AI Governance Has No Honest ROI Multiple. Fund It Anyway.

In a survey published in October 2025, EY asked 975 C-suite leaders at companies with more than $1 billion in revenue about the cost of AI-related risks. Ninety-nine percent said their organizations had lost money. Nearly two-thirds had lost more than $1 million, and EY put the average loss among the companies hit at $4.4 million, an estimate it called conservative.

Until this month, this article turned those figures into an 11-fold return on one governance hire. It multiplied EY’s $4.4 million by a 51% incident rate from a McKinsey survey and set the result against a $200,000 salary. The number was wrong because the method was wrong.

What does an AI governance hire return? No published study says. The case that holds is plainer: fund governance as a stated share of each AI budget, using the reference point two budget studies offer, near a tenth of AI spend.

Why the multiple falls apart

Three problems. The first two make the number unreliable, and the third makes it unknowable.

The two numbers describe different companies. EY’s $4.4 million is an average across large companies that had already suffered losses, and EY gives no time period for it. The 51% comes from McKinsey’s November 2025 State of AI survey of 1,993 people at organizations of every size, and it counts respondents who say their organization saw “at least one instance of a negative consequence” from AI. An inaccurate answer that someone caught counts. Multiplying the two treats a share of survey respondents as the yearly odds that a large company loses $4.4 million.

The probability is a choice, and the answer swings with it. When PwC modelled responsible AI investment in 2025, it assumed a baseline chance of an adverse AI incident of 2% a year. Put 2% into the same sum and the expected loss falls to $88,000. Use EY’s own 99% and it lands close to the full $4.4 million, with no time period attached. A product that moves that far on one input can’t anchor a budget.

Nobody has measured what the hire prevents. An expected-loss case has to say how much of the loss governance removes. The surveys report correlations between governance practices and outcomes, and none reports losses a governance hire averted. The old sum assumed it averted all of them. The salary was also unsupported: IAPP’s 2025-26 salary survey, which the old version cited for $200,000, puts the median for people working only in AI governance at $151,800.

A CFO who checks a multiple like this finds all three problems in an afternoon. When that happens the governance budget loses credibility along with the number, and the person who brought the pitch carries the cost.

What the studies do support

Take the multiple away and three findings remain, each resting on one source.

Losses are close to universal at large companies. That is EY’s finding, and it needs no arithmetic added. The risks it found most often were non-compliance with AI regulations (57%), harm to sustainability goals (55%) and biased outputs (53%).

Governance practices travel with better results. EY found that companies using governance measures such as real-time monitoring and oversight committees were “far more likely” to report gains in revenue growth, cost savings and employee satisfaction, and that those with a defined set of responsible AI principles reported 30% fewer risks. McKinsey’s March 2025 survey tested 25 attributes against the profit impact companies reported from generative AI. CEO oversight of AI governance was among those most closely tied to it, yet only 28% of respondents said their CEO held that job.

The two budget studies share a number, though they measured different things. In IBM’s 2025 survey of 915 executives, companies in the top quartile, spending 10% or more of their AI budget on AI ethics, reported operating profit attributable to AI 30% higher than the bottom quartile, which spent 5% or less. PwC’s model compared companies spending just enough to comply with companies spending an extra 10% of their AI budget on responsible AI on top of that, and found valuations up to 4% higher and revenues up to 3.5% higher over five years.

Read these for what they are. EY, McKinsey and IBM report what executives said about their own companies, and well-run companies may simply be good at both governance and profit. PwC’s figures come from simulation, and PwC calls them directional. None proves that governance causes the gains. They still give a CFO something to work with. In IBM’s survey the companies spending most on AI ethics reported more profit from AI than those spending least, which proves nothing about cause but offers no sign that governance drags on results. Both budget studies also put their marker at 10%: IBM where its top quartile starts, PwC above a compliance baseline, so PwC’s comparison if anything points higher.

