“A board rarely says no to technology. It just cannot act on a number, it cannot turn into money, risk, or market position.”
Executive Summary & Key Takeaways
- Boards act on money, risk, and market position: Technical metrics only land when restated in these terms.
- The Translation Layer: Requires no new data — only a clear line from each operational metric to a board-level concern.
- The IT Steering Committee: Chaired by a business executive, taking three strategic decisions each quarter.
- Start Small: One number, one translation, one decision, tested over 90 days.
1. The Problem in Brief
At an audit committee meeting at a microfinance company in Dhaka, the CIO presented the technology report: uptime figures, a migration that was 70 percent complete, and a slide on security posture. For a while, the directors were polite and attentive. After twenty minutes, they turned to their phones, and some reached for the food and drinks. Nobody was hostile; they had come to decide about money and exposure, while the report kept talking about systems.
Then one director spoke up: “Does the regulator require all of this? It sounds like we are putting more effort into the process than into the business goals.” The CIO answered by returning to the business case, the progress, and the achievements of the project. It was a fair answer to a different question, and it did not meet what the directors expected.
Three Things That Must Change:
- Metrics describe effort rather than results: Dashboards catalog activity rather than enterprise outcomes.
- Absence of a decision forum: There is no regular forum where technology decisions get made collaboratively.
- Descriptive rather than decisive reporting: Reports tell the board what happened without asking it to choose anything.
2. Where the Signal Gets Lost
IT teams are proud of patch cadence, ticket closure, and uptime. These show a busy, competent team, but not whether the work matters to the company. A system can run 99.99% of the time and still be the wrong system for the market the company wants to enter.
Furthermore, a red-amber-green dashboard gives directors something to look at and nothing to decide. Governance starts when you bring two or three real options and say what each one costs and risks.
Research Insight (MIT CISR)
Companies with boards strong in both digital and AI skills earned a noticeably higher return on equity than their industry peers (Weill, Woerner, Banner and Moore, 2025).
Regulatory Shift (EU NIS2 Directive)
Article 20 makes management bodies directly responsible for approving and overseeing cybersecurity measures, with personal liability for breaches.
3. A Framework That Does the Translating
The translation layer rests on a simple structure: connect your operational metrics to what it means for the business, and finally to what the board cares about.
| What IT Reports | What It Means | What the Board Cares About |
|---|---|---|
| System uptime and speed | Can customers complete transactions when it matters most? | Revenue protected: losses avoided at peak times (payroll runs, seasonal demand, period-end close). |
| Technical debt & legacy systems | How fast are we modernizing, and what do old systems cost to keep? | Capital efficiency: lower cost of ownership, more money for growth instead of maintenance. |
| Speed of fixing security flaws | How long are systems with customer data open to attack? | Regulatory & liability risk: less exposure to fines, legal claims, and contract penalties. |
Example in a Meeting:
“Average time to fix critical security flaws: 21 days last quarter, 6 days this quarter.”
“A critical weakness used to stay open for three weeks on systems holding customer data. Now it stays open for less than one, leaving attackers far less time to use it. On the numbers agreed with Finance, our estimated yearly regulatory exposure falls as a result.”
Five Questions for Every Board Slide:
4. Building a Steering Committee Worth Having
A framework needs a regular forum. I recommend an IT steering committee with a written charter, chaired by a business executive rather than the CIO so nobody can say IT is marking its own homework.
Three Decisions Each Quarter:
Strategic alignment
Does current spending fund the milestones in this year’s business plan, or has it drifted?
Stage-gated funding
Money is released in steps tied to results. A project earns its next tranche by showing the gain it promised.
Risk posture
What has changed outside the company (new rules, vendor dependence, emerging threats)?
5. Pilot It in 90 Days
Do not attempt a massive corporate reorganization overnight. Execute a phased 90-day pilot:
