When acceptance is pending and payroll is approaching
A software company is waiting for a customer's acceptance of a project. The final payment is delayed, payroll is approaching, and the delivery team is being asked to finish another deployment faster. Then an AI service used by the team becomes unavailable. Manual work grows, and nobody is sure which recent outputs need checking.
This is a hypothetical company, not a report about a real business. The point is how problems connect. A commercial delay becomes a cash problem; pressure on cash becomes pressure on people and quality; a technology dependency reduces the team's room to respond.
I would expect the CEO to make those connections visible, choose priorities, and give capable people clear authority. Personally chasing every invoice, checking every release, and answering every customer can turn the CEO into the slowest part of the response.
The CEO coordinates decisions across the business
The CEO is responsible for leading management within the company's governance arrangements and delegated authority. That does not make the CEO the sole legal bearer of every finance, employment, safety, privacy, or technical duty. Responsibilities depend on the entity, jurisdiction, roles, and circumstances.
An owner, shareholder, director, and CEO are different roles, even when one person holds several of them. Shareholders' capital decisions, board oversight, and management execution should remain distinguishable. A personal willingness to inject cash is not yet a documented funding commitment available to the company.
The G20/OECD Principles of Corporate Governance 2023 distinguish board oversight of management and risk from management's responsibilities. They primarily address listed companies and are not a substitute for local law. Smaller businesses can adapt relevant ideas without copying a listed-company structure.
In a small company, one person may perform finance, operations, or technology functions without holding a CFO, COO, or CTO title. Name the function, decision owner, backup, and approval limit anyway. Delegating work without authority creates delays; delegating authority without reporting creates blind spots.
Set direction, establish priorities and decide tradeoffs.
Own cash visibility, payment obligations and funding options.
Own commitments, acceptance terms and customer impact.
Own workload, safety and staffing needs.
Own delivery, quality and service restoration.
Own permissions, data, vendors and AI governance.
Keep the whole business in view
The CEO does not need to perform every specialist task. The job is to connect the choices and resolve conflicts between them. These questions form a proposed management agenda, not a complete legal checklist.
| Management area | CEO question | Evidence to request |
|---|---|---|
| Strategy and market | Which customers and services still justify committing scarce capacity? | Commercial demand, contribution, and alternative uses of resources |
| Cash and capital | Can we finish commitments and meet obligations before cash arrives? | Dated cash scenarios, funding conditions, and remaining delivery costs |
| Customers and promises | Which terms, concentrations, and deadlines create connected exposure? | Acceptance records, contracts, credit, and change requests |
| People and operations | What can the team deliver safely and reliably? | Capacity, rework, essential skills, payroll, suppliers, and backups |
| Technology and AI | What fails if a service, credential, or provider becomes unavailable? | Dependencies, tested alternatives, access, data, and recovery evidence |
| Governance and communication | Who may decide, who must be informed, and what can we say truthfully? | Authority, board escalation, specialist advice, facts, and update plan |
For the hypothetical company, accepting a new urgent project might bring an advance payment. It might also consume the people needed to finish the delayed acceptance. Sales, cash, and delivery must therefore be assessed together before promising a date.
COSO's public ERM overview connects risk with strategy and performance. The application here is to assess the business choice and its downside together, rather than leave risk in a separate spreadsheet after the decision has been made.
Set boundaries before the pressure arrives
Risk management cannot remove uncertainty. Decide what the company is prepared to accept in pursuit of its goals, and what needs escalation. A low tolerance for exposing customer data can coexist with willingness to test a new service in a limited pilot.
Turn that discussion into observable signals. Examples include cash projected below an agreed buffer, acceptance delayed beyond the plan, rising rework, excessive on-call load, an essential supplier losing availability, or a suspected unauthorized disclosure. Choose thresholds for the company's commitments and capacity; none of these examples supplies a universal number.
Each trigger needs an owner and a response. “Watch cash” is weaker than naming who updates the forecast, who can pause discretionary purchasing, and when the board or lender must be consulted. Agree in advance who can act if the CEO is unavailable.
Prepare alternatives that actually work: a tested manual workflow, current contact lists, access to backups, another qualified supplier where feasible, and enough trained people to avoid a single-person dependency. A backup that nobody has restored is evidence of a plan, not proof of recovery capability.
Separate the incident from the company's response
Incident response addresses the event, such as investigating and containing a service or security problem. Business continuity keeps priority activities operating at an acceptable level. Crisis leadership coordinates wider choices when normal decision-making and the company's viability, trust, or essential commitments are under pressure.
These are working distinctions for this article, not competing departments. A technical lead may direct the incident while an operations lead arranges continuity and the CEO resolves funding, customer commitments, and escalation.
NIST SP 800-61 Revision 3, published in April 2025, places cybersecurity incident response within ongoing cybersecurity risk management. It is cybersecurity guidance, not a manual for every kind of corporate crisis. ISO's public overview of ISO 22301 describes business continuity management.
The first day needs a shared picture and usable authority
The time windows below are illustrative management rhythms, not legal deadlines or service commitments. Serious safety or security concerns may require immediate action. Start by protecting people, including physical safety where relevant, then contain ongoing harm and preserve essential services as safely as possible.
Appoint a response lead with authority, a backup, and a route to the CEO and board when required. Build one situation record: confirmed facts, unverified reports, affected services and customers, cash implications, actions taken, decisions needed, and next update time. Protect evidence and personal information; keep broad updates separate from restricted investigation records.
