Beyond the Balance Sheet: Five Questions Directors Should Put to the CIO

Most directors did not come up through engineering, yet boards are increasingly held accountable for technology outcomes — from cyber incidents to failed modernization programs. The good news is that effective oversight does not require a technical degree. It requires questions that cut past the presentation and reach the operating reality underneath. Here are five, along with the answers that should raise your hand.

1. "If Our Largest Technology Vendor Stopped Working With Us Tomorrow, What Breaks First — and How Long Would Recovery Take?"

This question surfaces concentration risk and vendor dependency in one stroke. Red flags: vague reassurances about 'strong partnerships,' or an answer that names no specific systems. Dependency that cannot be articulated cannot be managed.

A strong answer names the vendor, the specific processes affected, the contractual protections in place, and a realistic recovery timeline measured in weeks, not hours. Follow-up probe: "When did you last test that assumption?"

2. "What System, If It Failed Today, Would We Not Learn About Until Customers Told Us?"

This is a monitoring question disguised as a hypothetical. It reveals whether the organization detects its own failures. Red flags: confidence that 'everything is instrumented' — no environment is — or deflection to the operations team. A strong answer concedes that blind spots exist, identifies the most likely one, and describes a plan to close it. Follow-up probe: "What did the last post-incident review find that monitoring missed?"

3. "Which Technology Projects Would You Cancel If You Had the Authority and No Political Cost?"

Every portfolio carries initiatives that survive on momentum and sponsorship rather than merit. A CIO who cannot name one is either exceptionally lucky or not being candid. Red flags: 'we review the portfolio continuously' without a single example, or visible discomfort followed by a safe, immaterial answer. A strong answer names a program, explains why it persists — usually sponsorship or sunk-cost dynamics — and states what would need to change. Follow-up probe: "What would you need from this board to make that cancellation possible?"

4. "How Do We Know Our Data Is Correct?"

Boards approve analytics investments, AI pilots, and reporting regimes on the assumption that the underlying data is trustworthy. Often it is not. Red flags: answers that leap straight to platforms and tools, or claims of a 'single source of truth' that no one has audited. A strong answer distinguishes between data that is validated and data that is merely collected, and can describe reconciliation processes for the numbers the board itself relies on. Follow-up probe: "When two of our systems disagree about the same fact, which one wins, and who decided that?"

5. "What Is the Technology Decision You Are Currently Delegating That You Wish You Weren't?"

This question gets at governance gaps from the inside. CIOs routinely inherit decisions — shadow IT, departmental software purchases, AI experiments conducted outside official channels — that they learn about late. Red flags: 'nothing comes to mind' or an answer confined to budget constraints. A strong answer acknowledges the decisions happening beyond IT's visibility and describes how the organization is bringing them into the light. Follow-up probe: "Who else in the company could answer that question differently?"

A Portable Standard

Notice what these questions share: none asks about spending, and none can be answered well with a slide. They are designed to distinguish leaders who know their operating environment from those who know their presentation deck. Directors need not evaluate the technical merits of any answer — only whether the response is specific, tested, and honest about limitations. In technology oversight, specificity is the tell. Vagueness, however polished, is the warning.