My contribution to a board
The first thing I would bring to a board is a reader's eye for technology papers. I spent ten years writing audit and risk reports and have spent seven receiving them as a CIO, so I know where management papers soften the news: availability averaged over a month, project status measured against a plan that has quietly been rebaselined, supplier risk described by spend rather than by what the company could not do without the supplier. I can help directors ask for the measure that would show the problem, and help management produce it without turning every meeting into an inquiry.
Second, I understand how customer-facing systems fail at scale and what recovery costs. A hospital network's patient records, a utility's billing run and a logistics company's dispatch systems are not banks, but they share the problems I work on: peaks that averages hide, ageing core platforms, dependence on one or two suppliers and fraud that arrives through the same convenience customers value. I would bring experience of deciding those questions with a board, not only advising on them.
I would not offer myself as an expert in accounting or audit standards. My IT audit background would let me serve usefully on an audit committee, but its chair should have deeper financial reporting experience than mine. The committee I am ready to chair is one that oversees technology or operational risk, and I would want a year on any risk committee before chairing it.
My first year on a board
For a quarter I would mostly read papers and ask questions. I would ask the company secretary for two years of board and committee papers on technology, outages, cyber incidents and major projects, and I would read the incident reports as they were first sent rather than as they were later summarised. I would meet the chief information officer, the chief information security officer, the head of internal audit and the external auditor's technology partner separately, and ask each the same question: which risk does this board understand least?
In the middle of the year I would visit operations rather than offices: a hospital ward at night, a billing centre on its busiest day or a warehouse at peak, depending on the company, to see how its systems behave when demand is highest. I would keep my views to myself until I had seen one full planning and budget cycle, unless I found a risk the board had not been told about.
Towards the end of the year I would ask the chair whether my questions had helped or slowed the board, and whether my banking habits had narrowed how I read a different business. If my contribution on technology risk proved useful, I would offer to help redesign the board's reporting on it for the following year.
Conflicts and their management
My employment at Talampas comes first, and any appointment would need our chief executive's consent and a review by our compliance and legal teams before I accepted. I would decline a seat at any bank, quasi-bank, e-money issuer, payment operator or lender, and at any technology supplier that sells to Talampas or bids for its business; banking rules on interlocking positions would in any case need to be checked. I would also decline a company that is a significant borrower from Talampas or provides it with material services.
Before appointment I would give the board a written list of my shareholdings, my trusteeship at Kalinaw Schools Foundation and any supplier I oversee at Talampas that also serves the company. Where a matter touched Talampas or one of its suppliers, I would declare it, leave the discussion and ask for the recusal to be minuted. I would not bring Talampas supplier prices, incident details or customer data into another boardroom, however relevant they seemed. If recusals became routine, I would resign the seat.
My independence statement
I am a serving executive of a listed bank and hold Talampas shares through our employee plan. Before any appointment I would put those facts in writing, together with my trusteeship and any commercial relationship between Talampas and the company. Whether I can be treated as independent is for that company's board to decide under the rules that apply to it, and I would not call myself independent until it had.
Judgement in practice
01Withdrawing the uptime report I had presented for four years
After the payday failure of December 2023, I told the board risk oversight committee that the monthly uptime figure I had presented since 2019 had never measured what customers experienced, and that I should have replaced it sooner. I proposed journey measures that would make our next reports look worse, and they did: in the first quarter, three of nine journeys breached their payday tolerances. The committee chair, Leticia Dumagan, asked for the worst payday of each quarter to be shown beside the average, and that has become the most discussed page of the pack. As a director, I would ask management early which of its own measures it no longer trusts, and treat the answer as useful rather than embarrassing.
02Keeping an audit finding open against management's wishes
In 2009, as head of IT audit, I found that our main integrator's staff held standing administrator access to the mainframe. Management proposed to close the finding on the strength of a remediation plan. I asked the audit committee to keep it open until the access had actually been removed and to receive a monthly update until then. Two senior executives thought this disproportionate for a long-standing supplier. The committee sided with me, and the access was withdrawn seven months later. I learnt that a committee's patience with a plan is itself a decision, and that directors should say explicitly how long they will accept one.
03Asking a school foundation how it would leave a provider
In 2023, shortly after I became chair of its finance and audit committee, the management of Kalinaw Schools Foundation proposed moving fee collection and parents' records to a low-cost overseas platform. The saving was real, about ₱3 million a year on a ₱180 million budget. I asked two simpler questions first: who could export the records if the provider failed, and what parents had been told. Nobody could answer either. The committee approved a local provider at a slightly higher cost, with a records export tested every term. As a non-executive I try to ask how we would leave before I ask what it costs.
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to chair | A board technology or IT risk committee · Risk oversight committee, after a full year as a member |
|---|
| Ready to join | Audit committee · Risk oversight committee · Board IT or technology committee |
|---|
Capacity and preferences
- Time available
- 22 days per year
- Current directorships
- 1
- Sectors
- Hospital and diagnostic networks with large patient-record systems · Electricity distribution and water utilities with billing and payment channels · Logistics and fulfilment companies that depend on continuous systems
- Company type
- A company listed on the Philippine Stock Exchange, or a large regulated not-for-profit, with no lending, payments or e-money business
- Company stage
- A company replacing core systems, adopting cloud services or recovering from a serious outage, whose board needs a director able to read technology risk papers critically
The seat I am pursuing
I am looking for one independent seat on the board of a listed Philippine company, or a large regulated not-for-profit, whose customers depend on systems that cannot stop: a hospital network, an electricity or water distributor, or a logistics and fulfilment business. I would like to join the audit or risk committee and to chair a technology or IT risk committee if the board has one or decides to form one. The companies where I could help most are in the middle of something difficult, such as replacing a core platform, moving services to the cloud, reducing dependence on a supplier or rebuilding trust after an outage. I am not interested in serving as the board's resident technologist, invited to comment on every digital idea, and I would decline a seat that came without committee work. Before going further I would want to understand what the chair thinks the board lacks, how the company reports technology risk today and how much board time recent incidents have taken.
Board and committee exposure
Presented to the Board or a committee
Talampas Bank
Board risk oversight committee
June 2019–present
Presents the quarterly technology risk report, including payday journey performance against tolerances, mule-account measures and the core migration risk register.
Presented to the Board or a committee
Talampas Bank
Board IT steering committee
June 2019–present
Presents the technology strategy and budget, supplier concentration reporting and a one-page record for each cloud service; raised the integrator key-person dependency in 2021.
Reported to a committee
Talampas Bank
Board audit committee
April 2008–October 2012
As head of IT audit, reported functionally to the committee each quarter on technology findings and overdue remediation.
Served as a director
Kalinaw Schools Foundation
Board of trustees; chair of the finance and audit committee from 2023
March 2021–present
Trustee of a not-for-profit running eleven low-fee schools in Rizal and Laguna; chairs the committee that oversees its accounts, external auditor and fee-collection systems.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
India keeps its own register of people eligible to serve as independent directors of Indian companies, the IICA Independent Directors' Databank. It does not apply to the Philippine appointments I am considering, and I have not registered. For a company listed in Manila, independence would be assessed by its board under the Philippine SEC's corporate governance rules and any requirements of its sector regulator.
- A corporate governance orientation course accredited for directors of listed companies, completed in 2024
- Annual corporate governance and anti-money-laundering briefings for Talampas senior officers
- Trustee service at Kalinaw Schools Foundation since 2021, including chairing its finance and audit committee
- Four and a half years reporting to a bank audit committee as head of IT audit