IT governance for an SME is the set of simple arrangements that let a board see, question and take decisions on technology risk, rather than leaving it to an informal chat with whoever runs IT. Most UK businesses of 20 to 300 people have nothing more formal than that chat. The directors trust the IT manager or the managed service provider, the systems mostly work, and technology appears on the board agenda only when something has gone wrong or a large bill needs approving.
That arrangement is becoming harder to defend. Technology now sits underneath almost every part of a business: revenue, operations, customer data, payments and reputation. Directors already carry general legal duties to exercise reasonable care, skill and diligence, and regulators, insurers, auditors, lenders and larger customers increasingly ask boards to show that they understand and oversee technology and cyber risk. The question “how does the board know?” is being asked more often, and “we asked the IT manager and they said it was fine” is a weak answer.
This guide starts with what a board actually needs to see and sign off, then covers how to build a lightweight technology risk register, what a quarterly technology report to the board should contain, how to run oversight without creating bureaucracy, and where the governance function sits — internally, with a virtual CIO, or shared between the two. It is written for directors and owners rather than IT specialists, and for businesses without a governance team, a risk function or a full-time CIO.
What IT governance means in an SME
In large organisations, IT governance is a formal discipline with frameworks such as COBIT and ISO/IEC 38500, committees, policies and internal audit. Those frameworks are useful references, but an SME that tries to implement one in full will produce documents nobody reads. The useful core is much smaller.
At its simplest, IT governance answers four questions for the board:
- Direction. Is technology investment aligned with what the business is trying to achieve over the next one to three years?
- Risk. What are the main ways technology could hurt the business, how likely and serious are they, and what is being done about them?
- Performance. Are systems, suppliers and projects delivering what was expected, at the expected cost?
- Accountability. Who is responsible for what, and how does the board know that responsibilities are being met?
Governance is not the same as management. Management runs the systems, fixes problems and delivers projects; governance sets direction, agrees how much risk is acceptable, and checks that management is doing what was agreed. In a small business the same people may do both, which is exactly why it helps to separate the conversations: an operational IT meeting about tickets and projects, and a board-level discussion about risk, direction and decisions.
If the board has never discussed technology formally, do not start with a framework. Start with a one-page quarterly technology report and a technology risk register of ten to fifteen entries. Together they give the board something concrete to read, question and decide on, and they create the habit on which everything else can be built.
What a board actually needs to see
Boards do not need to understand firewalls, licensing models or backup software. They need enough information to answer a small number of questions with confidence, and to make the decisions only they can make.
The top technology risks, in business terms
Not “unpatched servers” but “a ransomware attack could stop order processing for a week.” Each top risk should be expressed as a consequence the board understands, with a view on how likely it is, what controls are in place and whether the residual risk is acceptable.
Whether the business could recover
How long it would take to restore critical systems after a serious incident, when that was last tested, and whether the answer matches what the business could tolerate. This is often the single most revealing question a board can ask.
The state of key dependencies
Critical suppliers, systems approaching end of support, single points of failure, and key-person dependencies — the one engineer or provider who holds all the passwords and knowledge.
Spend against plan and value
Technology spend against budget, major commitments coming up, and whether significant projects are on track and delivering.
Incidents and near misses
What went wrong in the period, how it was handled, and what was learned. A board that only hears about incidents when they become crises has no sense of the underlying trend.
Decisions that need the board
Risk acceptance, significant investment, policy approval and changes in direction. A good report ends with the decisions the board is being asked to take, so the discussion leads somewhere.
Everything in the rest of this guide is a mechanism for providing those six things reliably, with as little overhead as possible.
Which technology topics reach SME boards
The bar chart shows how often each topic was discussed at board level in the previous twelve months, across the UK SMEs of 20 to 300 staff we work with or assess before engagement. The figures are indicative rather than a formal survey.
The pattern is clear. Boards discuss technology when it costs money or when something frightening has happened. Far fewer look at the overall risk position, and very few see evidence that the business could actually recover, or consider how dependent it is on a handful of suppliers. These are exactly the topics where board oversight adds the most value, because they rarely surface through day-to-day operations until it is too late.
Technology oversight in UK SMEs — the numbers
A few further indicators from the same group of businesses show how informal technology oversight typically is.
None of these figures reflects negligence. They reflect businesses that grew faster than their governance, where technology was once simple enough to leave to one trusted person. The fix is not a large programme; it is a small number of regular habits that put the right information in front of the board.
