Tristan Lawson · Chief Technology Officer · Australia

What a retail CTO would bring to an audit and risk committee

My contribution to a board

Most boards I have presented to read a balance sheet faster than a technology programme report. I would help close that gap. I have written those reports for six years at Halvorne and for nearly two years for a private-equity board at Pellbrook, and I know where they tend to be optimistic: testing described as complete when only the expected path was tested, recovery times quoted from a design rather than a rehearsal, and critical vendors missing from the risk register because a contract exists. I would ask for evidence of rehearsal rather than assurance of design.

I also bring direct experience of the risks that now dominate a consumer company's register: cyber incidents, privacy obligations, payment failures and the resilience of digital channels on their busiest days. I have reported on each of them to an audit and risk committee and managed live incidents in two. The ASX Corporate Governance Council's Principles and Recommendations ask listed boards to recognise and manage risk and to review whether their risk management framework remains sound. In most consumer businesses a growing share of that framework is technical, and a board benefits from a director who can test it without taking over management's job.

Finally, I can disagree usefully. I argued against a replatforming my chief executive first preferred, asked a private-equity board to sell less on its biggest weekend and kept a customer-service assistant narrower than my finance colleague wanted. Each time I brought test results rather than opinions, and each working relationship survived the argument.

I am not a financial expert and would not seek to chair an audit committee. I would be a useful member of an audit and risk committee, and ready to chair a technology or cyber committee after a year of membership.

Judgement in practice

A restore test reported before anyone asked

In 2023 our quarterly restore test of the order database took nineteen hours. We had told the audit and risk committee, on the strength of the design, that a restore would take four. Nothing had failed and no customer was affected, so there was no incident to report and some of my team saw no reason to raise it before the fix was ready. I put it on the committee's next agenda with the cause, a backup format that restored serially, and a plan to bring the time under four hours by the following peak, which we did. The chair asked for restore results as a standing item. As a director, I would ask every management team for the last rehearsed recovery time of its critical systems, not the designed one, because the difference is where the risk sits.

Telling customers when the threshold was arguable

In 2025 an email-marketing vendor told us that an intruder had copied a file containing the names, email addresses and broad purchase categories of 380,000 of our customers. The vendor assessed the risk as low, and our general counsel thought the Notifiable Data Breaches threshold of likely serious harm was probably not met. I recommended that we tell the affected customers anyway, describe exactly what had been taken and warn them about emails pretending to come from us, and the chief executive agreed. Within three weeks phishing emails using the stolen details appeared, and customers who had been warned reported them to us. On a board I would separate the legal question of whether a notice is required from the commercial question of whether customers would want to know.

Asking a private-equity board to sell less

In 2019 Pellbrook's board, led by the private equity investor, planned its largest sale weekend with 60 per cent more featured deals than the year before. Our load tests showed checkout failing at 1.6 times the forecast traffic, and the deals would have concentrated demand on a handful of sellers' stock. The investor's operating partner wanted to proceed and fix problems live. I recommended capping featured deals at the level we had tested and admitting visitors through a waiting room. The board accepted the cap. The weekend ran at 99.97 per cent availability, and gross merchandise value came in about 6 per cent below the original plan. The lesson I would carry to any board is to ask what management has actually tested against the plan in front of it.

My first year on a board

My first ninety days would be spent gathering evidence rather than forming views. I would read two years of board and committee papers, the risk register and the most recent internal audit reports on technology, and I would ask management for three documents that rarely reach a board in full: the last rehearsed recovery time for each critical system, the list of third parties whose failure would stop the company trading, and the inventory of personal data the company holds with its deletion dates. I would spend a day where incidents are handled, whether that is a contact centre, an operations room or a distribution centre.

In the second quarter I would agree with the committee chair which of my questions deserve a standing place on the agenda and which were only my curiosity. In the third, I would follow one major technology decision through the board from first paper to approval without trying to steer it, so that I learnt how this board decides. At the anniversary I would ask the chair for a candid view of whether my questions had helped the board decide or merely lengthened its meetings, and I would change my approach accordingly.

Conflicts and their management

Halvorne buys from hundreds of brands and works with finance partners, payment gateways, carriers and software vendors. I would decline any directorship of an electronics, appliance or general-merchandise retailer or marketplace; of any supplier, finance partner or service provider of material size to Halvorne; and of any technology vendor that sells to retailers. In each case my knowledge of Halvorne's plans would be impossible to separate from my judgement.

