The Governance Gap: Audit vs. Tech

The Governance Gap--Audit vs. Tech

February 20, 2026

Dear Friends of Trewstar:

If your board treats the broad range of technology issues as optional—without the structure, standards, and recency of expertise you demand from the finance and operations sides of the business—you’ve already made a risky decision. Is that what you intended?

Audit oversight across the Fortune 500 is uniform and rigorous. 100% of publicly traded companies in the Fortune 500 have audit committees, and 91% of their chairs are deemed “financial experts” under SEC and NYSE/Nasdaq rules, formally approved by their boards. In practice, that typically means retired Big Four audit partners or current/former public company CFOs/CEOs. The standard is exacting—and it’s respected by fellow directors, management, and, most importantly, shareholders.

Across these audit committees, there are 1,884 directors—many also meeting “financial expert” criteria and positioned as credible successors to the chair. 

In total contrast…

Only 74 Fortune 500 companies have a board level committee with “Technology” in the title (e.g., Technology; Technology & Sustainability; Technology & Information Security; Technology & Cybersecurity; Science & Technology; Science, Technology & Quality; Risk and Technology; Operations and Technology; Finance and Technology, etc.).

Those 74 committees have 342 directors as members.

Of those 74 committees, there are only 9 members who would meet a rigorous “expert” standard—if one existed—i.e., true technology C‑suite operators (CIOs, CTOs, CISOs, etc.) who have spent careers building and governing complex systems and are currently serving or recently retired. Recency of experience is a complicated question because another 41 executives on technology committees have comparable backgrounds, albeit less recently retired. One could argue that those executives, while not on the front lines of technology issues today, certainly have the capacity to stay current and understand today’s board level issues. And finally, because some exposure beats none, we also note that there are 103 technology committee members who have experience in non‑tech C‑suite roles at technology companies.

At best, that yields 153 of 342 members who might be deemed qualified. In other words, over half are not. Would any board accept a world in which more than half of an audit committee’s members were unqualified?

What about the remaining Fortune 500 companies with no technology committee? We often hear “technology is so important it goes to the full board.” Perhaps. But an equally plausible explanation is that there aren’t enough qualified directors to staff and chair a technology committee to a defensible standard.

{Note: Our analysis relies solely on publicly disclosed committee structures and director biographies. We intentionally excluded self‑reported “skills matrices,” which are widely understood to overstate expertise and are not comparable across companies.}

The stark comparison between financial oversight which is structured, standardized, and taken seriously versus technology oversight which is random and inconsistent—or non-existent is striking. In an era when technology rivals finance in its ability to create—or destroy—value, that imbalance raises major issues around a board’s ability to exercise its duty of care.

While contemplating these thorny questions, most of us are self‑educating. I recommend AMD CEO Dr. Lisa Su’s CES 2026 keynote speech - you'll find it on YouTube. It’s long, but worth it—start around minute 8:40 and maybe watch in chunks. 

Just for fun, here are some terms I have recently learned that highlight how far the vocabulary of modern technology has drifted from familiar boardroom lingo: 

• Tokenization—breaking text into the units large AI models process, roughly ¾ of a word, which drives context limits and cost (why only ¾ of a word?)

• Rack‑scale systems—designing at the rack level (think compact car size), not single servers

• Edge computing—pushing certain compute requirements back near the data and users (really, after a decade of “move everything to the cloud?”)

• Data warehouse (structured clean data) vs data lake (raw, unstructured data storage)

• My personal favorites—zettaflops, yottaflops, exaflops—measures of compute throughput (not footwear)

Some will argue directors don’t need to know the jargon. But without a shared understanding of these working concepts, it’s hard to judge what is and isn’t a board level concern.

Surely some combination from this list requires the board's attention: security writ large (hardware, software, vendors, incident readiness), cloud vs. on prem architectures, data readiness, remote work footprints, opportunities for cost reduction and/or product innovations and the fit‑for‑purpose of your technology leadership itself.

Yes, every company is different, but bottom line: This isn’t just “about AI.” It’s about the entire technology platform of the company.

We are developing a variety of solutions for this governance gap which we would be pleased to discuss with you. In the meantime, share your thoughts and experiences with us!

Beth Stewart & The Trewstar Team
bstewart@trewstar.com