Building a lightweight technology risk register
A technology risk register is a list of the main ways technology could harm the business, with an assessment of each and a record of what is being done about it. It is the backbone of board-level oversight, because it turns vague unease about “cyber” or “IT” into specific, owned, reviewable items. For an SME, it can live in a spreadsheet.
What each entry needs
Keep the columns few and the language plain. A useful technology risk register entry contains:
- Risk statement. Cause, event and consequence in one sentence: “Because backups have not been restore-tested, a ransomware attack could leave us unable to recover customer records for several days.”
- Owner. A named person accountable for managing the risk — usually a director or senior manager, not the IT provider.
- Likelihood and impact. Scored on a simple scale, typically one to five each, with short descriptions of what each score means so that scoring is consistent.
- Current controls. What is already in place to reduce likelihood or impact.
- Residual rating. The likelihood and impact after current controls.
- Treatment. Whether the risk is to be reduced, transferred (for example through insurance or contract), avoided or accepted, and the actions planned.
- Target and review date. Where the risk should be after treatment, and when the entry will next be reviewed.
Where to find the risks
Most SMEs share a familiar set of technology risks: ransomware and other cyber attacks, loss of a critical supplier, failure of an unsupported system, key-person dependency, data protection breaches, loss of connectivity, unrecoverable data, uncontrolled use of AI and cloud tools, and poorly governed access by former staff or suppliers. Start with these, then add risks specific to the business, such as dependence on a bespoke system, a single site or a particular regulatory obligation. A structured technology risk assessment is a good way to populate the first version.
How big should it be?
For a board, ten to fifteen technology risks is usually right. Fewer, and important risks are probably being missed; many more, and the register becomes an operational list the board cannot meaningfully review. Detailed operational risks can sit in a separate list owned by IT, with the top few rolled up to the board register.
Scoring without false precision
Likelihood and impact scores are judgements, not measurements. Their value is in forcing a conversation and allowing risks to be compared, not in the numbers themselves. Agree short definitions for each level — for impact, perhaps in terms of hours of disruption, financial loss or regulatory exposure — and score as a group rather than leaving it to one person.
What a register entry looks like
The table shows four sample entries from a technology risk register for a fictional 90-person professional services firm. Scores are likelihood times impact, each out of five.
| Risk | Owner | Residual score | Treatment | Next action |
|---|---|---|---|---|
| Ransomware encrypts file and practice management systems, halting client work for several days | Finance Director | 3 x 5 = 15 | Reduce | Quarterly restore test of practice management system; report result to board |
| Sole IT engineer leaves or is unavailable, leaving no one able to manage systems | Managing Director | 3 x 4 = 12 | Reduce | Document admin access and procedures; agree cover with external provider |
| Document management system reaches end of vendor support, with no security updates | Operations Director | 4 x 3 = 12 | Reduce | Replacement options to board in Q2 with costed proposal |
| Staff paste client data into unapproved AI tools, breaching confidentiality | Head of Risk | 3 x 3 = 9 | Reduce | Approve AI use policy; provide approved tool; brief staff |
Notice that the owners are business leaders, not the IT provider. The IT team or virtual CIO will do much of the work, but accountability for accepting or reducing a business risk belongs with the business. Notice too that every entry has a concrete next action, which is what the board will check at its next review.
Running the first risk register workshop
The first version of the register is best built in a single session with the directors and whoever runs IT, rather than drafted by IT and sent round for comment. A workshop gets the board thinking about technology risk in its own terms, and produces ownership that a circulated document rarely does.
Before the session
The person facilitating — an internal IT lead, a virtual CIO or another adviser — prepares a short pack: a list of fifteen to twenty candidate risks drawn from the baseline review, the scoring scales with plain definitions for each level, and a one-page summary of current controls. Directors should read it beforehand, but the session should not depend on them having done so.
During the session
Ninety minutes is usually enough. Spend the first part agreeing the scoring scales, particularly what each impact level means for this business — one day of disruption may be minor for one company and severe for another. Then work through the candidate risks, rewording them in business language, merging duplicates, adding anything missing and discarding anything that does not matter. Score each one as a group, discussing disagreements rather than averaging them away, because the disagreements often reveal the most. Finally, name an owner for each of the top risks and agree one next action for each.
