Ask most boards about their technology and you'll hear a version of the same three words. "Our technology is fine." It's rarely a careless answer. These are experienced people who understand their businesses and are paying attention. The difficulty is that it answers a different question from the one that matters. When organisations go through serious disruption - a regulatory finding, an operational failure, a security breach, ground lost to a competitor - it almost never begins with technology simply stopping one morning. The warning signs were visible well beforehand. What was missing was anyone connecting what was happening inside the technology environment to what it meant for the business. By the time that connection reaches board level, the problem has become considerably larger. Technology decisions are business decisions. Infrastructure that fails is an operational problem. Architecture that is inefficient carries a financial impact. Gaps in security become regulatory and reputational very quickly. So perhaps the question isn't "is our IT working?" Perhaps it is: who is responsible for connecting what's happening in our technology environment to the risks facing the business? In many organisations, the honest answer to that is complicated. Next week: why the honest answer is usually nobody - and why that isn't anyone's fault. Where does technology risk sit on your board agenda right now?

Most organisations have already tried to address technology risk. They brought in advisors. They commissioned the assessment. The findings were right. And then very little happened. Why is that? Find out next Tuesday.

Your IT team's job is to run the environment. Your vendor's job is to deliver what they sold you. Neither job is to tell your board what all of it means. That gap isn't anyone's failure. It's still a gap. Episode 2 is on our page. Next Tuesday, our CTO looks at what we're actually seeing across enterprise environments in the region; including the risks boards may be underestimating.

Infrastructure that fails is an operational problem. Architecture that's inefficient is a financial one. Gaps in security become regulatory and reputational. The line between "a technology issue" and "a business issue" is one most organisations can no longer afford to draw. From Episode 1 of our series. Episode 2 lands Tuesday.

Speaking with technical teams across the region, there's a pattern that keeps repeating. The people closest to the technology usually know exactly where the gaps are. They've identified them. They've raised them internally. In some cases they've been raising the same issues for years. But those concerns don't always reach the boardroom in a form that leads to action. And that's becoming a much bigger issue. Regulatory pressure across Africa is increasing, and the expectations placed on organisations are changing quickly. At the same time, cyber threats have become far more sophisticated - more targeted, more patient, and increasingly focused on organisations that digitised quickly without developing governance and oversight at the same pace. Boards are beginning to ask much harder questions: If our critical systems fail, how quickly can we actually recover? Are we exposed under new regulatory frameworks? Is our environment genuinely built to scale, or have we been adding to it and patching it together over time? Many organisations are still operating with architectures and oversight models designed for a very different time. Not through carelessness - but because no one has held the formal responsibility to step outside the day-to-day operation and examine the entire structure. And here's what makes it harder still. Most organisations have already tried to address this. They've brought in advisors. Commissioned assessments. They have the reports. And very little actually changes. Episode 3 of 5. Next week: why that happens. Our COO on the execution gap. Which of those three questions would be hardest for your organisation to answer today?

Last week, @Jonathan Tawiah asked who in your organisation is actually accountable for connecting technology to business risk. When we put that question to leadership teams, the answers are remarkably consistent. Some point to the IT lead or the CTO. Others point to a technology vendor or partner. Both are reasonable answers. Neither is the same thing as oversight at board level. Your IT team has a clear responsibility - keep the environment running, manage the technology, support the business. Your vendors have an equally clear one - deliver the solutions and services they've committed to. But there is a gap between them. Neither role is positioned to step outside the day-to-day environment, challenge the wider strategy, identify blind spots at executive level, and connect all of it into one clear picture of business risk. That is a different role entirely. And in many organisations it does not exist in any formal way. Not because leadership doesn't care about technology risk. They do. It's because, historically, the business model was never built that way. Risk doesn't disappear when it's hidden. It just becomes harder to see. Until something happens. Next week our CTO will discuss what's actually happening across African enterprise environments right now - including the risks boards consistently underestimate. In your organisation, who holds this? We'd be interested to hear how others have structured it. Episode 1 in the comments if you're joining midway.