Print
E-MailLee Henderson is the Center for Board Matters Leader, Jamie Smith is the Center for Board Matters Investor Outreach and Corporate Governance Director, and Barton Edgerton is the Center for Board Matters Corporate Governance Research Leader at EY. This post is based on their EY memorandum.
Boards must take decisive action to guide companies in seizing opportunities and mitigating risks.
In brief
- Boards play a critical role in guiding companies through technological changes and strategic challenges.
- Effective technology governance requires continuous alignment between directors and management on risks and strategic goals.
- Having structured conversations on technology oversight can enhance a board’s ability to enable strategic transformation.
To effectively oversee technology, directors need clear, timely information from management and to boost their own tech fluency to drive strategic discussions. Some boards are establishing dedicated tech committees, but is that the right answer for everyone? As with so much else, it depends—on factors such as the company’s needs, board expertise, and committee workloads—and it may evolve over time.
In what follows, we offer guidance to board leaders on determining how to best oversee technology to unlock strategic potential, whether it’s through a tech committee, an advisory group, the audit committee or the full board.
To understand what determines effective technology oversight, the EY Center for Board Matters reviewed S&P 500 tech committee charters and proxy statements and spoke with leading directors and tech executives at Fortune 500 companies. Drawing on this material, we highlight market trends, examine some of the challenges and opportunities around governing technology, and present different approaches boards are successfully using.
Methodology
In the second quarter of 2025, the EY Center for Board Matters reviewed S&P 500 technology committee charters and proxy statements. Companies were chosen for their size, complexity and reputation as early adopters of board operational changes. The review also included in-depth interviews with directors and executives at 18 companies.
How boards are handling technology’s growing impact: a range of governance approaches
The board’s role in overseeing technology has expanded significantly with advances in AI and other technologies, along with their associated risks, product innovations and new business models. Leading boards are realizing that traditional approaches may no longer be effective for overseeing the growing complexities of technology.
Typically, the audit committee handles technology oversight because of its broader role in overseeing risk management. However, these committees already have heavy workloads and adding technology oversight could risk overloading the committee. An audit committee might also focus on technology risks without giving strategic opportunity its due. As boards bring in more tech-savvy directors, they may gain the flexibility to consider new approaches, such as creating a technology committee or subcommittee or an ad hoc committee.
Leading boards are finding success with various approaches — each with advantages and challenges — tailored to the unique circumstances of the company and the board.
Governance approaches to overseeing technology
| Full board oversight | This approach may work at technology companies if it is fully integrated into all relevant items on the board agenda or if all board members have a deep understanding of technology and no separate forum for deeper discussions is needed.
However, some technology company directors suggest that a dedicated technology committee can help the board delve deeper into specific areas, such as competition, emerging technologies, and cybersecurity, without overloading the full board meeting. Conversely, non-technology company boards might opt to make technology oversight a full board issue. For instance, an industrials board dissolved its technology committee and reassigned those responsibilities to the full board, highlighting the strategic importance of technology and the growing interest among all directors in overseeing technological capabilities and protecting intellectual property. |
| Integration with a standing committee | This often works best when tech concerns align with existing agenda items. It also depends on the committee’s bandwidth to add new responsibilities.
An insurance company director noted that while some peers have technology committees, the director’s board chose not to after discussing it during annual evaluations. The board found that existing committees were managing tech oversight responsibilities effectively. For example, the audit and risk committee oversees technology risk, the finance and investment committee oversees digital transformation investments and the corporate development committee oversees technology-related mergers and acquisitions. |
| Standing up a technology committee | Creating a technology committee allows for in-depth discussions between directors and management on tech issues, which is beneficial for boards whose existing committees are already at capacity and where certain directors have relevant expertise and interest. One director at an electric utility company mentioned her board formed a technology committee to dive deeper into industry disruptions. This move helped the company shift from viewing technology as mere infrastructure to seeing it as a strategic differentiator for long-term competitive health.
However, setting up a technology committee can increase the burden of coordinating activities across committees and demand more time and resources. It can also be challenging to unwind once established. One board addressed this by creating a technology committee with a sunset clause, triggering its dissolution after it fulfilled its mandate of overseeing several strategic technology integrations. |
| Other approaches | Subcommittees, ad hoc committees, working groups and advisory boards are structural alternatives that may aid technology oversight. These may also provide temporary support during a specific period of transformation or serve as a test case for a more permanent committee.
As proof of concept, one financial services company’s board started a technology task force consisting of three directors who met monthly with the CIO. After a year, it transitioned into a formal committee to strengthen its authority and address how technology oversight might be perceived by regulators. Another financial services board, seeking a temporary solution during a large transformation, hired external advisors to engage with management and advise the board throughout the project, helping directors understand the risks involved. |
How large-cap boards are responding: two key trends
Based on our review of S&P 500 proxy statements and technology committee charters, two technology governance approaches stand out.
1. Adding a technology committee: one in seven large-cap boards has one
The share of S&P 500 boards with technology committees has nearly doubled, from 7% in 2018 to 13% in 2025. However, the path for each board varies, reflecting sector-, company- and board-specific factors.
Technology committees are most common in financial services companies (22%), followed closely by information technology (20%) and health care (19%) companies.
At S&P 500 companies, technology committees generally oversee risks, strategies and opportunities, but their charters show significant variation in scope, responsibilities and detail.
Different sectors emphasize distinct areas of oversight. Financial sector technology committees often focus on strategy, trends and investment decisions. In contrast, information technology sector committees primarily address cybersecurity, probably because the full board handles technology strategy. Health care technology committees usually concentrate on the adoption and impact of emerging technologies.
