Technology Risk Is Now a Board Responsibility

By Jabulani Chibaya

VICTORIA FALLS – The Internal Control Institute of Zimbabwe delivered far more than I expected.

Victoria Falls gave us temperatures above 35 degrees. The breeze off the mighty Zambezi gave us relief. A wildfire reminded us that risk arrives uninvited. And for a few days, the noise of busy city life gave way to something rarer: uninterrupted conversation about how institutions stay in control when technology sits at the centre of everything they do.

I went to the 12th Internal Control Congress for Africa to facilitate. I came home having learnt as much as I shared. The theme was “Building Resilient IT Control Environments for Effective Risk Governance, Cybersecurity, Data Protection and Digital Transformation.”

Looking back, it was less a title than a diagnosis.

One room, one theme
What do a Central Bank, Social Security, a Building Society, a Commercial Bank, a university professional, a Rural District Council, an aviation handling company, and a dam and road construction company have in common?
On paper, very little. Their regulators differ. Their customers differ. A runway, a pension payment, a mortgage and a stretch of tarred road have almost nothing in common.

Yet they all sat in the same room, listening to the same conversation, because they share the same exposure. Each one runs on systems. Each one holds data that belongs to someone else. Each one depends on suppliers it does not fully control. And each one answers to a board, a regulator or a public that expects the lights to stay on.

Sector is no longer the main variable in risk. Dependence on technology is.
That was my first lesson from Victoria Falls. When a ransomware crew, a fraudster or a careless click arrives, it does not check the logo on the building first.

What we covered

The congress ran under the banner of IT General Controls, and it was thorough. Over the days we moved from IT governance and digital leadership to logical access, segregation of duties and privileged access management. We covered change management, IT operations, backup and disaster recovery, data protection and third-party technology risk. Fellow facilitators walked delegates through COBIT 2019, ISO/IEC 27001, COSO, the NIST Cybersecurity Framework and ISO 31000.

My own sessions sat at the governance end of that spectrum. On the first day I spoke on IT governance and digital leadership: board oversight of technology, alignment of IT strategy with business strategy, and the governance of AI and emerging technologies within digital transformation. On the second day I took delegates through cybersecurity governance, including zero trust architecture, security operations centres, threat intelligence, incident response and ransomware preparedness. I then moved to AI governance: responsible AI, AI risk management, ethics, security controls and compliance.

I was glad to share the first day with Simbai Nyamayauta. We held the fort together, and his sessions on IT general controls and on IT audit and continuous assurance set a standard the rest of the congress built on.

The human element

Fraud and compromise run in cycles. Someone studies the target. They look for the weakest point. They get in, stay quiet, take what they came for, and then look for the next door. We walked through that cycle using global and local case studies. I will not name institutions here, but I will say this: the local cases felt uncomfortably familiar to everyone in the room.

In almost every case, the weakest point was a person. Not a firewall. Not an algorithm. A person who was rushed, who trusted the wrong email, who shared a password, or who held more access than the job required. Business email compromise and insider threat were on the agenda for good reason. Both succeed by exploiting the oldest vulnerability we have, which is trust.

Here is the uncomfortable part. Most institutions spend heavily on technology and lightly on the human beings who use it. Tools can be bought. Awareness has to be built. It takes repetition, leadership by example, and a culture where an employee can say “this looks wrong” without fear of becoming the problem. A control that people do not understand is a control that people will route around.

Trade-offs, not risks

The most useful insight of the week came from listening rather than speaking. The biggest challenge is not the risks themselves. It is the trade-offs.

Every leader in that room is pulled in several directions at once. Change management wants speed. Efficiency wants fewer steps. Cost optimisation wants a smaller budget. Customers want convenience and availability around the clock. Then cybersecurity and AI governance arrive and ask for friction: another approval, another test, another review, another layer of access control.

The hard question was how much of one good thing to give up for another. Do you delay a release for one more round of testing? Do you grant emergency access to keep a critical system available, and who reviews it afterwards? Do you adopt an AI tool that promises efficiency before you know where your data goes?

