My contribution to a board
A board would gain from me a working understanding of the technology risks that now decide whether a software-dependent company keeps its customers: outages, compromised builds, licence obligations it did not know it had and compute costs that grow faster than revenue. I have managed each of them as an executive and reported each of them to an Audit and Risk Committee, and I know which questions draw a rehearsed answer and which draw a real one.
I would also bring a habit of putting technical judgements on paper in a form directors can test. My papers to Sternhollow's board state the alternatives, the dissent and what we would give up, and I would ask management for the same. Directors without a technology background should be able to see the trade-off themselves rather than take a CTO's word for it.
I am not an accountant and would not present myself as a committee's financial expert. National Instrument 52-110, the Canadian securities rule on audit committees, expects each member of a listed issuer's audit committee to be independent and financially literate, meaning able to read financial statements of the breadth and complexity the company's own raise. I own a C$188 million budget, and a board could judge whether that experience meets the test for its company. My stronger contribution would be on a risk or technology committee, which I would be ready to chair after a year.
Judgement in practice
01A credential nobody should still have held
In June 2024 our red team found that an access token issued to a contractor who had left a year earlier could still publish packages to the internal mirror that feeds every build. There was no sign it had been used. The next Audit and Risk Committee meeting was eight weeks away. I reported it to the committee chair within two days, with what we knew, what we did not and the steps under way, and I recommended an external review of every credential with access to our build and release systems, at a cost of C$240,000. The review found eleven more credentials that should have been revoked, none of them misused. On a board I would expect management to do the same: report a near miss early and in proportion, and ask for independent assurance rather than offer reassurance.
02Declining an acquisition I wanted to like
In 2025 our chief executive and the Pelloway director supported buying a start-up whose AI tools generated textures and materials for game art, at an asking price of about C$38 million. The product was good and studios wanted it. My technical diligence found that the company could not show the provenance of a large part of its training images, some of which appeared to come from art-sharing sites whose terms prohibit that use. I recommended that we decline unless the seller retrained its models on licensed data before closing, which it would not do. The board declined after a debate in which I began in the minority. I still do not know whether we were right. As a director I would ask management for exactly that kind of paper: what it wants, what diligence found and the condition under which the answer would change.
03A sponsorship accepted on conditions
At the Westerly Game Makers' Society, a company selling monetisation software built around paid random rewards offered C$120,000 to sponsor our student game jam, more than a third of the programme's budget. Several directors wanted to accept without discussion. I argued that the sponsor's business sat uneasily with a programme for students, some of them under eighteen, and proposed conditions rather than a refusal: no branding on the jam itself, no access to participants' contact details and no place on the judging panel. The sponsor accepted the first two and withdrew over the third, and two smaller sponsors replaced most of the money. What I took from it about directorship is that a board's most useful work is often setting the terms on which it says yes.
My first year on a board
My first year would have three stages, and I would tell the chair in advance what each was for.
Before my first meeting I would read two years of board and committee papers, the latest external audit findings, any penetration-test and incident reports the committees have received, and the company's public disclosures on cyber risk. I would ask for an hour each with the chief technology officer, the head of security, the chief financial officer and the external auditor, and I would put to the technology leaders the question I am most often asked myself: which control would you strengthen first if budget were no constraint?
Through the first two quarters I would mostly listen, and follow one significant technology investment from proposal to approval to see how this board tests a business case.
At the end of the year I would give the chair a short written note: what the board seemed to understand well about its technology risks, what it understood less well and whether I had added anything. I would ask for candid feedback in return, including whether my questions had been useful or merely technical, and would not seek a committee chair before then.
Conflicts and their management
The commercial conflicts are the easiest to see. I would not join the board of a game studio, publisher, engine or tools maker, platform holder or cloud provider, or of any company that buys from or sells to Sternhollow, and I would treat a company in Pelloway Growth Partners' portfolio as conflicted whether or not the rules required it. Before accepting any seat I would seek the written consent of Sternhollow's board and set out my shareholdings and my society directorship for the nominating board.
