A Board That Cannot Question Technology Cannot Govern the Numbers
A board that cannot question how information is produced cannot claim to understand the numbers it approves.
Beyond the Accounts
The board pack says the finance systems are stable. The audit committee sees no red incidents. The year-end timetable remains on plan. Yet beneath that reassuring summary, a group of 84 legal entities is being consolidated through 17 spreadsheets, several manual journal uploads and a finance system whose privileged access list has not been reviewed since the last reorganisation.
None of those facts appears in the board papers. They are treated as technical detail.
That is precisely the problem.
Recent corporate collapses have forced directors to look harder at accounting judgements, executive conduct and the reliability of internal controls. New demands for executive certification and stronger control over financial reporting will sharpen that scrutiny. But the governance lesson reaches further than accounting. The numbers a board approves do not arrive untouched from the business. They are assembled, transferred, adjusted and reported through a chain of systems and manual processes. If directors understand the result but cannot question the machinery that produced it, their assurance is incomplete.
Literacy Is Not Expertise
The familiar objection is reasonable: a non-executive director cannot be expected to master every specialist discipline. Boards appoint auditors, finance leaders and technology professionals because detailed expertise belongs with those who practise it. Asking directors to become programmers or systems architects would waste scarce board attention and blur accountability.
But literacy is not expertise. A financially literate director need not post a journal entry to ask why a provision changed. A legally literate director need not draft a contract to understand where liability sits. Technology deserves the same distinction.
A technology-literate director should be able to ask:
- Which systems produce the figures on which this decision depends?
- Where does information pass between systems, and where is it re-keyed by hand?
- Who can alter standing data, access rights or reporting rules?
- Which controls prevent, detect and record an override?
- What happens to reporting if a critical system or supplier fails at the wrong moment?
These are governance questions because they concern the integrity, availability and traceability of management information. They do not require a technical vocabulary. They require an understanding that information has a provenance.
A board that cannot question how information is produced cannot claim to understand the numbers it approves.
The Green Report Can Conceal the Red Risk
Technology reporting at board level is often organised around operational health: major projects, outages, expenditure and service performance. Those measures matter, but they can leave the most important risk invisible. A stable system can still produce unreliable governance information.
Return to the group of 84 entities. The principal finance system is available, batches complete overnight and the help desk records few severe incidents. On conventional measures, it is green. But the consolidation depends on locally maintained spreadsheets. Two former employees still appear on a privileged-access report because no one owns the reconciliation between personnel records and system accounts. A late adjustment can be uploaded by the same small team that prepares the supporting schedule. The audit trail exists, but only a specialist knows how to retrieve it, and no board committee has asked to see evidence that it is reviewed.
The mechanism is straightforward:
- Management information is extracted from several systems with different definitions and control standards.
- Manual interventions bridge the gaps between them.
- Concentrated access allows a small number of people to correct data quickly.
- The same flexibility that keeps reporting on schedule weakens separation of duties.
- A summary status report measures whether technology is running, not whether the information chain can be trusted.
The risk does not begin with a dramatic system failure. It begins when a board accepts an operational proxy for information integrity.
A Different Board Conversation
Most boards do not need another standing presentation from the technology department. They need technology to be connected to the decisions already before them.
When the audit committee reviews revenue recognition, it should ask how source transactions become ledger entries and where manual adjustment is possible. When the board approves an acquisition, it should ask how quickly access, reporting definitions and control responsibilities can be brought together. When a major system change is proposed, it should ask not only about cost and delivery, but about the period during which old and new records will coexist.
This changes the quality of evidence requested. “The system is secure” is an assertion. A recent access review, a record of exceptions and named responsibility for unresolved accounts are evidence. “The project is on track” is a status. Reconciled test results, conversion totals and explicit acceptance of residual control weaknesses are evidence.
The board should also know where responsibility sits. Technology leaders may operate the systems; finance may own the figures; internal audit may test controls; external auditors may assess financial statements. Between those roles lie the seams where assumptions are made and accountability thins. Directors should insist that someone can describe the whole chain without handing the question from one specialist to another.
The Governance Gap
Board-level technology illiteracy persists partly because technology has been framed as infrastructure: essential, expensive and best delegated. That view made some sense when the principal concern was whether machines and networks remained available. It is no longer sufficient when transactions, controls and management reporting are inseparable from information systems.
The answer is not to reserve a single seat for “the technology director” and allow everyone else to disengage. One specialist can strengthen a board, but cannot carry the collective duty to understand the basis of its decisions. Nor is the answer a catalogue of technical risks detached from the business. The point is to make the information chain visible wherever the board is already exercising judgement.
Three habits would close much of the gap:
- Trace one important number. Periodically follow a material figure from original transaction to board report, including interfaces, spreadsheets and adjustments.
- Test one override. Ask who can bypass a control, how the action is recorded and who reviews the record.
- Name one dependency. Identify the system, person or external provider whose failure would most weaken the evidence before the board.
These are modest practices, but they expose whether assurance rests on evidence or confidence. They also change behaviour below the board. Once directors ask how a number was produced, management can no longer hide fractured ownership behind a green service report.
The present governance debate rightly demands greater independence, sharper challenge and more reliable control. It will fall short if technology remains outside that challenge. The board does not need to understand every line of code. It does need to understand enough of the information machinery to recognise when the accounts are resting on manual workarounds, concentrated access and untested assumptions.
Technology literacy is therefore not an optional modern interest for directors. It is part of the competence required to govern the enterprise that already exists.