Scorecard · for UK firms outside construction
Is technology under board control?
For MDs and CEOs of mid-sized UK firms. 22–25 short questions, about 5 minutes. You get your level, your data-chain view, your top three priorities and the questions to take to your board.
In engineering or construction? Take the construction scorecard
What you get
- Your level, from 1 Unmanaged to 5 Board-led, and the profile that best fits your answers.
- Your data chain: where figures are re-keyed between the plan, operations, payments and the board pack.
- Your top three priorities, each with a quick win for the next 30 to 90 days.
- Up to seven questions for your next board meeting.
22–25 questions · About 5 minutes · No sign-up
Your answers are scored in your browser. Nothing you answer is sent to us unless you ask for your result by email or take it to a call or an enquiry.
Step 1 · About your business (not scored)
What is your annual turnover?
Which best describes your business?
Is your business regulated in a way that reaches your systems or data (for example by a sector regulator, or by client or contract requirements)?
Roughly what share of your operations depends on outsourced providers or key suppliers (IT, logistics, manufacturing, services)?
Is any of these coming up in the next 18 months? (tick all that apply)
Step 2 · Ownership and the money chain
Ownership
Who owns technology and AI risk at board level?
Ownership
How often does the board see a report on technology and cyber risk?
Plan to budget
How does your business plan become the technology plan and budget?
Management figures
How current and trusted are the margin and performance figures the board sees each month?
Management figures
How do operational records (orders, jobs, time, stock or cases) reach finance?
Step 3 · Payments and supply chain
Payments
How are supplier invoices matched to orders and deliveries?
Payments
How are payments and changes to supplier bank details approved and checked each month?
Supply chain
How quickly would you know a critical supplier or IT provider was in financial or operational trouble?
Supply chain
Do your IT providers, software and AI tool suppliers and key suppliers have to meet stated cyber requirements?
Step 4 · Resilience and compliance
Cyber
If your main finance or operating system were down for a week, or ransomware hit, how ready are you?
Cyber
Are devices, shared logins and joiners and leavers (including temporary staff and contractors) controlled?
Compliance
Could you produce security evidence (such as Cyber Essentials Plus or ISO 27001) and data-protection documents for a client, insurer or tender within 48 hours?
Step 5 · Data, people and AI
Data
How many systems does a key figure (for example revenue or margin) pass through before it reaches the board pack?
Data
When operational and finance numbers disagree, what happens?
Adoption
Of the main systems you pay for, how many are used as intended?
AI
What is the firm's position on AI tools?
AI
Where is AI doing real work today?
Answer the visible questions to see your result.
Sources
- Across the UK economy, most employees now use AI at work, and many do so without their employer's approval: 71% of UK employees have used unapproved AI tools (Microsoft survey, 2025; vendor), and in a 47-country study almost half admitted using AI against company policy (University of Melbourne/KPMG, 2025). Do you know what your people are putting into AI tools?
- Only 15% of UK businesses check the cyber risk of their immediate suppliers, and just 6% look at the wider supply chain (DSIT, 2026).
- Almost half (48%) of breaches now involve a third party, up from 30% a year earlier (Verizon, global, vendor).
- The NCSC handled 204 nationally significant cyber incidents in the year to August 2025, up from 89 the year before; the most serious category has risen three years running.
- Three in ten UK businesses now use AI, up from under one in ten in 2023 (ONS).