In our example, confirm why acceptance is delayed and which conditions remain. Confirm the AI vendor's service status without assuming an outage is a breach. Identify the work dependent on that service and whether manual handling is safe. Pause the affected activity when necessary, while allowing unaffected work to continue.
For every material decision, record the owner, authority, options, evidence, expected consequence, deadline, escalation trigger, and review point. The CEO should settle conflicts such as whether to redeploy staff from a new sale to stabilize an existing commitment, rather than ask every team to make its own incompatible priority list.
Separate known facts, unknowns and impacts to investigate.
Identify decision makers, work owners and shared review points.
Scope action to the affected systems or activities.
Check payment obligations, acceptance conditions and customer commitments.
State the reason, owner and next facts to check.
Verify that services, work and data are usable again.
Return to verification and priorities when circumstances change.
The first week must connect cash, delivery, and people
Ask finance for a rolling 13-week cash forecast based on available funds and realistic collection dates. Separate restricted cash, committed facilities, and unconfirmed financing. Include payroll, mandatory payments, suppliers, debt service, and the cash still required to finish work already sold. Count actual payroll once, not again through allocated project labor.
Compare a base case with a slower-collection or higher-rework case. Find the lowest cash point and the decisions needed before it. BDC describes weekly updates to a 13-week forecast and cautions against consuming working capital for long-term investment. Positive accounting profit does not make money available on payroll day.
Prioritizing cash does not authorize unilateral delays to wages, suppliers, taxes, or other obligations. Review contracts and applicable law with appropriate advisers before rescheduling commitments. Discuss funding early, with assumptions and downside scenarios. Funding can buy time; a service that loses money on each sale still needs changes to pricing, scope, or delivery cost.
Have delivery identify the smallest safe scope that meets agreed acceptance criteria. Negotiate any change transparently. Do not remove testing or controls just to move the invoice date. Protect people from unsafe hours and repeated emergency work; exhausted staff can increase defects and prolong the cash problem.
Put a commercial owner on the customer conversation. Explain what is delivered, what remains disputed, the proposed next step, and the authority needed to agree it. Review customer concentration, credit exposure, change requests, and promises made by sales. Preserve critical suppliers through honest negotiation rather than silent nonpayment.
Treat technology and AI as business dependencies
The technology lead should map which services, data, credentials, vendors, and people are essential to delivery. Check whether alternatives can handle the real workload and whether the company's contracts and data rules permit them. Moving customer information to a new AI vendor during an outage is itself a decision requiring review.
Keep AI's authority bounded during recovery. It may summarize a situation or prepare a customer draft, but changing payment details, publishing an incident statement, or restarting sensitive operations needs the company's authorization process. A confident explanation from a model is not evidence that the incident is contained.
Use technical evidence to decide whether affected outputs require checking, access should be revoked, or systems should be isolated. Preserve logs and relevant records without circulating secrets or unnecessary personal data. Applicable reporting, contractual notice, and privacy duties need assessment by the responsible specialists; this article gives no universal notification deadline.
The NIST AI RMF Core treats AI risk management as ongoing governance, context assessment, measurement, and management. The CEO's practical question is who owns the dependency and its business consequences, not simply which model is most capable.
Say what is known, and give the next update
Employees, customers, suppliers, lenders, and the board need different information, but the underlying facts must agree. Assign a spokesperson and an approval route that is fast enough for the situation. Give staff a safe way to report bad news without being punished for raising it.
A useful update acknowledges the effect on people, states what is confirmed, describes action underway, and gives the next update time or condition. Say what remains unknown. Do not speculate about an attacker, promise that no data was affected without evidence, or make a recovery promise the team cannot support.
Inform the board and seek approvals where company rules or law require them, including material financing or changes in direction. Keep conflicts of interest visible. The same person being shareholder and CEO does not justify treating company funds, disclosures, and personal interests as interchangeable.
Recovery needs evidence, then a different plan if necessary
In the following weeks, define recovery conditions before declaring success: priority services stable, restoration tested, critical defects addressed, affected outputs checked, customer actions assigned, and funding sufficient under the revised scenario. The right criteria depend on the event. A vendor's green status page alone does not prove that the company's backlog, data, or customer obligations are restored.
Review which temporary controls should stay, which can be removed, and who approves that change. Reassess capacity, pricing, collection terms, supplier dependence, and the pace of investment. Consider opportunities, such as a better service design, only after examining funding, demand, and execution capacity.
Run an after-action review focused on decisions, information gaps, and system conditions. Accountability still matters, but blaming the last person who touched the work can hide the incentive or missing control that made failure likely. Assign improvements, owners, dates, and a test that demonstrates the change works.
Some businesses need restructuring or specialist financial and legal advice rather than a return to the previous growth plan. Escalate early when obligations or viability are at risk. Leadership includes changing the plan when the evidence no longer supports it.
Questions for the next management meeting
- Does the CEO have to lead every technical action?
- No. Appoint qualified leads with clear authority and reporting. The CEO coordinates priorities and decisions across the business within the governance structure.
- Should every department cut spending by the same percentage?
- Not automatically. Compare cash saved with effects on safety, legal duties, essential service, collections, and future capacity. Some cuts can make the crisis worse.
- If the service is back, is the crisis over?
- Not necessarily. Check customer impact, backlog, data, staffing, and the revised cash outlook against agreed recovery conditions.
- What evidence should the CEO request now?
- “What is confirmed, which commitment is at risk next, who can decide, and when will we review the result?” If those answers are missing, start there.