Yichen GuoChief Information Officer · Essays & perspective

Yichen Guo · Chief Information Officer · China

An audit committee member who can read the IT findings

My contribution to a board

I would bring to a board the working knowledge of someone who has explained technology decisions to directors for seven years without being one of them. Most boards I have presented to did not need more technical detail. They needed to know which decisions could be reversed, what a failure would stop and who would carry the consequences. I can help a board put those questions to its own management, in a manufacturing company or in any business whose operations depend on plants, warehouses or connected equipment.

Three areas are specific to my experience. The first is the control of large system changes: an ERP or execution-system replacement, a move to domestic software, a cutover in a plant that cannot stop for long. I have led them, and one failed in a way I describe on my impact page. The second is operational-technology and third-party security, where I can test whether a statement that the plants are protected rests on evidence or on an absence of incidents so far. The third is cross-border data: what flows out of China and what flows in, on what basis, and whether management knows. These subjects now reach audit committees through internal-control reviews and through incidents, and committees often lack a member who can read the underlying reports.

I would not claim accounting expertise. Under the CSRC's rules, the audit committee of a mainland-listed company is convened by an independent director who is an accounting professional, so I would serve as a member rather than as its convenor. Where a board has a strategy, risk or technology committee I could contribute more directly, and after a year I would be ready to lead one of them if the board wished.

I would also bring a habit of declaring my own interests before anyone asks. When my former employer bid for our plant systems, I left the commercial scoring before it began. A board is better for members who do that by reflex.

My first year on a board

Before my first meeting I would ask the board secretary for four sets of papers: two years of internal-control evaluations and auditors' letters to management, the register of systems the company cannot operate without, the list of outside vendors that can reach its plants or warehouses, and any data-export assessments or filings it has made. Those papers tell a new director where the company's operations are fragile far faster than a strategy presentation does.

In the first two quarters I would visit one plant or site during a shift change, meet the head of internal audit and the external auditors' IT specialists without management present, and ask the company's chief information officer to walk me through the last serious incident from first alert to closure. I would say relatively little in board meetings while I learnt how this board reaches decisions.

Throughout the year I would keep a private log of each question I raised, whether it was answered and whether the answer changed anything. At the anniversary I would review that log with the chair and with whichever committee chair I had worked with most, and ask both whether my questions had helped or merely added to the agenda. I would also use that review to decide, with the chair, whether I was ready to lead a committee or should serve another year as a member.

Conflicts and their management

Three kinds of conflict apply to me, and I would treat each differently.

The commercial kind is the clearest. I would not join the board of any maker of construction or mining machinery or hydraulic components, any Ruoshan dealer, supplier or significant customer, or any company that sells software or services to us, including Zhiluo Software and Qiyao Software. That rules out a good part of Chinese industry, and I accept it.

The ownership kind is less obvious. Our largest shareholder, a provincial state-owned investment company, holds stakes in many other businesses. I would decline any company it controls or significantly influences, because a board could reasonably doubt that I would be independent there.

The third kind is time. Ruoshan reports to two exchanges, and its quarterly calendar is fixed well in advance. I would agree the other board's dates a year ahead, protect thirty days for it including preparation and site visits, and say so plainly if I could not meet that.

Should a new relationship appear after I joined, for example a contract between the company and Ruoshan, I would tell the chair that week, take no part in the discussion or vote, and resign if the relationship looked likely to recur. Ruoshan's board would also need to consent before I accepted any seat.

My independence statement

My employer is Ruoshan, where I work full time, and I hold a small number of its shares through the 2021 employee share plan. Beyond that I have no family, lending or business ties to any company I would consider. Before any nomination I would list every relationship I have with the company, its controlling shareholder, its main suppliers and its auditors, including relationships I judge immaterial, because that judgement is not mine to make. The nominating board decides whether I meet the independence rules that bind it, and I would accept its conclusion either way.

Judgement in practice

01

Leaving the scoring when a former employer bid

When Ruoshan tendered for its plant execution system in 2022, Zhiluo Software, where I had worked until 2015, was one of four bidders. I held no shares and had no continuing arrangement with it, but I had hired some of the people presenting its bid. I declared the history to the president and the audit committee chair in writing and asked to be excluded from commercial scoring and from the final recommendation, while my architects took part in the technical evaluation under a deputy. The committee chose Zhiluo's system on scores I did not see until afterwards. Some colleagues thought the step unnecessary. I would expect the same of any director: a past relationship that others could reasonably question should be disclosed and stepped away from, even when the outcome would have been the same.

