# 26. How do we demonstrate GRC value without inventing ROI or misleading the board?

Build the business case from your baseline and distinguish cash savings from released capacity and improved assurance. Use traceable operational measures rather than importing a supplier’s customer-return claim into your own forecast.

Our proposed value model has three categories:

1. **Cash expenditure avoided:** a subscription or external service that will actually be retired.
2. **Capacity released:** documented reduction in recurring effort, with an identified use for the time.
3. **Assurance improvement:** better traceability, timeliness or coverage, measured without assigning speculative financial benefits.

**Illustration:** 25 people spending two hours per week on evidence chasing over 48 weeks at an assumed USD 60 hourly rate represents USD 144,000 of annual allocated effort. It is not automatically USD 144,000 of recoverable cash or achievable savings.

Pilot one workflow and compare like-for-like populations. Record additional review, administration and integration-support effort as well as reduced chasing.

For board reporting, make every headline traceable to its population, reporting date, methodology, owner and supporting records. Show unassessed items, stale evidence and accepted exceptions rather than silently excluding them.

NIST leaves measurement of CSF effectiveness to the organisation’s goals rather than prescribing a universal effectiveness score; that is a useful reminder to define what your own dashboard is intended to demonstrate. [NIST FAQ](https://www.nist.gov/cyberframework/faqs). ([nist.gov](https://www.nist.gov/cyberframework/faqs))

Do not count a regulatory fine as “avoided” without a defensible, case-specific basis. Do not treat fewer reported findings as automatically better control performance.