After the session
The facilitator writes up the register within a few days, circulates it for corrections, and presents it formally at the next board meeting alongside the first quarterly report. From then on, owners update their actions each quarter and the register is reviewed in full at least once a year, or sooner if the business changes significantly — a new site, an acquisition, a major system change or a serious incident.
The most common outcome of a first workshop is surprise. Directors discover risks they had not considered, particularly around key-person dependency, recovery and suppliers, and IT leads find that risks they have worried about for years are finally understood. That shared understanding is worth as much as the register itself.
Scoring three common SME technology risks
The score grid breaks three frequently seen risks into the dimensions a board should consider when deciding what to do about them. A high badge means a high level of concern on that dimension.
The grid shows why board attention matters. Ransomware is widely discussed, so it has at least some visibility and some controls. Key-person dependency is often invisible to the board and cheap to reduce — documentation, shared administrative access held securely, and agreed cover — yet it is rarely addressed until the person leaves. An unsupported core system is usually low on visibility and high on cost, which is exactly the kind of risk that needs a board decision, a budget and a timeline rather than being left to IT to worry about.
The informal chat versus lightweight governance
Most SMEs start with the arrangement on the left. The arrangement on the right adds structure without adding a governance team.
The informal chat
Technology discussed with IT as and when needed
Lightweight governance
A register, a quarterly report and clear ownership
The time cost of the right-hand column is modest: perhaps a day a quarter to prepare the report and update the register, and thirty to forty-five minutes of board time. In return, the board gains a clear view of technology risk, decisions get made before they become urgent, and the business can show insurers, auditors and customers that technology is overseen rather than assumed.
Putting governance in place over twelve months
The timeline shows a realistic sequence for an SME introducing technology governance from scratch, whether the work is led internally or by a virtual CIO. It deliberately starts small and builds habits before adding detail.
By the end of the first year, the board has a register it understands, four reports, a set of approved policies, evidence of a recovery test and a roadmap linked to the budget. None of these requires a governance team; together they amount to a credible, documented oversight framework. For the roadmap element, our guide to IT roadmaps and technology strategy covers the planning process.
What a quarterly technology report to the board should contain
The quarterly report is where governance becomes visible. Its purpose is to give the board what it needs to oversee technology in the time it can realistically give — usually a few pages and thirty to forty-five minutes of discussion. Board-level IT reporting goes wrong in two directions: too little, so the board learns nothing, or too much technical detail, so the board learns nothing either. A consistent structure helps.
1. Summary and headline position
Three to five sentences: overall position, what has changed since last quarter, anything the board must know. A simple red, amber or green status for each area gives an at-a-glance view, provided the criteria for each colour are defined and stable.
2. Top risks and changes to the register
The top five or so risks with their current rating and direction of travel, plus any new risks, closed risks or significant changes in score. The full register is attached for reference.
3. Security and resilience indicators
A handful of consistent measures, the same every quarter so trends are visible. Examples include the proportion of devices with current security updates, coverage of multi-factor authentication, the date and result of the last restore test, the number of privileged accounts, phishing simulation results and the status of any certification such as Cyber Essentials. Choose six to eight measures that matter to your business and stick with them.
4. Incidents and near misses
A short account of anything significant: what happened, impact, how it was handled, and what has been changed as a result. Including near misses, rather than only incidents that caused harm, gives the board a much better sense of exposure.
5. Projects and spend
Status of major projects against time and budget, technology spend against plan, and significant commitments or renewals coming up in the next two quarters.
6. Suppliers and dependencies
Performance of critical suppliers, contract renewals approaching, and any change in dependency risk, such as a supplier being acquired or a system nearing end of support.
7. Decisions requested
Clear, specific requests: approve this policy, accept this risk, fund this project, choose between these options. Each with a recommendation, the cost, and the consequence of not deciding.
Keep the main report to three or four pages. Technical detail can go in an appendix for anyone who wants it. The test of a good report is whether a non-technical director could read it in ten minutes and know what the main technology risks are, whether things are getting better or worse, and what they are being asked to decide.
Choosing indicators that mean something
The indicators in the quarterly report do more than fill a table. Chosen well, they let a board see in a minute whether technology risk is moving in the right direction. Chosen badly, they create a false sense of security or bury the board in numbers it cannot interpret.