One conflict already exists, and I manage it in the open. Halvorne donates retired staff laptops to Tessellan Digital Access, the not-for-profit on whose board I sit. I declared the link before joining Tessellan, I leave the room whenever its board discusses Halvorne donations, and at Halvorne the donation decisions sit with our sustainability team rather than with me.

For any new seat I would seek written consent from Halvorne's chair, disclose my shareholding and my Tessellan role, and agree with both boards in advance how a later conflict would be handled. Should a material relationship develop between the company and Halvorne, I would declare it, step out of the discussion and resign if it became permanent. Time is the remaining conflict. Halvorne's peak runs from November to early January, and I would tell a board before appointment that I can attend its scheduled meetings in that window but have little else to give then.

My independence statement

My income and some of my savings come from Halvorne, where I hold shares under the executive share plan, and those interests travel with me into any boardroom. I would accept a seat only where neither Halvorne nor I have a business relationship of substance with the company, its major shareholders or its key suppliers, and I would set out every relevant fact before the board decided anything. Whether I am independent for that company, under the ASX Corporate Governance Council's Principles and Recommendations and the board's own policy, is the board's call to make on those facts, not mine to claim.

Committee contribution

Chair and member readiness
Capacity	Committees
Ready to chair	A technology or cyber committee, where the board has one, after a year as a member
Ready to join	Audit and risk committee · Technology or cyber committee · Customer or sustainability committee where privacy sits within its remit

Capacity and preferences

Time available: 24 days per year
Current directorships: 1
Sectors: Energy and water retailers · Private health and aged-care providers · Travel, ticketing and live-events businesses · Large member-owned organisations holding personal data on millions of members
Company type: ASX-listed company, or a large private or member-owned organisation, outside retail, with millions of customer records, a digital channel that carries sharp peaks and no commercial relationship with Halvorne
Company stage: Soon after a major technology programme has been approved, or in the year after a cyber or privacy incident, when the board needs to test delivery and recovery rather than strategy alone

The seat I am pursuing

I am looking for one non-executive directorship at an ASX-listed company or a large private or member-owned organisation outside retail, where customers entrust the organisation with personal data and digital services face real peaks of demand. Energy and water retailers, private health and aged-care providers, travel and ticketing businesses and large member-owned organisations all fit that description. I would prefer a company that has recently approved a major technology programme or is recovering from a cyber or privacy incident, because that is when a board most needs a director who can test delivery and recovery.

I would join the audit and risk committee and, where the board has one, chair a technology or cyber committee after a year. I can give 24 days a year, including preparation, with the Halvorne board's consent. I am not building a portfolio of directorships. One seat, done properly alongside an executive role, is the right load for me until the store programme is finished.

Board and committee exposure

Presented to the Board or a committee

Halvorne Retail Group Limited

Board: technology investment, the commerce modernisation tranches and the store-systems business case

April 2020–present

Presents management's technology investment papers and tranche reports to the board; not a director of the company and holds no vote.

Reported to a committee

Halvorne Retail Group Limited

Audit and risk committee: cyber security, privacy, technology resilience and peak readiness

April 2020–present

Reports twice a year and after any significant incident, including restore-test results and worst-case breach exposure by system; meets the committee chair privately once a year.

Presented to the Board or a committee

Pellbrook Pty Ltd

Board of the private-equity-backed company: platform investment and sale-event readiness

July 2018–March 2020

Presented quarterly on platform risk and before each major sale event; not a director.

Served as a director

Tessellan Digital Access Limited

Board and its finance, audit and risk committee

May 2021–present

Unpaid non-executive director of a Melbourne charity, a company without shareholders, that refurbishes donated laptops for school students; committee member, not chair.

Governance learning and readiness

IICA Independent Directors’ Databank: Not yet registered

The IICA Independent Directors' Databank is an Indian scheme for people seeking independent directorships of Indian companies. It does not apply to Australian or private boards like those I am pursuing, so I have not registered. If an Indian company approached me, I would read the registration and proficiency self-assessment rules before taking the conversation further.

A five-day company directors course run by a professional body for directors, completed in 2024
Non-executive director of Tessellan Digital Access Limited since 2021, including membership of its finance, audit and risk committee
Twice-yearly reporting to Halvorne's audit and risk committee since 2020, with a private session with its chair each year
Study of directors' duties under the Corporations Act 2001 and the ASX Corporate Governance Council's Principles and Recommendations with Halvorne's company secretary