Helping boards ask the right questions about technology

“Multi-factor authentication: in place.” It is the kind of line that appears in a board report or risk register and rarely draws a question. During a review at a small organisation, I checked what that line meant in practice.

Boards check people and machinery before trusting them. Software that staff bring in deserves the same diligence, and the questions are familiar.

Most organisations keep far more information than they need. It sits in old email accounts, shared drives, forgotten SharePoint sites and the digital equivalent of boxes under the stairs. Nobody is quite sure what is in it, and nobody feels able to remove it.

This is usually described as caution, or as corporate memory. It is neither.

When I was in the RAF, exercises were part of normal life. Some were small: someone would try to follow you through a security gate, or turn up without a pass to see whether anyone would stop them. Others were anything but small. They went as far as battle damage repair on aircraft while wearing a full gas mask and NBC suit.

Every exercise had umpires. Their job was to watch, then tell us plainly what had gone wrong and what to try next time. I didn't always appreciate that at the time. Being told your best effort wasn't good enough stings.

Look around the table in many AI discussions and you will find a familiar mix: an innovation lead, a technology lead, a data lead and, often, a supplier. All capable people. All, by the nature of their roles, optimists.

That is not a criticism. Optimism is what gets pilots started. But a room full of it tends to produce the same result: enthusiasm mistaken for evidence, and plans with no answer to the question "what if this doesn't work?"

Three short stories from small organisations I have worked with.

Someone left a business in January. Nice person, better opportunity, no drama. In June, during a review, I found her account still active, still licensed and still able to sign in. HR had updated its records, payroll had been stopped and the leaving card had been signed. Nobody had told Microsoft 365.

Every board says it wants to hear bad news. Fewer behave in a way that makes it likely.

Bad news that arrives early is an asset. It keeps options open: there is still time to change supplier, add resource, re-plan, or tell customers before they hear it elsewhere. The same news six weeks later is a crisis, with fewer choices and a larger bill.