independent director in information technology: govern promises made in code and contracts

An independent director in information technology should distinguish bookings, contracted value, backlog and revenue before using any of them as proof of durable growth. A multi-year deal may contain termination rights, consumption variability, milestones, acceptance or transformation costs that change economics. The board should understand which obligations are delivered over time, which depend on customer sign-off and where estimates or variable consideration matter under the applicable accounting policy. Concentration by ultimate customer, product and renewal period is more revealing than a large unqualified pipeline.

SaaS and services models need different operating bridges. Subscription growth should reconcile new customers, expansion, contraction, churn and price, while services revenue should connect utilisation, rate, subcontracting, scope change and unbilled work. Capitalised development and implementation cost can shift expenditure across periods without improving cash. Directors should ask whether a weak margin reflects a deliberate investment, an underpriced contract or delivery failure. Audit and finance specialists own accounting application; the board ensures commercial reporting describes the same obligations recognised in the financial statements.

High utilisation can support margin and simultaneously remove capacity for training, quality recovery and unplanned customer demand. Directors should see critical skills, attrition, subcontractor reliance, bench composition and location concentration alongside the average. A project can be fully staffed yet fragile if one architect or customer-domain lead holds undocumented knowledge. Major programmes deserve milestone, acceptance, defect, change-request and customer-escalation evidence. The board should not manage sprint plans; it should understand whether delivery risk threatens cash, liability, renewal or reputation. Customer dependency on named specialists should be tested before those people become a hidden condition of renewal.

People measures need cohort detail. Voluntary attrition among scarce security or platform engineers differs from graduate movement, and a stable company rate can hide losses in one account. Incentives may reward billability while discouraging reuse, documentation or escalation of an unsafe deadline. Ask how capability is built before sales commit to it and whether subcontractor access and quality meet customer obligations. Succession for client partners and technical leaders should be visible where revenue depends on personal trust. The NRC can then connect reward and retention with the delivery model the strategy requires.

Technology providers often process customer data or operate systems whose failure harms another business. Security therefore sits inside product promise, contract liability and renewal, not only internal IT. Directors should know the critical services and data, privileged identities, secure-development gates, vulnerability handling, customer notification terms and tested recovery. Certifications cover a defined scope and date; acquired products, subcontractors or development environments may sit outside them. Board reporting should show material exclusions, overdue high-consequence fixes and whether customer commitments match actual control capability.

Privacy requires a use-case map. Customer instructions, the provider’s own analytics, employee monitoring and product telemetry can create different roles and purposes. Data location, retention, deletion, model training and cross-border access should follow contract and applicable law. A vendor cannot promise deletion if backups or derived datasets make it impossible. Incident exercises should include customer facts, forensic preservation, privilege, contractual deadlines and service reconciliation. Specialists run response; the board ensures one credible account of impact and correction reaches affected customers and any authority entitled to it.

AI governance should begin with the decision or content the system affects. Training and evaluation data, licences, customer confidentiality, performance by relevant group, human review, override and monitoring differ for coding assistance, fraud scoring and clinical support. A model demonstration does not show reliability in production data or adversarial use. The board should require higher evidence where error affects rights, safety or money, while avoiding a universal approval committee for trivial experimentation. Product leaders remain accountable for use-case design and the limitations communicated to customers.

Intellectual-property risk reaches beyond patents. Open-source obligations, employee and contractor assignment, third-party libraries, customer-developed material and generated code can affect ownership and distribution rights. Acquisition diligence should identify code and licence debt before the product is integrated. Directors do not review repositories, but they should ask how components are inventoried, how exceptions are approved and whether a customer indemnity exceeds the company’s ability to control the underlying risk. Qualified IP and technology counsel should interpret the actual licences, contracts and jurisdictions.

Currency, immigration, tax, export controls and geopolitical restrictions can change who may access data, where staff can work and whether a contract remains profitable. The board should see revenue and delivery concentration by ultimate customer and jurisdiction, including dependence on one cloud region, partner or visa route. Hedging can address currency movement but not customer budget cuts or access restrictions. A location strategy should consider talent, continuity, customer commitments and legal permissions rather than labour cost alone. Contract portability, substitute staffing and customer consent determine whether a planned transfer can occur during disruption.

Before joining, review contract liability, revenue recognition, customer concentration, major delivery disputes, cyber incidents, privacy commitments, IP ownership, AI use, talent concentration, acquisitions and D&O cover. Meet delivery, security, finance and legal leaders and test whether adverse customer information reaches the board. Confirm Section 149(6), DIN, databank, committee role and capacity. This material is general governance information, not accounting, cyber, privacy, export-control or IP advice for a specific company; current specialists should assess the relevant contract and jurisdiction.