14 Questions Every Board Should Ask About Technology

The technology questions every board should ask cover seven areas: strategy, delivery, security and risk, AI, people and leadership, suppliers, and resilience. The useful ones are specific enough that management has to answer with evidence, not reassurance. Below are fourteen of them, two per area, with why each matters and what a good answer and a worrying answer sound like.

Why boards need better technology questions

Most directors are not technologists, and nobody expects them to be. The board is expected to oversee technology risk the way it oversees financial risk: by asking questions that test whether management knows where things stand.

That expectation is increasingly written down. In Australia, the AICD and the Cyber Security Cooperative Research Centre publish Cyber Security Governance Principles for directors, refreshed in 2024. The UK government published a Cyber Governance Code of Practice for boards in April 2025. NIST added a Govern function to version 2.0 of its Cybersecurity Framework in 2024. The direction is consistent: technology oversight is a board job, not one delegated entirely to the CTO.

The trouble is that the default board question, "is everything OK?", almost always gets a "yes". We wrote about that gap in why "everything is running fine" isn't enough anymore. This post is the practical follow-on: the questions to put on the agenda instead.

One distinction: these questions test the technology function and its risks. Judging the person who leads it is a different exercise, covered in how to review the performance of your CIO, CTO or technology leader.

How to use these questions

Do not ask all fourteen at once. Pick the two or three that feel least comfortable and put them on the agenda in advance. A question asked cold gets an improvised answer; a question asked a fortnight ahead tells you whether the evidence exists.

Listen for the shape of the answer. Good answers are specific, name an owner, include a date, and admit what is not yet known. Worrying answers are general and rest on one person's confidence.

Technology strategy questions for the board

1. Which business outcomes is this year's technology spend meant to deliver?

Technology budgets drift towards whatever arrives first. Without a stated link to business outcomes, the board cannot tell investment from maintenance.

• A good answer: Names the three or four outcomes the spend supports, roughly how much goes to each, and how the business will know it worked.
• A worrying answer: A list of projects and platforms, with no connection back to revenue, cost, risk or customers.

2. What are we deliberately not doing, and what is the risk of not doing it?

A plan with no visible trade-offs usually means they are being made quietly, below board level.

• A good answer: A short list of deferred work, why it was deferred, and the point at which it would need to come back.
• A worrying answer: "We are doing everything we need to." No function with a finite budget is.

Technology delivery and project questions

3. Which of our major projects are behind, and how would we know?

Project status is usually self-reported. A project can report green for months and turn red late, when the options are expensive.

• A good answer: Separates projects on track by evidence (milestones met, scope stable, budget tracking) from those on track by opinion, and names the ones that are struggling.
• A worrying answer: Everything is green, every quarter.

StackUp's Project Assessment is built around this problem: the submitter's own red-amber-green rating is captured but not scored, and where it disagrees with the calculated health score, the report says so.

4. How do we measure whether technology is performing, apart from the absence of complaints?

"No one has complained" measures noise, not performance.

• A good answer: A small set of measures the board sees regularly, such as availability of critical systems, time to resolve incidents, and delivery against plan, with a trend over time.
• A worrying answer: Performance is reported as a narrative, and the numbers only appear after something goes wrong.

Cyber security and technology risk questions

5. What are our top technology risks, who owns each one, and what changed since last quarter?

A risk register that never changes is not being used. Risks should move: some reduced, some accepted, some new.

• A good answer: Five to ten named risks, each with an owner, a current rating, the action in progress, and what moved since the last report.
• A worrying answer: A long generic list ("cyber attack", "system failure") with no owners and no movement.

6. If we suspected a data breach tonight, who decides what, and how quickly?

Breach response is governed by deadlines that start before anyone is certain. In Australia, an entity covered by the Notifiable Data Breaches scheme that suspects an eligible breach must take reasonable steps to complete an assessment within 30 days, and the OAIC expects that to be treated as a maximum. US public companies must disclose a material cyber incident within four business days of determining that it is material, under SEC rules adopted in 2023.

• A good answer: A documented incident response plan that names who leads, who decides on notification, when the board is told, and when it was last tested.
• A worrying answer: "We would get the right people in a room." That is a plan to start planning.

AI governance questions for directors

7. Where is AI being used in the business today, including tools we have not approved?

Staff adopt AI tools faster than policies are written. The risk is rarely the approved project; it is customer data pasted into a public tool to save an hour.

• A good answer: A current view of where AI is used, which tools are approved, what data may go into them, and how that is checked, not just written down.
• A worrying answer: A policy exists, so the question is considered answered.

8. Is our AI investment producing measurable value, or mostly activity?

Pilots are easy to start and hard to stop. The board should know which AI work has moved a business measure.

