My contribution to a board
I would bring a board the working knowledge of someone who has run information systems on both sides of a hospital's door: inside a public teaching hospital, inside a manufacturer's China business and inside a listed distributor. Most boards in healthcare and adjacent industries now face technology questions that are really questions of law, operations and trust at once: whether a data flow is lawful, whether a system failure would stop the business, whether a supplier holds information the company cannot account for. I can help a board ask those questions precisely, and tell the difference between a management answer that is complete and one that is merely confident.
I would not be the accounting professional an audit committee needs. China's rules for listed companies expect that committee to be convened by an independent director with accounting expertise, and I would not pretend to that role. I could serve as a member who reads IT general controls, cybersecurity findings and data-protection matters closely, which is where many committees' attention is thinnest. After a year as a member, I would be ready to chair a risk, data or technology committee if the board had one.
I would also bring the habit of putting a refusal in writing. At Shuheng I have recommended against matching a competitor's free cloud offer, against sending patient data to principals abroad and against an even budget cut that every other function accepted. Each recommendation cost the company something it could measure, and each was made in a paper that set out what we would give up. An independent director needs the same discipline, exercised with less information and more distance.
Judgement in practice
01A ransomware incident reported to the committee chair within the week
In 2022 a contractor's remote-access account was used to place ransomware on the warehouse system at one of our regional logistics centres. We restored the system from offline copies in thirty hours without data loss and made the reports our incident procedures required. The next scheduled report to the Audit Committee was four months away. I wrote to the committee chair within the week, setting out what had happened, which deliveries were delayed and the real cause: sixty-three suppliers held standing remote access that nobody reviewed. The committee asked for a full review of supplier access and a recovery rehearsal it could observe. As a director I would expect the same of management: a serious incident reported when it happens, with its cause, rather than smoothed into the next routine paper.
02Holding a launch until a security assessment had closed
In 2023 our pharmacy division wanted to start receiving electronic prescriptions from three hospitals into our specialist pharmacies before the new interface had completed its level-three protection assessment. The commercial case was real: about RMB 18 million of annual sales were waiting, and the hospitals were ready. The assessment found two weaknesses in how prescription data was logged and retained. I recommended holding the launch for seven weeks until both were fixed and the assessment closed, and the president agreed over the division's objection. Nothing went wrong, so nobody can prove the delay prevented anything. That is usually the nature of such decisions, and a board should back management that makes them without demanding proof of a counterfactual.
03Re-tendering a hosting contract held by a shareholder-group company
In 2024 our data-centre hosting contract with a technology company in our controlling shareholder's group came up for renewal. The proposal was to renew for five years without competition, at a 9 per cent increase, on grounds of continuity. As a related-party arrangement it deserved proper scrutiny, and I recommended a competitive tender with an evaluation panel that included our head of internal audit. The group company won the tender at a price 17 per cent below its original proposal, with stronger recovery commitments. Relations were strained for some months. The lesson I would bring to a board is that a related-party contract is safest when the related party has had to compete for it, and that management should offer that evidence before a committee has to ask.
My first year on a board
In my first three months I would read before speaking: three years of board and committee minutes, the internal-control evaluation reports and the auditors' findings on IT general controls, the company's data catalogue if it has one, its cybersecurity gradings and assessment results, and any regulatory correspondence on data or traceability that the board has seen. I would ask to visit one operating site and one data centre or hosting provider, and to meet the head of internal audit and the person responsible for personal-information protection without management present.
For the rest of the year I would serve as a member of the committees I joined and would not seek a chair. I would aim to learn which risks the board discusses every quarter and which it has never discussed, and to propose one change to what the board receives, such as a regular account of external data flows or of recovery rehearsals. At the end of the year I would ask the chair for direct feedback on whether my questions helped the board decide or only lengthened its meetings.
Conflicts and their management
My first obligation is to Shuheng, where I am a full-time executive, and to our controlling shareholder's rules on senior managers taking outside positions. Almost every pharmaceutical manufacturer, hospital and pharmacy chain in western China is a supplier, customer or competitor of ours, which rules out most of the healthcare sector. I would not join the board of any distributor, pharmacy chain, manufacturer that supplies us, hospital or hospital group that buys from us, or software company that sells to hospitals, nor any company in our controlling shareholder's group.
