Pitching Invoice OCR to Your CFO: The Real Risk Math

By 2026, every CFO evaluating invoice OCR has already sat through the cost-per-invoice slide more times than they can count. $12 to $40 manual, $2 to $4 automated, payback in weeks at real volume. Our own accounts payable OCR guide and OCR in finance pieces cover that math in detail, and so does every vendor's sales deck. That number alone rarely wins approval anymore, because it is commodity information a skeptical CFO has been shown a dozen times before, and treats accordingly.

What actually moves a business case forward, in practice, is the part almost nobody quantifies at all: risk reduction, expressed as an actual dollar figure instead of a vague "improves compliance" bullet point on a slide. This is how to build that part of the pitch for invoice automation, on top of, not instead of, the cost math you already have.

Why cost-per-invoice ROI alone stopped being persuasive

Cost savings math is easy for a CFO to discount, because every vendor makes the same claim with the same structure, and the CFO has learned to apply a skepticism tax to headline numbers before they even ask a question. A pitch built entirely around "we'll save $X per invoice" competes on a dimension the CFO has already seen commoditized across a dozen prior pitches from other departments and other vendors. Risk-adjusted value is different, because almost nobody quantifies it rigorously, which means a pitch that does stands out for reasons unrelated to whether the underlying product is actually better.

The expected-value formula for fraud-risk reduction

This is the calculation most business cases skip entirely, replaced with a vague line about "reduces fraud risk." The actual formula, adapted from standard risk-quantification practice:

Expected annual value = (Baseline incident probability x Average loss per incident) - (Reduced incident probability x Average loss per incident)

Worked example: if your AP team's historical experience or industry data suggests a 2% annual probability of a material invoice fraud incident (a duplicate payment, a fake-vendor scheme, or a business-email-compromise loss, the categories our own document forensics guide covers) with an average loss of $75,000 per incident when it happens, the baseline expected annual loss is 0.02 x $75,000 = $1,500. If document-level fraud detection and duplicate matching genuinely cut that incident probability in half, to 1%, the new expected loss is 0.01 x $75,000 = $750. The risk-adjusted value of that reduction is $750 a year, a real number a CFO can add directly to the cost-savings line, not a vague compliance claim that reads as filler to anyone who has heard it a dozen times before in other pitches.

The honest caveat that makes this credible rather than salesy: your own incident probability and average-loss figures should come from your own historical data or a documented industry benchmark, never an invented number. If you do not have reliable internal data yet, use a conservative, clearly-labeled estimate and say so explicitly in the pitch, since a CFO trusts a modest number with a stated assumption far more than an impressive number with none.

The same formula at three company sizes

Company size	Baseline incident probability	Average loss per incident	Baseline expected loss	Value of 50% risk reduction
Smaller AP volume (under 1,000 invoices/month)	1%	$25,000	$250	$125/year
Mid-market (1,000-10,000 invoices/month)	2%	$75,000	$1,500	$750/year
Enterprise (10,000+ invoices/month)	3%	$250,000	$7,500	$3,750/year

These specific figures are illustrative structure only, not a universal benchmark you should copy directly, since real incident probability and loss severity vary enormously by industry, existing controls, and vendor concentration. The point of the table is the shape of the calculation, not the specific numbers, which every team needs to substitute with their own data or a clearly-cited industry source before using in an actual pitch. Note also that the risk-reduction value scales with company size roughly in line with exposure, which is worth stating explicitly if your pitch is for a smaller organization where the absolute dollar figure will look modest next to the labor-savings line, since a modest but real number beats an invented impressive one every time a CFO checks the math.

Why conservative assumptions build more credibility than impressive ones

A CFO's job trains them to discount optimistic projections by default, so a business case that leads with vendor-headline numbers (99% accuracy, 80% cost reduction, instant ROI) reads as exactly the kind of pitch they have learned to distrust. The stronger move: deliberately use the lower end of every range, state the assumption behind each number explicitly, and show the model still clears the approval bar even under the conservative case. A CFO who sees a business case survive its own worst-case assumptions trusts the whole document more than one presenting only the best case, and that trust is worth more to approval odds than a marginally higher headline ROI number.

Beyond fraud: the other risk dimensions worth quantifying the same way

Fraud-loss avoidance is the clearest example because the expected-value formula maps onto it directly, but the same structure applies to other risk categories AP automation touches, worth naming explicitly rather than folding into a vague "compliance benefits" line. Audit finding risk: the expected cost of a failed audit finding related to AP controls (remediation labor, potential regulatory penalty, reputational cost) times the probability that better documentation and audit trails reduce. Late-payment penalty risk: quantifiable directly from your own vendor contract terms and historical late-payment incidence, not an estimate. Key-person risk: the cost of AP knowledge concentrated in one or two people who process invoices manually, versus a documented, auditable system that survives someone leaving on short notice, harder to put a precise number on but real enough to name explicitly in the qualitative section of the pitch even without a formula behind it.

