Resilience, Returns and the Evolving CIO Mandate

How can CIOs meet today’s operational demands without compromising tomorrow’s capabilities? The answer depends as much on commercial understanding and enterprise leadership as on technology expertise.

Drawing on a recent Odgers breakfast in Sydney with senior technology, digital, and business leaders from financial services, healthcare, communications, retail, media, and technology, three connected priorities emerge: defining resilience in business terms, demonstrating commercial value, and broadening the capabilities required of technology leaders.

1. Delivering Transformation in Complex Businesses

Technology transformation looks very different depending on the business. Some leaders work within established, infrastructure-intensive environments where legacy systems remain central to daily operations. Others have greater flexibility to introduce new platforms, rethink processes or pursue growth through technology.

Delivering technology projects is not the same as achieving meaningful business change.

Major system upgrades and infrastructure programs remain necessary, but their success does not automatically translate into better customer experiences, improved productivity or stronger financial performance. Those outcomes often depend on changes to processes, ways of working and the capabilities of people across the business.

The commercial case for transformation can be difficult to establish. Compliance, operational efficiency, customer experience and future growth may all justify investment, but they involve different measures of success.

For CIOs, this creates an ongoing challenge: maintaining essential services and meeting immediate business requirements while securing investment in capabilities whose benefits may take longer to emerge.

2. Understanding Resilience Through the Lens of the Business

Operational resilience is as much a business decision as a technology responsibility, requiring alignment between CIOs, boards and risk committees.

Boards are paying closer attention to cybersecurity, operational continuity and the consequences of disruption. Yet a considerable gap can exist between an organisation’s stated risk appetite and the expenditure required to achieve it.

A practical starting point is defining what the business needs to protect and how quickly critical services must recover following an incident.

The difference between tolerating several hours of disruption and expecting almost immediate recovery can be significant, both technically and financially. These choices require explicit consideration of business priorities, cost and the consequences for customers and other stakeholders. A key question is whether conventional risk reporting and assurance processes adequately address these practical considerations.

A business may have extensive documentation, established controls and clear recovery objectives, but those arrangements still need to work during a real incident. Understanding the first decisions and actions required when something goes wrong is essential, recognising that no plan can anticipate every possible scenario.

Data sovereignty and third-party dependencies add further complexity, as does the distinction between protecting information and maintaining the ability to recover essential services.

These issues suggest a need for ongoing dialogue between technology executives and boards about acceptable risk, investment priorities and what operational resilience means in practice.

3. Helping Boards Navigate Technology and Information Risk

Board-level technology and data literacy matters increasingly as digital decisions carry wider business consequences.

As businesses become more dependent on digital systems and information, boards increasingly need to understand the implications of decisions that may once have appeared largely technical.
CIOs can help directors distinguish between compliance, assurance, and a business's practical capacity to withstand disruption.

Data provides a useful example. For many businesses, information represents a substantial source of commercial value, yet its importance may be difficult to reflect in conventional risk assessments or investment decisions.

Technology leaders therefore have an important role in translating technical exposures into their potential consequences for customers, operations, reputation and financial performance.

This also requires judgement about the level of detail boards need. The objective is not necessarily to make directors technology specialists, but to enable better-informed decisions about the risks the business is prepared to accept.

4. Assessing the Value and Risks of Artificial Intelligence (AI)

AI presents another set of opportunities and tensions.

Many businesses continue to explore its potential to improve individual productivity, customer experience and operational efficiency. However, employees using AI tools to perform tasks is not the same as businesses achieving sustained improvements across entire processes or functions.

The former may be relatively straightforward to demonstrate. The latter can require substantial changes to data, systems, governance and ways of working.

Assessing the financial returns from AI investment remains a challenge. Early adoption and experimentation can generate useful learning, but measuring benefits at enterprise scale remains more complicated.

At the same time, leaders must consider security, privacy, emerging regulation and the use of AI tools outside established corporate controls. Balancing innovation with appropriate safeguards remains difficult. An overly restrictive approach may discourage useful experimentation, while insufficient oversight can introduce risks that are not immediately visible.

A further question is whether executive understanding of AI is developing quickly enough to support informed investment and governance decisions. As AI applications become more sophisticated, including the prospect of greater autonomy through agentic systems, collaboration between technology, risk, business and people leaders may become increasingly important.

5. Demonstrating Commercial Value from Technology Investment

Demonstrating technology’s contribution to business performance requires more than evidence of successful project delivery.

Traditional measures of project delivery, system availability and operational efficiency remain relevant. However, they do not necessarily capture technology's full contribution to growth, customer experience, or changes in the cost of serving customers.

Investments need to be evaluated against broader business objectives, including the sometimes difficult choice between improving existing systems and developing new capabilities.

This becomes particularly important when budgets are constrained, and businesses need to make decisions about competing priorities.

Some investments offer relatively immediate and measurable benefits. Others address accumulated technical complexity, reduce future risk or create opportunities that may not yet have a clearly defined financial return.

The commercial challenge for CIOs involves explaining these differences and helping executive colleagues make informed choices, rather than treating every investment through the same financial or operational lens.

6. The Changing Expectations of CIO Leadership

The expanding CIO mandate calls for a broader combination of technical credibility, commercial understanding and leadership judgement.

Technology executives increasingly operate across a broad range of enterprise issues. Alongside technical expertise, they need to understand commercial priorities, organisational change, customer expectations, and the concerns of colleagues whose responsibilities may differ significantly from their own.

Balancing specialist depth with leadership breadth is therefore an important consideration.

The familiar concept of a T-shaped leader combines deep expertise with wider business understanding. Contemporary technology leadership may require an even broader combination of capabilities.

CIOs still need the technical credibility to make sound decisions and challenge expert advice. Equally, they must work effectively beyond their own functions, understand problems from different perspectives and exercise influence where they do not have direct authority.

A useful distinction is between technical knowledge and the judgement to apply it.

Technical knowledge remains essential, but senior leadership increasingly calls for judgement: understanding which problems deserve attention, recognising competing interests and knowing when the technically preferable solution may not be the most appropriate choice for the business.

Commercial understanding, empathy and the ability to connect different parts of the enterprise are therefore important considerations in how businesses assess and develop their technology leaders.

Looking Ahead

The choices facing CIOs: how much resilience to build, where to direct investment, how to assess emerging technologies and how to demonstrate value beyond the technology function, are ultimately business choices. They depend on strategy, available resources, risk appetite and the ability to bring different perspectives into decision-making.

As the CIO’s remit extends further into enterprise priorities, technical expertise remains essential. Equally important is the judgement to weigh competing demands, explain trade-offs and help colleagues make informed decisions. For organisations assessing and developing technology leaders, the question is not only what they know, but how effectively they apply that knowledge across the business.

______________________________________________________________

Get in touch. Follow the links below to learn more or connect directly with our dedicated executive search experts and Technology Practice consultants at your local Odgers office here.