Eleanor Ashford · Chief Technology Officer · Australia

What I would ask from the other side of the table

My contribution to a board

I would bring a practitioner's understanding of how technology fails in regulated services, and of the questions that expose a weakness before it matters. Many boards receive technology reports built from programme status and maturity scores. I can help directors ask what customers would experience if a named system stopped this afternoon, which outside providers that experience depends on, and what personal information would be exposed if a particular store were taken. I have answered such questions for five years as an executive before our risk committee, and I know which answers have been rehearsed. I also understand APRA's expectations on operational risk and information security from the side of the entity that must meet them. I have not been a director, and I would not expect a technology background to substitute for the financial, actuarial or legal judgement that other directors hold. My contribution would be strongest on a risk, audit or technology committee whose chair wants technology risk discussed with the same rigour as credit or liquidity.

Judgement in practice

Asking a committee to approve a tolerance it had seen tested

When our risk committee considered the claiming design, I could have presented the cheaper option as equivalent to duplication. It was not. Members would pay full fees at the counter during an outage, and I said so in the paper. The committee chair asked which members would be affected and for how long, and that question shaped the tolerances the committee approved. From the other side of the table, I would expect management to state the inconvenience its preferred option creates, and I would ask for evidence that a tolerance has been met in a test or an incident, not only in a plan. I would also want a dissenting executive's view recorded, as our chief risk officer's was, because a later committee may need to know that the choice was contested.

Changing the order of a purchase as a committee member

At Wattlegrove Community Housing, management proposed replacing its tenancy system and support-case records in a single contract. The tenancy data was straightforward; the support records held sensitive notes about tenants' health and family circumstances. As a committee member, I asked who would decide what moved to the new system and what would be destroyed. Nobody had been given that decision. The committee recommended that the board approve the tenancy migration first and treat the support records as a separate decision after a retention review. The project took four months longer and cost more in supplier fees. It also meant that eight years of notes the provider did not need were not copied into a new system. I did not manage the project; my role was to ask the question early enough to change the plan.

My first year on a board

My first months would go on understanding the organisation's services as its customers experience them. I would ask the chair for a reading list of recent board and committee papers, then meet the chief executive, the chief risk officer and whoever leads technology. I would want to see the list of critical operations and their tolerances, the register of material service providers and the most recent incident reports, including any that did not reach the board. Where I found gaps, I would raise them through the committee rather than directly with management staff. I would also need to learn what I do not know: the organisation's financial model, its regulatory relationships and the history behind its current strategy. I would also visit at least one service centre with management's agreement, because a committee paper rarely conveys how a frontline team copes when a system is slow. By the end of the year I would ask the chair whether my questions had helped the committee or merely added to its agenda, and adjust accordingly.

Conflicts and their management

Health insurance touches many sectors. Corrabeen Health pays benefits to hospitals and allied health practices, buys technology from several large suppliers and competes with other funds for members. An aged-care or disability provider might receive payments from a health fund; a technology supplier might sell to both organisations. Before accepting any role, I would list those relationships for the chair and my chief executive and ask both to judge whether they can be managed. I would not join the board of another health insurer or a hospital operator that contracts with the fund. If a recurring matter required me to leave the room, I would treat that as evidence that the appointment was unsuitable. Information from my executive role, including supplier pricing and security assessments, would stay with my employer.

My independence statement

My salary and incentives come from Corrabeen Health, and I would treat any organisation that buys from, sells to or competes with the fund as one where independence needs testing before I accept. I would ask the chair and the organisation's advisers to make that judgement with full information, not rely on my own view.

Committee contribution

Chair and member readiness
Capacity	Committees
Ready to join	Risk · Audit · Technology or cyber oversight, where a board has established one

Capacity and preferences

Time available: 22 days per year
Current directorships: 0
Sectors: Customer-owned banking · Not-for-profit aged care and disability services · Superannuation trusteeship
Company type: APRA-regulated customer-owned entity, or a not-for-profit holding sensitive personal information
Company stage: Replacing core systems or meeting new privacy and operational-resilience obligations

The seat I am pursuing

I am seeking a committee-centred first appointment where technology and data are material risks but not the organisation's product. A customer-owned bank would bring APRA's governance standards, which I know from the regulated side. A not-for-profit care provider would bring sensitive personal information and a duty of continuous service to vulnerable people. In either case I would want a board that has asked for technology experience deliberately, with a clear sense of what it expects, rather than one that needs a technology executive to oversee a programme it does not understand. I would accept a smaller organisation if its chair is willing to support a first-time director. I am not pursuing a listed company first, and I would not accept any role that required me to reduce my commitment to Corrabeen Health without its board's agreement.

Board and committee exposure

Presented to the Board or a committee

Corrabeen Health

Board risk committee and annual board technology sessions

March 2021–present

Quarterly reports on cyber security, operational resilience and material service providers; presented the case for the degraded claiming design. Not a director.

Member of a committee

Wattlegrove Community Housing

Finance, audit and risk committee (non-director member)

February 2023–present

Appointed by the board as an external committee member for technology and data risk; reviewed a tenancy-system replacement and the provider's breach response plan.

Governance learning and readiness

IICA Independent Directors’ Databank: Not yet registered

I hold no registration with India's IICA Independent Directors' Databank. That databank serves independent directors of Indian companies, not the roles in Australia that I am pursuing, and I would revisit it only if an Indian appointment were proposed.

Completed a company directors' course in 2024 covering directors' duties, financial statements and board risk oversight.
Studying the Financial Accountability Regime, which now applies to insurers, and what it asks of directors as well as accountable executives.
Reading APRA's governance and fit-and-proper expectations from the director's side rather than the executive's.