Where do you see the biggest source of friction between security and I&O?

Clearly defined roles and responsibilities agreed to and available in print. 

Objective - a defined objective will help define level of risk acceptance 

 Ok

Risk variables are often defined as too great by security to test root cause analysis during incidents

My CISO focusing only on confidentiality and overlooks integrity and availability in terms of data protection.