Good indicators share a few qualities. They relate directly to a risk on the register, so that a change in the indicator means something. They can be measured the same way every quarter without heroic effort. They have a target or threshold, so that the board knows what good looks like. And they are hard to game: a measure that can be improved without reducing the underlying risk will eventually be improved in exactly that way.
A typical starting set for an SME might include:
- Security update coverage. The proportion of devices and servers with current security updates, against a target such as 95% within a defined period of release.
- Multi-factor authentication coverage. The proportion of user and administrative accounts protected, ideally reported separately.
- Last successful restore test. The date, the system restored and the time it took, compared with what the business can tolerate.
- Privileged accounts. The number of accounts with administrative rights, with the trend over time.
- Leaver access. Whether accounts of staff who left in the quarter were disabled on time.
- Overdue register actions. How many agreed actions have passed their due date.
- Unsupported systems. The number of systems or devices past vendor support.
- Phishing simulation results. Where simulations run, the report rate as well as the click rate.
Avoid vanity measures that sound reassuring but reveal little, such as the number of threats blocked by a firewall or the number of tickets closed. They tend to rise or fall for reasons unrelated to risk, and they invite the board to feel safe without telling it whether it is.
What governance costs, compared with going without
The table compares indicative annual costs of different ways to provide technology governance with the costs that typically arise when it is absent. Ranges are broad, for UK businesses of 20 to 300 staff, and depend on complexity, sector and what is already in place.
| Approach | Indicative annual cost | What it typically provides | Main limitation |
|---|---|---|---|
| Internal IT lead given governance time | Around 10% to 20% of their time, plus board time | Register upkeep, quarterly report, policy drafting | Reporting on their own work; may lack board-level experience |
| Virtual CIO on retainer | Roughly £12,000 to £48,000, depending on days per month | Independent risk view, board reporting, roadmap, supplier oversight | Needs good access to internal information and people |
| Shared model: internal lead plus virtual CIO | Retainer at the lower end plus internal time | Internal knowledge with independent challenge and board experience | Roles must be clearly divided to avoid gaps |
| Periodic external review only | Roughly £3,000 to £15,000 per review | Point-in-time assessment and recommendations | No continuing oversight between reviews |
| No governance | Nothing up front | Nothing | Exposure to unmanaged incidents, rushed decisions, weaker answers to insurers and customers |
The last row is the one most SMEs are on, and its cost is deferred rather than zero. It arrives as an incident that could have been prevented, an end-of-life system replaced in a hurry at premium cost, an insurance application that is hard to answer honestly, or a customer security questionnaire that exposes gaps at the worst moment. Governance does not eliminate those costs, but it makes them visible and planned. Pricing for virtual CIO arrangements varies widely; the figures above are a guide only, and any provider should be able to explain what their retainer includes.
Technology spend and planning
One of the clearest signs of missing governance is technology spend that is not linked to any plan. Across the SMEs we assess, the proportion whose IT budget is not linked to any written technology plan or roadmap is high.
The figure is indicative rather than a formal survey. Without a plan, budgets tend to be last year’s spend plus whatever broke or was requested, and large items such as replacing a core system or upgrading hardware across the business arrive as surprises. With a plan linked to the risk register, the board can see why money is being spent, what risk each investment reduces, and what is coming in the next two or three years.
Linking spend to risk also changes the conversation about cost. “We need £30,000 for a new document management system” is easy to defer. “Our document management system loses vendor support next year, which raises the risk of a data breach from 12 to 20 on our register; replacement costs £30,000, and this is the plan” gives the board what it needs to make a reasoned decision — including, if it chooses, to accept the risk knowingly.
Running oversight without creating bureaucracy
The fear that governance means bureaucracy is reasonable: many businesses have seen policies written for an audit and never read again. An IT oversight framework for an SME should be judged by a simple test — does it lead to better decisions and fewer surprises? Anything that does not should be cut.
Use the rhythm the board already has
Do not create a new committee unless the business is large enough to need one. Add technology as a standing quarterly item on the existing board agenda, with the written report circulated in advance. Monthly or ad hoc items can be added when something significant is happening, such as a major project or an incident.
Keep the same measures
Consistency is more valuable than completeness. A small set of indicators reported the same way every quarter shows trends; a different set each time shows nothing. Resist the temptation to add measures every time a new topic arises.
Report by exception
Areas that are on track need one line. Board time should go to risks that are rising, actions that are overdue, incidents and decisions. A report that spends equal time on everything buries the important points.