Hayek taught that knowledge is dispersed, and that no central planner can see all of it. A control environment works the same way. The person who first sees the risk is rarely the person who owns the budget to address it. Good governance is largely the discipline of bringing those two people into one conversation, early, before the trade-off is made by default.

Technology is not parallel to strategy
For too long, many institutions have treated technology as an enabler: a supporting function that sits beside the business and keeps things running. The congress left me in no doubt that this view has expired.

Technology is part of who we are. It is the channel through which customers meet us, the record of what we owe and are owed, and the engine behind our operations. It sits inside strategy and operations, not parallel to them. When a bank’s systems go down, the bank is down. When a payment platform is compromised, the promise made to customers is broken, whatever the strategy document says.

This is why a board cannot delegate its way out. Oversight of technology is not a technical task. It is a duty of care. Directors do not need to configure a firewall. They do need to ask who is accountable for cyber risk, how the institution would know it had been breached, how fast it could recover, and what the AI tools in use are doing with the institution’s data.
AI sharpens the point. Artificial intelligence is already inside many organisations, sometimes approved, sometimes quietly adopted by staff. Governing it means asking about ethics, security, compliance and accountability before deployment, not after the first incident. Responsible AI is not a brake on innovation. It is what allows innovation to last.

Outsourcing does not outsource accountability
One principle surfaced again and again, across sessions on third-party technology risk, cloud controls and ICT contracts: outsourcing does not absolve you of accountability and reliability.
You can outsource a service. You can outsource infrastructure, hosting, support and development. You cannot outsource the consequences. When a vendor fails, the customer does not call the vendor. They call you.

That means due diligence before the contract, clear security and recovery obligations inside it, and continuous assurance after it is signed. It means knowing which of your critical processes sit in someone else’s cloud, and testing whether their recovery plan matches your tolerance for downtime. A signature on a service-level agreement is the start of oversight, not the end of it.

Government is not spared

Two speeches stayed with me. The Board Chair of ICIZ, Mr Danisa Chinamasa, opened the second day by laying out the risks we currently face. The room needed that honesty, because a risk we refuse to name is a risk we cannot control.

Then the Auditor General, Mrs Vimbai Chikwenhere, officially opened the congress as Guest of Honour. She showed that government is also going through digital transformation, and that it is not spared some of the risks and issues the private sector faces. That matters. Public bodies hold citizens’ data, run essential services and move public money. When their systems are weak, the cost is carried by people who never had a choice about using them. Digital transformation in the public sector is not only a technology project. It is a public trust project.

Data protection and cybersecurity

We also explored data protection and cybersecurity in depth. A backup is not a recovery until the recovery has been tested. A disaster recovery plan that has never been exercised is a hope, not a plan. Data you have not classified is data you cannot protect. Data you keep longer than you need is a liability waiting for a breach. And when a breach does come, the quality of the response often matters more than the breach itself: how quickly you detect it, who you tell, and what you say.

Cross-border data transfers deserve particular attention from African institutions that rely on cloud services hosted elsewhere. Knowing where your data lives, and under whose law, is now a basic governance question.

What I am taking home

Trade-offs are the real test. Make them deliberately, with the right people in the room.
Technology belongs inside strategy. Not beside it, and not beneath it.
Outsourcing moves the work. It never moves the accountability.

People are the most vulnerable control. They can also be the strongest one.
No sector is exempt. Government included.
I learnt a great deal, and I am grateful to the ICIZ board, my fellow facilitators and the delegates for the conversations, inside the sessions and beyond them. Thank you, ICIZ, for the invitation and the hospitality.

Governance is a leadership decision before it is a technical one. Cybersecurity and AI governance are no longer IT topics. They are board topics. So here is the question I am leaving with you: if your board still treats technology as an IT department matter, which risk are you carrying without knowing it?

Jabulani Simplisio Chibaya is a Data and AI Consultant specializing in data science, artificial intelligence, blockchain, and cryptocurrency innovation. A seasoned conference speaker, he also writes on the intersection of technology, regulation, and economic development. Contact: Cell: +263 778 921 881 | Email: simplisiochibaya22@gmail.com | LinkedIn: https://www.linkedin.com/in/jabulani-simplisio-chibaya