Not every risk dimension needs a rigorous formula to be worth including. The fraud-loss calculation earns its place because the expected-value math is genuinely defensible with real data. Other risks are worth naming honestly as qualitative factors, clearly labeled as such, rather than forcing a number onto something that does not actually have reliable inputs, since a fabricated-looking calculation undermines the credibility of the real one sitting next to it.

The opportunity-cost question every pitch needs to answer directly

A CFO is not evaluating your request in isolation, they are choosing among every capital and headcount request competing for the same limited budget this cycle. A strong ROI in isolation is necessary but not sufficient if three other departments are also pitching strong ROI on their own initiatives. The question your business case needs to answer explicitly, not leave implicit: why does this specific dollar of investment produce more value here than in the next-best alternative use of that same dollar. This requires knowing, at least roughly, what else is competing for the same budget cycle, information most AP-level pitch-builders never think to ask for before building their case, and that a controller or finance lead who does ask for it will have a materially stronger pitch than one who does not.

Anticipating the three questions every skeptical CFO actually asks

Beyond generic objection-handling scripts, three specific questions come up disproportionately often in practice, and each deserves a prepared, specific answer rather than a reactive one. First: "what happens to the headcount." Answer this directly with your actual plan, redeployment, absorbed growth, or reduction, rather than avoiding the question, since a vague answer here reads as either dishonesty or a lack of planning. Second: "what is the realistic timeline to value, not the vendor's timeline." Present your own conservative timeline, built from a real rollout's actual week-by-week pace rather than a vendor's best-case sales estimate. Third: "what happens if this underperforms the projection." Have an actual answer, a defined checkpoint at which you would reassess, not just confidence that it will work.

Where the numbers actually come from, and why sourcing matters as much as the math

A risk-adjusted calculation is only as credible as its inputs, and the single fastest way to lose a skeptical CFO's trust is presenting a made-up incident probability as if it were researched. Three legitimate sources, in order of preference: your own historical incident data, even a small sample, since real internal experience beats any external benchmark for relevance to your specific operation. A documented industry report from a named organization (the Association of Certified Fraud Examiners publishes regularly cited occupational fraud statistics, for instance) when internal data does not exist yet. A clearly labeled, conservative estimate, explicitly flagged as an assumption rather than a researched figure, when neither of the first two is available.

What should never happen: presenting a plausible-sounding number with no stated source, hoping nobody asks where it came from. A CFO who catches one unsourced number in a pitch will discount every other number in the same document, whether or not those other figures were actually well-researched, because the unsourced one signals the whole document was built the same way, and that impression is very hard to walk back once it forms.

What I would put in the pitch deck that most business cases leave out

One slide, explicitly labeled, showing the expected-value risk-reduction calculation with your stated assumptions visible, not buried in an appendix. One slide showing the conservative-case model clearing approval thresholds, not just the best case. One paragraph, direct and specific, answering the opportunity-cost question rather than assuming the CFO will infer your relative priority on their own. These three additions are not complicated to build, and they are the specific things missing from almost every AP automation business case template circulating publicly right now, which is exactly why including them differentiates a pitch that gets a close look from one that gets a polite pass.

None of this replaces the cost-per-invoice math you already have. It sits alongside it, and it is the part a genuinely skeptical CFO will actually remember after the meeting ends.

Frequently asked questions

How do you calculate the risk-adjusted value of invoice fraud prevention for a business case?
Expected annual value equals the baseline fraud incident probability times average loss per incident, minus the same calculation using the reduced probability after implementing detection controls. Use your own historical data or a documented industry benchmark for both figures, never an invented estimate.

Why does cost-per-invoice ROI alone no longer persuade CFOs?
Because it is commodity information nearly every AP automation vendor and internal proposal presents identically, which a CFO has learned to apply routine skepticism to. Risk-adjusted value, quantified explicitly rather than asserted vaguely, is a dimension few business cases actually calculate, which makes it disproportionately persuasive when done well.

Should a business case use optimistic or conservative ROI assumptions?
Conservative, explicitly. A CFO trusts a modest projection with clearly stated assumptions more than an impressive one without them, and showing that the model still justifies approval under conservative assumptions builds more credibility than presenting only the best case.

What is the opportunity-cost question a CFO business case needs to answer?
Why this specific investment produces more value than the next-best alternative use of the same budget, since a CFO evaluates every request against competing capital and headcount priorities in the same cycle, not in isolation.

What questions do CFOs typically ask about AP automation proposals?
What happens to headcount, what the realistic (not vendor-provided) timeline to value looks like, and what the plan is if actual results underperform the projection. Each deserves a specific, prepared answer rather than a reactive one in the room.

Should a business case include risk categories that cannot be precisely quantified?
Yes, but labeled honestly as qualitative factors rather than forced into a formula without reliable inputs. Key-person risk and audit-finding risk are worth naming explicitly even without a precise number, since a fabricated-looking calculation undermines the credibility of the real quantified figures next to it.

None of this is complicated math. It is simply math most business cases never actually do, choosing instead to gesture at risk reduction without ever putting a real number behind it.

Written by Nupura Ughade.