Boards That Cannot Question Their Systems Cannot Govern Their Numbers
A board does not need to understand the code; it must understand how the organisation’s claims become numbers.
The Number No One Could Trace
A non-executive director asks where a £72 million revenue adjustment in the board pack originated. The finance director explains the accounting treatment. The technology director confirms that the reporting system is stable. The auditor notes that the total agrees to the ledger.
None answers the question.
In the composite organisation behind that exchange, the number begins in seventeen operational systems, passes through sixty-two spreadsheets and receives forty-one manual adjustments before reaching the ledger. Six people understand parts of the route. Nobody owns the route end to end. The board sees one authoritative figure where the organisation actually operates a chain of judgement, access, interfaces and undocumented intervention.
Recent corporate failures have made boards more alert to accounting policy, executive incentives and audit independence. That scrutiny is essential. Yet the same failures reveal another weakness: directors are asked to govern organisations whose claims are increasingly produced by systems they do not know how to question.
This is usually described as technology illiteracy, which invites the wrong remedy. Directors do not need lessons in programming or network engineering. They need the ability to interrogate how information, control and technological dependence shape the truth presented to them.
A board does not need to understand the code; it must understand how the organisation’s claims become numbers.
Technology Has Moved Inside the Control System
For many boards, technology remains an operational service: systems should run reliably, projects should stay within budget and the technology director should control suppliers. Those matters are important, but they describe only the machinery.
Technology now sits inside the organisation’s control system.
An enterprise application determines which transactions may be entered and who may approve them. A customer database decides which records are treated as the same customer. A spreadsheet can turn operational estimates into reported profit. An interface can exclude transactions that fail a rule nobody at board level has seen. Access rights can allow one person to create, approve and amend a record. A system conversion can change the evidence available to auditors and managers.
These are governance effects. When directors discuss the reported result without asking how the information chain works, they govern the conclusion while ignoring the mechanism that produced it.
The board pack is not the organisation’s information. It is the final compression of an information system.
Compression creates danger because confidence rises as detail disappears. A clean table may conceal inconsistent definitions, unresolved reconciliations and estimates copied forward for months. The better the presentation, the easier it is to mistake form for control.
The Delegation Trap
Boards commonly delegate in three directions.
- Finance owns the numbers.
- Technology owns the systems.
- Internal and external audit test the controls.
Each delegation is reasonable. Together they can create a gap that belongs to nobody.
Finance may validate accounting treatment without understanding the technical path from source to ledger. Technology may keep the platform available without judging whether the business rule is appropriate. Audit may test selected controls at a point in time while the organisation changes interfaces, access and manual workarounds between reviews.
The board then receives three partial assurances and interprets them as one complete assurance.
In the composite organisation, the revenue adjustment is not fraudulent. It is worse in a quieter way: the organisation cannot demonstrate that the adjustment is complete, consistently defined and approved at the right level. One division exports transactions after the monthly cut-off, another changes classifications in a spreadsheet, and a third uses an estimate because its source system cannot produce the required detail. Each local choice appears practical. Together they make the reported number fragile.
Technology illiteracy at board level allows this fragility to remain invisible because directors ask whether the system works, not whether the information chain is governable.
The Serious Case for Specialists
There is a strong objection. Non-executive directors cannot become experts in every technology, system and data structure. Board agendas are already crowded. Detailed technical questioning can draw directors into management, blur accountability and encourage superficial confidence. A little knowledge may be more dangerous than a clear reliance on qualified specialists.
That argument should be accepted. The solution is not to turn the board into a technology committee or to invite directors to approve system design.
But reliance on specialists is not the same as surrendering judgement. Directors already challenge actuarial assumptions, legal exposure, financing structure and market forecasts without performing the underlying professional work themselves. They ask about evidence, sensitivity, independence and consequence. Technology-dependent control deserves the same discipline.
The board’s task is to know which questions cannot be delegated.
| Specialist question | Board question |
|---|---|
| Is the system available? | Which business claims depend on it? |
| Are access controls configured? | Can one person initiate, approve and conceal a material action? |
| Does the ledger reconcile? | Which sources, adjustments and estimates sit outside the reconciliation? |
| Has the project passed testing? | What changed in the control environment and evidence trail? |
| Is recovery provision in place? | Which operations and obligations become impossible during an interruption? |
| Is the supplier meeting contract? | Which capability and knowledge have become dependent on the supplier? |
The first column requires expertise. The second requires governance.
What Non-Executives Must Be Able to See
Board-level competence begins with a map, not a tutorial. For every material claim—revenue, cash, exposure, customer liability, regulatory return or critical service—the board should be able to see four things.
- Source: Where does the information originate, and which parts are estimates?
- Transformation: Which systems, interfaces, spreadsheets and manual adjustments change it?
- Authority: Who may enter, amend, approve and override?
- Evidence: What reconciliation, exception and independent test supports the final claim?
This map should be short enough to govern and detailed enough to expose concentration. If one analyst alone understands a critical spreadsheet, that is a control dependency. If a new enterprise system replaces local records, the board should know what evidence will disappear. If a supplier operates a critical platform, the board should know whether access, recovery and knowledge survive contract failure.
The questions at each board or audit-committee review should then be concrete:
- Which material figures rely on manual adjustment?
- Which reconciliations are overdue, and for how long?
- Where do business units use different definitions for the same reported measure?
- Which access exceptions permit incompatible duties?
- Which control weaknesses are being carried through a system change?
- Which technology failure could prevent the board from knowing the organisation’s true position?
The purpose is not more reporting. It is sharper visibility into the few information chains on which governance depends.
Stop Reviewing Projects in Isolation
Another source of illiteracy is the project-by-project view. A board approves a finance system, a customer database, an electronic sales channel and an outsourcing agreement as separate investments. Each has a business case. Together they alter control, information ownership and organisational dependence.
The cumulative effect may be more important than any project.
A common customer record can improve service while concentrating access risk. A shared finance system can strengthen standard control while creating one point of operational failure. Outsourcing infrastructure can professionalise operations while weakening the organisation’s ability to challenge technical decisions. Connecting external trading or sales systems can accelerate business while making cut-off, identity and reconciliation more complex.
Board governance should therefore maintain a view of the technology estate as a set of enterprise dependencies:
- material information chains;
- critical services and recovery priorities;
- concentrated suppliers and skills;
- major system changes affecting controls;
- unresolved manual workarounds;
- benefits and risks accumulating across the portfolio.
This is not an architecture diagram. It is a map of where the organisation may become unable to operate, know or prove.
The Leadership Standard
The present crisis of trust will lead many boards to demand stronger declarations, more audit work and additional committee papers. Those responses may help. They will fail if directors continue to treat the systems beneath corporate reporting as somebody else’s specialist domain.
Technology literacy at board level is not fluency in technical language. It is the habit of following a material claim back through its mechanism, asking where judgement enters, identifying who can override control and understanding what happens when the chain breaks.
The practical test is simple. When a director asks where a number came from, can the organisation answer without assembling six people and reconstructing a trail after the meeting?
If not, the problem is not merely poor reporting or weak technology. It is a board governing claims it cannot yet see.