Twenty-eight years from the audit file to the CIO's office

Mandate

Keep payment channels reliable as instant and QR volumes multiplied, reduce dependence on the mainframe and on a single integrator, and give the board measures of technology risk it could act on.

Outcomes

• Reduced confirmed mule accounts from 8.3 to 1.6 per thousand digital openings between the first half of 2023 and the second quarter of 2025.
• Raised payday QR payment success from 99.2% in 2023 to 99.86% in 2025, with no payday incident over thirty minutes in 2025.
• Moved 6.9 million time deposit and savings accounts off the mainframe in two migrations, cutting the overnight batch from 6h10m to 3h20m.
• Reduced one integrator's share of change spend from 64% to 37% and built a 52-person in-house engineering team with its own design authority.
• Kept mobile banking available through the 2020 Luzon lockdown as logins tripled in five weeks.

Decisions in context

The board appointed me chief information officer in June 2019, when instant-payment volumes were growing faster than any of our plans had assumed. My first year was dominated by the pandemic: we kept the mobile app running as logins tripled and moved most of the technology organisation to home working in a fortnight. From 2021 I turned to structural problems. I split our integrator's contract and built an in-house design authority, persuaded the board to leave the mainframe in phases rather than in one cut-over, and after the December 2023 payday failure replaced system uptime with journey measures whose tolerances the board risk oversight committee sets. With our head of fraud operations I redesigned the first two days of a new digital account to keep mule accounts out. I present to the risk oversight and IT steering committees every quarter and attend board meetings when technology matters are on the agenda. I am not a director of the bank.

Reason for the move

Current appointment; completing the deposit migration and preparing the loan migration.

Mandate

Connect the bank to the new instant-payment rail, rebuild the mobile app and stabilise the ATM and card switch.

Outcomes

• Connected Talampas to the instant-payment rail at its 2018 launch; instant volumes reached 5.2 million a month by mid-2019.
• Replaced the mobile app; monthly active users rose from 0.6 million to 1.7 million.
• Reduced ATM unavailability from 4.1% to 1.3% of operating hours.
• Prepared merchant QR acceptance ahead of the interoperable QR standard.

Decisions in context

Benjamin Acuesta, then head of retail banking, asked me back to Talampas to run the technology behind payments, cards, ATMs and the mobile app. My main task was readiness for the country's instant-payment rail, which went live in 2018. We connected on the first day and spent the following year discovering what real-time money did to systems built around overnight posting: balance queries, duplicate credits after timeouts and fraud that moved faster than our monitoring. I rebuilt the mobile app with a new team, replaced ATM monitoring that had reported machines as available when they had no cash, and prepared merchant QR acceptance before the interoperable standard arrived. I also worked closely with the chief information officer on the first plans to reduce our dependence on the mainframe. When he retired in 2019, the board appointed me to succeed him.

Reason for the move

Appointed chief information officer by the board on the retirement of my predecessor.

Mandate

Make a fast-growing wallet platform reliable and controllable enough for its regulator, its partner banks and its customers.

Outcomes

• Raised platform availability from 98.1% to 99.7% while wallets grew from 0.4 million to 3.1 million.
• Cut cash-out fraud losses by 58% in one quarter of 2014 with velocity rules on incoming credits.
• Built the first daily reconciliation between wallet balances and the partner-bank trust accounts holding customer funds.
• Prepared the company for its first full examination of technology and operations by the central bank.

Decisions in context

Sagwan Payments was a venture-funded e-money issuer with ninety people when I joined and about 380 when I left. I ran platform operations: infrastructure, releases, reconciliation and, because nobody else did, the first fraud controls. In 2014 we found that wallets opened the same morning were receiving stolen funds from compromised bank accounts and being emptied at cash-out partners within the hour. With two analysts I wrote velocity rules that scored each incoming credit against the wallet's age and history, and losses fell by more than half within a quarter. I also built the first daily reconciliation between wallet balances and the trust accounts at partner banks holding customers' money, which our regulator expected and our investors had not funded. The role taught me speed, the economics of a small company and how a receiving account becomes the weak point of a payment chain. I left when Talampas offered me the chance to apply those lessons at scale.

Reason for the move

Invited back to Talampas to run payments and digital channel technology as the instant-payment rail approached.

Mandate

Build a risk-based IT audit plan for a bank whose technology audits had been checklist reviews.

Outcomes

• Removed standing supplier administrator access to the mainframe after keeping the finding open for seven months.
• Introduced risk-based coverage of all 160 applications on a three-year cycle.
• Reduced overdue technology audit findings from 61 to 9 through quarterly reporting to the audit committee.
• Audited the bank's first internet banking platform before launch.

Decisions in context

I joined Talampas to lead an IT audit team of fourteen that had been carrying out checklist reviews. I introduced a risk-based plan covering all 160 applications on a three-year cycle and began reporting overdue technology findings to the audit committee each quarter. My most consequential finding came in 2009: staff of the bank's main integrator held standing administrator access to the mainframe, granted during a 2004 project and never withdrawn. Rather than accept a remediation plan, I asked the committee to keep the finding open until the access had gone, and it agreed; removal took seven months. I also audited the bank's first internet banking platform before launch and found weaknesses in session handling that were fixed before any customer used it. By 2012 I wanted responsibility for building systems rather than examining them, and I left to find out whether I could.

Reason for the move

Wanted to build and run systems rather than examine them; joined an e-money start-up.

Mandate

Assess technology and outsourcing risk in the bank's overseas branches and bring them to the group's control standards.

Outcomes

• Wrote the first technology risk assessments for the Jakarta, Manila and Bangkok branches.
• Brought outsourcing contracts in three countries under one review process with tested exit clauses.
• Led the review of a card-data incident at a third-party processor serving an overseas branch in 2007.

Decisions in context

Kellbrook was a Singapore-listed regional bank with branches in Indonesia, the Philippines and Thailand, each running a mixture of group systems and local outsourcing. I joined its technology risk function to assess those overseas branches and bring them up to the group's standards. My manager, Ong Siew Ling, insisted that every risk paper describe what a customer would experience if a control failed, and she returned my first one four times until it did. I wrote the first technology risk assessments for the Jakarta, Manila and Bangkok branches, brought their outsourcing contracts under a single review process with exit clauses that we actually tested, and in 2007 led the review of a card-data incident at a third-party processor serving one of the branches. Long periods in Manila introduced me to Philippine banking and to the people who later recruited me to Talampas.

Reason for the move

Recruited by Talampas to lead its IT audit function in Manila.

Mandate

Audit system controls at banks and finance companies, as part of financial statement audits and year-2000 reviews.

Outcomes

• Audited general IT controls for eleven banking clients in Singapore, Jakarta and Manila.
• Worked on year-2000 readiness reviews at four banks in 1999.
• Promoted to manager in 2001 and ran engagement teams of up to eight.

Decisions in context

I joined Haldane Wren's technology assurance practice in Singapore straight from university, in the months after the Asian financial crisis. Much of the work supported financial statement audits of banks and finance companies in Singapore, Jakarta and Manila: testing access controls, change management, batch processing and reconciliations. In 1999 I worked on year-2000 readiness reviews at four banks, which gave me an early view of how little most institutions knew about their own systems. Gerald Thwaite, the partner who trained me, taught me to write findings that named one specific failure and its consequence rather than a list of weaknesses. I was promoted to manager in 2001 and ran engagement teams of up to eight. I left in 2003 because I wanted to be the person who decided what to do about a finding, not the person who reported it.

Reason for the move

Moved to a bank to own risk decisions rather than report on them.