• A good answer: Separates experiments from production use, names what each production use has changed, and is candid about what has not worked.
• A worrying answer: Counts of pilots, licences or trained staff, with no outcome attached.

StackUp's AI Maturity Assessment is organised around the four questions boards ask about AI: are we positioned to win, is it actually working, what could go wrong, and can we keep up. It reports an AI Risk Rating separately from maturity, so a mature programme cannot hide a risky one.

Technology leadership and people questions

9. What happens if our most knowledgeable technical person leaves tomorrow?

Many organisations have one person who understands a critical system or how the whole estate fits together. That is a continuity risk, however good the person is.

• A good answer: Names the key-person dependencies honestly, and describes what is being done about each: documentation, a second person trained, a supplier on standby.
• A worrying answer: "That won't happen", or a pause followed by the person's name.

10. Does what we hear in the boardroom match what staff experience day to day?

Information gets diluted as it travels up a hierarchy. Not dishonestly; nobody volunteers the gap they have been meaning to close.

• A good answer: Management points to evidence that does not pass through them, such as staff feedback or an independent assessment, and explains where it differed from their own view.
• A worrying answer: The only evidence offered is the technology leader's own report.

StackUp's Discovery Agents exist for exactly this reason: they call or message staff directly on a schedule and report back what is happening, with the recording and transcript behind every finding.

Supplier and third-party technology questions

11. Which suppliers could stop us trading, and what would leaving each one take?

Supplier concentration is not wrong, but it should be a decision rather than an accident.

• A good answer: A short list of critical suppliers, the contract terms that matter (renewal dates, notice periods, data return on exit), and a realistic view of what switching would take.
• A worrying answer: Nobody is sure when the main contracts renew, or what happens to the data if the relationship ends.

12. How do we know our critical suppliers protect our data as well as we do?

A supplier with access to your systems or customer data is part of your attack surface. The 2024 refresh of the AICD principles specifically added guidance on digital supply chain risk.

• A good answer: Critical suppliers are assessed before onboarding and reviewed periodically, security obligations are in the contract, and someone owns the follow-up when a supplier has an incident.
• A worrying answer: "They're a big company, they'll be fine."

Technology resilience and incident readiness questions

13. When did we last restore a critical system from backup, and how long did it take?

Having backups and being able to recover from them are different things, and an untested recovery plan only reveals itself when it is needed.

• A good answer: A date, a system, how long the restore took, what went wrong during the test, and what was fixed afterwards.
• A worrying answer: "We have backups", with no date for the last successful restore.

14. Have we rehearsed a serious incident as a board, and do we know which decisions would be ours?

In a real incident the board makes or approves calls under time pressure: what to disclose, when to call the regulator, whether to keep trading. They are much harder to make well for the first time on the day.

• A good answer: The board has run an exercise in the last year, knows which decisions sit with it and which with management, and changed something as a result.
• A worrying answer: Incident response is considered an IT matter, and the board expects to be informed rather than involved.

What to do when the answers are vague

A vague answer is not a failure on its own. Often it means the evidence has never been gathered. Ask for it by a set date, from something more structured than one person's recollection, and ask the same questions the same way each quarter so the answers become comparable.

How boards use StackUp for independent technology oversight

This is the gap StackUp was built to close. StackUp for board members gives directors a structured, repeatable baseline of technology health without a slow consulting review, and without needing deep technical expertise to read the results.

The Technology Assessment gives you evidence for many of the questions above, from strategy and key-person risk to supplier terms and recovery testing. It is eighty-four questions across twelve categories, usually completed in one sitting by the person who runs technology, and scored by fixed rules into eight areas and one number out of 100, banded from At Risk to Excellent, with the four priority actions worth starting with. The same answers always produce the same score, so running it again a quarter later shows what actually changed. It is free to run. On a paid plan, a verified score of 80 or higher earns StackUp Certification.

Be clear about what that baseline is. It is answered by the person who runs technology, so the scoring is independent of their opinion but the answers are not. To meet the test in question 10, invite others into the same assessment to check the answers, and run a Discovery Agents check-in round so the picture does not rest on management's account alone.

The Crisis Tabletop Simulation is how a board rehearses question 14. In about an hour, the room works through a bad year in four quarters and twelve decisions against a five-minute clock, then a debrief prices what those decisions cost and traces each gap to the assessment answer behind it. With the board lens, options are framed as oversight calls: what the board asks management, what it approves, when it discloses, whether it calls the regulator. The first tabletop is free. It is a simulation, not a substitute for your legal or regulatory advisers.

For a worked example, see the board technology oversight case study. Or put two of these questions on your next agenda and see what comes back.