It’s also a relatively large assumption that Agile (let’s assume Scrum, but we could use Lean as well) would work more effectively than an Iterative Waterfall approach. So much depends upon the effectiveness of the teams, the quality of the respective planning and associated risk tolerance.

Regarding priorities, if risk exposure to lack of PCI compliance or bolstered security needs are acute, these could easily take precedence over other requirements showing considerable ROI on £’s, using a financial model exclusively. This would be the case even though regulatory compliance or security issues could, at best, be framed as ‘soft’ financial savings (no hard ROI compared to incremental top line sales growth for example).