Adrian Moreau · Chief Information Officer · Europe

What a CIO can help a board outside telecoms to see

My contribution to a board

I would bring a board a practitioner's reading of large technology change in a regulated, customer-facing business. I have spent twelve years writing the reports an integrator sends to its client and twelve years receiving them. I know which parts of a programme status report are designed to reassure, which risks are usually reported late and what questions reveal whether a migration, a consolidation or a decommissioning is genuinely safe. Most boards see technology programmes through cost and schedule. I can help them see customer consequences in numbers they can test: bills held before issue, complaints per thousand customers affected, records retrievable after a system is switched off.

I would also bring recent experience of cyber oversight as obligations on management bodies have tightened. I designed the NIS2 sessions our directors attended in 2024, and I report every quarter to an audit and risk committee that asks hard questions. I can help a board decide what it needs in front of it to oversee cyber risk rather than simply receive reports about it, and how to ask about suppliers' people and not only suppliers' policies.

My limits should be stated plainly. I am not a qualified accountant and would not present myself as the financial expert on an audit committee. I have chaired programme boards but not a board committee. I would expect to serve a full year as a member before chairing a technology or risk committee, and to learn the company's business before offering views on its systems.

Judgement in practice

Telling a board the savings date would move

When our third billing migration wave overcharged 7,900 households in November 2024, the integration case assumed the mobile platform would close by December 2025. I told the chief executive the same day and asked to brief the board's chair before the next meeting rather than after it. My paper set out the error, the refunds, the seven-week pause and its cost of about €6.4 million, and stated that the decision to accept a sampled test had been mine. One shareholder director asked whether the pause was necessary; I answered with the comparison between the cost of a full test and the cost of customers finding errors first. The board accepted a quarter's delay. As a non-executive, I would want management to bring a slipped date early and with its cause attached, and I would try to make that easy for them to do.

Replacing a maturity score with a count of people

During 2024 our audit and risk committee received a quarterly cyber maturity score that moved little and told directors almost nothing about our principal exposure. I proposed adding a single measure: the number of named people with privileged access, broken down by whether they worked for us, for a contracted supplier or for a subcontractor. The first figure was 1,140, which alarmed the committee chair and was meant to. I explained what it would cost to reduce, including about €1.8 million a year in repriced supplier work, and how quickly it could fall. The committee accepted both the measure and the cost. It now asks about every increase. On a board, I would look for measures that let directors see an exposure directly, even when the first reading is uncomfortable.

Asking a credit union board to test its exit before renewing

At Tullagreen Credit Union in 2023, management recommended renewing the outsourced core banking contract for seven years on improved terms. The board had never seen a tested plan for leaving that provider if it failed or raised prices sharply. I recommended deferring the renewal by three months while management produced an exit plan and tested the extraction of member records with the provider's help. Two directors worried that the provider would treat the delay as a negotiating signal. The extraction test found that loan histories before 2014 could not be exported in a usable form, which the provider then fixed at its own cost as a condition of renewal. As a director I try to ask what the organisation would do on the day a supplier stops, not only what the contract promises while it continues.

My first year on a board

The first thing I would do on joining a board is resist the pull of my own specialism. A company that appoints a CIO as a non-executive will tend to hand me the technology questions, and I would want to understand its customers, its regulators, its economics and its people before I said much about its systems. In the first three months I would read two years of board and committee papers, meet the chair, the chief executive, the finance director, the head of internal audit and whoever leads technology and security, and ask each of them what the board does not see.

Over the following six months I would attend every meeting of my committees and visit at least two operating sites, preferably where customers or patients meet the company's systems directly. I would ask to see one significant programme as its team sees it, not as the board summary presents it, and I would compare the two.

By the end of the year I would expect to have proposed, if it was needed, one change to what the board receives on technology or cyber risk, agreed with the committee chair rather than imposed. I would also ask the chair for a frank assessment of whether my questions had helped or had narrowed the board's view of a business that is not a telecom operator.

Conflicts and their management

My first obligation is to Lonmara, and any appointment would require the consent of our chief executive and our shareholders, and a review by our general counsel. I would decline any board in telecommunications, pay television or connectivity, any company that supplies Lonmara with systems, integration or network services, and any company in which Ostrevan Infrastructure Partners or Veltmoor Holdings holds an interest, because each of those creates a relationship I could not manage simply by stepping out of a meeting.