Fund it as a line in the AI budget

Once the multiple goes, a budget share replaces it. Ask for governance inside each AI programme’s budget at a stated percentage, instead of a stand-alone hire defended with an insurance sum. Ten percent is the only reference point the published evidence offers. It isn’t an optimum; nobody has tested 6% against 14%. Adjust it by risk. A programme that makes credit, hiring or health decisions should carry more than one that summarises internal documents, and shared work such as the inventory belongs in one central budget. On a $5 million AI programme, 10% is $500,000 a year, a little over three times IAPP’s median salary for someone working only in AI governance. The share pays for people and for what they produce.

Attach the share at the moment each AI programme is approved, so governance is costed the way compute and data work already are. A programme that cannot carry the share has told the CFO something useful about its own margins.

The first 90 days of that money should buy what Minimum Viable Governance is built around: a list of every AI system in use, a record of how each one could fail and who, inside or outside the company, would be hurt, and a named person with the authority to pause each one. They are cheap to produce and easy to audit. They are also what a regulator, an insurer or an acquirer will ask to see first.

The board ask in five lines

1. The exposure. Nearly every billion-dollar company EY surveyed had lost money to AI-related risks, and almost two in three had lost more than $1 million.
2. The evidence, labelled honestly. EY, McKinsey and IBM all find governance and better results moving together. None of them shows which drives which.
3. The amount. A stated share of the AI budget, set against two reference points: IBM’s top quartile (10% or more on AI ethics) and PwC’s model (10% above compliance).
4. Where peers stand. In 2025 proxy statements, 54% of the S&P 100 disclosed board oversight of AI and 28% disclosed both oversight and an AI policy, according to Glass Lewis.
5. What the board gets by day 90. The inventory, the failure record and the named owners, plus a date to decide whether the share should move.

Line three is where a CFO will push. Name the share your largest AI programme can carry, and if it differs from 10%, say why in one sentence.

The fifth line carries the most weight. It turns a request for belief into a request for something the board can check.

Where this breaks down

Most sources here studied large companies, and EY sampled only firms above $1 billion in revenue. A company a tenth that size has no loss benchmark in this article and shouldn’t borrow EY’s. The budget anchor also assumes an AI budget big enough for a tenth of it to pay for real work. At small scale the first step is a named owner with part of a week. A percentage is the wrong lens there.

The strongest objection is practical. Without a multiple, governance may lose the budget fight to projects that promise one. Those promises face the same afternoon with the same CFO, and I would rather defend a budget line with a dated deliverable than a figure no study supports.

Once the money is approved, the next argument is about timing: when to measure AI returns, and what to count. A CFO has heard plenty of multiples. A share of spend with a deliverable at day 90 is a smaller promise, and a CFO can hold you to it.

Sources and changes

• EY, "EY survey: companies advancing responsible AI governance linked to better business outcomes", 8 October 2025, and the full report, "How responsible AI translates investment into impact".
• McKinsey, "The state of AI in 2025: Agents, innovation, and transformation", 5 November 2025 (archived copy).
• McKinsey, "The state of AI: How organizations are rewiring to capture value", 12 March 2025 (archived copy).
• PwC, "Quantifying the value of Responsible AI", 7 August 2025 (archived copy).
• IBM Institute for Business Value, "The AI ethics trust engine", October 2025.
• IAPP, "Salary and Jobs Report 2025-26: summary", 3 August 2025.
• Sarah Wenger, Glass Lewis, "US AI Oversight Through Three Lenses: Investor Expectations, the S&P 100 and Company-Specific Analysis", Harvard Law School Forum on Corporate Governance, 11 March 2026.

Changes on 6 October 2026. Rewritten and cut from about 3,300 words to an Argument under a new headline. The earlier version’s 11x return on a governance hire is withdrawn, because it multiplied figures from two different surveys. Also removed: a $200,000 salary not found in its cited report, speed and incident figures from a vendor blog with no named study, project-failure figures not found at their cited source, a quotation not found in its cited source, seven custom charts and a download that did not match its title.