Research briefing: does capital allocation follow narrative and timing rather than analysis?

Bottom line: the thesis is well supported at its core but overstated at its edges; the evidence shows enterprise budgets are sticky by default and get unfrozen by macro shocks (breaches, regulation, AI hype), that executive narrative measurably precedes and predicts real investment, and that timing/framing are studied strategic skills, but the same evidence shows disciplined analysis is what separates funded initiatives that create value from the roughly 95% of narrative-led AI pilots that do not.

TL;DR

• Strongly supported: budgets are inertial (McKinsey: firms reallocate only ~8% of capital year to year on average; a third move ~1%), so a macro-anxiety shock is often the only thing that unfreezes them; and executive narrative predicts real spend (an NBER study finds conference-call language forecasts capex up to nine quarters out). Timing, packaging and "reading the wind" are named, researched skills in the issue-selling and resource-allocation literatures, not mere office politics.
• Important counterweight: framing without substance is a trap. Only substantive AI discussion (not buzzwords) drives capex in the Federal Reserve's textual analysis; MIT found 95% of enterprise GenAI pilots delivered no measurable P&L impact; Gartner predicts 40%+ of agentic-AI projects will be cancelled by end 2027. Riding the narrative wins funding but frequently loses on delivery.
• Most citable proof points: the "compliance window" (GDPR drove ~$7.8bn of Fortune 500 spend; SOX 404 cost ~$4.36m per firm in year one; DORA €2-5m per firm), and post-incident windows (Change Healthcare pushed 57.5% of healthcare orgs to plan bigger 2025 cyber budgets; the CrowdStrike outage pushed 86% of surveyed firms to raise development budgets).

Key findings

1. Default enterprise behaviour is budget inertia, and the return premium goes to firms that reallocate actively; this is precisely why a narrative "shock" that unfreezes the budget is so valuable to a strategist.
2. What executives say on earnings calls now measurably predicts what they later spend, and the effect is real only when the language reflects genuine capability, not hype.
3. The strongest theoretical backbone for "sequencing around windows" (Kingdon's policy-windows model) comes from public policy and maps almost perfectly onto corporate IT funding, but the corporate application is an analogy, not a directly tested corporate-finance result.
4. Regulatory deadlines and public incidents are the cleanest, best-quantified funding windows in the evidence base; identical engineering work is repeatedly funded when tied to a deadline or an incident and stalled when framed as "good practice."
5. The dark mirror of the thesis is well evidenced: because funding follows anxiety, roughly 40% of IT balance sheets are consumed by technical debt and reliability work waits for a public failure to earn its window.

Details

1. Academic and management research on internal capital allocation

Theory vs. practice in capital budgeting. The foundational survey is Graham and Harvey, "The Theory and Practice of Corporate Finance: Evidence from the Field" (Journal of Financial Economics, 2001), based on 392 CFO responses. Large firms rely on NPV and CAPM (about 74.9% use NPV; 73.5% use CAPM), but payback (a theoretically inferior rule) was the third-most-common technique, used always/almost always by about 56% of firms and disproportionately by older, longer-tenured, non-MBA CEOs. In his 2022 Journal of Finance Presidential Address ("Corporate Finance and Reality"), Graham reiterates that firms use "simple decision rules," that NPV "often plays a supporting role," and that managers try to time the market. Takeaway: even the discipline theory prescribes is applied loosely and behaviourally, which leaves room for framing.

Resource allocation process (Bower-Burgelman). Joseph Bower's "Managing the Resource Allocation Process" (1970) and Robert Burgelman's papers (from 1983) established that strategy in large firms emerges from an iterated process: bottom-up initiatives from front-line and middle managers compete for scarce corporate resources and top-management attention, while senior managers set a "structural and strategic context." Middle managers act as champions who impute strategic context to proposals; they choose which initiatives to back and how to frame them to fit what the top wants. Noda and Bower (1996, Strategic Management Journal) reframed strategy making as "iterated processes of resource allocation." This is the academic backbone for the claim that the sponsor and the framing, not the raw analysis, determine what advances. ^[1][2]

