Imogen Fletcher · Chief Information Officer · Australia
Most boards of essential services now receive cyber and resilience reports that are long, technical and difficult to challenge. I can help directors ask the questions that make those reports useful. Which controls have been tested, and when? Which recovery times were measured rather than designed? Which suppliers could stop the organisation working, and what would the organisation know if they did? I have written these papers for an audit and risk committee for five years, and I have sat on the other side of an outsourcing contract, so I recognise both an over-confident management report and a provider's comfortable service-level summary. I also bring practical experience of operating in remote country through floods and cyclones, which suits organisations whose customers are spread across difficult geography. I would not try to run the technology function from the board table. My contribution would be to make sure that what directors are told about risk matches what has actually been tried, and that the gaps carry owners and dates.
| Capacity | Committees |
|---|---|
| Ready to join | Audit and risk · Technology and cyber risk |
I am looking for a first non-executive role, or a co-opted committee place leading towards one, with an organisation that delivers an essential service and depends heavily on technology it does not fully control. A regional water business, port authority, health service or larger community-sector provider would suit me. I would join an audit and risk committee, or a technology and cyber risk committee, and I do not expect to chair one until I have served several years. I would prefer a board that is part-way through a resilience programme or a significant systems replacement, where my experience of recovery testing, outsourcing and legacy invoicing would be directly useful. I am not seeking a seat in remote power or mining, a paid advisory role disguised as a directorship, or an appointment whose main purpose is to show that the board has someone technical.
Presented to the Board or a committee
Audit and risk committee; full board for the annual risk-management report
March 2021–present
Presents quarterly technology and cyber risk reports and the annual risk-management report for board approval; not a director.
Member of a committee
Finance, audit and risk committee
July 2023–present
Co-opted, non-director member of a Cairns disability-services provider's committee, contributing on technology, privacy and continuity matters.
After our first full recovery test took five hours and forty minutes against a four-hour objective, I could have reported the test as substantially successful, since every system came back. I reported the measured time, the two causes and the date of the retest instead. One committee member asked why we had approved a design that had not involved the customer desk, and the honest answer was that I had not thought to include them. The retest met the objective. As a director I would expect the same candour from management and would treat a report that describes only design targets as incomplete. I would also try to receive bad news without making the next messenger reluctant, because the committee's reaction to that first failed test decided how frank later reports were.
The invoicing decision set a discount of A$0.9 million against an annual cost of about A$0.6 million and a risk that was hard to price. The chief financial officer's objection was reasonable, and the board needed to see both views rather than my recommendation alone. I learnt that a board paper on outsourcing should state what knowledge the organisation would lose or retain, not only the price and service levels. On another board I would ask that question of any significant renewal: who inside the organisation could explain this service if the provider left tomorrow? I would also accept that the answer will sometimes favour the provider, and that keeping everything in-house is a cost of its own, not a virtue.
I would spend the first three months reading rather than recommending. That means the last two years of committee papers, the risk register, any recent incident reviews and the main outsourcing contracts, followed by conversations with the chief executive, the chief financial officer and whoever runs technology. I would ask to visit at least one site where the organisation's service is delivered under difficult conditions. In the second quarter I would agree with the committee chair which areas I should examine more closely, rather than choosing my own. By the end of the year I would hope to have helped the committee distinguish tested controls from documented ones, and to have asked for at least one recovery exercise that includes the people who would actually do the work. I would request feedback from the chair at twelve months and accept it if my questions were too detailed for the board's needs. I would also tell the chair early which parts of the organisation I still did not understand, so that my induction could continue into a second year.
My largest conflict is my employer. Ollanvale buys from technology suppliers, managed-service providers and engineering contractors who also serve water, port and health organisations in northern Australia, and it sells power to mining companies and to government agencies that fund remote communities. Before accepting, I would give the prospective chair a list of Ollanvale's material suppliers, customers and government relationships and ask for an assessment of overlap. I would leave any discussion of a contract with a supplier that Ollanvale also uses, and if that happened often, I would conclude that the seat was wrong for me. My former employer, Halvarine, still provides managed services in Queensland; I hold no interest in it, but I would disclose the connection. Ollanvale's policy on outside appointments requires my chief executive's consent, and the wet season limits my availability from December to March, which a board should know before appointing me.
My judgement would be my own, but my connections are not invisible. I would list every supplier, customer and government relationship that Ollanvale shares with the organisation, and let its chair and advisers decide whether those links impair my independence before I accept.
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is an Indian register and plays no part in the appointments I am considering in Australia, so I have not registered with it. Duties here arise under the Corporations Act 2001 or under the statute governing a particular government-owned or not-for-profit body, and I would take advice on whichever applies.