2. Expanding existing committee oversight responsibilities
Most S&P 500 companies have expanded the purview of existing committees — usually the audit committee — to include specific aspects of technology oversight, such as cybersecurity and AI governance.
Nearly all companies (92%) cite cybersecurity among their committee oversight responsibilities in proxy statements. In most cases (75%), the audit committee is the primary committee overseeing cybersecurity. This differs from the financial services sector, where 42% of boards assign cybersecurity risk oversight to the risk committee, and in utilities, where a third assign it to a compliance committee.
The share of S&P 500 companies specifically citing AI among committee responsibilities has more than tripled over the past year, rising from 6% to 20%. In most cases, AI oversight matters have been assigned to the audit committee, followed by technology, risk, compliance, nominating and governance, and others such as finance or sustainability.
Selecting the right approach: what to ask and discuss
Decisions on board structure and committee responsibilities are ultimately up to each board, typically led by the nominating and governance committee. These choices significantly impact management time, board calendars, and board and committee composition. Therefore, these decisions require careful consideration. The following board conversations can help facilitate meaningful discussions and guide boards in choosing the most effective approach for them.
Determining the role of technology in advancing company strategy
While technology is often seen as a disrupter, we view it as an enabler that spawns new competitors and business models, and drives changes in regulatory policy, capital flows and workforce realities, all of which can disrupt incumbents. Leading boards frequently discuss how technology is fostering product and business model innovation, reshaping the competitive landscape and introducing threats to existing and future businesses.
Framing questions
-
-
- What role does technology play in the company’s strategy and enterprise risk management? Is it a mission-critical matter? Is it a strategic enabler or differentiator?
- How does the current approach to technology oversight enable the board to serve as strategic partner to management in technology transformation and investment?
- Does the company’s investment in technology require more board oversight? Or is current spending insufficient for competitive growth, potentially needing more board leadership?
-
Securing the expertise needed for effective oversight
Some directors tell us that having a technology expert on the board can elevate the entire board’s understanding and discussion of technical material. However, they emphasize the importance of directors’ speaking the language of business first and question the shelf life of technology expertise gained through executive experience. What we have heard from institutional investors is that adding a technical expert to the board may not be the best approach. Instead, they focus on how boards access external expertise and upskill through ongoing education. Boards make decisions collectively, not individually, and are liable as such. Boards should discuss the knowledge and experience needed for oversight, how to achieve it, and the role of ongoing training and external advisors.
Framing questions
-
-
- What expertise does the board have to oversee the company’s technology strategy and risks? To execute the responsibilities of a stand-alone technology committee?
- Who are the technology experts on the board, and do they facilitate full board competence and discussion? How do they contribute to broader business discussions?
- What is the bandwidth of existing committees? What resources and expertise do they need to meet evolving technology oversight needs?
-
Optimizing and communicating board oversight
Enhancing board oversight of technology involves several tactical considerations. Different committees may focus on different aspects of technology, making coordination essential when executives discuss related topics with multiple committees. Committee charters should clearly delineate specific oversight responsibilities. Some boards use a regularly updated matrix of responsibilities to coordinate, while others find success with alternative strategies to keep committee work clear and aligned. Regular evaluation of these operations is crucial. Boards should also consider how their oversight approach is communicated through proxy statements and other channels. Investors tell us that technology oversight, particularly of AI, is becoming a key focus of their stewardship efforts.
Framing questions
-
-
- How do committee responsibilities related to technology potentially overlap? How is committee work coordinated?
- How do the charters define each committee’s technology-related responsibilities? How are those responsibilities reflected in the calendar and agendas?
- What other external disclosures could clarify the board’s approach to technology oversight for investors and other stakeholders?
- How is the board regularly evaluating the effectiveness of its technology oversight and committee structure?
-
In addition to these discussions, boards may also use the EY Center for Board Matters framework for board effectiveness as a tool for assessing and enhancing the board’s oversight of technology.
Executive insights: what technology leaders want from boards
Technology leaders want boards to engage strategically, clarify risk tolerance and offer oversight without micromanaging. Recent insights from our discussions with chief information officers, chief technology officers, chief development officers and chief information security officers highlighted four consistent expectations for effective board involvement in technology strategy.
1. Develop stronger relationships with technology executives and have more strategic discussion
Boards are looking for more strategic conversations with management, rather than just listening to presentations. Technology executives share this sentiment, wanting to move beyond key performance indicators to discuss critical issues that need attention and investment. Some executives pointed out the limitations of formal board meetings and suggested informal conversations outside of these meetings to better understand perspectives and foster deeper engagement. Others mentioned that creating a board technology committee has provided the necessary space for deeper engagement.
2. Recognize the IT executive as a strategic leader
Technology is the backbone of modern business, and CIOs and CISOs aim to move beyond their traditional roles as technology managers to become strategic leaders. They see their roles evolving like that of the CFO, becoming key players in strategic business decisions. To build a more effective partnership, IT executives are urging boards to shift their mindset and embrace this strategic perspective.
3. Set the technology risk appetite for the company and proactively discuss trade-offs
The board plays a crucial role in setting the company’s risk appetite and guiding executives on balancing risk and reward, both in the short and long term. By engaging in robust discussions on technology-related market disruptions, ethics, trust, capital expenditures and ROI, boards can align with management on the level of risk the company is willing to take to achieve its technology goals. This alignment provides that strategic decisions are made with a clear understanding of the potential sacrifices involved.
4. Maintain oversight without micromanaging
Technology executives worry that appointing a narrowly focused technology expert to the board could lead to micromanagement. While they recognize the benefits of having a tech expert — such as providing valuable feedback on board materials and asking critical questions to guide and challenge management — they stress the importance of these experts maintaining an oversight role rather than overstepping boundaries.
