Technology, risk and governance
Helping boards ask the right questions about technology
I have worked in technology for more than thirty years, from the RAF to company director and chief technical officer, much of it in defence, nuclear, finance, regulation and the public sector. I now want to bring that experience to boards as a non-executive director, trustee or governor. On a board, my job is to ask whether technology, data and risk are really under control, and to make the answers clear to people who are not technologists. It is not to run the technology.
What I bring to a board
-
Judgement where the stakes are high
Much of my work has been in regulated and safety-critical settings. At a UK government-owned nuclear organisation with rail and maritime sites around the UK and abroad, I led the restructuring of how information was classified and controlled. I quantified the risks, recommended the best route, and set out the governance options to support it, with examples, so senior leaders could decide on evidence.
-
Knowing when assurance is too optimistic
I have designed how organisations store, share and protect information. I know what good looks like, and where reports to the board tend to say more than the evidence supports.
-
Spending decisions with the consequences in view
As chief technical officer, I put every budget and major purchase forward with the consequences of approving, refusing or delaying it, from backup power for the server room to call recording for the dealing desk. I now ask management the same: what will this change, what happens if we don't do it, and how will we know it has worked?
If you are recruiting for a board and would like to talk, please get in touch
Commentary
Eight in ten executives say an AI-related incident reached their board in the past year. Fewer than half changed how AI is governed as a result.
AI is making old software weaknesses easier to find. Many were built in when systems were signed off because they worked. What a board should ask.
Due diligence tests the accounts and contracts but rarely asks where the data lives. Five questions an investor can ask without being technical.
Spreadsheets, databases and automations that staff build for themselves can quietly become critical. Four questions a board can ask about them.
“Multi-factor authentication: in place.” It is the kind of line that appears in a board report or risk register and rarely draws a question. During a review at a small organisation, I checked what that line meant in practice.
Boards check people and machinery before trusting them. Software that staff bring in deserves the same diligence, and the questions are familiar.
Most organisations keep far more information than they need. It sits in old email accounts, shared drives, forgotten SharePoint sites and the digital equivalent of boxes under the stairs. Nobody is quite sure what is in it, and nobody feels able to remove it.
This is usually described as caution, or as corporate memory. It is neither.
When I was in the RAF, exercises were part of normal life. Some were small: someone would try to follow you through a security gate, or turn up without a pass to see whether anyone would stop them. Others were anything but small. They went as far as battle damage repair on aircraft while wearing a full gas mask and NBC suit.
Every exercise had umpires. Their job was to watch, then tell us plainly what had gone wrong and what to try next time. I didn't always appreciate that at the time. Being told your best effort wasn't good enough stings.
Look around the table in many AI discussions and you will find a familiar mix: an innovation lead, a technology lead, a data lead and, often, a supplier. All capable people. All, by the nature of their roles, optimists.
That is not a criticism. Optimism is what gets pilots started. But a room full of it tends to produce the same result: enthusiasm mistaken for evidence, and plans with no answer to the question "what if this doesn't work?"
Three short stories from small organisations I have worked with.
Someone left a business in January. Nice person, better opportunity, no drama. In June, during a review, I found her account still active, still licensed and still able to sign in. HR had updated its records, payroll had been stopped and the leaving card had been signed. Nobody had told Microsoft 365.
Every board says it wants to hear bad news. Fewer behave in a way that makes it likely.
Bad news that arrives early is an asset. It keeps options open: there is still time to change supplier, add resource, re-plan, or tell customers before they hear it elsewhere. The same news six weeks later is a crisis, with fewer choices and a larger bill.