McKinsey capital-reallocation stickiness. McKinsey's studies (2012-2018) found most multi-business firms give each unit a near-constant share of capital year after year. Over 1990-2005 (n = 1,616), a unit's allocation this year tracked last year's very closely; firms in the top third of reallocation shifted an average of 56% of capital across units over 15 years and earned about 30% higher total returns to shareholders (TRS). Extending to 20 years (1,500 companies), the high-vs-low reallocator TRS gap widened. Later framing: "dynamic reallocators" (moving at least 49% of prior-year budget) achieved 10% TRS CAGR vs 6.1% for "static allocators." A third of companies reallocate about 1% of capital year to year; the average is 8%; 83% of executives call reallocation the top growth lever. Takeaway: budgets are sticky by default, which is exactly why a macro shock that unfreezes them is such a powerful funding window.

Issue selling (Dutton and Ashford) - the core of the thesis. Dutton and Ashford, "Selling Issues to Top Management" (Academy of Management Review, 1993), frames issue selling as the process by which middle managers direct scarce top-management attention to particular issues, treating timing and packaging as deliberate moves. Follow-ups sharpen the practical content: Dutton, Ashford, O'Neill and Wierba (1997, SMJ), "Reading the Wind: How Middle Managers Assess the Context for Selling Issues"; and Dutton, Ashford, Lawrence and O'Neill (2001, AMJ), "Moves That Matter," which examined 82 accounts of issue selling and identified moves including packaging, involvement and timing, plus three kinds of contextual knowledge (relational, normative, strategic). "Reading the wind" and knowing when a window is open is exactly the skill the thesis describes.

Kingdon's multiple streams / policy windows - the strongest theoretical frame. John Kingdon's "Agendas, Alternatives, and Public Policies" (1984) argues that change happens when three independent streams (problems, policies, politics) couple at a "policy window," and that "policy entrepreneurs" who keep solutions ready and time them well push proposals through. Windows open infrequently and briefly (Kingdon's "launch window" metaphor), and entrepreneurs do "softening up" preparatory work before a window opens. This maps almost one-to-one onto the thesis: a macro shock opens a window and the skilled strategist has the proposal ready to couple to the moment. Caveat: the framework is from public policy; applying it to corporate IT investment is a reasonable analogy, not a tested corporate finding.

Garbage can model (Cohen, March, Olsen, 1972). "A Garbage Can Model of Organizational Choice" describes "organized anarchies" where problems, solutions, participants and choice opportunities flow somewhat independently and decisions happen when the streams collide; solutions look for problems as much as problems look for solutions, and most decisions are made "by oversight" without resolving the attached problem. This both supports the thesis (a ready solution attaches itself to whatever anxiety is salient) and cautions against it (much coupling is accident, not skilled sequencing). ^[3]

Behavioural / narrative angle. Shiller's "Narrative Economics" (2017 AEA address; 2019 book) argues contagious stories, not just fundamentals, drive economic decisions. Graham's own survey work, showing executives rely on heuristics and market timing rather than pure DCF, is consistent with story and framing mattering inside investment committees.

2. Evidence that budgets follow macro narratives and shocks

Earnings-call theme counts (AI). FactSet (John Butters, "Earnings Insight") tracks how many S&P 500 companies cite "AI" on earnings calls. Mentions surged after ChatGPT (Nov 2022): the count hit a then-record above 200 companies in Q1 2024 (about 41%, versus a 5-year average of 88 and 10-year average of 55) and stayed above 200 for at least five straight quarters. By Q4 2025 the term appeared on 331 (about 68%) of S&P 500 calls, and Q1 2026 set a record at 337 calls (again about 68%), against a 10-year average of 94. Goldman Sachs put the Q4 2023 figure at an all-time-high 36% of the S&P 500. This is talk, not spend, but the next point links the two.

