The questions owners and boards should ask about IT

Why governance matters even in a small business

Directors carry responsibility for the business's risks, and technology is now involved in nearly all of them. A serious cyber incident, extended outage or privacy breach can stop trading, damage client relationships and create legal obligations. Owners who never ask about IT are not protected by not knowing; they simply find out at the worst possible moment.

Good governance does not mean micromanaging. It means asking the right questions at regular intervals, recording the answers and following up on gaps. A quarterly IT item on the board or owners' meeting agenda, lasting fifteen to twenty minutes, is enough for most small businesses. The important part is consistency: the same questions, asked on a regular cycle, with written answers that can be compared over time.

Questions about recovery

If our main systems stopped working tomorrow, how long would it take to get back to trading, and has that been tested? When was the last time we restored data from backup, and did it work? If our office became unusable, where would people work, and could they access everything they need? These questions test whether the business could actually survive an incident rather than whether it owns backup software.

Good answers include a date, a result and a time. Restored a sample of files last month in under an hour is a good answer. We have backups is not, because it says nothing about whether they work, how current they are or how long a full recovery would take. Ask the person answering to show the evidence, such as a restore test report, at least once a year.

Questions about access and security

Who has administrator access to our critical systems, and is that list reviewed? Is multi-factor sign-in turned on for every account, including directors? How quickly is access removed when someone leaves? Are we confident a convincing fake invoice or bank change request would be caught before money moved? Do staff know how to report a suspicious email, and do they actually do it?

Ask too about the basics that frameworks such as the NCSC's guidance for small businesses emphasise: updates applied promptly, devices protected and encrypted, backups kept separate from the systems they protect. You do not need technical detail, only confidence that each one is in place and checked. If the answer to any of them is that nobody is sure, that is itself the answer, and a sign the business needs an independent look.

Questions about dependence and suppliers

If our IT person or provider disappeared tomorrow, could someone else take over, and do we hold the passwords and documentation? Which suppliers could stop us trading if they failed, and what is our plan if they do? Who owns our domain name, and is it registered in the business's name? These questions surface key-person and supplier risks that often go unnoticed until a relationship ends badly.

Owners should hold, or know how to obtain, the master credentials for the business's core systems, kept securely in a password manager or sealed record. An IT provider that is reluctant to share administrative access with the business that pays for it is a warning sign. Check too that the documentation describing how systems fit together is current and stored somewhere the business can reach without asking the provider.

Questions about money and direction

What are we spending on IT this year, and how does it compare with last year and with our plan? What will need replacing in the next two years? Which of our biggest risks are we choosing to accept, and why? What would we do differently if we had more budget, and what if we had less? These help connect IT spending to business priorities rather than treating it as an overhead to be minimised.

Ask how IT supports the business strategy. If the plan is to grow, win larger clients or sell the business in a few years, IT readiness affects all three. The owners should see a short IT plan that reflects those goals. If no such plan exists, asking for one is a reasonable first step, and it will make every later IT conversation shorter and clearer.

Listening to the answers

Be wary of answers that are vague, overly technical or overly confident. Everything is fine, we are totally secure or that is too complicated to explain are signs that the person either does not know or is not willing to say. Good answers are specific, honest about gaps and include what is being done about them.

Record the answers in the minutes and ask the same questions next quarter. Progress over time is the real measure. If the same gap appears meeting after meeting with no action, that is a governance problem, and the owners should consider an independent review to get a clear picture. Directors are entitled to clear answers about the risks they are accountable for, and a fresh set of eyes is often the quickest way to get them.