The six places my judgement is tested

Each of our three acquisitions arrived with its own directory, email system and habits about who could administer what. Vanthiro in Ho Chi Minh City ran its own directory, Gajiwara in Jakarta used a cloud directory with no multi-factor authentication, and Siravanna in Bangkok shared administrator accounts. I treat identity as the first system to integrate and the last to be negotiable. Within ninety days of each closing, every employee of the acquired business signs in through our identity platform, with phishing-resistant authentication for administrators and payroll specialists. Joiner, mover and leaver changes flow from the HR record rather than from tickets, so that a resignation in Jakarta removes access within hours rather than at the next review. Finance and HR systems can follow later; access cannot. We now run one identity platform for 3,400 employees and about 600 contractors, and the median time to remove a leaver's access is under two hours.

Our 1,450 payroll specialists must see salaries, tax numbers and bank details to do their work, so I cannot design insider risk away by hiding data. What I can design is the small set of actions where one person could move money or extract personal data alone: changing where pay goes, adding a person to a payroll, altering a rate outside an approved file, approving an off-cycle payment and exporting a whole file. Since 2023 each of those needs a second, independent fact before it completes. Access to a client's records opens for the specialists rostered to that client during its pay window and closes afterwards, with cover approved by a team leader in minutes. We log every access against the assignment that allowed it and review alerts daily. I chose not to buy behavioural scoring software, because the useful signals appear only once the workflows are narrow.

Fast-growing technology companies buy software the way they hire, quickly and team by team. When I mapped our estate in 2022 there were 430 subscriptions costing S$11.6 million a year, and 64 of them held employee or client personal data without a data-processing agreement. I organise our register by the data each tool holds, in five classes from client payroll data to none, and set rules for each class: client pay and identity data may live only in eleven approved systems, and new tools that would hold personal data need a security and legal review before purchase. Company cards can no longer buy software. We reached 214 subscriptions and S$8.1 million of spend. The harder current question is existing tools that add AI features which pass content to another provider; each such change now returns to review, even when the vendor calls it a minor release.

For most of the data we hold, our clients decide why it is processed and we process it on their behalf. Singapore's Personal Data Protection Act treats a company in our position as a data intermediary: we must protect the data and, since the 2021 amendments, notify the client without undue delay if we find a breach, so that the client can assess whether to notify the regulator. The Philippines' Data Privacy Act, Thailand's personal-data law, Indonesia's 2022 law, Vietnam's 2023 decree and Malaysia's recently amended act each describe processors and transfers in their own terms, and several place conditions on sending personal data abroad. I do not pretend to give legal advice on any of them. My job is to keep an accurate record of which client data sits in which system and country, so that our counsel and our clients can answer their own obligations quickly and from evidence.

I learnt at Cendravale that data-centre capacity is measured in power, not floor space. Singapore paused approvals for new data centres in 2019 and has since allocated new capacity selectively, favouring efficient designs, while Johor's growth has brought its own questions about power connections and water for cooling. In 2023 our Singapore colocation provider could not give us the additional 120 kilowatts our internal systems needed for at least two years. I split our estate by the data it holds: corporate systems and disaster recovery in a Johor facility, client payroll data in a public cloud region in Singapore. I now treat hosting as a resilience decision first. Every system has a stated recovery time, every recovery plan is tested at least once a year, and every failed test goes to the Audit and Risk Committee as a failure, with the date of the retest.

In our first acquisition, in Vietnam in 2022, I was asked to plan the IT integration after the purchase agreement had been signed. My team found an unsupported payroll server, missing backups and administrator accounts held by former staff, and the remedy cost S$1.9 million that nobody had priced. Since then I have asked to start IT and security due diligence before the term sheet is final, with access to the business's systems lists, access reviews and incident history. Findings are graded by whether they should change the price, become a condition before closing, be funded through an escrow released against milestones, or simply join the integration plan. For Siravanna in 2024, that process produced a S$2.7 million holdback and two pre-closing conditions. I also look for the people the business cannot run without, because remediation that drives out its best engineers is a cost the model rarely shows.