Keep policies short
A two-page acceptable use policy that staff actually read is worth more than a twenty-page one that sits on a shared drive. Board-approved policies should set principles and responsibilities; detailed procedures can be owned and updated by IT without returning to the board.
Make decisions explicit
Record in the minutes what the board decided, including decisions to accept a risk. “The board noted the risk from the unsupported finance system and agreed to accept it until replacement in Q3, with compensating controls” is evidence of oversight. A vague “IT update noted” is not.
Separate governance from operations
Ticket volumes, individual faults and day-to-day project detail belong in operational meetings, not the board. If the board starts discussing printer problems, the reporting is at the wrong level.
Governance practices in place in UK SMEs
The progress bars show how often each governance practice is in place among the UK businesses of 20 to 300 staff we work with or assess. Figures are indicative.
Technology governance practices in place
The most common practice, budget approval, is about money rather than risk. The least common — recording risk acceptance and seeing recovery test results — are the ones that show a board has genuinely engaged with technology risk. Moving those two from rare to routine is often the most valuable step a board can take, and neither requires significant spend.
Where the governance function sits
Someone has to prepare the report, maintain the register, chase actions and give the board an informed view. In an SME without a CIO, there are three common arrangements.
Internal
An internal IT manager or operations lead takes on governance alongside their day job. This works well when that person has the time, the seniority to speak candidly to the board, and some experience of risk and strategy. The weakness is independence: they are reporting on their own work and their own team, and may be reluctant to raise risks that reflect on them, or may not see risks outside their experience.
Virtual CIO
An external virtual CIO provides governance as a part-time service: maintaining the register, preparing and presenting board reports, developing the roadmap and overseeing suppliers, including the managed service provider. The strengths are independence, board-level experience and a view across many businesses. The weakness is distance: a virtual CIO depends on good access to internal people and information, and must not become a substitute for business ownership of risk. Our comparison of virtual CIOs and IT consultants explains how the role differs from project-based advice.
Shared
Often the most effective arrangement for businesses with an internal IT lead. The internal lead owns operational information and delivery; the virtual CIO provides independent challenge, structures the register and reporting, and presents to the board alongside the internal lead. Responsibilities must be clearly divided — for example, internal lead gathers indicators and updates action status, virtual CIO reviews risk ratings and drafts the board report — so that nothing falls between them.
Whichever model is chosen, two things stay with the board. A named director should sponsor technology governance and make sure it happens, and risk ownership should sit with business leaders rather than being handed to the IT function or an external provider. Virtual CIO governance supports the board’s oversight; it does not replace it.
When the managed service provider is the main source of information
Many SMEs rely on a managed service provider for most of their IT. That provider will have valuable information, but asking it to be the sole source of the board’s view of technology risk creates an obvious conflict: it is reporting on its own performance. Independent review, whether from a virtual CIO, an internal lead or a periodic external assessment, gives the board a more balanced picture without implying any criticism of the provider.
Directors, regulators and the expectations around technology risk
This section is a general overview, not legal advice; directors should take advice from their own legal and professional advisers on their specific obligations.
Company directors in the UK have general duties under company law, including a duty to exercise reasonable care, skill and diligence. These duties do not mention technology specifically, but as technology risk becomes central to most businesses, it is reasonable to expect directors to show that they have considered it. Data protection law places accountability obligations on organisations processing personal data, including demonstrating appropriate security measures. Regulated sectors, such as financial services, legal and healthcare, have additional requirements set by their regulators.
Government guidance aimed at boards has also developed. The Cyber Governance Code of Practice, published in 2025 with input from the National Cyber Security Centre, sets out what directors should expect to oversee on cyber risk, including risk management, strategy, people, incident planning and assurance. It is voluntary and aimed at medium and large organisations, but its principles translate well to smaller businesses and provide a useful checklist for what a board should be seeing.
Beyond formal obligations, practical expectations are rising. Cyber insurers ask detailed questions about controls and governance at application and renewal. Larger customers send security questionnaires and may require certifications such as Cyber Essentials. Lenders, investors and acquirers look at technology risk in due diligence. A board that can produce a current risk register, recent reports and minutes recording decisions is in a far stronger position in each of these conversations than one relying on assurances. The specific requirements of any insurer, customer or framework vary, so check current terms with the relevant party.
