True legal, security, or market risks of the status quo are made concrete and personal to the people accountable for them, so acting looks like the responsible choice.
Borderline: whether this move is justified depends on the situation, and only the person in it can judge.
An example
One week after a peer firm was fined $400 million for sanctions failures involving a payments vendor, the new chief compliance officer at a mid-size payments company presented to the audit committee. She had been trying for a year to fund a vendor-screening program. This time she opened with the peer's case, the enforcement order's language about board oversight, and the company's own exposure: 140 vendors with access to payment flows, 31 never screened. Each committee member could see their own role in the scenario. She paired every scenario with a base rate from industry enforcement data and set out the program's residual risk and delivery plan. When a director asked whether the program would fix everything, she said no and showed the gaps. The committee approved the budget that afternoon.
Why it works
A vivid, recent threat makes acting look better, because approving the program becomes a discharge of duty and insurance against later blame. The status quo looks worse once its stability is shown to rest partly on luck, and costlier once a specific, dated, personal penalty is attached to doing nothing. Four conditions favor it: at least one recent case the audience remembers, decision-makers with personal blame exposure, timing near a confirming news cycle, and no internal challenger with equal standing on risk. The pitch works on benefit and on the alternative's cost; adding that the program is cheap tends to dilute it.
The thinking behind it
Daniel Kahneman Tversky and Kahneman's Judgment under Uncertainty: Heuristics and Biases (1974) describes availability: people judge how likely something is by how easily instances come to mind. A peer's $400 million fine, a week old, is the most available instance of vendor risk the audit committee has. Pairing the scenario with base rates keeps availability working for an accurate case, since vivid instances alone push estimates of likelihood too high.
Amos Tversky In The Framing of Decisions and the Psychology of Choice (1981), Tversky and Kahneman showed that equivalent descriptions of a choice can reverse preferences, and that the frame depends partly on how the problem is put. Describing inaction as exposure to a named penalty puts the status quo in a loss frame, where acting looks like the prudent way to avoid harm. The frame is honest when the exposure is real, which is why residual risk belongs in the same presentation.
When it fits
Use it when the risk is real, recent events have made it visible, and the people deciding carry personal accountability for it: boards, regulated officers, fiduciaries. You need standing in the risk domain, data the audience can check, and a credible plan. Skip it when the only scenarios that carry it are tail events a numerate audience will puncture.
How to use it well
Choose one scenario the audience already remembers and make it specific to them: which systems, which vendors, which signatures. Then give them what a skeptic would ask for before anyone asks. Keep the case on the risk and the benefit of acting. Adding that the program is cheap reopens a cost debate the risk case does not need.
- Pair every scenario with a base rate and its source.
- State the program's own feasibility and residual risk, including what it will not fix.
- Time the pitch close to the event, while it is fresh, without inventing urgency around it.
- Brief the internal risk peer who could challenge you before the meeting, and invite their numbers.
What it costs and where it backfires
Your risk credibility is the asset being spent, and it allows a limited number of uses. Overreach into tail scenarios gets punctured by a quantitative audience and discounts every later warning you give. The line is the numbers: once you inflate a probability, or drop the base rate because it weakens the case, this stops being a vivid case and becomes risk posturing, and the next audit committee will remember.
When it is used on you
When a pitch leads with named catastrophes and no base rates, leave the scenarios alone and ask for a base rate beside each one, plus the program's own feasibility and residual risk. An internal challenger with equal standing on risk can recalibrate the odds without seeming to dismiss the threat.