Four decisions that narrowed what anyone could reach

Holding back S$2.7 million of a Bangkok purchase until its payroll servers were rebuilt

In early 2024 we agreed in principle to buy Siravanna Software, a Bangkok payroll bureau and software company with 310 staff and about 1,100 clients, for 1.62 billion baht, roughly S$61 million. Unlike in Vietnam, I joined due diligence before the price was fixed, and my team had three weeks of access.

We found that Siravanna's payroll engine ran on two servers in its Bangkok office, on an operating system the vendor no longer supported. Eleven administrator accounts were shared, remote access needed only a password, backups had never been restored in a test, and its records of processing under Thailand's personal-data law were incomplete. None of this meant a breach had occurred. It meant the business could suffer one at any time, and its clients' payroll data would become ours to protect at closing.

I recommended a S$4.5 million holdback, released against remediation milestones, and two conditions before closing: rotating every administrator credential and adding multi-factor authentication to remote access. Our chief strategy officer, who led the deal, disagreed. Another bidder was in the process, and he believed the sellers would walk away rather than accept a holdback of that size. He was probably right. The chief executive settled on S$2.7 million in escrow against four milestones within twelve months, and both pre-closing conditions. I accepted the smaller figure.

The deal closed in July 2024. In November an attacker encrypted a file server in Siravanna's office that had not yet been connected to our network. Because the credentials had been rotated, the attack did not reach the payroll servers, and we restored the file server from backup within a day. Three milestones were met within nine months and the fourth, moving the payroll engine to our hosted environment, in eleven. The escrow was released in full in June 2025.

The cost was real. Two of Siravanna's three senior engineers left within six months, partly because of the pace we set, and we paid contractors S$380,000 to cover them. Since then, every acquisition paper our board receives carries a section of IT findings graded by whether they change price, terms or only the integration plan.

I would offer retention arrangements to the key engineers at signing, not after they resign, and I would ask for four weeks of access rather than three.

Taking bank-detail changes away from the people who run the pay

In February 2023 an employee at one of our client companies told her HR team that her salary had not arrived. Within a day we found that a specialist in one of our operations centres had changed the bank details of seventeen employees at two clients in the days before their pay runs. Over two monthly cycles, S$231,400 had gone to accounts he controlled. We repaid every affected employee within two working days, reported the matter to the police and told both clients before they asked.

Our review was uncomfortable. The specialist had held exactly the permissions his role required, and our quarterly access reviews had confirmed it. A bank-detail change could arrive by email, be entered and be paid by the same person. The role was the weakness, and every one of our 1,100 specialists at the time held a version of it.

I proposed three changes: bank-detail changes only from employees through our self-service app with verification, or from a named client HR officer confirmed by call-back; a freeze on changes within three working days of a pay cut-off; and access to each client's records only for rostered specialists during that client's pay window. Our head of payroll operations disagreed with the third change. She argued that specialists covering for sick colleagues would be stranded and that clients' ad hoc queries would wait. Our chief revenue officer warned that clients with factory workforces would object to the freeze. Both were right.

We introduced the changes over five months. Standing access paths from specialists to client records fell by about 96 per cent. Query response times rose in the first quarter, and we added a read-only view of the previous three pay runs that opens with a logged reason. One manufacturer with 4,200 employees, many without smartphones, left us at renewal, taking S$0.9 million of annual revenue. There has been no diversion since, and the client audits that followed found no exception in the bank-change workflow.

What changed most is the question we ask about any new permission: where can one person act alone? We now review those actions with clients each year.

I would build an assisted route for employees without smartphones before introducing the freeze, not afterwards. I would also stop treating a clean quarterly access review as evidence that a role is safe.

Cutting 430 software subscriptions to 214 by following employee data

In mid-2022, three months after I became CIO, our finance team asked me to reduce software spending, which had doubled in two years to S$11.6 million. When we combined invoices, card statements and sign-in records, we found 430 separate subscriptions. Sixty-four of them held employee or client personal data without a data-processing agreement, including a survey tool that had collected client employees' payslip queries and a free file-transfer service that two teams used to send payroll files to clients.

The cost case alone would have produced a different programme. It would have cut the most expensive tools and left small, cheap ones that held the riskiest data. I chose to organise the work by data class instead: client pay and identity data, our own employees' HR data, commercial data and no personal data. I proposed that client data live only in approved systems, that company cards stop buying software and that every tool holding personal data either sign an agreement within sixty days or be withdrawn.

Our chief technology officer objected to withdrawing tools his engineers had chosen, and our chief revenue officer wanted to keep a second prospecting database his team valued. I kept the prospecting database under an agreement and lost the argument about one engineering diagramming tool, which we kept. I did not give way on the file-transfer service or on card purchases. We also deferred S$600,000 of planned automation work so that my team could run the programme.

Over nine months, 42 personal-data tools signed agreements and 22 were withdrawn. Subscriptions fell to 214 and annual spend to S$8.1 million, a saving of S$3.5 million. Most of the saving came from duplicates the data mapping exposed, not from the cuts we had planned. Two engineering teams lost about a month of productivity while they moved to approved tools, and the sales team complained for longer.

The register now drives purchasing, offboarding and client audit answers. When a client asks where its employees' data may sit, we answer from the register within a day.

I would have set up a five-day exception route at the start rather than after the first month, when frustrated teams had already begun sharing logins to the tools that remained.

Splitting our systems between Singapore and Johor when the hall ran out of power

In 2023 our internal systems, including finance, HR, the identity platform, the payroll specialists' workbench and backups of client files, ran in eighteen racks we leased in a Singapore colocation facility. Growth from our acquisitions meant we needed about 120 kilowatts more. The provider told us the hall's power was fully allocated and that it could not offer more for at least two years. New capacity in Singapore was scarce, and the facilities with space quoted prices well above our existing contract.

There were three options. Moving everything to a public cloud region in Singapore would cost about S$2.1 million a year more than we were paying. Colocation in Johor, about an hour's drive across the border, was quoted at 38 per cent less than Singapore. A split would combine them. Our chief financial officer favoured moving everything to Johor, which would have saved a further S$0.8 million a year. I recommended the split: corporate systems and disaster recovery in Johor, and every system holding client payroll data in the Singapore cloud region. Several of our bank and insurer clients had contracts specifying where their employees' data could be held, and others had asked us in audits. A cheaper design that required us to renegotiate those contracts would not have stayed cheap.

The board approved the split. We moved in two stages over seven months and added two engineers to run a second location. The Johor provider's new hall was delayed seven months by its own grid connection, and we paid about S$140,000 for an interim hall in the meantime. Our first full disaster-recovery test, in August 2024, failed: recovery took nine hours against a four-hour objective, because our identity replica depended on a service still in Singapore. We fixed the dependency, and in October 2024 the retest recovered in three hours and twenty-five minutes.

The split costs S$1.3 million a year less than the all-cloud option. Every hosting decision now records where client data sits, the recovery time and the provider's power and cooling commitments.

I would ask any provider for written evidence of its grid connection date before signing, and I would run the first recovery test before the move, not after it.