My contribution to a board
Most infrastructure boards now ask about cyber risk and digital investment, but few have a director who has been responsible for operational technology in a live, safety-critical setting. That is the gap I could help fill. I have run control systems that start tunnel ventilation in a fire, replaced them under traffic, kept them isolated through a ransomware attack and reported on their risk to an audit and risk committee for six years. I know what a management team's assurance on such systems usually looks like, and which questions reveal whether it describes the real network or only the policy.
I would also bring a habit of separating measured from modelled figures, which matters in sustainability reporting, in estimates of asset condition and in the business cases for technology programmes. I have learned to ask what a number rests on before asking whether it is good.
I would be candid about my limits. I am not a qualified accountant and would not chair an audit committee. My financial experience is that of a budget holder and a joint-venture director, not a finance executive. I would join an audit and risk committee as a member with operational-risk expertise, and I could chair a technology or resilience committee where one exists or is being formed.
My first year on a board
In a first year I would expect to learn far more than I contributed. I would ask for an induction covering the company's licences or contracts, its regulatory relationships, its principal risks and the reports through which the board sees them. I would visit the control rooms and at least two operating sites, accompanied by management, to understand how the systems described in board papers are run in practice.
I would read the last three years of committee papers on operational and cyber risk and ask management one question about each: what evidence shows that this control works on the actual assets? I would want to know when the company last rehearsed losing a key system, how long recovery took and what changed afterwards.
I would meet the external auditor and, where there is one, the head of internal audit, to understand how they test operational technology and sustainability data. And I would ask the chair for feedback at the end of the year on whether my questions had been useful or merely technical. A director with my background can easily drift into designing the solution. My role would be to test whether management has chosen a sound one and can show that it works.
Conflicts and their management
My principal conflicts are clear, and I would manage them mainly by avoiding them. I would not join a company that competes with Elvaran for concessions, supplies it with technology or services, or is a material counterparty, and I would exclude Kvarnfjord Systems and its competitors in tunnel systems integration. Before accepting a seat I would give the board a written list of my employment, my Arvelo directorship and any advisory work, and update it whenever these changed. Where a conflict arose on a specific matter, I would declare it, leave the discussion and make sure the minutes recorded both. If a conflict became persistent rather than occasional, I would resign the seat rather than ask the board to work around me.
My independence statement
I am an employee of Elvaran Infrastructure and an Elvaran-nominated director of Arvelo Road Services, and I would remain both during a first appointment. I would not consider a seat at a company that bids against Elvaran for road concessions, supplies it with technology or is a material counterparty, and my former employer Kvarnfjord Systems would also be outside my range. Whether I meet the independence criteria in a particular company's governance code is for that board to assess on full disclosure. I would provide that disclosure and would not describe myself as independent before the assessment.
Judgement in practice
01Holding the network isolation for eleven days
After the 2022 ransomware attack, restoring the transaction link on day three would have restarted billing and eased pressure from tag issuers. I recommended waiting until forensic work confirmed the operational side was clean and the jump servers had been rebuilt on a separate identity domain. The later review accepted €0.31 million of written-off tolls as the cost of that choice. The judgement a director needs is the same: ask what is known, what is assumed and what it costs to be wrong in each direction.
02Declaring a former employer before a tender
When Kvarnfjord bid for the tunnel control-system replacement in 2021, I declared my nine years with the company and my role in delivering the system being replaced. I took no part in scoring and recorded the declaration with the chair of the audit and risk committee. I would apply the same rule on any board: disclose early, step out of the decision and make sure the record shows it.
03A smaller programme than some directors wanted
On the asset register I recommended a €5.9 million programme over a €17 million digital twin, against the initial preference of the concessions and investment committee chair. The committee approved the smaller programme after I set out which handback conditions each option would help us evidence. A non-executive director should ask management the same thing: which decision does this investment improve, and how will we know?
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to chair | Technology, cyber and operational resilience committee |
|---|
| Ready to join | Audit and risk committee · Sustainability committee |
|---|
Board and committee exposure
Reported to a committee
Elvaran Infrastructure
Audit and risk committee
2020–present
Quarterly report on operational-technology and cyber risk since 2020, including the 2022 incident review and the segmentation programme; presented jointly with the head of operational-technology security since 2023.
Presented to the Board or a committee
Elvaran Infrastructure
Concessions and investment committee; full board for major technology capital
2019–present
Presented the tunnel control-system renewal, the free-flow conversion and the asset-register programme for approval as an executive; this is not a director appointment.
Served as a director
Arvelo Road Services
Board of directors (six members); no committee seats
April 2021–present
One of two directors nominated by Elvaran to the joint venture that operates and maintains its second Polish concession; a nominee seat, not an independent one.
Capacity and preferences
- Time available
- 28 days per year
- Current directorships
- 1
- Sectors
- Water and wastewater utilities · Ports and logistics infrastructure · District energy and heat networks · Logistics and industrial property
- Company type
- A listed or long-term-investor-owned infrastructure company with a large estate of operational technology and long-lived contracted or regulated assets
- Company stage
- Mature operations facing renewal of control systems, closer security supervision or new sustainability reporting obligations
The seat I am pursuing
I am seeking one independent non-executive seat, alongside my executive role, on a listed or long-term-investor-owned infrastructure company outside road concessions: a water or wastewater utility, a port operator, a district-energy network or an owner of logistics and industrial property. What these share is a large estate of long-lived operational technology, rising expectations from security supervisors and sustainability reporting that depends on operational data. I would expect to join the audit and risk committee and, where the board has or wants one, to chair a technology, cyber and operational resilience committee. I can commit twenty-eight days a year, subject to Elvaran's consent, which the chief executive has said she would consider for a non-competing role. I would want a board that is prepared to hear uncomfortable questions about legacy systems and that treats technology risk as part of its oversight of the business, not as a specialist topic left to one director.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
The Indian Independent Directors' Databank applies to appointments at Indian companies, and the seats I am pursuing are in Europe, so I have not registered. If an Indian company approached me, I would take advice on databank registration and any proficiency-assessment requirement before considering the role, rather than assume either did or did not apply.
- Non-executive director programme, Albarra Governance Institute (2024): directors' duties, board dynamics and committee practice
- Executive programme in infrastructure finance, Calderwood School of Management (2016, part-time)
- Five years as an Elvaran nominee director on the Arvelo Road Services board, including budget cycles and the renegotiation of its operations and maintenance contract
- Annual briefing on national corporate governance codes and their comply-or-explain expectations, arranged through Elvaran's company secretary