Gabriel HawthorneChief Information Officer · Essays & perspective

Gabriel Hawthorne · Chief Information Officer · United States

What I would ask about a company's critical systems from the boardroom

My contribution to a board

What I would offer a board is the habit of asking what stops. Directors usually receive technology reports organised around projects, budgets and framework scores. I have spent thirty-three years in utilities, on substation monitoring, control centres, billing, competitive retail and now a cooperative's whole technology estate, and I would help a board turn those reports into specific questions. Which systems could the business not run without for three days? How long do they take to restore from offline copies, and when was that last tested? Which customer-facing systems carry decades of unexamined rules? Which forecast numbers rest on commitments, and which on correspondence?

I also bring long experience of answering to boards that live near their customers. Merrowind's directors come from our member cooperatives, and many are farmers and small-business owners who hear about a wrong bill at the feed store before they read about it in a board paper. I have learnt to report a failure plainly, with its cost and the people affected, before a director hears of it elsewhere. At Hollensby I presented a failed billing conversion to the audit committee, and at Corvallen I reported to the sponsor's risk committee through the 2021 storm.

I would not present myself as an audit committee financial expert or a capital-markets specialist. My natural seat is on a risk or technology committee, or on an audit committee as a member who can examine IT general controls, cyber disclosure and large system implementations. I would serve a full year before chairing anything.

Judgement in practice

01

Telling a committee that its good cyber score did not answer its question

In my first report to Merrowind's audit and risk committee, in October 2021, I was expected to present a cyber maturity assessment a consultant had completed that spring. It scored us well. I presented it and then told the committee that nobody could say how long it would take to restore the systems that schedule, fuel and settle our power, because we had never tried. One director asked why we had paid for an assessment that missed the point. I said it had answered the question it was asked, and that the committee's own question needed a different kind of evidence. The committee asked for a tested restore time within three years and accepted a deferral of the data platform to fund the work. The answer arrived in November 2024: nineteen hours. As a director I would ask management for the measure that would matter on the worst day, and allow time to produce it honestly.

02

Asking a board to plan on a smaller number

When I took the large-load register to Merrowind's board in March 2025, I had to tell directors that the 9.6 GW they had heard about was 4.1 GW of distinct projects, of which very little was committed. Several directors had described the data-centre interest at their own members' annual meetings, and one said the register would make the cooperative look unwelcoming. I did not contest the economic case for data centres. I argued that the board was close to planning a US$1.6 billion plant on enquiries, and I showed the matching method so that directors could check it. The board adopted the gates and added the confidentiality rule our largest member had requested. A board will accept a smaller number when its method is visible and its members' concerns are allowed to change the design.

03

Holding bills after the Texas storm

In February 2021, at Corvallen, I recommended to our chief executive that we hold 61,000 bills based on incomplete meter data rather than send estimates. The risk committee of the sponsor's board of managers was worried about cash: the company was absorbing heavy wholesale losses, and delayed billing would add strain. I set out three options on one page: send estimates and correct them later, hold every affected bill, or hold only the bills where estimates were least reliable. We held them for up to three weeks and sent accurate bills with a payment-plan offer. Billing complaints that spring stayed below our usual level. On a board I would ask what a decision does to customers already under strain, and accept that a good answer can cost money.

My first year on a board

I would treat the first year as learning the company's risks rather than applying my own. Before the first meeting I would ask the company secretary for two years of committee papers on technology and cyber risk, the latest internal audit reports on IT controls and any incident reports the board has received. I would read them looking for the systems the business plainly depends on but the papers never mention.

I would then ask for three conversations away from the boardroom: with the chief information officer or the chief information security officer, without the chief executive present; with the head of internal audit about where technology findings recur; and with someone who runs an operation, a plant, a call centre or a dispatch room, about what they do when systems fail. I would take notes rather than positions.

In my first committee meetings I would confine myself mostly to questions of method: how a figure was measured, when a restore was last tested, which systems were excluded from a review and why. I would not propose changes until I had seen a full annual cycle, unless I saw a risk that could not responsibly wait.

At the end of the year I would ask the chair two things: whether my questions had helped the committee or merely lengthened its meetings, and whether my utility background was helping me read a different business or tempting me to treat it as a utility. I would want honest answers to both.

Conflicts and their management

My conflicts come from three directions, and I would set each out in writing before any appointment.

The first is Merrowind. As its executive I cannot sit on the board of another utility or power producer in our regional market, a developer seeking load or generation connections from our members, or any company that sells Merrowind fuel, equipment, software or services. Any appointment would need our chief executive's consent after review by our general counsel.

The second is our members. Merrowind's board is drawn from seventeen distribution cooperatives, each with its own suppliers and large customers. I would decline a seat at a company with a significant contract or dispute with any member, because I could not separate what I know from my work.

The third is the suppliers I have chosen. Over my career I have selected billing, outage management and security vendors. I would decline a board role with any of them, or with their direct competitors, for at least three years after a procurement in which I took part.

If a conflict arose after appointment, I would tell the chair as soon as I knew, leave the discussion and make sure the minutes recorded it. If that happened more than occasionally, I would resign, since a director who must keep leaving the room is not doing the job. I would never bring Merrowind's security information or any member's data into another boardroom, whatever its apparent relevance.

My independence statement

I am a full-time executive of an electric cooperative, and whether I am independent is for the appointing board to decide, not for me to assert. Before any appointment I would set out in writing my employment, my nonprofit directorship, my investments, any supplier I have selected in the past three years and any commercial link between Merrowind, its member cooperatives and the company. I would expect the board to test those facts against its exchange's listing standards and its own policies before I am proposed.

Board and committee exposure

Served as a director

Tessaly Rural Connectivity Fund

Board of directors; finance and audit committee member

January 2022–present

Director of a nonprofit that funds rural broadband connections and digital-skills programmes in Oklahoma and Kansas; reviews its audit, grant controls and technology risk.

Reported to a committee

Merrowind Electric Power Cooperative

Board audit and risk committee

October 2021–present

Reports twice a year on cyber risk, the operations-essential enclave, measured restore times and incident escalation; designs the board's annual tabletop exercise.

Presented to the Board or a committee

Merrowind Electric Power Cooperative

Full board

March and September 2025

Presented the large-load register, its four gates and confidentiality rule, and the de-duplicated load figures used in the resource decision.

Reported to a committee

Corvallen Energy Services

Risk committee of the board of managers

2019–2021

Reported on billing, collections and customer-data systems, and through February and March 2021 on the storm's billing decisions.

Presented to the Board or a committee

Hollensby Electric Company

Audit committee

2013

Presented the review of the billing conversion that delayed or estimated about 38,000 bills, and the stabilisation plan.