rather than build business strategy based primarily on company data, according to Richard Wagner, field chief technology officer at Board International, a provider of business intelligence software.

“Before the pandemic I felt I was screaming underwater” when encouraging finance executives to look beyond revenue, costs and other internal gauges of performance, he said.

Early in the pandemic a maker of power tools that closely tracked consumer trends forecast a surge in home improvement and expanded production before its rivals, Wagner said. “That insight enabled them to capture millions in revenue, and gain higher profitability and market share.”

Also, a beverage maker, after identifying an 80% correlation between its sales and federal outlays for food stamps, can estimate the decline in demand triggered by Trump’s cuts to entitlement spending and plans for mass deportations, Wagner said.

At the same time, CFOs monitoring external events need to ensure they are not “blinded by the lightning” from an unexpected calamity, Chambers said.

Some companies struggling to adjust at the start of the pandemic failed to anticipate second- and third-order consequences such as higher inflation, a surge in federal spending and massive purchases of bonds by the Fed, he said.

“The dominoes continue to fall long after the initial impact” from upheaval, Chambers said.

3. ‘Nowcast’ as well as forecast

During the pandemic, many companies abandoned single-point annual planning for multi-point scenario planning updated monthly, Wagner said. “You are actually thinking about the quarter and the year on almost a daily basis.”

Reliable hard data such as gas prices, interest rates and consumer spending are especially useful, Wagner said. By updating monthly, a CFO can usually gain fresh insights without the risk of relying on less credible, shorter-term data, he said.

Even as CFOs today face the risk of acting on unseasoned data, they need to make bigger decisions with greater frequency than during less turbulent periods, Chambers said.

“The speed with which risks emerge and the volatility of those risks — how random and unpredictable they are — have all converged into perma-crisis,” Chambers said.

“We’re no longer in a position to look a year out, a month out, a week out, or even a day out —  in some cases, we have to be prepared to move on a moment’s notice,” he said.

Since the start of the pandemic, Daruka and his colleagues have built multiple scenarios and set strategic targets on a monthly and quarterly basis. They track weekly data revenues, costs and eight other “business drivers.”

“It is becoming a more agile exercise,” he said, noting the whipsawing endured by Tredence customers from sudden changes in import levies and other policies.

“We are working with a lot of clients that will be significantly impacted from tariffs,” he said. The border taxes influence the “investments they are making in terms of cutting edge technologies and certain transformation projects.”

4. Harness artificial intelligence

Finance executives late to take advantage of the rapid insights from AI in scenario planning put themselves at a competitive disadvantage, the CFOs and risk management experts said.

Use of AI will become “just part of their job — just as much as closing the books,” honing forecasting and speeding adjustment to tariffs and other high-stakes challenges, Wagner said.

Deploying the technology is like fielding a team of economists and, by speeding up scenario planning, gives CFOs a fighting chance of keeping up with the accelerating pace of trade and other policy changes, he said.

Consumer packaged goods companies have made strides using AI to identify markets, determine the best price points, streamline supply chains and manage inventory, including when to buy and how to optimize delivery and use of warehouses, Daruka said.

Tredence uses AI and machine learning to identify patterns in revenue, geopolitical risk, client credit risk and the relation between employees skills and wages, he said.

5. Make scenario planning a company-wide project

A CFO should weave scenario planning throughout a company, acknowledging that different departments view risks differently, Wagner said.

Key players in scenario planning should include executives from finance, supply chain management, marketing, sales, logistics and other departments, he said.

The broad-based team should use a common integrated planning tool, ensuring they analyze the same data and model the various scenarios across their company’s entire income statement, Wagner said.

While building the scenarios, each member of the team will see how various versions of future events would require different shifts in their department’s strategy.

“There’s a lot of power in the collaboration,” Chambers said. “A CFO can play a really critical role in making sure that all the key players understand how they’re interconnected in the success of the enterprise.”

6. Flag the unknowns, with humility

Scenario planning and risk management arise from the principle that the future is unknowable. So a CFO, when communicating with audit committees and C-suite colleagues, should point out patches of fog across a company’s entire risk landscape, the finance executives and risk management experts said.

“CFOs, and I think everybody, needs to be much more comfortable in acknowledging what they don't know and what they can't see,” Chambers said.

As cyberrisks mounted during the past decade, many CFOs in discussions with their boards described cybersecurity tools with unwarranted confidence, he said.

