My contribution to a board
I would bring to a board the habits of an engineer who has spent her career at the boundaries between organisations, where most expensive technology failures begin. I can read an operational-technology risk, a cyber incident report or a major system business case and tell a board what has been tested, what has only been asserted and what depends on another company's timetable. I have written those papers under pressure to get approval, so I know what tends to be left out: the cost of parallel running, the vendor's contract terms, the people who must change how they work, and the date on which an outside party such as an electricity network will actually deliver.
The ASX Corporate Governance Council recommends that a listed company's audit committee have at least three non-executive members, a majority of them independent, chaired by an independent director who is not the board chair. I would not be the committee's accounting expert. I would be the member who can test management's account of technology controls, cyber resilience and the risks of large system programmes, alongside directors with financial expertise. Many boards now ask their audit and risk committee to oversee cyber risk without anyone on it who has run a security function. I have run one, through a chief information security officer who reports to me.
I would also bring a willingness to recommend the slower, more expensive option and to say so in the first paragraph. At Morrowgate I asked the board to revise a commitment it had published, and I recommended a migration plan that cost A$11 million more than the alternative. Both recommendations were made on paper, with the cost stated and the people who disagreed named. A non-executive director has less information and more distance than an executive, and I would rely on the same discipline: ask for the evidence, state the objection plainly, and record it.
Judgement in practice
01Reporting a penetration test before the fix was ready
In September 2022 a penetration test we had commissioned reached the telemetry network of our reach stackers at one terminal from a compromised corporate laptop. The fix, network separation at that site, was already planned for the following quarter. Our security team's instinct was to accelerate the fix and report it as complete at the next committee meeting. I reported the finding to the chair of the Audit and Risk Committee within the week, with what we knew, what we did not, and the interim controls we had put in place. The committee asked for monthly updates until the work was finished in December. As a director I would want exactly that: bad news early, with its uncertainty stated, rather than a closed finding presented after the event.
02Putting technology diligence into the price, not the integration plan
In 2024 Morrowgate agreed to acquire a regional cold-chain carrier for A$140 million. My team's diligence found that its transport and telematics systems ran on unsupported software, that administrators shared passwords, and that temperature records for some pharmaceutical customers had unexplained gaps. The deal team wanted to treat these findings as integration tasks. I recommended a price adjustment and a specific indemnity for the temperature records, because a buyer that fixes a seller's gaps after completion pays for them twice. The board negotiated an A$8 million reduction and the indemnity. Integration cost A$7.4 million. I would ask the same question of any acquisition paper as a director: which technology findings are in the price, and which have been left to the integration budget?
03Pausing a driver ranking before it was published
In 2022 our operations team proposed publishing a monthly ranking of every driver's telematics safety score at each depot. The scores weighted harsh braking and cornering heavily. When we tested them against routes, night-shift drivers on the hilly Hume corridor and drivers on dense metropolitan work scored worst, regardless of how they drove. I asked the Safety, Health and Environment Committee to delay publication while we adjusted for route and shift, and to use the scores for coaching rather than ranking. Some operations managers saw the delay as protecting poor drivers. The adjusted scores, introduced six months later, identified a different and smaller group for coaching. On any board I would ask how a new measure treats the people it measures before approving its use.
My first year on a board
I would spend my first quarter learning how the company actually operates. I would read two years of board and committee papers, the internal audit plan and its findings, the external auditor's management letters and the company's register of material risks, and I would ask how cyber and operational-technology risk reach the board, and from whom. I would visit at least two operating sites, because the controls that matter in an asset-heavy business are physical as well as procedural, and I would meet the chief information security officer and the head of internal audit without other executives present, if the committee chair agreed.
For the rest of the year I would serve as a committee member and not seek a chair. I would want to learn which judgements recur each quarter, where management's reporting is strong and where it relies on assertion. Near the end of the year I would ask the board chair and the committee chair for direct feedback on whether my questions had been useful, and I would use the board's own evaluation to test that answer rather than my impression of it.
Conflicts and their management
My first obligation is to Morrowgate. I would not join the board of any freight, logistics, stevedoring, rail or fleet-leasing business, any technology or equipment supplier to Morrowgate, any electricity network or retailer that supplies our depots, or any customer that uses our services to a material extent. Before accepting a seat I would disclose my Morrowgate shareholding and my directorship of Kestwick Driver Training Foundation, and I would seek Morrowgate's board consent.
