IT Director vs CIO: The Difference

An IT Director keeps the technology working. A CIO decides what the business should be doing with it. Both are legitimate and necessary; they are not the same job, and the businesses that struggle are usually those that appointed one while needing the other. Where IT needs leadership at short notice, an interim IT Director can step in.

The confusion is understandable, because in a great many UK mid-market businesses one person does both and the title chosen reflects preference rather than scope. This article sets out where the line actually falls, when a business should move from one to the other, how both differ from a CTO, and what the current governance expectations on cyber and operational resilience mean for whichever role you appoint.

What each role owns

The IT Director owns the estate the business runs on. Networks, servers or cloud infrastructure, end-user devices, core applications, the service desk, licensing, vendor management and security operations. Accountability is for availability, performance, cost and risk — the systems work, they are protected, and they cost what they were budgeted to cost.

The CIO owns the relationship between technology and the business strategy. Which capabilities to build or buy, where technology creates commercial advantage rather than merely enabling operations, how data is used, and what the technology estate should look like in three years rather than what it looks like now. The IT estate typically sits beneath them.

Put plainly: an IT Director is judged on whether things break. A CIO is judged on whether the business is doing the right things with technology, which is a considerably harder thing to measure and a considerably easier thing to get wrong.

The distinction also shows in how each spends a week. A good IT Director’s diary is full of supplier reviews, change advisory meetings, service performance, security patching cycles and the occasional incident. A good CIO’s diary is full of executive team meetings, business unit leaders, investment committees and conversations about what the operating model will need in two years. Both diaries are busy. Only one of them is mostly spent with people outside the technology function.

Side-by-side comparison

The table describes the clean version. In practice the boundaries move with the size of the business. In a company with a single technology leader, that person will cover both columns to some degree, and the question is which column carries the weight. If most of the value they add comes from keeping a complex estate stable and secure, you need an experienced IT Director, whatever the title. If most of it comes from shaping investment and changing how the business operates, you need a CIO.

Where the CTO fits

A third title that overlaps both and confuses many briefs. The clean distinction is inward versus outward.

A CTO owns the technology the business builds and sells — the product. A CIO owns the technology the business runs on — the enterprise estate. In a software company both exist and are quite separate roles. In a manufacturer, a retailer or a professional services firm there is usually no product technology at all, and what the business calls a CTO is functionally a CIO.

The practical test when writing a brief: does your technology generate revenue directly, or enable the business to generate it? Product means CTO. Enablement means CIO or IT Director. Getting this wrong attracts an entirely different candidate pool from the one you need.

Where a business is unsure which of the three it needs, it is worth talking the brief through before the role is advertised. Our technology and digital leadership recruitment work starts with that question, because a CTO search run for what is really an IT Director requirement will produce impressive candidates who leave within a year.

When to move from one to the other

Most businesses appoint an IT Director first and consider a CIO later. Four signals suggest the move is due.

Technology decisions are being made by people who cannot evaluate them. When a Finance Director is approving a platform choice because nobody senior enough owns technology strategy, the business is carrying a risk it cannot see.

Data has become an asset rather than a byproduct. Once the business wants to use its data commercially — pricing, customer insight, automation — that requires strategic ownership rather than operational maintenance.

The board is asking questions the IT function cannot answer. Cyber exposure, AI adoption, the case for a major system replacement. These need translating into commercial terms, and that is a different capability from running an estate well.

A significant transformation is coming. An ERP replacement, a post-acquisition integration or a shift in operating model. Programmes of that size need someone who can hold the business case, not just deliver the technology — and in some cases a dedicated transformation lead alongside.

The reverse move happens too. A business that appointed a CIO during a growth phase may find, once the transformation is delivered, that what it now needs is steady operational management. Keeping a strategist in a role that has become an operations job is expensive and usually frustrating for both sides. Being honest about which phase the business is in is the single most useful thing a board can do before briefing a search.

A common pattern we see is a capable IT Director who has been asked, gradually and without anyone deciding to, to act as a CIO. Nobody changed the title or the reporting line, but they are now expected to make investment cases to a board they rarely sit with. Sometimes that person makes the step and should be promoted properly, with the title, reporting line and executive seat that go with it. Often they are excellent at the job they were hired for and uncomfortable in the one they have drifted into. Either way it is worth naming, because the alternative is significant technology decisions with nobody genuinely accountable for them.

Assessment: separating the two at interview

Candidates frequently present for both, and CVs at this level are written to keep options open. Four questions separate them.

“Describe an investment case you took to a board. What did they push back on?” — the CIO question. Look for commercial framing and evidence they have been challenged and held their position.

“Talk me through your last major incident. What changed afterwards?” — the IT Director question. Detail here is hard to invent, and the change afterwards distinguishes people who learned from people who recovered.

“What did you decommission?” — revealing for both. Estates accumulate. Someone who has never retired a system has been adding rather than managing.