“We do a disservice to boards if we give them any kind of false sense of security about how the future might unfold,” he said, adding “we learned that in my field very, very vividly in the past 10 years about cybersecurity.”

“If I’m a CFO today I’m going to try to lower the confidence level that everything is going to be OK,” he said. “You’ll get the attention of the board much faster if you communicate that way.”

7. Find opportunity in chaos

When campaigning for a second presidential term, Trump promised big shifts in finance, trade, regulation, taxation, immigration and foreign policy. Volatility in the dollar and stock markets, along with public demonstrations, underscore the extent of his policy changes.

Under Trump, looser federal regulation in finance, labor law and environmental protection may make a company more — or less — competitive, and reduce operating and compliance costs.

“In any seismic, risk-induced disruption there is almost inevitably going to be winners and losers,” Chambers said. “Risk is one side of the coin, opportunity is the other side.”

Changes to tariffs, taxation and fiscal policy provide an opening for Tredence, as many companies seek to adjust to uncertainty by cutting costs and taking a “wait-and-watch” approach to investment and expansion plans, Daruka said.

“A cost-take-out opportunity for the client is also a revenue opportunity for me,” he said, “so I can build the right type of solution for the client to help them with profitability and reducing costs.”

Identifying potential payoffs from disruption is a CFO imperative, Daruka said.

“Scenario planning for me as a CFO is not just a cost activity or not just a margin activity, it is equally a growth opportunity,” he said.

Five years after the pandemic normalized remote work, companies are still wrestling with the pros and cons of requiring employees to return to offices. For CFOs, a strategic approach to office space and RTO goes hand in hand with prudent budgeting. 

That’s because, for many companies, office real estate remains the second-largest expense, following payroll, whether “it’s being used or it’s not,” Andrew Farah, CEO of workplace analytics company Density said. It’s up to a company’s leaders to make the tough decision to either use it or lose it — in order to avoid shelling out for empty space.

“The main question is, should you try to get your employees back into an office, or should you let your physical space go?” Farah said in an interview. For CFOs, who tend to consider real estate in terms of numbers, answering the RTO question can come down to the simple question of utilization: “if you have a real estate portfolio that's not being used, get rid of the buildings or require people to come back,” Farah said.

Utilization refers to how often and effectively employees are making use of a space: a good meeting room utilization rate, for example, is between 40% to 60%, according to a 2024 post by workplace software firm Envoy.

The San Francisco, California-based company provides workplace analytics software and sensors aimed at enabling companies to gain insight into how their real estate is being utilized, according to its website. Farah has served as Density’s CEO since May 2014, and previously served as a managing partner for software development agency Rounded, according to his LinkedIn profile.

The ‘de facto’ remote pitfall

The office space question has continued to loom large in the minds of CFOs and other C-suite leaders, as many high-profile companies — as well as the federal government under President Donald Trump — have begun to issue return to office mandates.

Many of the RTO policies that have been enacted this year have triggered pushback from both company employees and even executives, some of whom themselves prefer hybrid or remote work, CFO Dive previously reported.

That could be partially due to wishy-washy guidance from top-line leadership: many C-suite leaders are unwilling to be strict about RTO policies “for fear of attrition or the inability to recruit, Farah said, “so what they do is they just choose not to have a policy,” he said. “Or they say we're hybrid, which actually means many things. Hybrid is a terrible term. It's imprecise, it's vague,” and Farah said it’s often left to managers to execute.

In such cases, “hybrid” companies often turn into “de facto” remote companies, he said — with the business still footing the cost of real estate.

Fixing the ‘movie theater’ problem

As well as unclear guidance, many executives can often have a murky idea regarding exactly how the office spaces they do have are really being used by their employees — a question distinct from occupancy. For CFOs as the stewards of finance, figuring out if the space is being put to effective use is a critical factor in determining an RTO policy, especially in the midst of rising cost pressures.

Businesses that are implementing RTO policies have also found themselves facing both logistical and financial challenges, such as pricey office refurbishments to entice employees that can strain an already tight budget or a shortage of necessary supplies such as desks and WiFi access, March reports by Raconteur and NPR found.

Underutilized buildings tend to have what Farah calls the “movie theater problem,” where, entering into an empty theater, patrons “naturally spread out,” he said. “They don’t sit next to each other.” A similar pattern emerges in underutilized offices, where, lacking critical mass, employees will fill the space they’re in, but “for a CFO, it's just dollars being spent on space that's not being used,” Farah said.