If a conflict arose after appointment, for example because the company began buying freight services from Morrowgate, I would declare it at once, leave the room for the relevant discussion and offer to resign if the relationship looked likely to recur. Time is the other conflict. Morrowgate's results calendar and another company's will overlap, so I would agree meeting dates a year ahead and keep 25 days genuinely free, including preparation and site visits.
My independence statement
I am a full-time executive of Morrowgate and hold its shares through an executive equity plan. I would accept a non-executive seat only at a company with which Morrowgate and I have no material business, family or financial relationship, and I would disclose everything relevant before any appointment is considered. The ASX Corporate Governance Council's recommendations describe relationships that may bear on a director's independence; whether I would be independent of a particular company is for its board to assess on the facts I disclose.
Board and committee exposure
Presented to the Board or a committee
Morrowgate Freight Limited
Board of directors: technology strategy, the transport-platform replacement and the fleet energy programme
March 2021–present
Presents twice a year and on major capital decisions, including the 2023 recommendation to revise the electric-truck commitment; not a director and holds no vote.
Reported to a committee
Morrowgate Freight Limited
Audit and Risk Committee: cyber security, technology risk and the critical infrastructure risk management programme
March 2021–present
Reports every quarter and prepares the annual programme report that the board approves; internal audit reports to the committee independently of me.
Presented to the Board or a committee
Morrowgate Freight Limited
Safety, Health and Environment Committee: fatigue technology, telematics data policy and fleet electrification
July 2022–present
Presents twice a year on driver-monitoring cameras, electronic work diaries and electric-truck performance.
Served as a director
Kestwick Driver Training Foundation
Board of a not-for-profit that trains new heavy-vehicle drivers in regional Victoria
2022–present
Non-executive director with a vote; approves the annual budget, the training-fleet replacement plan and the chief executive's appointment and review.
Member of a committee
Kestwick Driver Training Foundation
Finance and Risk Committee
2023–present
Member of a three-person committee reviewing accounts, insurance, grant compliance and the risk register.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is an Indian requirement for independent directors of Indian companies, and it does not apply to any board in Australia that I am considering. I have not registered with it. My preparation has been a company directors' course completed in 2023, service on a not-for-profit board and committee, and more than five years of reporting to a listed company's Audit and Risk Committee.
- Company directors' course completed with the Australasian Board Practice Institute in 2023
- Quarterly reporting to Morrowgate's Audit and Risk Committee since 2021, and the annual board approval of our critical infrastructure risk management programme
- Director of Kestwick Driver Training Foundation since 2022 and member of its Finance and Risk Committee since 2023
- Annual sessions with Morrowgate's external auditors on IT general controls and with its general counsel on directors' duties under the Corporations Act 2001
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to chair | A technology and cyber risk committee, after a year as a member |
|---|
| Ready to join | Audit and Risk Committee · Safety, Health and Environment Committee · Technology and Cyber Committee |
|---|
Capacity and preferences
- Time available
- 25 days per year
- Current directorships
- 1
- Sectors
- Water and wastewater utilities · Hospital and aged-care operators with large connected facilities · Building materials and construction services · Food processing with regional supply chains, where there is no customer relationship with Morrowgate
- Company type
- An ASX-listed company outside the top 100, or a large unlisted or government-owned business, with physical operations that depend on connected equipment and no material relationship with Morrowgate
- Company stage
- An established business in the middle of an operational-technology, cyber or energy transition that has raised new questions for its Audit and Risk Committee
The seat I am pursuing
I am pursuing one non-executive directorship at an ASX-listed company outside the top 100, or at a large unlisted or government-owned business, where physical operations depend on connected equipment and where an energy, automation or cyber transition is under way. Water utilities, hospital and aged-care operators, building-materials producers and food processors share the problems I know best: equipment that was never designed for open networks, large system replacements that must not interrupt operations, energy decisions constrained by a network connection, and boards that need technology risk explained without jargon.
I want to join the Audit and Risk Committee and, after a year, chair a technology or cyber committee if the board has one or wishes to form one. I am not seeking a seat to make up numbers, and I would not take a second board role while I remain an executive. Morrowgate and the company concerned both deserve my full attention.