7 CFO risks from the high

Editor’s note: This is the second report of a two-part series exploring the potential risks and benefits as CFOs weave artificial intelligence into company operations.

CFOs and technologists are prone to superlatives when describing the coming impact of artificial intelligence, labelling the technology more disruptive than — to name a few — the steam engine, telegraph and mainframe computer.

“It’s become as big if not bigger than the dot-com internet boom,” Burt Chao, CFO of Nintex, a process automation provider, said in an interview, describing the pace of change as a “blur.”

Global spending on AI infrastructure will swell 53% this year to $487 billion, according to International Data Corporation. Outlays will likely grow at a five-year compound annual rate of about 31% and exceed $1 trillion by 2029, IDC said.

“This is no time for analysis paralysis,” said Chad Gold, CFO at Fullstory, a behavioral data company. “Things are moving too fast.”

“That doesn’t mean you should just open the checkbook and throw money at everything,” he said in an interview. “But you should be more willing than you’ve ever been before to let teams experiment.”

The challenge of AI adoption tests the flexibility and judgment of a CFO more than other prior technologies, according to technologists and top executives.

The high financial and competitive stakes also require a CFO to carefully size up AI’s risks, financial executives and technologists said, flagging seven hazards:

1. Low — or no — return on investment

At many companies, the pace of returns from AI lags investment in the technology.

More than half of CEOs (56%) said they did not gain revenue or achieve cost reductions from AI during the previous 12 months, according to results of a PwC survey of 4,454 CEOs across 95 countries released in January. (Only 30% reported higher revenues; only 26% report lower costs.)

Yet the potential payoff is clear among leaders in AI adoption, according to McKinsey.

Twenty such companies boosted EBITDA by 20%, reached breakeven in 24 months or less and generated $3 of incremental EBITA for every $1 invested, McKinsey said.

The AI leaders focused on no more than three areas of their business, maintained a “maniacal” focus on customers and AI users, and insisted on accountability for KPIs, McKinsey said.

Most CFOs (71%) believe common metrics for ROI are ill suited for measuring the gains from AI and other emerging technologies, EY found in a survey released last month.

Traditional ROI frameworks fail to accurately gauge future, indirect or intangible benefits, including improved decision-making, forecasting accuracy and operational agility, EY said.

CFOs would benefit from qualitative measures, such as how AI improves price setting, streamlines supply chains or frees up finance employees to focus on higher value-added tasks, according to EY.

CFOs would also benefit from patience, Gold said.

“What you learn with AI is that you have to be willing to invest the time at the front end,” he said.

“It potentially takes longer to train AI the first time than it does to do the task,” Gold said. “But if you do it the right way and invest the time, the payoff in the long run is pretty significant.”

CFOs leery of lunging at AI can start with pilot projects or create partnerships to dilute risk, technologists and financial executives said.

“You can share ROI risk by striking deals with your service providers, having the amount they get paid tied to the benefits you achieve,” Christopher Wright, global CFO solutions and business performance improvement leader at Protiviti, said in an interview.

2. Loss of institutional knowledge

Relying on AI to gather and analyze data risks eroding the knowledge employees gained through years of problem solving on core business subjects, including financial planning, customer relations and risk management, technologists and CFOs said.

“If you have AI doing that for you, it’s dangerous because all of a sudden all of that human capital goes away,” Gold said, noting that people who grew up using GPS often do not know how to use a paper map.

A CFO may automate forecasting, Gold said, “but how are you going to replace the knowledge your team gained by building that forecast — what they learned about the business and how they made changes along the way?”

The potential for loss of institutional knowledge and sound judgement is one of several reasons to ensure close human oversight of AI, Wright said.

“You want it to run with some autonomy, but you always have to have human judgement, double checking,” Wright said. “The prime example — you don’t want the agent to make final payment decisions, but you would rather not key in the invoices by hand either.” 3. Little or no governance

Many C-suite executives fear that an internal AI agent will run off the leash, spew proprietary data far and wide, open vulnerabilities to cyberattack or promise customers benefits or services that do not exist.

Yet the top threat comes from humans, according to technologists and CFOs.

“The biggest risk is not a rogue model,” ModelOp CEO Dave Trier said. “It’s the cottage industry most enterprises are running today, where every team builds and deploys AI differently with no shared standard,” he said in an email.

Kfir Lippmann, CFO at Salt Security, an AI security platform, also considers the “shadow agent problem” to be the largest hazard from AI.

“Teams across the organization are deploying AI agents independently, connecting them to internal systems, customer data and financial workflows without central oversight or budget approval,” he said in an email. “These are real operational and financial commitments being made outside the normal governance process.”

Four out of five organizations (82%) during the past year discovered AI agents used internally that they did not know existed, Lippmann said, citing a survey by the Cloud Security Alliance. “Every one of those agents is an unbudgeted-line-item risk to operations and a potential compliance liability.”

