Technology governance is the set of rules and decisions that ensures an organisation uses its technology safely and effectively to reach its goals. It settles what gets bought, who decides, who is accountable, which rules apply and how technology risk is managed. These decisions now include how staff use AI tools.
Governance and IT management are different jobs
IT management is the daily work of running systems, such as applying updates, setting up accounts and fixing problems. Governance sits above that work and sets out who is accountable, what rules apply and how leadership knows the rules are being followed. A staff member, volunteer or contractor can take on the first job, but the board or committee stays responsible for the second. The FAQ on who is responsible for cyber security covers the questions leadership can ask.
What technology governance covers
- Access control, meaning who holds administrator access to key systems and what happens if that person is unavailable or leaves.
- Cyber risk, with as much attention given to prevention as to response after a breach.
- Privacy and data handling, including what personal information is collected and whether the people it belongs to would be comfortable with how it is stored and used.
- AI use, including what staff can use AI tools for and what data can go into them, as set out in an AI policy.
- Documentation and continuity, so that knowledge and access are held by more than one person.
- Reporting that turns technical risk and technology performance into plain language leadership can act on.
Why it matters to a board
Boards and committees change over time, and so do the staff and volunteers who run the systems. Where access and knowledge sit with one person, the organisation depends on that person staying. We worked with an organisation in that position, where concentrated administrator access and minimal documentation had left the board with no real oversight of its own infrastructure until a security crisis forced the issue. The case study describes what we did and how it turned out.
Governance also shifts attention to prevention. Most organisations spend more time planning for what happens after a breach than on the measures that make one less likely. Our blog post on governing through a cyber crisis explains why both need weight.
Signs of a governance gap
- Administrator access sits with one person and documentation is thin.
- Nobody has formally reviewed who controls the website, domain, email and cloud accounts.
- Leadership hears about technology only when something breaks or budget is needed.
- Staff use AI tools without agreed rules.
- Reports to the board are either too technical to follow or too vague to use.
An IT assessment is a practical way to see where the gaps are.
How we help
Our Technology Governance service covers each of the areas above and is typically delivered through an Advisory engagement, often alongside a Current State Assessment. The work is informed by AICD Foundations of Directorship training, which brings a governance perspective to technology decisions. The approach page describes the options.
