At a former job I worked directly under the CISO doing architecture audits.
He described his job as "we shouldn't do this, or this. we probably need money for both, or failing that, implement some really annoying, workflow-impacting changes that will annoy people. so gib mony plz".
inevitably the org would say no to both, so he asked for that in writing and then played the CYA game hard when it went bad.
"a cortisol rollercoaster followed by begging followed by more rollercoaster" was a phrase he used.
