The auditor who went back to run the systems he once examined

My father kept the books for a rubber trading company in Medan, North Sumatra, and on Saturdays I sat beside him while he reconciled the week's receipts against the bank statement. When the two did not agree he never adjusted his own figures to fit. He walked to the bank and asked a teller to show him the ledger card. I think of that walk whenever someone shows me a dashboard. The number on the screen is a claim about what happened, and somebody has to be willing to go and look.

I left Medan in 1994 on a scholarship to read computer engineering at Bencoolen Technical University in Singapore, graduated in May 1998 and joined the technology assurance practice of Haldane Wren that July. It was an odd moment to begin auditing banks. The Asian financial crisis had left several of our clients in Jakarta and Manila under severe strain, and the year 2000 date change gave every bank a reason to inventory its systems properly for the first time. I spent five years reading access logs, batch schedules and change records. I learnt that the most useful finding is usually small and specific: a supplier account with standing access to production, or a reconciliation marked complete for months without anyone opening it.

In 2003 I moved to Kellbrook Bank in Singapore as a technology risk manager, later covering its branches in Jakarta, Manila and Bangkok. My manager, Ong Siew Ling, made me rewrite my first risk paper four times because each version described controls rather than what a customer would experience if they failed. That habit has stayed with me. Kellbrook also gave me my first long stays in Manila, and I met my wife, an architect from Bacolod who was then working in Singapore.

Talampas recruited me in April 2008 to lead its IT audit function, reporting to the audit committee. Within a year I found that staff of the bank's main systems integrator held standing administrator access to the mainframe, granted during a project in 2004 and never withdrawn. Management proposed to close the finding on the strength of a plan. I asked the audit committee to keep it open until the access had actually gone, and the committee agreed. It took seven months. The integrator was Marrowgate Technologies, and years later I would spend part of my time as CIO reducing the bank's dependence on it. That first finding taught me how hard it is to remove something a supplier has come to regard as normal.

By 2012 I wanted to build rather than examine. I joined Sagwan Payments, a venture-funded e-money issuer in Makati, to run platform operations. Sagwan was small, quick and short of money, and it taught me things a bank could not. In 2014 we found that wallets opened that morning were receiving stolen funds from compromised bank accounts and being emptied at cash-out partners within the hour. With two analysts I wrote velocity rules that scored each incoming credit against how old the wallet was and how it had been used. They were crude, and they cut our fraud losses by more than half in a quarter. I have been thinking about receiving accounts ever since.

Benjamin Acuesta, then head of retail banking, asked me back to Talampas in October 2016 to run payments and digital channel technology. The country's instant-payment rail went live in 2018, and within a year our customers were sending more money in seconds than they had once sent by cheque in a week. When our chief information officer retired in 2019, the board appointed me to succeed him. The pandemic arrived nine months later. During the Luzon lockdown in March 2020, two-thirds of our branches closed for a time and mobile banking logins tripled in five weeks. The app stayed up, but I learnt how much of our capacity planning had quietly assumed that customers would walk into a branch.

Four questions have occupied me as CIO. The first is mule accounts: in 2023 our new in-app onboarding was opening accounts for people who rented them to scammers, and I had approved the dashboards that missed it. The second is availability. On 15 December 2023, a payday, QR payments and instant transfers failed for 3 hours 40 minutes while our monthly uptime report stayed above 99.9%. The third is the mainframe, which has carried our deposit and loan ledgers since 1997 and which we are leaving one product family at a time. The fourth is supplier concentration, which for me began with that audit finding in 2009.

I lead by asking for the customer count first. When an incident note reaches me, I want to know how many people could not do what, and for how long, before I read about root causes. I write my own papers for the board risk oversight committee, usually four pages long, with the measure I would least like to report placed on the first. I ask engineers to bring me the worst payday of the quarter rather than the average. Colleagues would say that I am patient with honest mistakes and slow to trust a green dashboard, and that my years in audit still show. I completed a part-time MBA at Escolta Graduate School of Business in 2015, mainly to understand the economics of the businesses I serve. It changed how I ask for money: I now begin with what a failure costs a customer, and only then with what it costs the bank.

Open to Board appointments · Advisory roles · Speaking invitations

Languages / English · Bahasa Indonesia · Filipino (working knowledge) · Hokkien (spoken)