Reported to a committee
Tidelorne Contact Services
Audit and risk committee
January 2014–present
Quarterly reports on information security, certification results, availability and significant incidents; I am not a director.
Ethan Fraser · Chief Information Officer · Canada
What a committee gains from an outsourcer's CIO
My contribution to a board
I would bring a board the view of someone who has run systems on behalf of other organisations' customers. Outsourcing, shared platforms and automated assistance all move personal information into places the original customer never chose. Directors are asked to oversee those arrangements through management summaries, certification reports and vendor assurances. I know what those documents establish and what they leave out, because I have prepared them and answered for them before an audit and risk committee for more than a decade. I can help a committee ask where customer data actually sits, who could reach it, how an incident would be noticed and how management would tell the people affected. I can also read a platform migration or automation proposal for the operational risks budgets tend to omit: dual running, rollback, carrier dependencies and the staff who absorb a poor design. I have not served as a director. I would join an audit, risk or technology committee as a member, learn the company's business before offering views on it, and leave legal and privacy conclusions to the qualified advisers whose work I would expect to test rather than replace.
Board and committee exposure
Presented to the Board or a committee
Tidelorne Contact Services
Board of directors
2021–2025
Presented the client separation, telephony migration and agent-assist recommendations; decisions rested with management within board-approved budgets.
Committee contribution
| Capacity | Committees |
|---|---|
| Ready to join | Audit · Risk · Technology or cybersecurity |
Capacity and preferences
- Time available
- 18 days per year
- Current directorships
- 0
- Sectors
- Business services that hold customer data · Credit unions and regional insurers · Health-technology and public-service providers
- Company type
- Canadian listed small-cap or larger private company with an independent board
- Company stage
- Replacing core systems or introducing automation that touches customer information
The seat I am pursuing
I am looking for a first non-executive seat on an audit, risk or technology committee of a Canadian organisation whose customers trust it with personal information: a business-services company, a credit union or regional insurer, or a health-technology or public-service provider. A company in the middle of a core-systems change or introducing automated decisions would use my experience best, provided the board wants scrutiny rather than an extra adviser to management. I would prefer a board with an experienced committee chair and a regular reporting cycle I could learn from. Listed and private companies both suit me; I would expect the company's counsel to confirm how securities rules and its governance policies apply to my independence. I am not looking to chair a committee in my first term. Eighteen days a year is a realistic allowance alongside my role, and I would rather say so plainly than accept a seat that needs more.
Judgement in practice
Reading an isolation claim beneath its contract wording
Our separation programme began because a client's reviewer looked beneath a phrase our contracts had used for years. A board can face the same gap when management reports that customer data is segregated or protected. I would ask how separation is achieved, whether someone has tested it by trying to cross it and what evidence the company could show a customer tomorrow. I would also ask what the separation costs and who pays for it, because an unfunded control tends to erode quietly. In our case the honest answer included lost occupancy and running costs most clients would not reimburse. A director does not need to design network segments. The committee should still know whether a statement about data protection describes tested practice or a reasonable assumption nobody has checked.
Weighing a vendor incentive against the cost of a failed weekend
The telephony decision set a visible incentive against a risk that had no line in the budget. Boards meet that pattern whenever a supplier rewards speed. I would ask management to describe the failure the incentive invites the company to accept: which customers would be affected, how quickly the change could be reversed and what a day of disruption would cost in credits, complaints and regulatory attention. I would not assume that caution is always right. Our phased approach cost about C$3 million more and still suffered a 52-minute outage. The value of the discussion lies in a decision whose costs are stated in advance, so that when an incident occurs the board can judge whether it fell inside the risk it accepted or outside it.
My first year on a board
In the first months I would ask to see how the board receives information about technology and customer data: the reports, their definitions and the incidents that changed them. I would meet the chief information officer, the head of security and the privacy lead separately, because their accounts of the same risk usually differ in useful ways. I would read the latest external assurance reports in full, including exceptions and management responses, rather than their summaries. Before raising a technical point at a meeting I would take it to the committee chair, to learn whether the board has already considered it. By the second half of the year I would expect to contribute to one substantive review, perhaps a platform change or a significant supplier renewal, with questions grounded in this company's circumstances. At the year's end I would ask the chair whether my questions helped directors decide or merely added detail, and adjust accordingly.
Conflicts and their management
Tidelorne's clients include utilities, insurers, software firms and health-technology vendors, and we buy from carriers, platform providers and hardware suppliers. Any of those could be a prospective board's competitor, supplier or customer, so my first step would be a written list exchanged with the company's corporate secretary before any interview reaches detail. Some seats would be closed to me while I remain an executive: another contact-centre outsourcer, a client whose contract I oversee or a vendor whose renewal I influence. Where a connection is distant, I would disclose it, leave the related discussions and ask for that to be minuted. I would also inform our own board, whose consent I need, and agree how Tidelorne's confidential client information stays separate from any outside role. If exclusions became frequent enough to limit my usefulness, I would decline the seat or step down from it.
My independence statement
Apart from my employment and shareholding at Tidelorne, I hold no business interests that would connect me with a prospective board, and I would confirm that position in writing before any appointment. My executive role links me to Tidelorne's clients and suppliers, so the company's counsel, rather than I, should judge whether those links affect my independence.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is an Indian requirement and does not apply to the Canadian seats I am considering, so I have not registered with it. For any Canadian appointment I would rely on the company's counsel to confirm how securities rules and its own governance policies treat my independence.
- With guidance from our corporate secretary, I have studied how Canadian securities rules shape the composition of audit committees and the independence of their members.
- Reporting to our audit and risk committee since 2014 has shown me how directors test management's cyber-risk reporting, and I am now studying the committee's terms of reference to understand the board's side of that exchange.