An automation business case template for Australian boards has five sections: strategic alignment, a 24 to 36 month cost stack, a benefit case with measured baselines, a risk register mapped to Australian law, and a governance pathway with a written kill criterion. Boards approve specific, bounded bets with an exit. They reject cases that pitch capability without a baseline.
This guide is for CFOs, COOs, CIOs and program sponsors at mid-sized and enterprise Australian organisations preparing a board paper for an AI or process automation investment. It gives you the structure, the questions directors will ask, and the one-page readout.
Key takeaways
- Most automation cases are rejected for their shape: unbounded scope, year-one-only costs, a thin risk register and no kill criterion.
- Carry the cost stack 24 to 36 months, with build, run, staffing, monitoring, assurance and exit lines shown separately.
- Every benefit line needs a baseline a finance committee can re-derive from a source system, and a named owner.
- The risk register must cover Australian Consumer Law, the Privacy Act, vendor concentration, model deprecation and capability gaps.
- Agree a quarterly scale-or-stop gate before the money is approved.
Why do automation business cases get rejected?
Boards do not approve "we want to do AI". They approve specific bets. Internal cases usually fail because they open with capability ("we want to deploy an AI agent"), pitch an open-ended ambition, stop the cost stack at year one, wave at risk in three lines and leave out the kill criterion. A director reading that has no idea what they are approving, what failure costs or when they may stop.
The fix is structural. Treat the case as a capital allocation document with a regulatory overlay, in five sections, in this order. Pair it with the AICD's director guidance on AI governance and DISR's Voluntary AI Safety Standard, which boards increasingly expect to see referenced.
What sections does an automation business case template need?
1. Strategic alignment: why this, why now, why us
One paragraph tying the bet to a strategic objective the board has already endorsed. One sentence on why now that is more concrete than "AI is the future". One sentence on why your organisation can execute this use case: data access, process maturity or a customer relationship. Boards reject cases that read as "everyone else is doing it".
2. The 24 to 36 month cost stack
The full cost of running the capability, carried well past the first licence fee. Boards have seen pilots turn into multi-year commitments without a refreshed case. Our articles on operating AI agents in production and the AI agent staffing gap cover the operating and staffing lines in detail.
3. The benefit case
Four to six benefit lines, each with a baseline measured today, a target, the evidence behind it and a named owner. Productivity alone rarely carries a case. Risk reduction and customer experience measures strengthen it.
4. The risk register
Ten to twelve named risks with likelihood, impact, control, control owner and control effort, including the ones directors are exposed to under Australian law.
5. Governance and review cadence
Clear answers to four director questions: who decides, who reviews, when do we scale and when do we stop?
- Strategic fitTied to an endorsed objective
- Cost stack24 to 36 months, all lines
- BenefitsMeasured baselines, named owners
- Risk registerAustralian law mapped to controls
- GovernanceQuarterly gate and kill criterion
What belongs in the 24 to 36 month cost stack?
The most common reason a case is approved at pilot and rejected at scale is that the pilot case understated the run cost. Show every line separately so the board can see where the money goes after go-live.
- Build and integration (one-off)Quoted per phase
- Model licences, usage and compute (24 months)Vendor pricing x forecast volume
- Specialist staffing or managed service (24 months)Internal salaries or service agreement
- Monitoring, evaluation and logging (24 months)Tooling plus review time
- Privacy impact assessment and security review (annual)Internal or external assurance
- Insurance review for AI-related exposureBroker advice
- Exit and contingency reserveA set share of total
Show a range for each line. The low end assumes one bounded use case on a tightly scoped product. The high end assumes a custom build with several integrations and internal staffing. Staffing is the line most often under-budgeted, so show it on its own. The offset against existing run costs belongs in the benefit case.
How do you build a benefit case a CFO will accept?
A benefit case lands when every line has a baseline measured today and a target a CFO would accept. Replace the examples below with your own processes.
| Today (baseline, evidence required) | Target (24 months, evidence required) | Impact | |
|---|---|---|---|
| Cycle time on the target process (for example quote turnaround) | Measured median from the current ops report | Agreed reduction, time-stamped from the same system | Source: ops system |
| Error or rework rate | Audit sample, last 90 days | Post-deployment audit at months 3 and 12 | Source: internal audit |
| Hours redirected (people redeployed, not removed) | Time-tracking baseline by task | Hours moved to named higher-value work | Source: workforce plan |
| Customer experience measure (NPS, complaints, first contact resolution) | Trailing 12 months, source named | Conservative improvement on the chosen measure | Source: CX system |
| Risk reduction (incidents, control coverage) | Incident register, last 24 months | Defined control coverage | Source: risk register |
| Revenue-side benefit (conversion, retention, recovery) | CRM and finance baseline | Uplift target with a clear attribution method | Source: CRM and finance |
A credible baseline can be re-derived from a source system by the finance committee. A credible target is one a department head will sign. If either is missing, cut the line. Boards spot "directional" benefits and discount the whole case. Our manual data entry cost calculator and automation payback period calculator help with the arithmetic.
