Where an insurer's promise becomes arithmetic

The first claim I processed in code was for a pair of spectacles. In February 1997 I joined Kestrelby Systems in Adelaide as a graduate programmer, three months after finishing a computer science degree at Tellebrook University. Kestrelby wrote membership and claims software for small health funds, several with fewer than twenty thousand members. My first assignment was the routine that checked an optical benefit against an annual limit. The limit sounded simple until I learnt that it could be shared across a family, reset on a calendar or membership year depending on the fund, and reduced by a claim paid months earlier at a different counter. I came to respect product rules as the place where an insurer's promise becomes arithmetic.

In 2000 I moved to Brisbane to join Marrowind Insurance, a home and motor insurer, as an analyst programmer on its policy system. General insurance introduced volume of another kind. Renewals ran in overnight batches, and a defect in a rating table could reach forty thousand notices before anyone opened one. I became a team leader in 2002 and policy systems development manager in 2005. The defining weeks came at the end of my time there. The floods in south-east Queensland in January 2011 produced more home claims in three weeks than our claims system normally received in four months. We kept lodgement open by moving assessors' notes into a temporary database and reconciling them afterwards. It worked, but I left with a lesson I still apply: the plan for a bad day must be designed before that day, with the people who will use it.

From 2011 to 2016 I led claims systems at Ostravel Claims Services in Melbourne, which managed injury claims as an agent for a state workers' compensation scheme. That work was less about volume than about time. An injured worker's claim could stay open for years, passing between case managers, medical providers and return-to-work coordinators. The scheme set the rules and owned much of the data; we ran the systems case managers used each day. I learnt to work inside someone else's requirements and to say plainly when a requested change would weaken the record of a decision already made about a person.

I returned to Adelaide in July 2016 to join Corrabeen Health as general manager of claims and member platforms. Our hospital claims engine was nineteen years old and maintained by two people close to retirement. Between 2018 and 2020 we replaced it in five stages, one benefit group at a time, with the old engine running beside the new one until each group reconciled. The programme cost A$17 million, about A$2.5 million more than estimated, mostly because we kept both engines running longer than planned. I became chief technology officer in March 2021, reporting to the chief executive.

The attacks of late 2022 changed my priorities more than any technology I have adopted. A large criminal breach at another Australian health insurer exposed personal and claims information about millions of current and former customers. Our board asked whether the same could happen to us. My honest answer was that our defences were better tested than our data holdings were justified. We held complete identity records for people who had left the fund more than twenty years earlier. Reducing that store, described on the Impact page, became a programme with real costs to colleagues who valued the history.

APRA's operational risk management standard, which applied from July 2025, gave formal structure to questions I had carried since the Brisbane floods. We named our critical operations, set tolerance levels for disruption and identified the service providers on which those operations depend. The standard did not tell us what our tolerances should be. Settling them took argument with our chief risk officer, and later the evidence of a real outage, about what members could reasonably absorb.

I lead through a few written principles and many conversations with the people who carry the consequences. Engineers on my teams know that a proposal must name what it removes as well as what it adds. I ask claims, product and member-services leaders to test a change from the member's side of the counter. I try to tell our board the condition of our systems before I tell them my plans for those systems. Those reports are sometimes uncomfortable, but a committee cannot oversee a risk that management has softened in advance.

I am now looking for a first non-executive contribution outside private health insurance. I have never been a director. I have presented to our board and its risk committee for five years, and since 2023 I have been a non-director member of a community housing provider's finance, audit and risk committee. That committee has shown me how differently a question sounds from the other side of the table. I would like to learn the role properly, in an organisation where personal information and continuous service matter as much as they do in a health fund.

Open to Board appointments · Advisory roles

Languages / English