Louisa Barrett · Chief Information Officer · Australia

Technology risk seen from the tenant's side

My contribution to a board

I would bring a practical view of how personal information and asset evidence move through an organisation that depends on contractors and government funding. Many boards receive cyber reports that count blocked attacks and completed training modules. I can help directors ask more useful questions: which records would harm people if exposed, who outside the organisation can reach them, how quickly the organisation could notify the people affected, and whether its asset forecasts rest on recent observation or old assumptions. I have made those decisions as an executive, including ones that cost money and colleagues' goodwill, so I understand why management sometimes resists them. My limits are equally clear. I am not a lawyer, an accountant or an engineer, and I have never been a director. I would need an experienced chair, a committee where my technical background complements financial and legal expertise, and time to learn how the organisation's funding agreements and regulator relationships work before offering firm views.

Judgement in practice

Weighing a cheaper notification against the people receiving it

The 2023 mailbox compromise raised a question boards often face: how far beyond the legal minimum should an organisation go when it tells people about a breach? Counsel's advice was reasonable, and the cost difference was real. My judgement was that the people affected were less able than most to recover from identity misuse, or from a letter read by the wrong person, so their circumstances should set the scope. On another board I would ask management to present both options with their costs and the characteristics of the people involved, rather than a single recommendation framed by legal exposure. I would also ask whether the organisation already knows which of its customers need a different kind of contact. If that list has to be built during an incident, the board has learnt something important about its preparation.

Asking when a forecast's data was last observed

When our board considered the predictive maintenance platform, the argument was presented as old method against new technology. The real question was whether our condition data could support any forecast at all. On another board I would ask, for each material forecast, what proportion rests on recent observation, what was assumed and in which direction the assumption is likely to be wrong. Complaint-driven data understates the problems of people who do not complain, and that bias matters most where an organisation serves vulnerable customers. I would not insist on the most expensive evidence every time. Our resurvey should have started with a sample, and I would encourage management to test the quality of its data cheaply before funding a full programme. A director's task is to know how much confidence a figure deserves before relying on it.

My first year on a board

In the first three months I would read the last two years of committee papers, the risk register and any incident reports, then ask to meet the people who hold the organisation's most sensitive records: frontline managers, the privacy officer and the account leads of its main contractors. I would want to understand the funding agreements and regulator expectations that shape the organisation's choices before commenting on them. Through the first full reporting cycle I would mostly ask questions, keeping a short list of those the papers could not answer. By the second half of the year I would hope to contribute to one defined piece of work, perhaps an incident exercise or a review of how asset data supports the long-term plan. At the end of the year I would ask the chair for direct feedback on where my questions helped and where they distracted, and adjust accordingly.

Conflicts and their management

Three relationships need careful handling. Wynnorra receives state funding and leases government homes, so a seat with another Queensland housing provider could place me across the table from my employer in the same funding rounds; I would not accept one. Several software suppliers and maintenance firms work for Wynnorra and for other housing providers, and any board I joined might contract with them. I would declare those relationships at the outset, leave the room for related decisions and never carry pricing or security details between organisations. Sundercombe, my employer until 2009, remains on our maintenance panel, and I would record that history too. Time is the fourth issue. Twenty days must absorb an incident at either organisation, and a major cyber event at Wynnorra would take priority. I would tell the chair this before accepting, so the board can judge whether that limitation is acceptable to it.

My independence statement

I am an employee of Wynnorra and would remain one. I hold no shares, loans or family connections with any of our contractors, software suppliers or government counterparts. Sundercombe, where I worked until 2009, sits on Wynnorra's maintenance panel; I have no interest in it but would declare the history. Whether I am independent of a particular organisation is for its board to judge with all of those facts in front of it.

Committee contribution

Chair and member readiness
Capacity	Committees
Ready to join	Audit and risk · Technology and cyber risk

Capacity and preferences

Time available: 20 days per year
Current directorships: 0
Sectors: Community housing and homelessness services · Disability and support services · Regional water, airport and transport infrastructure
Company type: Not-for-profit public company or registered charity, or a government-owned or mutual infrastructure operator
Company stage: Growing through merger, stock transfer or new government contracts, while records and contractor access are changing

The seat I am pursuing

I am seeking a first non-executive seat on a board that holds sensitive information about people who depend on its services, and where contractors or partners handle part of that information. A community housing provider outside Queensland, a disability or homelessness service, or a regional infrastructure operator would all fit. I would expect to join the audit and risk committee, or a technology committee where one exists, and to learn from its chair before taking on more. I am less suited to a large listed company whose technology risks are mainly commercial, or to a start-up whose board needs product strategy. I would like a board that wants its technology reporting to change and is prepared to fund what better reporting reveals, including improvements that offer no quick return. In exchange I would offer careful preparation, plain questions and a willingness to be told when my housing experience does not transfer.

Board and committee exposure

Reported to a committee

Wynnorra Community Housing

Audit, Risk and Technology Committee

July 2019–present

Quarterly reports on cyber risk, privacy incidents, contractor access and system programmes; has led the committee's annual incident exercise since 2022.

Presented to the Board or a committee

Wynnorra Community Housing

Board of directors

July 2014–present

Annual technology plan and major investment papers, including the 2024 condition resurvey and the 2023 breach response; attends by invitation, not as a director.

Governance learning and readiness

IICA Independent Directors’ Databank: Not yet registered

IICA's Independent Directors' Databank applies to appointments in India. I am seeking Australian roles, so I have not registered and it does not apply to me.

Completed a five-day company directors' course in 2024 covering directors' duties, financial statements and board oversight of risk.
Studied the ACNC governance standards that apply to registered charities and their responsible persons.
Observed two full Wynnorra board strategy days, with the chair's agreement, to see how directors weigh competing risks.