Overseeing AI and cloud tool adoption
One area where SME governance is visibly lagging is the rapid adoption of AI assistants and cloud applications by staff. Many of these tools are useful and inexpensive, and many are adopted without anyone in IT or on the board knowing. That creates questions about where business and client data goes, what terms apply to it, and whether outputs are being relied on without checking.
Board oversight here does not mean banning tools or reviewing every application. It means the board agreeing a position and making sure it is followed. A sensible approach for most SMEs includes:
- A short acceptable use policy for AI. Which tools are approved, what kinds of data may and may not be entered into them, and the expectation that outputs are checked before being relied on.
- An approved alternative. Policies that only prohibit tend to be ignored. Providing an approved tool with appropriate business terms gives staff a legitimate route.
- Visibility of what is in use. Periodic review of which cloud applications are being used, which IT can usually establish from existing systems.
- A place on the register. Uncontrolled AI and cloud use as an explicit risk, with an owner and actions, rather than an unspoken concern.
- A decision process for new tools. A light route for staff to request a new tool, with a quick check of data handling and terms before approval.
The specific obligations that apply — around personal data, client confidentiality or sector rules — depend on the business and should be checked with appropriate advisers. The governance task is simpler: make sure the board has taken a position, that staff know what it is, and that someone is responsible for keeping it current as the tools change.
Technology governance maturity — where most UK SMEs sit
Combining the governance practices above gives an indication of overall maturity. The gauge reflects a typical UK SME of 20 to 300 staff before deliberate governance has been introduced.
A score around thirty typically reflects a business where technology is competently run but not governed. Budgets are approved, some policies exist, and the IT team or provider is trusted. What is missing is the structure that would let the board see the overall risk position, track it over time and make deliberate decisions about it.
The gap closes quickly. A named sponsor, a risk register, a quarterly report and a recovery test can be in place within six months and typically move a business into the sixties. The rest — a roadmap linked to the register, supplier oversight, recorded risk decisions and an annual review — follows over the first year.
Common IT governance mistakes in SMEs
The mistakes below recur in businesses introducing governance for the first time. Most come from either doing too much or handing the work to the wrong people.
- Adopting a full framework. Implementing an enterprise framework in an SME produces paperwork rather than oversight. Borrow the principles, not the bureaucracy.
- Making IT the risk owner. The IT team or provider manages controls, but business risks should be owned by business leaders who can decide to accept or fund them.
- Reporting in technical language. Reports full of acronyms and system names leave the board unable to engage. Describe risks as business consequences.
- A register that never changes. If scores, actions and owners are the same every quarter, the register has become a document rather than a tool.
- Changing measures every quarter. Without consistent indicators, the board cannot see whether things are improving.
- Relying solely on the managed provider’s view. A provider reporting on its own performance cannot give fully independent assurance.
- Assuming recovery works. Backups that have never been restored in a test are a hope, not a control.
- No recorded decisions. Discussions that are not minuted as decisions provide little evidence of oversight and are easily forgotten.
- Treating governance as a one-off project. A burst of policies and a register created for an insurance renewal, then left alone, quickly goes stale.
- Ignoring staff use of AI and cloud tools. Unapproved tools handling business or client data are one of the fastest-growing risks in SMEs, and often invisible to the board.
Policies and registers that do not reflect reality create false comfort for the board and can be unhelpful if examined after an incident by insurers, regulators or customers. A short register that is genuinely reviewed, and a policy that matches what staff actually do, are worth far more than comprehensive documents nobody follows. If a control described in a policy is not actually in place, either put it in place or change the policy.
Case study: from informal updates to a governed board
A family-owned manufacturing business with around 160 staff and two sites had a capable internal IT manager and a managed service provider for infrastructure and security. Technology reached the board through a verbal update from the IT manager every few months, usually focused on projects and spend. There was no risk register, no written report and no record of risk decisions.
The prompt for change came from two directions at once. The business’s cyber insurer asked detailed questions at renewal about backup testing, multi-factor authentication and incident planning, which the board found difficult to answer with confidence. A month later, a major customer sent a supplier security questionnaire asking how the board oversaw cyber risk.
The board engaged a virtual CIO on a two-day-a-month retainer, working alongside the IT manager in a shared model. The finance director became the board sponsor for technology. In the first quarter, the virtual CIO and IT manager ran a baseline review and a risk register workshop with the directors, producing thirteen risks with named owners. The first quarterly report followed, with seven consistent indicators and three decisions requested: approve an information security policy, fund a restore test programme, and decide what to do about an unsupported production planning system.
