IT Governance for Small Business: Who Decides What, with a Decision-Rights Table

IT governance for a small business means deciding ahead of time who makes each kind of technology decision, who has to be consulted, and how those decisions get reviewed. Write it down as a one-page decision-rights table, so software purchases, security risks and vendor choices stop defaulting to whoever happens to be closest.

It’s not bureaucracy. Done right, governance makes decisions faster, because everyone knows whose call it is.

What IT governance is, and what it isn’t

Governance is the set of agreements about how technology decisions get made: who decides, who recommends, who needs to know, and how often you check the results. It answers questions like “Who can buy new software?” and “Who decides whether we accept a security risk?”

It isn’t the day-to-day work of running technology. Your internal IT team or MSP still manages devices, users and systems. Governance gives them clear direction and a clear person to go to when a decision is needed.

This isn’t a big-company idea scaled down. The NIST Cybersecurity Framework 2.0 puts Govern at the center of its six functions and includes roles, responsibilities and authorities as part of it. The same principle applies to technology decisions in general.

Signs your business needs it

• Software shows up on company cards and nobody knows who approved it.
• Two departments pay for different tools that do the same thing.
• Your IT provider’s recommendations wait weeks for an answer.
• Employees are using AI tools, and nobody has said which ones or with what data.
• When a vendor misses a commitment, nobody is sure who should hold them to it.
• A client asks who’s responsible for security, and the answer is “well, it depends.”

If several of these sound familiar, our technology ownership self-check takes about five minutes.

The decision-rights table

Here’s a starting template. The roles are generic; replace them with names. Each row has exactly one person who decides.

Decision	Decides	Recommends	Consulted	Informed	Reviewed
Annual technology budget and priorities	Owner or CEO	Technology lead	Finance, department heads	All staff (summary)	Quarterly
New software or SaaS purchases	Technology lead	Requesting department head	Finance, IT provider	Users affected	Quarterly
Which AI tools are approved, and with what data	Technology lead	Department heads	IT provider, legal advisor when needed	All staff	Quarterly
Vendor selection and contract renewals	Owner or CEO for major contracts; technology lead for the rest	Technology lead	Finance, users	IT provider	At each renewal
Accepting a security risk or granting an exception	Owner or CEO	Technology or security lead	IT provider	Affected department	Every six months
Who gets access to sensitive data and systems	Data owner (department head)	Technology lead	IT provider	HR	Quarterly access review
Major projects and changes	Owner or CEO	Technology lead	Department heads, IT provider	All staff	Monthly during the project
Recovery priorities if systems go down	Owner or CEO	Technology lead	Department heads, IT provider	All staff	Yearly, plus after any incident

Notice what the IT provider does in this table: it recommends and implements, with a seat at the table on every technology decision. That’s not a lesser role. It’s the right one. Business decisions, like accepting risk or choosing a major vendor, belong with the business.

How to set it up in two weeks

1. List your recurring decisions. Start with the eight rows above and add any that are specific to your business.
2. Assign one decider per row. If two people both think it’s their call, settle it now, not during a crisis.
3. Set spending thresholds. Decide the dollar amount above which a purchase moves from the technology lead to the owner. Pick a number that fits your business and write it in the table.
4. Share it. Give the table to department heads and your IT provider, and make it easy to find.
5. Put the reviews on the calendar. A monthly 30-minute technology check-in and a quarterly review of the roadmap and budget are enough for most small businesses.

Keep it light

Small-business governance should fit on one page and take a few hours a month. If it’s generating more meetings than decisions, cut it back. The goal is clarity, not paperwork. Review the table itself once a year, or whenever the business changes shape: a new location, an acquisition, a new line of work or a new regulated client.

How governance fits our framework

At Balancelogic®, governance is one of the three disciplines in The Balancelogic MTP Framework™, alongside Leadership and Modernization. Its job is to keep every technology decision, risk and dollar accountable to the business. In practice that means vendor management, IT project leadership, security and risk decisions, security program development and business continuity planning. Read more about how the model works on our What Is an MTP? page.

Balancelogic works alongside your internal IT team and your MSP; they keep doing the work, and the decisions get a clear owner.

Balancelogic partners with our sister company ITAssurance℠ when ongoing managed IT, cybersecurity, and operational support are needed.

When you’re ready to put a decision-rights table in place, book a free IT Strategy Session.

Frequently asked questions

Our work supports your compliance program. It doesn’t guarantee compliance, certification or audit results.