In 2006, during an IT audit at an insurer's Singapore office, I asked for a list of the people who could approve a claim payment above the branch limit. The business believed there were five. The system returned sixty-three, most of them added during a busy quarter years earlier and never removed. As far as we could find, nobody had misused the permission. But the company's picture of who could act on its behalf was wrong by a factor of twelve, and I have spent most of my career since closing that kind of distance.
01 / Identity and access across acquired companies
02 / Payroll-operations controls and insider risk
03 / Software portfolio and personal-data mapping
04 / Data-processor obligations in six countries
05 / Hosting capacity and disaster recovery
06 / IT due diligence in cross-border deals
Employees paid through Amarisca each month
1.9 million
For 9,800 employers in six Southeast Asian countries
Fewer standing access paths to client records
96%
After access tied to rostered pay runs replaced country-wide access in 2023
Annual software spend removed
S$3.5m
430 subscriptions cut to 214, every personal-data tool under agreement
A payroll company holds a region's salaries and bank details, so I judge our systems by how little any one person, supplier or acquisition can reach.
I am the chief information officer of Amarisca Workforce Technologies, a fictional Singapore company that pays 1.9 million employees a month for 9,800 employers in six Southeast Asian countries. We sell cloud payroll and HR software, and for many clients our own specialists prepare every pay run. Revenue in 2025 was S$318 million. My remit is the inside of the company: identity, enterprise systems, corporate security, the workbench our 1,450 payroll specialists use and the technology half of every acquisition. The customer product belongs to our chief technology officer.
I came to this work from the auditor's side of the table. After seven years testing technology controls for Singapore banks, insurers and listed companies, I crossed over to run IT and security for a colocation operator in Kuala Lumpur, then enterprise technology for a Singapore travel-booking company that grew from 600 to 2,100 people. I joined Amarisca in January 2020 and became its CIO in April 2022.
The decisions I am proudest of made the company slower or less comfortable for a while. After a specialist diverted S$231,400 of client employees' salaries in 2023, we took bank-detail changes away from the people who run the pay and made access to each client expire with its pay run. Before we bought a Thai payroll business in 2024, I asked for part of the price to be held back until its servers were rebuilt. I think a CIO in a business like ours earns trust by narrowing what anyone can reach, and by saying so to the board before an incident says it for us.
Access that closes when the pay run does
After the 2023 diversion, access to a client's records opens only for rostered specialists during its pay window. Standing access paths fell by about 96 per cent. There has been no diversion since, and one 4,200-employee client left us over slower bank-detail changes.
A holdback written into a Bangkok purchase
Due diligence on Siravanna Software found shared administrator accounts and untested backups. A S$2.7 million escrow was released against four milestones, met within eleven months. A ransomware attempt after closing reached one office file server and no payroll data.
Software counted by the personal data it holds
We traced 430 software subscriptions by the data they held, not by invoice, and cut them to 214. Annual spend fell from S$11.6 million to S$8.1 million, and every tool still holding employee or client personal data now operates under a signed data-processing agreement.
Two hosting locations chosen for different data
When our Singapore colocation hall could not give us more power in 2023, we moved corporate systems and disaster recovery to Johor and kept client payroll data in a Singapore cloud region. The split costs S$1.3 million a year less than moving everything to the cloud.
Current focus
Two pieces of work fill my calendar into 2027. The first is IT due diligence on a proposed acquisition of a payroll bureau in Manila, which our board expects to consider in the first quarter. The second is replacing passwords with device-bound credentials for every payroll specialist before the year-end tax season, when the volume of urgent changes is highest and the temptation to share a login is greatest.
Conversations I welcome
I am not looking to leave Amarisca. I would consider one independent directorship at an SGX-listed company, or a larger private group preparing to list, outside HR and payroll technology. I would expect to join a board risk committee or a technology committee, and to chair one after a year if the board wished. I can give about twenty-four days a year, subject to our board's consent and a conflicts review, and I accept a few invitations each year to speak to audit and risk committee members.
Beyond the page
The record behind the perspective.
In the boardroom
Siravanna Software Co., Ltd.Director of the wholly owned Thai subsidiary, in an executive capacity · 2024–present
Sevaline Learning TrustBoard member of a Singapore digital-skills charity · 2021–present
Formation
Bachelor of Computing (Information Systems)Straitsmoor University · 2001
Master of Science in Information Security, part-timePelangra Institute of Technology · 2007
A week before we signed in Bangkok, Serena told me the deal should either cost us less or wait. I did not enjoy hearing it, and I gave her less than she asked for. Four months later an attacker hit a server whose administrator passwords she had already made the sellers change.
Damian Teoh Wei KiatFictional co-founder and chief executive, Amarisca Workforce Technologies Pte. Ltd.The full record ↗
Contact
I am not looking to leave Amarisca. I would consider one independent directorship at an SGX-listed company, or a larger private group preparing to list, outside HR and payroll technology. I would expect to join a board risk committee or a technology committee, and to chair one after a year if the board wished. I can give about twenty-four days a year, subject to our board's consent and a conflicts review, and I accept a few invitations each year to speak to audit and risk committee members.
