Finance leaders end up closer to technology risk than almost anyone else in the building — you sign the cyber insurance application, approve the IT spend, own the payment controls, and answer for the losses when something goes wrong. You don’t need to speak fluent IT to manage any of that. You need the finance view of five topics, and the discipline to ask for numbers instead of assurances.

1. Total technology cost, in one place

Most companies’ technology spend is scattered across support fees, software subscriptions, internet and phones, hardware purchases, and the occasional surprise project. Pull it into one schedule with four buckets — recurring services, licenses, projects, and lifecycle replacement — and two things usually happen: you find subscriptions nobody’s used since 2023, and you discover the hardware bucket has been quietly running on borrowed time.

That last one matters. Computers and servers age on a schedule, which means replacement is a forecastable expense, not an emergency. A simple three-year replacement forecast turns IT capital spending from a fire drill into a line item. (Building the budget · lifecycle planning)

While you’re in there: separate what you’re paying to prevent problems from what you’re paying to react to them. A bill that’s all reaction is usually the expensive kind, even when it looks cheap. (The hidden cost of reactive IT.)

2. Payment fraud — your control, not IT’s

The costliest attack on businesses your size isn’t ransomware. It’s an email — apparently from the CEO, a vendor, or a title company — asking someone on your team to send money or change banking details. No malware, no hacking; just persuasion aimed at the person with payment authority. (How these attacks work.)

The defense is a finance control, and it belongs to you:

  • Any change to payment details is verified by phone, at a number already on file. Never a number from the email requesting the change.
  • Dual approval on wires and ACH changes above a threshold you set.
  • No urgency exceptions. The pressure to skip verification is the attack. Make it policy that the person who slows down to double-check is doing it right — especially when the email came from you.

Write these down, train them, and test them the way you’d test any control. Auditors have started asking; so have insurers.

3. Cyber insurance: treat the application like a rep letter

The application asks pointed questions — MFA on email and remote access, endpoint detection, tested and separated backups. Answering “yes” beyond reality isn’t optimistic paperwork; it’s grounds for a denied claim, and carriers have won those disputes. Before renewal:

  • Re-answer last year’s application honestly and turn every soft “yes” into a work item
  • Collect evidence as you go — enforcement screenshots, backup test logs — the same way you’d support any attestation
  • Check the social engineering sublimit. The fraud losses in section 2 are often capped at a fraction of the headline policy limit, which is a nasty thing to learn during a claim

(Full renewal prep guide.)

4. Downtime, quantified

“We can’t be down” isn’t a number. Cost out a day of downtime — idle payroll, lost billings or orders, recovery labor, and the softer cost of clients who notice — and you get the figure that makes recovery decisions rational. Whether faster backup infrastructure is worth it stops being an IT debate and becomes a comparison between two numbers. (The calculation, step by step.)

Then ask IT for their two numbers: how much data we’d lose (recovery point) and how long we’d be down (recovery time) — and check they’re consistent with yours. Misalignment here is the most expensive assumption in the building. (RTO and RPO explained.)

5. What to ask for each quarter

You don’t need dashboards; you need a habit. Quarterly, in writing:

  1. Backup restore tests: date of last successful test, and any failures since
  2. MFA coverage: any accounts without it, and why
  3. Departed employees: confirmation access was cut, with dates
  4. Aging report for hardware and software — what’s out of support in the next 12 months
  5. Incidents and near-misses, in plain English
  6. Spend vs. the technology budget, with variances explained

Any provider or internal team worth their fee can produce this without drama. Ours builds it into the quarterly business review; however you get it, get it in writing. Controls you can’t evidence are hopes with better formatting.

The bottom line

Treat technology the way you treat any other material risk: one cost schedule, real controls on money movement, an insurance application you could defend, a downtime number instead of a downtime feeling, and quarterly evidence. That’s the whole finance-side job — and it’s the difference between IT as a black box and IT as a managed line item.