The Changing Nominating Committee Conversation

Nominating committees spend real effort on the board talent matrix. Which skills are represented, where the gaps are, and what the succession pipeline looks like. For most boards, that matrix covers financial expertise, industry knowledge, regulatory experience, and increasingly ESG and DEI considerations.

Technology risk governance is still an afterthought on most boards’ talent maps.

This is beginning to change. We’re seeing boards that treat technology risk as enterprise risk, not IT oversight, and reframe the director recruitment question. Not "do we have someone who understands technology?" but "do we have someone who can govern technology risk with the same discipline we apply to financial risk?"

The distinction matters. The first question can be satisfied by a director who once ran a software company or sits on a technology advisory board. The second requires someone who has governed at the board level through the complexity of cyber resilience, AI exposure, legacy modernization, and third-party concentration risk.

Boards that make this shift don’t necessarily add a new committee. They add a governance expectation: that technology risk receives structured, evidence-based, cadenced oversight and that someone in the room is equipped to anchor the conversation with the management.

For nominating committees, the practical step is adding a technology risk governance criterion to the talent matrix and evaluating candidates against it with the same specificity applied to financial or legal expertise. Drawing on my own experience in both technology leadership and board governance, I’d argue this criterion is as consequential as any other on the matrix right now.

Most boards aren’t there yet, but the ones moving in that direction are better positioned for what’s already a business reality.