Because CIOs are concerned about Return on Investment (ROI) and CSOs are concerned about Return on Risk (ROR) there is potential for conflict.
http://www2.csoonline.com/blog_view.html?CID=32914
[Editor's Note (Valle) I agree with the author's recommendations that the CSO should not report to a CIO but should instead report to the CEO, Board of Directors, or head of auditing or risk management]