“Explain a technology risk to me as though I were a non-technical director.” — decisive for a CIO. If technical exposure cannot be translated into commercial consequence, the board will never fund the fix. Professional standards for technology leadership are published by BCS, The Chartered Institute for IT.

Beyond the questions, look at the evidence the candidate brings. An IT Director should be able to talk precisely about service levels, supplier contracts, budgets they have held and the security controls they introduced. A CIO should be able to show a strategy document or investment paper they wrote, explain how it was received, and say what the business did differently as a result. References matter more than usual here: speak to the CEO or CFO the candidate worked for, not only to their technology peers, and ask whether the board trusted their judgement on spend.

If you are recruiting for the operational role, our IT Director recruitment process builds these questions into the shortlist assessment, so the interview panel sees candidates who have already been tested against the scope you actually need.

Two things that apply to both

Data protection accountability. Whichever title is used, someone must own the organisation’s data protection posture, and the board should know who. The Information Commissioner’s Office sets the expectations, and a technology leader who treats this as a legal department matter is leaving a gap.

Statutory status. Many people carrying “Director” in a technology job title are not registered company directors. Where the appointee is formally appointed and filed, they carry statutory duties including the obligation at section 172 of the Companies Act 2006 and personal exposure. Confirm the position at appointment.

Cyber and resilience: what the board now expects

Cyber risk has moved firmly onto the board agenda, and that changes what boards should expect from their senior technology leader. In April 2025 the government published the Cyber Governance Code of Practice, developed with the National Cyber Security Centre. It is aimed at boards and directors of medium and large organisations, and it sets out what directors themselves should do to govern cyber risk under five headings: risk management; strategy; people; incident planning, response and recovery; and assurance and oversight.

The code is directed at the board, not at the technology team, but it has a direct bearing on the IT Director versus CIO decision. A board trying to meet those expectations needs someone who can explain cyber risk in business terms, propose a proportionate strategy and report on it in a way directors can challenge. That is closer to the CIO profile. An IT Director can do it well, but only if the reporting line and board access are there to support it.

For FCA-regulated firms there is an additional layer. Under the FCA’s operational resilience rules, firms were required by 31 March 2025 to be able to remain within impact tolerances for their important business services in severe but plausible scenarios. That involves mapping the people, processes, technology and third parties behind each service, and testing that the business can recover in time. The technology leader is central to all of it, and in a regulated firm the brief for an IT Director or CIO should say so explicitly.

Larger or more exposed businesses often separate security leadership from both roles. Where cyber risk is material enough to need its own accountable executive, CISO recruitment may sit alongside the IT Director or CIO appointment rather than being folded into it. The key point is that someone below board level owns the detail, and someone at board level can explain it.

Interim, part-time and fractional options

Not every business needs a full-time permanent technology leader on day one. Three alternatives are worth considering, and each fits a different situation.

• Part-time IT Director. A smaller business whose estate is too important to leave to a service provider, but not large enough to justify a full-time director, can engage an experienced part-time IT Director for a set number of days a month. They provide oversight of suppliers, security and spend without the cost of a permanent senior hire.
• Interim CIO. Where a transformation programme, an acquisition or the sudden departure of a technology leader leaves a gap, an interim CIO can step in full-time for a defined period, hold the strategy steady and often help shape the brief for the permanent appointment.
• Fractional CIO. A growing business that needs strategic technology input but already has a capable IT Manager or IT Director running operations can add a fractional CIO for a day or two a week. This is often the most cost-effective way to test whether a full-time CIO is needed.

The choice between the last two depends on how much time the role needs and how long the requirement will last. Our guide to choosing between a fractional and interim CIO sets out the trade-offs in more detail. As a rule, interim suits a defined, intensive period; fractional suits an ongoing need that does not fill a full week.

Frequently asked questions

Is a CIO more senior than an IT Director?

Generally yes. The CIO owns technology strategy and typically reports to the CEO, with the IT estate beneath them. In businesses with only one technology leadership role the titles are often used interchangeably, so check the reporting line rather than the wording.

What is the difference between a CIO and a CTO?

A CTO owns the technology the business builds and sells; a CIO owns the technology the business runs on. Software companies have both. Non-technology businesses generally need a CIO, whatever they choose to call it.

When should a business appoint its first CIO?

Commonly when technology decisions start carrying material commercial consequence, when data becomes a commercial asset, when the board needs technology risk explained in business terms, or ahead of a significant transformation programme.

Can an IT Director become a CIO?

Often, though the step requires commercial framing and board communication that running an estate well does not automatically develop. Give the candidate an investment case to build and a board session to present before deciding.

Who should the technology leader report to?

A CIO to the CEO or MD, ideally with executive team membership. An IT Director commonly reports to a Finance Director or COO, which is workable — but if technology is strategically important, that reporting line will eventually constrain it.

Who should own cyber risk at board level?

The board as a whole is accountable, which is the premise of the government’s Cyber Governance Code of Practice. In practice one senior technology leader should brief the board and own the detail, and many boards also name a director to take a particular interest in cyber.