Financial services directors: are you accountable for IT you can’t prove?

Author: Bruce Penson | Managing Director

In hundreds of conversations with directors, COOs and operations leads at investment firms, wealth managers, asset managers and funding businesses, one tension comes up again and again. The regulator holds senior people accountable for systems that nobody at the top has time to run.

In a firm of 10 to 80 people, IT often sits with the COO alongside compliance and finance. Sometimes it’s a long-standing provider, or a friend of the founder who set it all up years ago. It works, until someone asks you to prove it does: an investor’s due diligence questionnaire, a network’s certification requirement, or the regulator after an incident.

That’s why we wrote IT, cyber security and AI in SME financial services firms 2026.

Why it matters now

The bar for evidence is rising fast. From March 2027, the FCA’s new rules require almost all regulated firms to report operational incidents that meet set thresholds, and firms in scope must keep a register of material third parties such as IT and cloud providers. Firms with EU business also need to know where DORA applies.

At the same time, AI is moving faster than the policies meant to control it. The FCA has chosen not to write new AI rules, which means the Consumer Duty and the Senior Managers and Certification Regime already apply to how your staff use AI today.

What the report answers

The report combines IT Maturity Scorecard results with what we heard in our conversations, set against guidance from the FCA, the ICO and the NCSC, with a section on DORA. It’s built around the questions boards actually ask us:

• How does our firm compare with others our size?
• What do we need in place before March 2027?
• Who decides whether an incident gets reported to the FCA, the ICO and clients?
• How do we answer an investor or the regulator who asks how AI is governed?
• What are the best-run firms doing that we aren’t?

One finding stood out. Talking about IT at board level isn’t the same as having a plan, and most firms that discuss it at the board still have nothing written down.

Who it’s for

The report is written for directors and senior management at financial services firms of 10 to 80 people. It’s practical rather than technical, and it ends with ten actions to take to your next board meeting.

Download the free report: IT, cyber security and AI in SME financial services firms 2026.

Want to know how your own firm measures up?

Our free IT benchmarking assessment takes just five minutes, and you’ll get your personalised results instantly.

Take the free IT benchmarking assessment