My contribution to a board
I can help a board see where a technology decision moves risk between the company, its customers and its suppliers. Platform proposals usually reach directors as a cost and a timetable. What is harder to see is which customer experience depends on the change, which supplier the company is becoming more reliant on, and what the way back would be if it failed. I have prepared those questions for our own audit and risk committee for five years, and earlier reported platform incidents to a board risk committee at a hosted-systems provider. I understand billing and payment controls, personal data obligations under Malaysia's law, hosting choices and supplier contracts well enough to test management's answers without trying to run the work. My limits matter as much. I hold no accounting qualification and would rely on financially qualified colleagues for judgements on revenue recognition or impairment. I have never served as a director, so a first appointment should be as a committee member under an experienced chair. I would add most where a company is in the middle of a platform change or depends heavily on outsourced technology.
My first year on a board
In my first three months I would read two years of committee papers and risk registers, then ask management to take me through the three customer journeys that generate the most complaints. I want to see where the company's systems actually meet its customers before forming views on its technology plans. In the second quarter, with the chair's agreement, I would meet the heads of internal audit, information security and data protection without other executives present and ask each what they find hardest to escalate. By mid-year I would expect to know which suppliers the company could not replace within twelve months. In the second half I would contribute to the committee's annual review of technology and data risk, and complete any accreditation for directors that the relevant exchange requires. At the end of the year I would ask the chair for direct feedback on whether my questions sharpened decisions or merely lengthened meetings.
Conflicts and their management
My conflicts come mainly from the supplier market. Kemaruna Fibre buys billing software, cloud hosting, payment processing, network equipment and installation services, and resells mobile service on a host operator's network. A seat at any of those suppliers, or at a broadband or mobile provider competing in northern Peninsular Malaysia, would be incompatible with my role. Corvanthe Equity also owns other portfolio companies, and I would declare any proposed seat at one of them to our board before accepting. Beyond formal conflicts, I would avoid situations where knowledge of one company's contract terms could colour my view of another's. If a board matter involved a supplier I deal with as an executive, I would declare it and leave the discussion. I keep a written list of my current supplier relationships, which I would give to the company secretary on appointment and update every year.
My independence statement
I hold no shares in, family ties to or commercial relationship with any company I am considering. Because I am a serving executive, I would ask each board to assess my independence under its own rules, and I would decline where my employer's supplier or customer relationships could compromise it.
Judgement in practice
01Putting two designs and their failure cases before a committee
When the cloud plan reached our audit and risk committee, I could have presented only my preferred split and its cost. Instead I asked the cloud provider's architects to present their caching design beside mine, and described what a household would experience under each if the cloud link failed during a storm. The committee asked for the scenarios to be stated in households affected and hours lost, which turned a preference into evidence. As a director I would ask management for the same: two credible options, each with the customer consequence of its likely failures written plainly. I would also watch my own bias. A director who once ran systems can be tempted to choose the design. On another board my task would be to test whether the executives had examined the right failure cases, and then leave the design with them.
02Reporting lower debt recoveries beside a data reduction
After we deleted the identity images, recoveries on older debt fell by about RM 142,000 a year. It would have been easy to present 403,100 deletions as a clean data-protection result. I put the recovery figure in the same committee paper, because directors needed to judge whether the trade was worth making, and because our head of collections had predicted it. The committee accepted the trade and asked for the figure to be tracked for two years. On another board I would look for the cost that a successful programme report leaves out. Improvements in privacy, resilience or security often carry a commercial price paid by a different department. Directors should see that price beside the benefit, and know who raised the objection and whether it was properly heard.
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to join | Audit and risk committee · Technology and risk committee |
|---|
Capacity and preferences
- Time available
- 22 days per year
- Current directorships
- 0
- Sectors
- Telecommunications and broadband · Digital payments · Utilities and other household subscription services
- Company type
- Malaysian or Singaporean company, listed or privately held, with a large subscriber or account-holder base
- Company stage
- Midway through a platform change, an outsourcing review or a growth in data obligations
The seat I am pursuing
I am pursuing a first seat as an independent non-executive director of a Malaysian or Singaporean company that serves many subscribers or account holders and depends on a small number of technology and payment suppliers. Telecommunications, digital payments, utilities and consumer subscription businesses are the closest fit. A company listed on Bursa Malaysia would require me to complete the exchange's accreditation programme for directors within its required period, and the Malaysian Code on Corporate Governance would shape my expectations of board practice. A Singapore company would be measured against the Singapore Code of Corporate Governance. I would prefer a board partway through a platform change or an outsourcing review, where my questions would be most useful. I would join as a committee member and learn the full board's work before considering any chair role.
Board and committee exposure
Presented to the Board or a committee
Kemaruna Fibre Sdn Bhd
Audit and risk committee
March 2021–present
Presents quarterly papers on technology risk, data protection and major platform decisions as chief information officer; not a director.
Reported to a committee
Solvantri Mobile Platforms Sdn Bhd
Board risk committee
2015–2017
Reported platform incidents and remediation progress as head of platform delivery.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is an Indian requirement and does not apply to the Malaysian and Singaporean boards I am considering. I have not registered with it, and would look at it only if a seat at an Indian company were ever proposed.
- I have worked through the Malaysian Code on Corporate Governance and the Singapore Code of Corporate Governance with our company secretary, focusing on the expectations of audit and risk committees.
- I stay for the full audit and risk committee meeting each quarter, by agreement with its chair, to observe how directors weigh items beyond technology.