Presented to the Board or a committee
Quorrindale Site Systems
Board and audit and risk committee
July 2021–present
Presents quarterly on security, reliability, data residency and cloud spending as chief technology officer; not a director.
Edward Langford · Chief Technology Officer · Australia
Technology risk that a board can actually question
My contribution to a board
Many boards now carry technology risk that none of their directors has managed. They receive security dashboards, availability percentages and cloud invoices without a reliable way to ask what sits behind them. I can help with that. I have spent twenty-seven years building, running and paying for software that customers depend on early in the morning, and I have reported on it to a board and its audit and risk committee for five years. I know how an availability figure can be flattered by quiet hours, how a security maturity score can describe intentions rather than tested controls, and how a cheaper architecture can quietly breach a contractual promise. I would bring those questions to committee discussions, and I would ask them of management in a way that respects its responsibility for the answers. I would also bring my own limits plainly. I have not been a director, I am not an accountant, and my understanding of sectors outside software and construction is thin. My contribution would therefore begin as a committee member who reads carefully, asks precise questions about technology and data, and learns the rest from colleagues with different experience.
Committee contribution
| Capacity | Committees |
|---|---|
| Ready to join | Audit and risk · Technology, cyber and data risk, where a board has constituted one |
Capacity and preferences
- Time available
- 22 days per year
- Current directorships
- 0
- Sectors
- Business software and data services · Construction and infrastructure services · Vocational training and community services
- Company type
- Private, venture- or growth-backed, or not-for-profit organisation with a functioning audit and risk committee
- Company stage
- Growing organisations whose dependence on software has outpaced the board's experience of it
The seat I am pursuing
My preferred first role is as a non-executive director serving on an audit and risk committee, under a chair who wants technology and data risk examined with the same care as financial risk. A mid-sized software or data company, a construction services business outside our customer base, or a not-for-profit training or community organisation would each suit me. I am not looking for an advisory title, a technical consulting arrangement presented as a directorship, or a role in which I would be expected to direct the company's engineers. I would want to know why the board is recruiting, which skills it has identified as missing and how it assesses its own performance. Any appointment would depend on a full conflicts review, my chief executive's consent and an honest view of my availability after the morning-hours obligations of my executive role.
Board and committee exposure
Member of a committee
Joistwell Apprentice Trust
Finance, audit and risk committee (independent member, not a director)
February 2023–present
Volunteer committee member at a not-for-profit apprentice-training organisation; reviews risk reports, cyber questions and the annual audit plan with its directors.
Judgement in practice
Asking a committee to see a deferred risk before it became an incident
In 2018 I identified weak separation between customer accounts and allowed it to slip twice behind features. When a near miss exposed the weakness in 2023, I told the audit and risk committee at its next scheduled meeting, five weeks later. That was too slow. The board question was not whether the engineers had fixed the query; they had done so within a day. It was whether the company had been carrying a known risk that directors had never been shown. On another board I would ask management for a short register of deferred technology risks, with the date each was first identified, the reason it was deferred and the consequence if it occurred. I would also ask how quickly a near miss reaches the committee chair. Neither request requires directors to manage engineering work.
Distinguishing an obligation from a preference in a cost comparison
My first paper on a standby region presented Singapore and Melbourne mainly as a price comparison, and directors reasonably asked why the dearer option was preferred. The deciding fact, that our contracts required Australian hosting, sat on page four. The board approved Melbourne only after the obligations were set out first. As a director I would look for the same gap in other papers. When management compares options on cost, I would ask which constraints each option must satisfy and who has confirmed them. A contractual commitment, a regulatory requirement and an internal preference deserve different weights, and the paper should say which is which. I would not substitute my own architecture for management's, but I would want the board to understand what a lower price would require the company to give up.
My first year on a board
In the first months I would read the past two years of board and committee papers and ask the chair which decisions directors found hardest. I would want a briefing from the chief financial officer on how the organisation is funded and from the person responsible for technology on its most significant systems, suppliers and deferred risks. I would visit at least one operating site or service, arranged through management. Before my first audit cycle I would study the external auditor's previous findings and the way management responded. During the year I would keep my questions concentrated on areas where my background is useful, such as resilience, data handling and technology spending, while listening more than I speak on financial reporting and sector-specific matters. I would ask the chair for frank feedback after six months and again at the year's end, particularly on whether my questions helped or simply added work for management.
Conflicts and their management
Quorrindale sells to builders and civil contractors and buys from cloud providers and software suppliers. Our investor holds interests in other technology companies. Any of those relationships could make a board unsuitable for me, so I would ask for the prospective company's customer, supplier and investor lists before a second meeting. I would decline a seat at a builder that uses our software, at a direct competitor, or at a company in our investor's portfolio. My employee shareholding would be disclosed in full. If a smaller conflict arose during an appointment, such as a tender in which both organisations had an interest, I would declare it, leave the discussion and record my absence. If those absences became routine, I would resign rather than offer a diminished contribution. Megan's written consent would be a condition of any appointment, and Quorrindale's calendar, including our year-end and the morning-hours obligations I carry, would limit how many meetings I can attend at short notice.
My independence statement
My employment at Quorrindale and my shareholding through its employee plan are interests I would declare to any board before discussions went further. I would not describe myself as independent of a company that buys from us, sells to us, competes with us or sits in our investor's portfolio. Whether I meet a particular board's independence test is for that board to judge, with full information from me.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is an Indian requirement and does not apply to my Australian career, so I have not registered with it. Any Australian appointment would be considered under the Corporations Act duties of directors and, for a listed company, the ASX Corporate Governance Council's Principles and Recommendations.
- Completed a five-day company directors' course in 2024, covering directors' duties, financial statements and board risk oversight.
- Three years as an independent member of a not-for-profit finance, audit and risk committee, including two annual audit cycles.
- Studying how audit and risk committees in other sectors oversee cyber risk and incident reporting without drifting into management.