The board approved the policy and the restore tests. The first test showed that restoring the production planning system would take nearly three days rather than the few hours everyone had assumed. That finding, presented with options and costs, led to a decision to bring forward replacement of the system and to improve backup arrangements in the meantime. The board formally accepted the residual risk until replacement, with the decision recorded in the minutes.
Within a year, the business had four quarterly reports, a register under regular review, approved core policies, two restore tests, a roadmap linked to the budget and clear answers for its insurer and customers. The IT manager described the change as finally having a forum where risks they had worried about for years were heard and decided.
“We always trusted our IT team, and we still do. What changed is that the board now actually knows what our technology risks are, and we make decisions about them rather than hoping. The restore test alone changed a major investment decision.” — Finance Director, UK manufacturing business
The lesson is not that the business had poor IT. It had good people without a mechanism to put the right information in front of the board. Governance supplied the mechanism.
The 12-point IT governance checklist for SME boards
The checklist sets out the minimum arrangements for credible technology oversight in an SME. Most can be in place within six to twelve months.
- Name a board sponsor. One director responsible for making sure technology governance happens.
- Decide where the function sits. Internal, virtual CIO or shared, with responsibilities written down.
- Create a technology risk register. Ten to fifteen risks in business language, each with an owner, scores, controls, treatment and next action.
- Assign business owners to risks. Directors and senior managers, not the IT provider.
- Agree a quarterly report format. Summary, top risks, consistent indicators, incidents, projects and spend, suppliers, decisions requested.
- Choose six to eight indicators. Report them the same way every quarter.
- Approve a small set of core policies. Information security, acceptable use including AI, access, backup and recovery, suppliers.
- Test recovery and report the result. At least one critical system restored in a test each year, with results to the board.
- List critical suppliers. With contract dates, dependency risk and an owner for each relationship.
- Link budget to a roadmap. A one- to three-year plan connecting spend to business goals and register risks.
- Record decisions. Including risk acceptance, with reasons and review dates, in the minutes.
- Review annually. Look at whether the arrangements are working and adjust them.
A business that follows this checklist produces, as a by-product, most of the evidence that insurers, auditors, customers and acquirers ask for: a current register, regular reports, approved policies, test results and minuted decisions. There is no need to create separate documentation for each request, which saves considerable time once the habits are established.
Getting started this quarter
For a board that has never governed technology formally, the first steps are small. At the next board meeting, nominate a sponsor and agree who will prepare the first report and register. Ask the IT lead, provider or virtual CIO three questions, and ask for the answers in writing before the following meeting: what are our ten most serious technology risks; when did we last restore a critical system in a test, and how long did it take; and which suppliers or individuals could stop the business if they disappeared tomorrow?
The answers will usually be enough to populate a first register and shape the first report. They also tend to reveal, quickly, whether the business has the information and the people it needs or whether external support would help. Our guide on when an SME needs a virtual CIO sets out the signs, and our earlier overview of IT governance for small businesses covers the broader pillars of governance beyond board reporting.
At a glance: technology governance for SME boards
| Element | What it involves | Frequency | Who owns it |
|---|---|---|---|
| Board sponsor | Director accountable for technology governance | Ongoing | Board |
| Governance function | Internal lead, virtual CIO or shared model | Ongoing | Agreed by the board |
| Technology risk register | 10 to 15 risks with owners, scores, controls and actions | Updated quarterly | Risk owners; maintained by governance function |
| Quarterly technology report | Summary, risks, indicators, incidents, projects, suppliers, decisions | Quarterly | Governance function |
| Indicators | Six to eight consistent measures | Quarterly | IT lead or provider |
| Core policies | Security, acceptable use and AI, access, backup, suppliers | Reviewed annually | Approved by the board |
| Recovery testing | Restore critical systems in a test and report results | At least annually | IT lead or provider; reported to the board |
| Supplier oversight | Critical supplier list, contracts, dependency risk | Reviewed annually | Relationship owners |
| Roadmap and budget | One- to three-year plan linked to risks and goals | Annually | Governance function; approved by the board |
| Incident reporting | Incidents and near misses with lessons | Quarterly, or immediately if serious | IT lead or provider |
| Recorded decisions | Approvals and risk acceptance in minutes | Every board meeting | Company secretary or chair |
| Independent view | Challenge beyond the provider reporting on itself | Ongoing or periodic | Virtual CIO or external review |
| Annual governance review | Is the framework working; what should change | Annually | Board |
How Cloudswitched supports technology governance
Our virtual CIO service gives SME boards the technology oversight they need without a full-time CIO or governance team. We start with a baseline review and a risk register workshop with your directors, then maintain the register, prepare a concise quarterly technology report, present it to the board and help turn discussion into recorded decisions.