Language predicts subsequent investment (the key causal-ish link). Jha, Qian, Weber and Yang, "ChatGPT and Corporate Policies" (NBER Working Paper 32161, Feb 2024; ~106,994 firm-quarter observations across 3,920 US firms in the validation window) built a firm-level "investment score" from conference-call transcripts. Their abstract states the score "predicts future capital expenditure for up to nine quarters, controlling for Tobin's q and other determinants," correlates strongly with CFO survey responses, and "also separately forecasts future total, intangible, and R&D investments." Separately, the Federal Reserve's Paul Soto, "Research in Commotion" (FEDS 2025-011, Jan 2025), built an "AIR Index" from semantic similarity between earnings calls and AI research papers across 4,589 firms and found "a sharp rise in the AIR Index leads to persistent increases in year-over-year capex growth, lasting about a year," but "no significant effects of AI R&D on productivity or employment." Crucially, substantive AI discussion drove capex while AI "buzzwords" (raw counts of "artificial intelligence"/"machine learning") were "small in magnitude and insignificant," suggesting "investors place a premium on meaningful AI integration rather than superficial mentions of AI hype." This is strong support that executive narrative precedes and predicts real allocation, with an important qualifier.

Gartner IT spending: the multi-speed, AI-narrative-driven market. Gartner's April 2026 forecast put 2026 worldwide IT spending at $6.31 trillion (up 13.5%), with data-centre systems growing 55.8% to about $788 billion on AI infrastructure, while devices and communications services grow far more slowly. Gartner explicitly describes a "multi-speed IT market, with hyperscaler purchases and AI-centric software segments significantly outperforming more traditional categories." This is the pattern the thesis predicts: the narrative category (AI) balloons while unglamorous categories are flat. ^[4][4]

Security spending is event- and macro-sensitive. Gartner (July 2025) projected worldwide information-security end-user spending of $213 billion in 2025 (up from $193 billion in 2024), rising about 12.5% to $240 billion in 2026, with AI and GenAI threats named as key drivers. The IANS Research / Artico Search "Security Budget Benchmark Report" shows security as a share of IT spend rose steadily from 8.6% (2020) toward the low teens by 2024, then decelerated: budget growth fell from 8% (2024) to 4% (2025), the lowest in five years, and security as a share of IT spend dropped to 10.9% in 2025 as AI and cloud expanded the denominator. IANS' Steve Martano: "security budgets are not immune to macro conditions." Conflict to flag: the 2024 report was quoted at 13.2% of IT spend, but the 2025 report restates 2024 as 11.9%; treat the exact level cautiously, though the direction (rise then 2025 dip) is consistent. ^[5]

Incident-driven spending, concrete cases.

• SolarWinds (Dec 2020). Triggered US Executive Order 14028 (May 2021) on national cybersecurity and a proposed 30% budget increase for CISA; widely credited with reshaping federal supply-chain security policy and spending. ^[6]
• Change Healthcare / UnitedHealth ransomware (Feb 2024). The largest healthcare breach ever, exposing about 190 million people; UnitedHealth's total cost estimate reached roughly $2.45 billion by Q3 2024. An AHA survey of nearly 1,000 hospitals (March 2024) found 74% reported direct patient-care impact and 94% a financial impact. The HIMSS 2024 Healthcare Cybersecurity Survey (273 professionals) found 55% planned to increase cybersecurity spending in 2025 and explicitly credited the Change Healthcare attack with prompting many organisations to act. ^[7]
• CrowdStrike outage (19 July 2024). A faulty Falcon content update crashed about 8.5 million Windows machines globally. Parametrix estimated about $5.4 billion in direct losses for Fortune 500 companies alone (Harvard Business Review estimated ~$1.5 billion in insurer payouts). An Adaptavist survey (400 software professionals at $10M+ firms, UK/US/Germany) found 86% of enterprises were increasing software-development budgets in direct response; its six-month follow-up found 79.25% had increased IT-infrastructure investment and 99.5% planned to hire additional technical staff. A textbook "resilience window." ^[8]
• Healthcare more broadly. The 2023 HIMSS Healthcare Cybersecurity Survey found 57.54% of respondents anticipated a cybersecurity budget increase in 2024, with only 17.32% expecting it to stay the same and 2.79% expecting a decrease.

Regulatory-deadline-driven spending (the "compliance window").