Before accepting a seat I would disclose my Shuheng shareholding through our employee share plan, my directorship of Shuheng Digital Health and any dealings with the company's suppliers, and I would seek my company's written approval. If a conflict arose after appointment, for example because the company began to trade with Shuheng, I would disclose it immediately, leave the relevant discussions and offer to resign if it was likely to continue. Time is the other conflict, so I would fix meeting dates a year ahead and commit only the days I can keep.
My independence statement
I am a full-time executive of Shuheng and hold a small number of its shares through an employee share plan. I would consider an independent seat only at a company with which Shuheng, its controlling shareholder's group and I have no trading, family or financial relationship of substance, and I would disclose everything relevant before any appointment is considered. Whether I satisfy the independence requirements for a particular company is for that company's board, under the rules that apply to it, to decide on the facts I disclose.
Board and committee exposure
Presented to the Board or a committee
Shuheng Medical Supply Chain Company Limited
Board Strategy Committee: technology plan, traceability programme and data-protection framework
April 2021–present
Presents the annual technology plan and major programmes; not a director of the company and holds no vote.
Reported to a committee
Shuheng Medical Supply Chain Company Limited
Audit Committee: IT general controls, cybersecurity and internal-control evaluation findings
April 2021–present
Reports twice a year and after any serious incident; attends as an invitee, not as a member.
Served as a director
Shuheng Digital Health Technology Company Limited
Board of the wholly owned subsidiary that runs hospital supply services technology and the manufacturers' data portal
January 2022–present
Director in an executive capacity, approving the subsidiary's accounts, security policies and hospital contracts.
Reported to a committee
Vestrell Pharma (China) Company Limited
Group Asia-Pacific data-protection and compliance committee
2016–2019
Reported quarterly on China data hosting, access reviews and the move of China data onshore.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is an Indian register and does not apply to the Chinese and Hong Kong appointments I am considering, so I have not registered with it. The expectations that matter for me are the CSRC's rules for independent directors of listed companies and, for a Hong Kong listing, that exchange's Corporate Governance Code. No training record, and nothing on this page, makes me independent of a particular company or entitles me to a seat.
- A stock-exchange training programme for independent directors of listed companies, completed in 2025
- Five years of Shuheng Audit Committee and Strategy Committee meetings attended as an invitee
- Study of the CSRC's 2023 rules on independent directors and the revised Company Law with Shuheng's board secretary
- Annual briefings from Shuheng's external auditors on IT general controls and the internal-control evaluation
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to chair | A risk, data or technology committee, after a year as a member |
|---|
| Ready to join | Audit Committee, as a member with IT-controls and data-protection expertise rather than as its accounting professional · Risk management or sustainability committee · Nomination committee |
|---|
Capacity and preferences
- Time available
- 25 days per year
- Current directorships
- 1
- Sectors
- Medical devices and diagnostics sold outside Shuheng's channels · Technology and claims administration for health insurers · Infant nutrition and food with traceability obligations · Cold-chain and regulated logistics outside medicines
- Company type
- A-share or Hong Kong-listed company in a regulated, data-heavy business with no trading relationship with Shuheng, its controlling shareholder's group or the manufacturers and hospitals we serve
- Company stage
- An established listed company facing a systems or data change its board must oversee: a new traceability obligation, a cross-border data question or an integration after an acquisition
The seat I am pursuing
I am pursuing one independent directorship at a company listed in Shanghai, Shenzhen or Hong Kong, in a regulated, data-heavy business that does not trade with Shuheng. The candidates I have in mind are a medical-device or diagnostics maker that sells through channels other than ours, a company providing technology or claims administration to health insurers, or an infant-nutrition or food company with its own traceability and quality obligations. These businesses share the problems I know: an authority that can examine records at any time, personal or product data that must be traceable and protected, and systems whose failure would stop the business.
I would join the audit committee as a member with IT-controls and data-protection expertise and, after a year, would be ready to chair a risk or technology committee if the board had one. The CSRC's 2023 rules limit how many domestic listed boards an independent director may sit on and expect a minimum amount of on-site work each year. I would take only one seat while I remain an executive, and I have set aside about twenty-five days a year for it. I am not seeking a seat to make up a board's numbers.