We work alongside whatever arrangements you already have. Where you have an internal IT lead, we typically use a shared model: they own operational information and delivery, and we provide independent challenge, board-level reporting and the roadmap. Where a managed service provider runs your IT, we provide the independent view that a provider reporting on its own performance cannot, and we oversee supplier performance and contracts on your behalf.
We also help with the elements that make governance credible: short, practical policies, a recovery testing programme with results reported to the board, a technology roadmap linked to your budget and risk register, and clear evidence for insurers, customers and auditors. Risk ownership stays with your leadership team, where it belongs; our role is to make sure the board has the information and options to exercise it. We do not provide legal advice, and we work alongside your legal and professional advisers where needed.
Want your board to see technology risk clearly?
Talk to us about virtual CIO support for risk registers, board reporting and technology oversight sized for your business.
Talk to a Virtual CIO SpecialistFrequently Asked Questions
What is IT governance for an SME?
The arrangements that let a board set direction for technology, understand and decide on technology risk, check performance and hold people accountable. For most SMEs it comes down to a named sponsor, a risk register, a quarterly report, a few policies, recovery testing and recorded decisions.
Is IT governance a legal requirement for UK SMEs?
There is generally no single law requiring an SME to have a formal IT governance framework, though regulated sectors may have specific requirements. Directors have general duties of care, skill and diligence, and data protection law requires appropriate security and accountability. Take advice from your own legal advisers on your specific position.
What should be in a technology risk register?
For each risk: a plain-language statement of cause, event and consequence; a named business owner; likelihood and impact scores; current controls; a residual rating; the chosen treatment and actions; and a target and review date.
How many risks should the board see?
Usually ten to fifteen on the board register, with the top five or so discussed in each quarterly report. More detailed operational risks can sit in a separate list managed by IT.
What should a quarterly technology report to the board include?
A short summary, top risks and register changes, six to eight consistent security and resilience indicators, incidents and near misses, project and spend status, supplier matters, and specific decisions requested. Keep it to three or four pages.
Who should own technology risks?
Business leaders who can decide to fund, reduce or accept the risk — typically directors or senior managers. IT teams and providers manage controls and deliver actions, but should not be the owners of business risk.
Do we need a separate technology or risk committee?
Most SMEs do not. A standing quarterly technology item on the main board agenda is usually enough. Larger or regulated businesses with significant technology risk may benefit from a committee.
What does a virtual CIO do in governance?
Typically maintains the risk register, prepares and presents board reports, develops the technology roadmap, oversees suppliers and provides independent challenge. A virtual CIO supports the board’s oversight but does not take over business ownership of risk.
Can our managed service provider handle governance?
A provider can contribute valuable information and may offer reporting, but relying on it alone means it reports on its own performance. Many businesses add independent review through an internal lead, a virtual CIO or periodic external assessment.
How does the Cyber Governance Code of Practice apply to SMEs?
The Code is voluntary guidance for boards, aimed mainly at medium and large organisations. Smaller businesses are not expected to follow it formally, but its principles — risk management, strategy, people, incident planning and assurance — are a useful guide to what a board should be overseeing.
How much time does governance take?
For a typical SME, perhaps a day a quarter for whoever prepares the report and updates the register, and thirty to forty-five minutes of board time each quarter, plus a risk workshop and an annual review.
Where should we start?
Nominate a board sponsor and ask three questions in writing: what are our ten most serious technology risks, when did we last restore a critical system in a test, and which suppliers or individuals could stop the business if they disappeared? The answers form the basis of a first register and report.
Related reading
More guidance on running and overseeing UK business IT:
Technology oversight without a governance team
Cloudswitched virtual CIOs give SME boards a clear technology risk register, concise quarterly reporting and independent challenge, with risk ownership staying where it belongs.
Talk to a Virtual CIO Specialist
CloudSwitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
