Why risk and control is often the stronger case for change

Most business cases for operational change lead with efficiency: hours saved, cost per transaction reduced, capacity freed up. That argument asks a leadership team to trust a projection. A risk and control argument asks something much easier: to look at something that has already happened, and decide whether it can be allowed to happen again.

Why efficiency alone is a hard sell

An efficiency saving is, by its nature, hypothetical until it is realised. It depends on assumptions about how much time a task really takes, whether the saved time gets used productively, and whether the projected numbers survive contact with how the business actually operates. Leadership teams have heard enough optimistic business cases to be reasonably sceptical of the next one.

A risk case does not carry that problem, because it is not a projection. A figure omitted from a VAT calculation, a stock count that no longer matches reality after a failed integration, an invoice that goes out late because a customer's purchase order reference was missed, these are not hypothetical. They already happened, and the cost of them happening again is not in dispute.

An efficiency case asks you to believe a number that has not happened yet. A risk case asks you to look at a number that already has.

Where risk tends to hide in ordinary operations

Manual steps with no check. Any point where a figure is typed in by hand, with nobody else looking at it before it matters, is a place where a single mistake becomes the business's number.

Systems relied on for something they were not built for. A spreadsheet used as an audit trail, a shared inbox used as a task tracker. These arrangements can work for years and then fail exactly when volume or scrutiny increases.

Single points of knowledge. Compliance and accuracy that depend on one person remembering to do something, rather than a process that would catch it if they forgot, is a risk that only becomes visible the day that person is unavailable.

Record keeping that would not survive scrutiny. UK businesses are legally required to keep adequate records, and a limited company can be fined £3,000 by HMRC, or its directors disqualified, if it does not keep accounting records. That is a concrete, quantifiable exposure, not an abstract inefficiency.

An illustrative example

Consider a business (illustrative, not a specific client) where a stock management integration occasionally overwrote quantities without anyone noticing until a customer order could not be fulfilled. Framed as an efficiency problem, the fix competed for budget against a dozen other improvements with more attractive-looking numbers attached. Framed honestly as a risk of double-selling stock to customers, with the reputational and refund cost made explicit, it moved to the top of the list within a week.

What this means in practice

Value in an operational review should be assessed across more than time and cost. Service, management visibility and risk avoided are all legitimate parts of the case, and for an established business with something to lose, risk avoided is frequently the argument that actually gets budget approved. It is worth asking, of any process under review, not only how much time it costs, but what has already gone wrong, or nearly gone wrong, and what it would cost the business if it happened again at a worse moment.

If you need to build the case for an operational change, see how I help with performance and operational change.