My contribution to a board
Most financial-services boards now rely on technology they do not operate themselves: outsourced platforms, cloud services and software maintained by people outside the company. I can help a board understand those dependencies in terms it can act on. I spent nearly ten years inside an outsourcing provider, six at a broker that consumed insurers' systems and fourteen at an insurer overseeing both, so I know what each side tends to leave out of its reports. I would bring three things to a risk and control committee: questions about exit and concentration that go beyond the register, a practical reading of DORA incident and testing results, and experience of explaining legacy-system risk without alarming or soothing directors. I would not bring expertise in investment, actuarial or credit matters, and I would rely on colleagues who have it. I have presented to boards but never served on one, and I expect a first appointment to teach me how a board reaches a collective decision.
Judgement in practice
01Asking what it would cost to leave
The Gemmaldi renewal taught me that a supplier's price is only half of a decision. On another board, when management brings a long outsourcing or cloud contract, I would ask when the company last tested its ability to leave, which data and interfaces the test covered and who owns the relationship internally. A cheaper, longer contract can be right, and I would say so when the exit route is credible. My concern is a commitment nobody has tried to unwind. I would also ask management to describe sub-contractors and shared hosting, because concentration often sits one level below the contract that directors approve. None of these questions needs technical training, and the answers usually show whether oversight is real or assumed.
02Reading an incident for its effect, not its category
Our broker-portal incident fell below DORA's major-incident criteria, yet forty-one policyholders' records were viewed and the GDPR assessment led to notification. Classification alone can mislead directors in both directions. On another board, I would read incident reports for what happened to customers and what remained exposed, not only for the regulatory label. I would also ask why a known weakness had been accepted earlier, a question I had to answer to our own committee when optional authentication on our portal proved costly. A board that asks it routinely makes it easier for executives to raise uncomfortable trade-offs before an incident forces them into the open.
My first year on a board
In the first three months I would read two years of risk-committee papers, the outsourcing register and the latest resilience-testing results, then ask management to walk me through the systems customers depend on during a busy week. I would meet the chief risk officer, the head of internal audit and whoever owns the largest supplier relationship, separately and without slides. By the first annual cycle I would want to know how the board sets its tolerance for ICT disruption and whether its reports reveal breaches of that tolerance. I would not propose changes to reporting until I had seen a full year of it. After six months I would ask the chair whether my questions were helping the board decide or were merely technical, and I would adjust accordingly. I would also visit the operations or service centre during a peak period, because a dashboard rarely conveys how a failure feels to the staff handling customers.
Conflicts and their management
My possible conflicts fall into two groups. The first is commercial. Corvelline buys from outsourcing providers, cloud services and software firms, and distributes through brokers and agencies that also work with other financial companies. Before accepting a seat I would compare the prospective company's main suppliers and distributors with ours and disclose any overlap to both chairs. Where a shared supplier came up for decision, I would declare it and leave the matter to other directors. The second is competitive. While I am Corvelline's CIO, I will not join the board of another Italian life insurer or of a provider serving life insurers. Anything I learn on either board stays with that board. If conflicts became frequent enough that I was regularly absent from the discussions I had been appointed for, I would step down rather than remain a director in name only. Time is a conflict of its own: if a serious incident at Corvelline coincided with a board meeting, my executive duty would come first, and I would tell the chair of that possibility before accepting.
My independence statement
I hold no shares in, and have no family connection with, any firm I would consider joining. My current employment at Corvelline and my earlier years at Gemmaldi Informatica and Brescolani Brokers are the relationships a board should examine, and I would expect it to reach its own view on them.
Capacity and preferences
- Time available
- 24 days per year
- Current directorships
- 0
- Sectors
- Regional banking and consumer credit · Asset management · Pension funds · Payments
- Company type
- Italian or EU-regulated financial-services firm outside life insurance
- Company stage
- Replacing a core system, reviewing a major outsourcing or embedding DORA in daily practice
The seat I am pursuing
I am looking for a non-executive seat on the board of an Italian or European regulated financial-services firm outside life insurance: a regional bank, a consumer-credit company, an asset manager or a pension fund. The best fit would be a firm in the middle of replacing a core system, reviewing a major outsourcing or turning DORA's requirements into daily practice, where a director able to read ICT-risk evidence would be useful. I would join a risk and control committee rather than chair one, at least in a first term. Twenty-four days a year is realistic beside my executive role, on the understanding that an incident or a transaction may demand more. I would avoid boards whose central questions are investment strategy or underwriting, where my contribution would be marginal, and boards of technology providers, where my role as a buyer would compromise both sides. I would also want evidence that the board already receives ICT-risk reporting it can discuss, however imperfect, rather than expecting one director to supply it.
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to join | Risk and control · ICT and operational resilience, where a board has constituted one |
|---|
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
The Indian independent directors' databank does not apply to the Italian and European boards I am considering, and I have not registered with it. The tests that matter for me are each company's own independence criteria and the fit-and-proper assessment that European financial supervisors apply to board members.
- In 2025 I completed a non-executive director programme for financial-services boards at Morvaldi Polytechnic.
- With its chair's agreement, I observe two of our audit committee's meetings each year to see how members test management's evidence.
- I am studying how the Italian Corporate Governance Code frames the work of a control and risk committee.
Board and committee exposure
Presented to the Board or a committee
Corvelline Vita S.p.A.
Board risk committee
April 2021–present
Presents a quarterly ICT-risk report and papers on outsourcing, DORA implementation and cyber incidents; no director appointment.
Presented to the Board or a committee
Corvelline Vita S.p.A.
Full board: IT strategy and material outsourcing
December 2022–present
Presented the mainframe outsourcing renewal for approval and the annual IT strategy thereafter; attends for those items only.