02

Narrowing a partner's request for field data

In 2022 a European supplier of hydraulic pumps, with which we were co-developing a new pump for our mid-size excavators, asked for continuous telematics data from 30,000 machines working in China to refine its design. Our engineering team supported the request. I recommended against sending raw data, because it included machine locations and working patterns on Chinese sites, which could raise questions under China's data rules and which the supplier did not need. Instead we offered monthly aggregated statistics on pump hours, pressures and temperatures by model and duty class, without locations, prepared in Changzhou and reviewed by our legal team. The supplier accepted after two months. Directors should ask in any partnership what data is leaving and whether the partner needs it in that form.

03

Showing the audit committee the whole list

In 2020 our auditors found that 46 generic administrator accounts in the foreign ERP suite were shared among staff and vendor consultants, so changes could not be traced to a person. Management's first draft response summarised the finding as a weakness in access management with remediation under way. I asked to present the full list instead, with the owner of each account, the changes made through it in the previous year and a date by which each would be closed. The committee asked for monthly updates. All 46 were closed within nine months, and two changes made through them in the past year had to be re-examined by finance. On a board I would want findings in that form, with names and dates, rather than in a sentence that hides their size.

Committee contribution

Chair and member readiness
CapacityCommittees
Ready to chairA technology, digital or risk committee, where the board has one, after a year as a member
Ready to joinAudit committee · Strategy committee · Risk management committee

Board and committee exposure

Presented to the Board or a committee

Ruoshan Heavy Machinery Company Limited

Board of directors: annual technology plan, the domestic-software programme and material security incidents

March 2019–present

Presents the technology plan each December and reports incidents and programme milestones; not a director and holds no vote.

Presented to the Board or a committee

Ruoshan Heavy Machinery Company Limited

Strategy committee of the board: digital investment cases and the twice-yearly AI pilot table

June 2020–present

Presents investment cases above RMB 50 million and the pilot table; the committee has twice sent a case back for revision.

Reported to a committee

Ruoshan Heavy Machinery Company Limited

Audit committee: IT general controls, auditors' findings on system access and change management

March 2019–present

Reports each half-year on IT control findings raised in the A-share internal-control audit and the H-share audit, and on their remediation.

Served as a director

Ruoshan Machinery (Thailand) Company Limited

Board of the wholly owned Thai assembly subsidiary

March 2021–present

Director in an executive capacity, approving the subsidiary's systems, data-handling arrangements and annual accounts.

Capacity and preferences

Time available
30 days per year
Current directorships
1
Sectors
Household-appliance and electronics manufacturers with plants abroad · Logistics, warehousing and port operators · Specialty chemicals and new materials with continuous-process plants · Medical-device manufacturers
Company type
A company listed in mainland China or Hong Kong with several plants or warehouses, an international business and no trading relationship with Ruoshan or its largest shareholder
Company stage
A company in the middle of a large systems change or an expansion abroad, or recovering from an operational or security incident

The seat I am pursuing

I want one independent directorship, at a manufacturer, logistics or materials company listed in mainland China or Hong Kong, with revenue roughly between RMB 5 billion and RMB 40 billion. The businesses I have in mind are household-appliance or electronics makers building plants abroad, logistics and port operators, specialty-chemicals producers and medical-device makers. What they share with Ruoshan is the kind of risk I understand: many sites running on common systems, connected equipment maintained by outside vendors, and data that crosses borders in both directions. What they do not share is any trading relationship with us.

I would join the audit committee as a member who can read IT-control and security findings in depth, and the strategy or risk committee where the board has one. After a year, if the board wished, I would be ready to lead a technology or risk committee. The CSRC's rules limit how many mainland listed boards one person may join as an independent director and expect regular time on site, and I would hold only this single seat while I remain an executive, because both companies deserve the attention that a single seat allows. I am not looking for a seat that exists to complete a board's numbers.

Governance learning and readiness

IICA Independent Directors’ Databank: Not yet registered

The IICA Independent Directors' Databank is an Indian register for directors of Indian companies. I am looking for a seat in mainland China or Hong Kong, so it does not apply to me and I have not registered with it. The obligations that matter for me are the CSRC's rules on independent directors of listed companies and, for a Hong Kong listing, the exchange's Corporate Governance Code and its independence guidance. Nothing here makes me independent of a particular company or entitles me to a seat.

  • The CSRC's 2023 rules on independent directors of listed companies, studied with Ruoshan's board secretary
  • Director training on Hong Kong listing obligations, arranged by our legal advisers before the 2019 H-share listing
  • Every strategy-committee meeting since June 2020 as a presenter, and half-yearly audit-committee reviews of IT controls since 2019
  • A course on directors' duties and the board audit committee under the revised Company Law, in force since July 2024