William AshfordChief Information Officer

William Ashford · Chief Information Officer · Australia

Oversight for boards that run trucks, trains and terminals

My contribution to a board

Most boards I would join run physical assets: trucks, trains, terminals, storage or plant. Their systems are rarely the product, yet a system failure can stop the operation, harm a worker or a road user, or expose customers' data. I would bring three things to such a board. First, a habit of asking when a system matters most in the operating year and whether testing, change control and recovery are planned around that period rather than the convenience of a project timetable. Second, practical experience of operational technology that sits close to safety, such as rostering against fatigue rules, receival queues and shiploader controls, and of separating it from corporate networks. Third, a willingness to put a cost on a cautious choice and report it honestly, because boards make better decisions when management states what a safer option takes away. I would also bring the limits of my experience. I have presented to an audit and risk committee for six years but never voted on its recommendations, and I have no experience of capital raising or executive remuneration decisions.

Judgement in practice

01

Asking what a delay would cost on the road

When the receival programme fell behind in 2023, the debate in management was framed as budget against schedule. I asked the board paper to describe what a failed harvest cutover would look like at a weighbridge: trucks queued across fourteen sites, drivers' work hours extending, paper tickets for every load and weeks of reconciliation. Once that consequence was described plainly, the A$2.6 million cost of deferral could be weighed against something real. As a director I would ask the same question of any programme timed close to an operating peak: what happens to people and vehicles if this goes wrong at the worst moment, and who has tested the fallback? I would not expect directors to judge the technical readiness themselves, but I would expect them to see the evidence for it.

02

Separating a design flaw from a finding about conduct

The terminal access review found that our trading staff could see other exporters' nominations. It would have been easy to treat that as an accusation, or to minimise it because no misuse was found. I recommended presenting it to the audit and risk committee as a control design flaw with a fairness obligation behind it, setting out the narrow and fuller options with their costs and the trading subsidiary's objection. The committee chose the fuller rebuild. On another board I would look for the same discipline: a clear description of what a control failure allowed, separate from any conclusion about people, with legal advice kept distinct from management's preference. Directors should be able to see both the obligation and the commercial cost of meeting it before deciding.

My first year on a board

My first months would be spent learning how the organisation earns its money and where its operating year is under the most pressure. I would ask to visit a depot, site or terminal during a busy period, not only on a scheduled tour, and to read the last two years of audit and risk committee papers. I would want to understand which systems the business cannot operate without, who owns them, and when they were last tested under realistic conditions. I would also ask the chair what the board wants from me in particular and agree how I should raise questions between meetings without drifting into management. By the end of the first year I would hope to have contributed to at least one significant decision with a clear understanding of its trade-offs, and to have asked the chair for direct feedback on whether my questions were useful or merely technical.

Conflicts and their management

Grain handling is a small industry in a few regions, and that shapes my conflicts more than any formal rule. Competing bulk handlers, exporters who use our terminal, rail operators we contract, software vendors we buy from and the port authority where we lease our berth could all be connected with a board I might join. I would list those relationships before any discussion progressed, and I would expect a board to decline me if a competitor relationship could not be managed. Where a conflict arose on a particular matter, I would declare it and leave the discussion. If that happened often, the appointment would be wrong and I would step down rather than become a director who regularly sits out the important items. Ninderbrook's confidential information, including grower data, pricing and terminal plans, would stay with Ninderbrook. My harvest commitments also limit availability from October to January, which a board would need to know before appointing me.

My independence statement

I am employed by Ninderbrook Bulk Logistics and hold no shares in it. Any organisation that competes with Ninderbrook for growers' grain, uses its terminal, supplies it or is supplied by it would raise an independence question that the board, not I, should decide with full disclosure from me.

Committee contribution

Chair and member readiness
CapacityCommittees
Ready to joinAudit and risk · Safety and operational risk · Technology and cyber, where established

Capacity and preferences

Time available
22 days per year
Current directorships
0
Sectors
Agribusiness and grain supply chains · Ports, rail and road freight · Regional infrastructure and member-owned organisations
Company type
Unlisted company, member-owned cooperative or government business enterprise with heavy-vehicle, plant or port exposure
Company stage
An organisation replacing core operating systems or strengthening its oversight of cyber and safety risk

The seat I am pursuing

I am seeking a first seat on a board that oversees physical operations where systems are part of the risk but not the whole of it. Good examples would be a member-owned agricultural cooperative, a regional freight or port business that does not deal with Ninderbrook, a water or energy utility with significant operational technology, or a government business enterprise in transport. I would prefer an unlisted organisation with an experienced chair and a functioning audit and risk committee, where I could learn the director's role before considering any committee chair. I would rather join a smaller board that wants my experience for a clear reason than a larger one where I would be the token technologist. I would not accept a seat that required me to reduce my commitment to Ninderbrook without its chief executive's agreement, or one whose calendar could not accommodate harvest.

Governance learning and readiness

IICA Independent Directors’ Databank: Not yet registered

India's IICA databank is a register for that country's independent directors and plays no part in appointments in Australia, where every seat I am considering sits. I have therefore not registered with it.

  • Completed an introductory programme for new directors in early 2025 covering duties under the Corporations Act 2001, financial statements and board risk oversight.
  • With the chair's permission, studying the charter, papers and minutes of Ninderbrook's audit and risk committee beyond the items I present.
  • Reading the ASX Corporate Governance Council's Principles and Recommendations, although my first seat is more likely to be unlisted.

Board and committee exposure

Presented to the Board or a committee

Ninderbrook Bulk Logistics

Audit and risk committee; annual board technology session

January 2020–present

Presents quarterly on cyber security, technology risk and major programmes, including the receival deferral and access separation; not a director.

Reported to a committee

Kurrajine Coaches

Owners' risk committee

2016–2019

Reported quarterly on rostering and driver-hours system reliability, data quality and technology risk.