As such, many “CFOs are turning to their heads of real estate and expecting hard data on utilization,” Farah said. Finding out key numbers — such as exactly how much the business is spending per head — can help finance chiefs make targeted decisions regarding if “you're going to grow some places [or] you're going to consolidate [in] others,” he said.

Historically, chief revenue officers mainly focused on driving sales and revenue growth. Today, CROs are front and center when it comes to such areas as financial planning, investor relations, pricing strategies and forecasting, according to Irina Wolpert, a leader with the executive search firm Egon Zehnder. 

As businesses have become more complex and market dynamics have shifted over the last three to five years, the responsibilities of the CRO have expanded to “just encompass a much broader set of strategic and operational functions,” Wolpert said. 

That leaves CROs nudging up against CFOs’ typical remits, an evolution that comes both with potential points of tension as well as greater opportunities to create success for their businesses.

“Both roles are incredibly critical and in fact have to coexist and partner in order for the company to have a long-term, sustainable growth agenda,” Wolpert, who serves as leader, financial services, tech & fintech practice groups at Egon Zehnder, told CFO Dive in an interview.

Weighing risk versus growth  

One of the newer entrants to the C-suite, the CRO position began to gain ground as companies — especially startups in the technology and software spaces — increasingly focused on high growth, according to a 2015 article by VentureBeat.

The position, which could also be occupied by a “chief experience officer,” or “chief growth officer,” is “tasked with creating a single revenue engine — from lead generation in digital marketing to closing the sale,” a 2023 write-up by McKinsey said. “The CRO’s role goes beyond sales and marketing to the entire market landscape, customer journey, and strategic expansion plans.”

As such, one of the main areas of tension between a CRO and CFO tends to be that “balance of risk versus growth,” Wolpert said. CFOs tend to have a more conservative approach, focused on risk management and financial stability, while CROs “are typically incentivized to take much more calculated risks to achieve more aggressive revenue targets,” she said. 

“Typically, where we see the tension is, number one in the area of resource allocation,” Wolpert said. “If you think about the traditional role of the CRO, typically they tend to push for more resources to drive sales and revenue growth. The CFOs, rightfully so, are typically much more focused on budget constraints.”

Prior to joining the Zürich, Switzerland-based leadership advisory firm, Wolpert served as global head of sales enablement and go-to-market strategy for e-commerce company Amazon, according to her LinkedIn profile.

A former professional ballet dancer turned business executive, Wolpert also served a 15-year span at American Express in various roles including as head of sales enablement and marketing and VP, global sales enablement.

While the two positions can tussle over growth versus stability, both the CRO and the CFO are morphing into more strategic leaders within the C-suite.

“Given how both roles have evolved, these two critical roles can actually build a much stronger partnership than they ever could in the past,” Wolpert said. In order for businesses to achieve their goals, that collaboration is critical, she said.

“When I think about strategic planning at the end of the day, you need both functions to focus on revenue growth and they have to be completely in alignment on their financial goals,” Wolpert said. “And I think you need a very strong CFO and a very strong CRO to really come together and think about a business strategy that ultimately drives growth and profitability.”

Broadening the path to the CEO seat  

A strong relationship between CFOs and CROs — both of which typically report to the CEO — can also help top executives to more smoothly execute on their business strategies, balancing “financial frugality” with a customer-centric approach to growth and revenue, Wolpert said. As such, both CFOs and CROs are becoming more “viable contenders” for the role of the CEO, she said.

In her view, the CRO is in a slightly better position to assume the top executive seat, as those executives have a “comprehensive” view of the businesses’ entire revenue ecosystem and so, they naturally develop “a very deep understanding of how various parts of the organization ultimately work together to achieve [a] common objective,” she said.

Finance chiefs are also emerging as more popular candidates for the CEO chair, however — and for those companies which are examining their CFOs for such a role, it’s important to invest in honing the operational leadership and other key skills of their finance chiefs outside of finance, Wolpert said.

Some companies approach this by crafting “an intentional path for the CFO to step into a chief operating officer role or a divisional CEO role” within the same company, she said, enabling them to develop their operational skills.

“I also think… the most successful CFOs who ultimately become CEOs, not only do they bring the kind of operating chops and experience running other parts of the organization, but they have really cultivated tremendous relationships with the board, with their peer set,” Wolpert said.