• GDPR (2018). IAPP/EY estimated Fortune 500 firms would spend a combined $7.8 billion on compliance (about $16 million average per Fortune 500 firm) and FTSE 350 firms about $1.1 billion. A clear deadline-driven surge.
• SOX 404 (2004-2005). FEI's 2005 survey found average first-year Section 404 compliance cost of $4.36 million (up 39% from the earlier estimate), including about 27,000 hours of internal time for large firms. The "SOX 404 tax" persists: KPMG's 2025 survey put average annual SOX programme cost at $2.3 million and 15,581 hours.
• DORA (applicable 17 Jan 2025). Deloitte's European DORA survey found 64% of financial entities planned to spend €2-5 million each. A Rubrik/Wakefield survey of 350 finance-sector CISOs found 47% of UK and 38% of EU firms spent over €1 million on compliance. (A widely repeated "$181 billion annually" figure traces to Forbes and refers to general financial-sector compliance cost, not DORA specifically; do not present it as a DORA number.)

The compliance-window observation. Practitioner sources are consistent that proposals bundled with a regulatory deadline get funded where identical proposals framed as good engineering do not, captured bluntly by one CIO-advisory source: "Quantified regulatory exposure secures funding; generic security requests do not." Well supported anecdotally; under-evidenced by controlled study. ^[9]

3. The CFO perspective

What CFOs say drives priorities. Deloitte's CFO Signals surveys show a sharp rotation toward technology and AI: in Q4 2025, 87% of CFOs said AI will be extremely or very important to finance operations in 2026 (only 2% said not important), up from a majority still merely "experimenting" less than three years earlier, and 54% named embedding AI agents a transformation priority. In the Q2 2026 survey, 46% said their biggest internal AI concern was cost uncertainty or lack of transparency (the No. 1 response). Deloitte's UK CFO Survey (July 2026) found geopolitics the top-rated external risk for 16 of the prior 18 quarters. The macro-anxiety CFOs react to visibly rotates: growth, then cost, then tariffs/uncertainty, then AI.

How finance evaluates technology proposals. Finance functions think in cash flow, payback period, risk-adjusted return and cost of capital; proposals framed in technical language force finance to "translate," and the translation usually fails. Multiple practitioner sources converge on the same success factors: lead with the quantified cost of inaction (using numbers finance already tracks, e.g. downtime cost per hour, breach exposure, churn), connect explicitly to EBITDA/capacity/risk reduction, and make payback and strategy-fit visible before technical detail. The gap between what CFOs say they want (strategic transformation) and what they approve (defensible near-term financial or risk cases) is a recurring theme.

Framing in financial/business-outcome language secures funding. Practitioner guidance (TechTarget, CIO.com) is explicit that CIOs reporting into finance should frame as "spend $100k to save $400k," and that building a compelling business case is now a core CIO competency directly tied to keeping a boardroom seat. A CIO-advisory source adds that early budget requests "shape allocation before constraints solidify," echoing both reallocation-stickiness and window-timing.

Capex-to-opex (cloud) shift. The move to cloud reclassified large technology spend from capex to opex, changing funding politics (consumption-based, harder to predict, spread across teams). Deloitte notes AI's usage-based pricing makes bills "hard to predict" and is driving demand for AI-specific P&L views.

New-CFO effect. A change of CFO is a recognised trigger for write-offs, restructuring and reallocation ("big bath" behaviour), creating a predictable funding/de-funding window. This is widely asserted in the finance literature and is directionally supported, but I did not retrieve a single definitive headline statistic in this pass; treat as plausible and under-quantified.

4. The counter-case and nuance

Good analysis and discipline do matter. The McKinsey reallocation evidence cuts both ways: inertia is common, but disciplined, active reallocation (a process/analytical capability) is what correlates with ~30% higher TRS. The honest reading is not "analysis doesn't matter" but "analysis without the political/timing skill to unfreeze budgets doesn't get deployed."

