Reina Mizukaede · Chief Information Officer · Japan
Japanese boards now publish skills matrices, and many list IT or digital among the skills they want. I would bring something narrower and, I hope, more useful: years of running critical services through a supplier the company cannot control, and of deciding what customers experience when that supplier fails. I can read an outsourcing contract for its exit terms, ask how management would know which customers an outage affected, and tell an incident report that explains from one that reassures. I also understand fraud and authentication from the side of customers who are older and less confident online, which many consumer-facing companies in western Japan share with us. What I do not bring is experience as a director. I have presented to Ogiwatari's board since 2017 and reported to its audit and supervisory board members, but I have never voted on a board decision. I expect to learn capital allocation, remuneration and succession from colleagues who have done them, and to contribute most where a board must judge technology risk without being able to inspect the technology itself.
| Capacity | Committees |
|---|---|
| Ready to join | Audit and supervisory committee · Risk or system-risk committee |
I am looking for one outside-director seat on the audit and supervisory committee of a listed company in western Japan, from April 2027. The best fit would be a business used daily by many older people, such as a railway or bus group, a utility, a regional retailer or a care operator, which is replacing a core system, consolidating its suppliers or rebuilding after an incident. I want a board where the chair expects outside directors to question management on system risk and on how customers are treated when things go wrong. I am not seeking a chair role, a remuneration committee seat or a position in another financial institution. I would rather contribute well on one committee and learn the rest of the board's work properly than appear on several committees and serve none of them thoroughly.
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is an Indian register and does not apply to appointments in Japan, so I have not registered. Here, independence is judged against the listing exchange's criteria and each company's own published standards.
Presented to the Board or a committee
Board of directors: quarterly system-risk and incident reports, and technology investment proposals
April 2017–present
Presented the inheritance-system and customer-app proposals in 2022, the passkey decision in 2025 and quarterly incident reports since 2021; no director appointment.
Reported to a committee
Audit and supervisory board members: incident reviews and IT audit findings
April 2021–present
Reports after each significant incident and answers the internal audit department's findings on technology controls.
Member of a committee
User council of the shared back-office service; chair of its incident working group since April 2025
April 2019–present
A contractual forum of the 23 user firms rather than a corporate board; it agrees priorities and incident procedures with the supplier.
In November 2024 we improvised a sound rule under pressure, but it was improvised. On another board I would ask whether management has agreed, in advance and in writing, what the company does when a critical system is unavailable or wrong: which customers are served, which are held, who decides and how quickly customers are told. I would want the rule tested with the people who would apply it, not only approved in a meeting. I would also ask what independent record the company keeps of its own critical data, because our copy of executed orders was the only reason we could tell good positions from bad ones. A board cannot prevent every supplier failure. It can make sure the company is not inventing its response at twenty to eight on a weekday morning.
Making passkeys compulsory cost us part of our online channel, and the board approved it knowing that. I would bring the same questions to any security proposal. Does the control remove the weakness or only ask customers to be more careful? Who loses access, how many, and what equally safe alternative do they receive, at what price? Has management counted the contact-centre and branch work that follows? I would be wary of a fallback added to make a decision comfortable, because attackers look for exactly that route. Equally, I would question a proposal that treats lost customers as an acceptable statistic without a plan for each of them. The board's task is to see both the risk removed and the people affected before it approves.
I would ask for three things before a general induction: the register of critical outsourced services with their contract end dates, the last two years of incident reports exactly as the board received them, and the board's skills matrix with an explanation of why my column was thought to be missing. Reading those together would show me where the company depends on others and how candidly that dependence is reported. I would then visit one operating site and one customer-facing location, without management present for part of the visit if the chair agreed. I would sit through a full audit and supervisory committee cycle before proposing anything structural, and I would keep my questions in the first meetings to understanding rather than correction. Around the ninth month I would ask the chair and one fellow outside director for a frank view of whether my contributions were useful, too technical or too cautious, and adjust accordingly.
My conflicts are specific, and I would list them for any prospective chair. Ogiwatari is a securities firm, so I could not join the board of a company whose shares our advisers actively sell without our compliance department placing that company on a restricted list, and I would follow our insider-trading rules for any holdings of my own. Our two allied regional banks and Kuranoe Information Systems rule out seats at those companies and their direct competitors. If an appointing company were an Ogiwatari customer, a Kuranoe customer or a borrower from one of our allied banks, I would disclose it and leave any discussion of that relationship. Time is the other conflict. I am the escalation point for system incidents at Ogiwatari, so my deputy would cover board days, and I would tell the chair before accepting if a major renewal, such as Kuranoe's in 2028, threatened my attendance.
I am employed by Ogiwatari Securities and would remain so. An appointing company should test my independence against its exchange's criteria and its own standards, including any business it has with Ogiwatari, our two allied banks or Kuranoe Information Systems. I would answer each question in writing and step out of any matter that touches those relationships.