Sound governance of AI begins with a CFO asking basic questions, Wright said: are systems such as the enterprise resource planning software compatible with AI; can the technology interact with company data; do employees have the skills and tools to operate the agent; would the technology increase exposure to cyberattacks; is the company board ready and able to interact with AI?

Pipedrive, a provider of customer relationship management software, has tightened governance by reviewing proposals for AI procurement with a team from departments overseeing security, compliance, technology and privacy, CFO Regi Vengalil said. The team meets twice each week and assesses proposals primarily from product engineering and marketing staff.

“Over the past few weeks we’ve been working on how we can go faster but still maintain the right constraints,” he said in an interview. 4. Flawed data AI adoption will likely slow or stop if not fed with data that is accurate, timely and easily accessed, technologists and financial executives said.

“Some people are expecting to turn garbage into gold,” Chao said. “In time, it might prove to be fool’s gold.”

Cleaning up the data may prove costly, technologists and financial executives said.

“The central question for us is: How do we migrate most of the older code and the architecture into a more nimble and flexible architecture for where we’re going?” Vengalil said.

“That’s the biggest opportunity for us,” he said, while flagging the challenge of finding weaknesses in the data without devoting excessive time and money in the effort.

Ensuring human oversight of data is vital, technologists and CFOs said, noting that AI, while prized for quickly fixing problems, is capable of quickly creating problems as well.

“To have a process that can actually have observability is really important,” Chao said. “If you’re not really watching everything in all the steps in between, or have the ability to inspect that, then that really does run the risk of that error propagation getting out of hand.”

With AI still at an early stage, much of the technology suffers from an “education gap” and needs human help, Wright said.

“The experienced judgment of somebody with institutional memory is probably better than the AI model until you’ve trained the AI model,” he said. “The machine has not yet learned what it needs to learn.” 5. Low ‘black box’ credibility AI insights drawn from clean data but lacking clarity in the underlying reasoning can prove unconvincing and frustrate the C-suite, technologists and CFOs said.

“You can imagine a user who is getting recommendations from us — if they don’t understand where our view is coming from, they don’t trust it,” Vengalil said.

“It can’t be a black box, and we have to give reasonable traceability to our users” so customers can see the data supporting the rationale for the recommendation, he said.

An inexplicable AI finding is often a mix of at least a few opaque insights that need untangling, Chao said. “Big problems are often combinations of small problems.”

Finance departments should be leery of relying on AI for forecasting, a high-stakes category of output that is vulnerable to the black box problem, Wright said.

“No finance organization is going to use AI to do their forecast — it doesn’t have the judgement they have,” Wright said.

AI can help speed information gathering, format it for analysis and provide a first draft of forecast insights, he said. “But ultimately you have to fact check, you have to make sure you’re working with real data and not imagined data.” 6. Compliance with myriad regulations CFOs and a broad range of finance executives singled out data security and privacy as the No. 1 risk in AI adoption, Protiviti found in a global survey.

Companies deploying AI enter a thicket of AI regulation.

Shielding against such hazards is not easy. Governments have enacted overlapping and conflicting AI regulations, complicating compliance with standards for data privacy, cybersecurity, intellectual property and other top vulnerabilities, CFOs and technologists said.

To streamline AI adoption, CFOs and their C-suites colleagues need to include attorneys and compliance and cybersecurity experts in decision-making, Wright said.

The specialists would help identify who in the company should be accountable for ensuring compliance as well as plan the training of employees or hiring of outside experts, Wright said in an interview.

Compliance, legal and security experts “need to be embedded in product building,” Pipedrive CFO Vengalil said.

Pipedrive, a provider of customer relationship management software that operates in several countries, must ensure transcripts of calls with customers align with privacy regulations, CFO Vengalil said.

“We’re thinking through all of the complex dynamics that are raised as part of the acceleration of the technology,” he said. “We don’t want to get too far ahead and then find out at launch that we can’t launch.” 7. Employee fear, resentment

Employees often react to AI adoption in one of two ways, either resisting it as a threat to their jobs, or welcoming it as an opportunity to upgrade their skills and keep pace with innovation, technologists and CFOs said.

“There’s a risk of losing people who don’t want to innovate or who are scared of how this plays out,” Chao said.

The champions of adoption often launch deployment from the top-down, without enough input from employees who run operations in finance, operations or human resources, according to Elizabeth Ngonzi, an AI consultant and an American Society for AI board member.

“You end up automating broken workflows, hard‑coding outdated assumptions or deploying tools no one trusts or uses,” she said in an email.

“The financial risk shows up as sunk implementation cost, stalled adoption and ‘AI on the slide deck’ instead of in daily decision‑making,” she said.

The solution is openness and collaboration with employees at all levels, technologists and CFOs said.

“You need to bring people along, make sure you’re listening to people, and what their hopes and fears are around this, and how that might align with the path you’ve set out,” Chao said.