Narrative-driven investment has a high failure rate. MIT NANDA, "The GenAI Divide: State of AI in Business 2025" (July 2025; based on 150 executive interviews, a survey of ~350 employees and analysis of 300 public AI deployments), found "just 5% of integrated AI pilots are extracting millions in value, while the vast majority remain stuck with no measurable P&L impact," against $30-40 billion of enterprise spend; enterprise-grade tools reached pilot at only 20% and production at just 5%. Caveat: the study's success definition (measurable P&L within roughly six months) is narrow and has been publicly challenged, so cite it with that qualification. Gartner (press release, 25 June 2025) predicts over 40% of agentic-AI projects will be cancelled by end 2027 due to escalating costs, unclear value or inadequate risk controls; analyst Anushree Verma notes most such projects "are early stage experiments or proof of concepts that are mostly driven by hype and are often misapplied," and Gartner estimates only about 130 of thousands of "agentic AI" vendors are real ("agent washing"). This is the thesis's own warning label: riding the narrative gets you funded but can set you up to fail on delivery.

Hype cycle as a funding phenomenon. Gartner's Hype Cycle explicitly models the "Peak of Inflated Expectations" (where agentic AI now sits) followed by the "Trough of Disillusionment," and analysts tie hype-driven, poorly-governed adoption to the coming cancellation wave. Prior waves (RPA, big data, blockchain, "digital transformation") show the same narrative-led funding and disappointing conversion, though clean single-number failure stats for those waves vary in quality.

Underinvestment in unglamorous work. If funding follows anxiety, maintenance and reliability get starved until they fail publicly. McKinsey ("Breaking technical debt's vicious cycle to modernize your business," based on a July 2020 survey of 50 CIOs at $1bn+ financial-services and tech firms) reports technical debt "accounts for about 40 percent of IT balance sheets" and that "some 30 percent of CIOs we surveyed believe that more than 20 percent of their technical budget ostensibly dedicated to new products is diverted to resolving issues related to tech debt." Practitioner benchmarks commonly put "keeping the lights on"/run-the-business at around 70% of IT budget (with only ~30% for innovation), and Deloitte's "digital vanguard" firms still spend about 47% on existing operations while targeting 33% (these KTLO percentages are practitioner estimates rather than a single authoritative source). This is the strongest ethical/organisational critique embedded in the thesis: the system systematically defers reliability spend until an incident creates a window.

Is window-riding rewarded or punished long-term? Mixed and under-evidenced. The issue-selling literature shows selling issues well builds credibility and visibility (good for the individual), and CIO sources say a successful, business-case-backed project boosts careers. But the garbage-can and hype-cycle evidence implies individuals who ride hype into failed delivery are exposed when the trough arrives. There is no clean dataset on the long-term career outcomes of "window-riders" specifically; a genuine gap.

5. Practical / tactical evidence

Sequencing to cycles and windows. Practitioner and issue-selling sources converge: time asks to budget/planning cycles and board calendars, and move early because "early requests shape allocation before constraints solidify." Post-incident windows (breach, outage, audit finding, regulatory deadline) are the highest-conversion moments, consistent with the Change Healthcare, CrowdStrike, SolarWinds and GDPR/DORA/SOX evidence above. ^[9]

Framing moves that work. Documented, repeated practitioner patterns: (1) attach infrastructure modernisation to a compliance mandate ("quantified regulatory exposure secures funding"); (2) attach a data platform or security/observability work to a headline AI initiative so platform work rides the funded programme as a dependency ("riding the coattails"); (3) lead with the cost of inaction in numbers finance already tracks, not vendor benchmarks. This is precisely the "sequence proposals around whatever macro-pressure the executive team is reacting to" behaviour the thesis describes.

Language and metrics that resonate with boards/CFOs. Payback period, cash conversion, EBITDA impact, risk-adjusted return and quantified risk. For cyber specifically, the FAIR model (Factor Analysis of Information Risk) is the recognised standard for expressing cyber risk in financial terms, letting security proposals compete on the CFO's own terms.