Some relationships would be smaller and should be disclosed rather than avoided. Many companies buy connectivity from Lonmara on standard terms, and Tullagreen Credit Union does. Where that is the case, I would tell the board at the outset, take no part in any decision about the contract and ask for the minutes to record it. I would also disclose any personal relationship with the company's technology suppliers, including former colleagues at Kervana, Halvecor or elsewhere.

If a conflict arose during an appointment that recusal could not contain, I would resign rather than hold a seat with conditions attached. I would never bring Lonmara's confidential information into another board's discussion, however relevant it seemed, and I would expect the same discipline from the other board in return.

My independence statement

Whether I am independent of a particular company is a judgement for its board under the governance code that applies to it, and I would not anticipate that judgement. What I can do is list what the board should weigh: my employment at Lonmara and the long-term incentive I hold under its cash-based plan; my directorship at Tullagreen Credit Union; any contract between Lonmara and the company, its suppliers or its owners; and my former employment at Kervana, from which I hold no continuing interest.

Committee contribution

Chair and member readiness
Capacity	Committees
Ready to chair	Technology or cyber risk committee, after a year as a member
Ready to join	Risk committee · Audit and risk committee, as a member with technology and cyber experience · Technology committee

Capacity and preferences

Time available: 20 days per year
Current directorships: 1
Sectors: Energy and water networks · Logistics and transport operators · Insurance and other regulated financial services outside telecommunications · Healthcare providers with large patient-record systems
Company type: Mid-sized listed or privately owned company in Ireland or Belgium with an established risk or audit committee and substantial dependence on outsourced technology
Company stage: A company in the middle of a large system replacement, a merger integration or new cyber obligations, where the board needs to oversee technology change it cannot see directly

The seat I am pursuing

I am looking for one non-executive seat, from 2027, on the board of a mid-sized company in Ireland or Belgium outside telecommunications, where technology change and cyber risk are central to the business but not its product. Energy and water networks, logistics and transport operators, insurers and healthcare providers are the settings in which my experience would transfer most directly, because each depends on large customer-record systems, outsourced technology and new security obligations. I would like to join the risk or audit and risk committee and, after a year, to chair a technology or cyber risk committee if the board has or wants one. I am not looking for a seat chosen because the board thinks it needs a technologist on the list. Before taking a conversation further, I would want to understand what the chair believes the board cannot currently see, the company's largest technology dependency and how it last tested its ability to recover from a serious incident.

Board and committee exposure

Served as a director

Tullagreen Credit Union

Board of directors; leads the board's oversight of outsourced IT and the core system replacement

December 2021–present

Volunteer director of a community credit union in south Dublin; led the board's review of its outsourced core banking contract and the exit plan required before renewal.

Reported to a committee

Lonmara Communications DAC

Audit and risk committee

March 2023–present

Quarterly report on technology and cyber risk, including privileged access by employer type, incident rehearsals and the decommissioning programme.

Presented to the Board or a committee

Lonmara Communications DAC

Full board

2023–present

Presented the support-systems consolidation plan, the decision to pause billing migration in 2024 and the 2024 director sessions on NIS2 responsibilities.

Presented to the Board or a committee

Tolvarra Broadband Limited

Board of directors

2019–2023

Presented the separation from the former owner's IT, the billing replacement investment case and IT due diligence on Lonmara Mobile.

Reported to a committee

Brennoch Business Communications

Audit committee

2017–2019

Reported on GDPR preparation and on the risks of the consolidated billing system.

Governance learning and readiness

IICA Independent Directors’ Databank: Not yet registered

India's IICA Independent Directors' Databank serves companies governed by Indian law, so it has no bearing on the Irish or Belgian boards I am considering, and I have not registered with it. For any appointment here, independence would be assessed by the board against the code that applies to that company.

Director-education programme on audit and risk committee practice, completed in 2025
Annual director training at Tullagreen Credit Union since 2022
Designed and attended, with Lonmara's general counsel and an external adviser, the 2024 board sessions on management-body responsibilities under NIS2
Executive MBA, Drumcarra Business School, 2012, including a module on corporate governance