Information is the conflict people overlook. As a CTO I learn about suppliers' security weaknesses, pricing and product plans; as a director I would learn the same about another company. I would keep the two apart, with no supplier introductions in either direction. If a matter at the company touched a Sternhollow supplier or competitor, I would declare it and leave the discussion.
Time is the third. Sternhollow's release calendar and a listed company's reporting cycle will collide at least twice a year. I would fix meeting dates a year ahead, keep twenty-four days clear and tell the chair early if an incident at Sternhollow ever made me unavailable.
My independence statement
Three facts bear on my independence. I am employed full time by Sternhollow; I own Sternhollow shares and options; and Pelloway Growth Partners, which holds 31 per cent of Sternhollow, invests in other Canadian software companies. Any board considering me should weigh all three, along with whatever its own inquiries find, and reach its own view under the rules that govern it. I would not join a Pelloway portfolio company or a Sternhollow customer, supplier or competitor, and I would not call myself independent until that board had decided.
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to chair | A technology, cyber-security or innovation committee, after a year as a member |
|---|
| Ready to join | Risk committee · Technology or cyber-security committee · Audit committee, as a member contributing technology and controls experience |
|---|
Board and committee exposure
Presented to the Board or a committee
Sternhollow Technologies Inc.
Board of directors: technology strategy, capital requests, the GPU fleet and the engine-core programme
March 2021–present
Presents the technology report at every quarterly board meeting and brought the C$19.5 million GPU purchase for approval; not a director and holds no vote.
Reported to a committee
Sternhollow Technologies Inc.
Audit and Risk Committee: cyber security, the software supply chain, service reliability and open-source licence exposure
March 2021–present
Reports each quarter on security controls, incidents and licence exposure, including controls behind plan; attends for that item only and is not a member.
Served as a director
Westerly Game Makers' Society
Board of a British Columbia non-profit society supporting independent game developers
June 2019–present
Elected director; votes on budgets, grants and sponsorships for a society with about C$1.6 million of annual revenue.
Member of a committee
Westerly Game Makers' Society
Finance and Audit Committee
June 2020–present
Member; reviews the annual financial statements with the society's accountants and the controls over its grants programme.
Capacity and preferences
- Time available
- 24 days per year
- Current directorships
- 1
- Sectors
- Payments and financial software · Telecommunications and connectivity services · Health-technology platforms · Software and data businesses selling to regulated customers
- Company type
- A TSX-listed or comparably sized private Canadian company whose revenue depends on software it operates for customers, with an established audit or risk committee and no commercial relationship with Sternhollow or its principal investors
- Company stage
- Within five years of listing, or in the middle of a platform change or a material increase in its cyber or reliability exposure
The seat I am pursuing
I am looking for one independent directorship at a Canadian company, listed on the TSX or privately held at a comparable scale, whose revenue depends on software it operates for customers: a payments or financial-software company, a telecommunications or connectivity provider, a health-technology platform, or a software business selling to regulated clients. Those companies share the risks I know best: outages measured in their customers' lost hours, exposure through the code and suppliers they depend on, and technology spending that boards find hard to judge.
I would like to join a risk or technology committee and, if the board wishes, chair it after a year. I would also be useful as a member of an audit committee that wants a technologist alongside its financial experts. I am not looking for a seat that adds a technology name to a slate, and I would not take a second directorship while I remain an executive. I would prefer a company outside games, so that the conflicts are manageable and the learning is genuine.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
India's IICA Independent Directors' Databank concerns people seeking independent directorships of Indian companies, so it has no bearing on the Canadian seats I am considering. I have not registered and do not intend to seek a seat in India. A Canadian board would judge my independence itself, under the securities regulators' guidelines and its own policies.
- Quarterly reporting to Sternhollow's Audit and Risk Committee since March 2021, including an annual session on cyber risk with the external auditors
- Seven years as a director of a non-profit society, six of them on its Finance and Audit Committee
- A governance course for new directors run by a Canadian business school, completed in 2024
- Structured study of Canadian audit-committee rules and corporate governance guidelines with Sternhollow's general counsel