Recommendations

Staged, concrete next steps for building and pressure-testing the post:

1. Lead the post with the inertia-plus-narrative pairing, because it is the best-evidenced part. Anchor on two hard facts: McKinsey's finding that the average firm reallocates only ~8% of capital year to year (and a third move ~1%), and the NBER finding that earnings-call language predicts capex up to nine quarters out. Together they make the thesis concrete: budgets are frozen until a narrative unfreezes them, and the narrative genuinely leads the money.
2. Use the compliance window as your cleanest example. GDPR ($7.8bn Fortune 500), SOX 404 ($4.36m per firm year one) and DORA (€2-5m per firm) are the closest thing to a natural experiment for "identical work funded on a deadline, stalled as good engineering." It is more defensible than any single anecdote.
3. Pre-empt the obvious pushback by including the counter-case, which strengthens rather than weakens the argument. Pair the funding win with the delivery risk: MIT's 95%-no-measurable-P&L finding and Gartner's 40%+ agentic-AI cancellation prediction. The sharpest, most shareable line is the Federal Reserve finding that substantive AI talk drives capex while buzzwords do not: framing works, but only with real substance behind it.
4. Land the ethical hook on technical debt. McKinsey's "~40% of IT balance sheets" and "30% of CIOs say >20% of new-product budget is diverted to tech debt" quantify the cost of anxiety-driven funding and give the post a responsible, non-cynical conclusion: the skill is not gaming the narrative, it is knowing when the window opens to move genuinely good analysis.

Benchmarks that would change these recommendations: if you can source (a) a peer-reviewed corporate (not public-policy) test of policy-windows behaviour in firms, (b) a controlled study directly comparing funding rates of deadline-framed vs. engineering-framed proposals, or (c) a longitudinal dataset on the careers of "window-riders," you could promote those from "plausible" to "well-supported" and lead with them instead.

Caveats

• Kingdon's policy-windows and the garbage-can model are imported from public policy/organisational theory. Their fit to corporate IT funding is a strong analogy, not a tested corporate-finance result; say so in the post.
• The MIT 95% figure is contested. Its success definition (measurable P&L within ~six months) is narrow; use it as directional evidence of over-funded, under-delivered narrative investment, not as a precise failure rate.
• The IANS security-budget percentages conflict between report years (13.2% vs restated 11.9% for 2024). Use the trend (rise through 2024, dip in 2025), not a single decimal.
• The "$181bn annual DORA cost" is a mis-attribution in some sources; it is a general financial-sector compliance figure from Forbes. Do not cite it as DORA-specific.
• KTLO/"70% keeping the lights on" and the "new-CFO effect" are widely repeated but rest on practitioner estimates and general finance lore rather than a single authoritative dataset; present them as directional.
• Earnings-call mention counts (FactSet) measure talk, not spend; the spend link comes from the separate NBER and Fed studies, so keep those citations attached when you make the causal claim.
• Several vivid budget-shift statistics come from vendor or single-firm surveys (Adaptavist on CrowdStrike; HIMSS on healthcare; Rubrik on DORA). They are useful and specific but are not independent academic work; attribute them to the named survey and sample size rather than presenting them as universal.

1. ResearchGate — https://www.researchgate.net/publication/334332575_The_Resource_Allocation_Process
2. Pbworks — http://sjbae.pbworks.com/w/file/fetch/58197839/noda_bower_1996.pdf
3. ScienceDirect — https://www.sciencedirect.com/science/article/abs/pii/S1569190X07001499
4. Gartner — https://www.gartner.com/en/newsroom/press-releases/2026-04-22-gartner-forecasts-worldwide-it-spending-to-grow-13-point-5-percent-in-2026-totaling-6-point-31-trillion-dollars
5. IANS + 2 — https://www.iansresearch.com/resources/press-releases/detail/ians-research-and-artico-search-release-security-budget-benchmark-report
6. PBS — https://www.pbs.org/newshour/amp/nation/massive-breach-fuels-calls-for-u-s-action-on-cybersecurity
7. Hyperproof — https://hyperproof.io/resource/understanding-the-change-healthcare-breach/
8. Theadaptavistgroup — https://www.theadaptavistgroup.com/company/press/crowdstrike-outage-drives-reform
9. Ciomastermind — https://www.ciomastermind.com/articles/budget-defense-for-cios