What should an automation risk register include?
A board paper that ignores the Australian regulatory perimeter will be sent back. This is the minimum shape. Re-rate each line for your use case.
| Risk, likelihood, impact | Control and owner | Impact | |
|---|---|---|---|
| 1. Misleading conduct under the ACL when AI speaks to customers | Medium likelihood, high impact | Output review, escalation paths. Owner: GM Customer | ACL, Moffatt v Air Canada (2024) |
| 2. Privacy breach or notifiable data breach | Medium, high | PIA, data minimisation, retention rules. Owner: Privacy Officer | Privacy Act 1988, OAIC NDB scheme |
| 3. Vendor retires the model or API | High over 24 months, medium-high | Fallback model, version terms in contract. Owner: CIO | Vendor deprecation schedules |
| 4. Vendor concentration and lock-in | High, high at exit | Data portability clauses, exit testing. Owner: Procurement | Vendor selection framework |
| 5. Cannot hire or retain people to run it | High, high | Managed service or partner cover. Owner: COO | Workforce plan |
| 6. Public chatbot or AI incident damages the brand | Medium, high | Guardrails, human review on sensitive paths. Owner: CMO | DPD and Air Canada chatbot incidents (2024) |
| 7. Inaccurate output on regulated content | Medium, high | Evaluations on regulated paths, grounding in your documents. Owner: Head of Compliance | NIST AI RMF, ISO/IEC 42001 |
| 8. Prompt injection or data exfiltration | Medium, high | Security checklist coverage, testing cadence. Owner: CISO | 50-point AI security checklist |
| 9. Unclear accountability and director duties | Medium, high at incident | Documented decision rights. Owner: Board | AICD guidance |
| 10. Regulatory change | Medium over 24-36 months, medium | Track DISR and OAIC changes, build to ISO/IEC 42001. Owner: General Counsel | DISR guidance, Privacy Act reform |
| 11. Insurance gap on AI-related loss | Medium, high at incident | Broker review, policy endorsement. Owner: CFO | Insurer guidance |
| 12. Continuing past the kill criterion | Medium, medium-high | Pre-agreed quarterly scale-or-stop gate. Owner: Sponsor and Board | Governance pathway below |
The register earns its place when every line has a named control owner in the room at approval. That matters more than the precision of any score. Our AI governance framework shows how the register fits a wider program.
What governance pathway do boards want?
The pathway turns approval of one build into a defensible program, and gives the board a way to stop without losing face.
- Month 0Pilot approvalBounded scope, fixed budget for the phase, named owners, written kill criterion, first review date
- Months 1-3Build and run alongside the teamPilot runs beside the existing process with logging and evaluation from day one; PIA and security review done before live traffic
- Month 3Quarterly review 1Report against agreed KPIs and the risk register; continue, adjust or stop
- Month 6Scale gateIf KPIs are met and risks are controlled, decide whether to scale
- Months 9-12Annual program reviewBenefits verified against the finance baseline; cost stack, risks and insurance refreshed
- Month 12+Ongoing governanceProgram joins normal risk and audit cadence with an annual board briefing
Boards reward three properties. The pathway is reversible: the kill criterion is real. It is observable: every gate reports against the original case with the original numbers. It is defensible: each gate produces the records a regulator or court would ask for.
Is your automation case board-ready?
If any answer is no, the case is not ready yet.
- 1. Is the use case bounded: one process, one owner, one system of record?If no, rescope before submitting
- 2. Is the baseline measurable today from a system the CFO can re-derive?If no, measure for four to six weeks first
- 3. Is Australian regulatory exposure mapped to named controls and owners?If no, add the risk register
- 4. Is the kill criterion explicit, with a date, metric and decision-maker?If no, write it
- 5. Does the cost stack run 24+ months with run cost and staffing shown separately?If no, rebuild the stack
A case that passes all five can be approved in one sitting. A case that fails any one will be deferred, however good the idea.
What goes on the one-page board readout?
The executive summary decides most cases. It fits on one page and covers these ten items, in this order:
- The bet. One sentence naming the process, the automation's role and the scope boundary.
- The baseline. One line from a named source system, dated.
- The 24-month cost. Total, with build and run shown separately.
- The 24-month benefit. Total, with productivity, risk and revenue lines separated.
- Net position and payback month. With a worst-case sensitivity.
- Top three risks and controls. One line each, naming the owner.
- The kill criterion. "If by month 6 we have not achieved [metric], the program is wound down with [residual cost]."
- The governance cadence. "Quarterly review against this paper, scale gate at month 6."
- The approval requested. Scope, capex, opex, start date, first review date.
- Sponsor and owners. Including the executive accountable for the benefit number.
Everything else is appendix. For presentation tips specific to AI investments, see our companion AI business case template for board presentations.
How Solve8 can help
Our consultants help mid-sized organisations build the evidence behind a board paper: process baselines, a realistic cost stack and a risk register, then deliver the first phase on a fixed fee you can stop after. See our AI strategy and process automation services, or talk to us.
