My contribution to a board
I would bring to a board the experience of an executive who has run plant technology in a regulated, listed manufacturer through a listing, a ransomware attack and a multi-year digitisation programme. Most boards now hear about cyber security and digital projects at every meeting. Fewer have a director who can tell when a cyber report is measuring activity rather than resilience, or when a digitisation plan is counting screens rather than controls. I can ask those questions without needing to run the answer myself.
The SEBI Listing Regulations require the larger listed companies to have a Risk Management Committee whose remit includes cyber security and business continuity, with at least one independent director among its members. I have sat on such a committee as an executive member for nearly three years, so I know what a committee should ask management for: a measured time to recover the systems that matter, an honest list of risks that have waited longest for funding, and a clear account of who may reach the plant networks from outside. I would expect to join the Risk Management Committee and, where the board has one, a technology committee. I could be a useful member of an Audit Committee on IT general controls and internal financial controls, but I would not seek to chair one; that needs accounting expertise I do not have.
I would also bring a habit of separating what a system can do from who decides. In a pharmaceutical plant, quality owns the decision to release a batch and the meaning of a GMP record, while technology owns the systems that make the decision possible. Boards are well served when directors keep a similar line between oversight and management. I would not use a board seat to redesign a company's systems. I would use it to make sure the board knows how they would fail, and what it would cost to find out.
My first year on a board
I would spend the first quarter learning the business before its technology. I would read two years of board and Risk Management Committee papers, the internal audit reports on IT, the statutory auditors' observations on internal financial controls and the risk register, noting how long each open item has waited. I would ask to walk one plant or site with its manager and its head of IT, and to see a restore test or the record of the last one. Where good practice allows, I would meet the internal auditors and the chief information security officer without other management present.
For the rest of the year I would be a member who asks questions rather than one who offers designs. I would want to understand how the company divides its spending between prevention and recovery, who owns the risks that fall between IT, operations and quality, and how the board would hear about an incident in its first hours. At the end of the year I would ask the committee chair and the board chair for direct feedback, and use the board evaluation to test whether my questions helped or merely lengthened the agenda.
Conflicts and their management
My first obligation is to Trivikaya, where I am a full-time executive. Because a contract manufacturer may count almost any pharmaceutical company as a customer or prospect, I would not join the board of any pharmaceutical, biotechnology or API company, any company that supplies chemicals, equipment or software to Trivikaya, or any company in which Corvanta Capital Partners holds an investment. I would also decline technology vendors that sell to manufacturers like us, because my purchasing decisions would follow me into their boardroom.
Before accepting a seat I would disclose my Trivikaya stock options, my committee membership and any relationship with the company's suppliers, and seek the consent of Trivikaya's board. If a conflict arose later, for example because the company chose a technology supplier that also bids for our work, I would disclose it at once and stay out of the discussion. Time is the other conflict. Twenty-five days a year means twenty-five, including preparation, and I would agree the calendar a year ahead around our results and inspection seasons.
My independence statement
I am a full-time executive of Trivikaya and hold stock options under its employee scheme. I would decline any company with a business relationship with Trivikaya, with its significant shareholder Corvanta Capital Partners or with Corvanta's other portfolio companies, and I would disclose every relevant relationship before an appointment was considered. Whether I meet the criteria in section 149(6) of the Companies Act for a particular company is for that company's board to judge on the facts I place before it.
Judgement in practice
01Sizing cyber insurance against what we had actually measured
At the 2025 renewal of our cyber insurance, after the February incident, the board was offered cover of ₹150 crore at about three times the previous premium, and management's first paper recommended taking it. I asked the Risk Management Committee to set the proposed cover beside our own measured losses: the incident had cost ₹9 crore directly and had moved ₹63 crore of revenue between quarters rather than losing it. I recommended ₹100 crore of cover, with the premium saved, about ₹1.1 crore a year, spent on immutable backups and a second restore drill. The chair asked for an independent broker's view, which supported a figure between ₹80 crore and ₹120 crore, and the committee agreed. As a director I would ask for the same comparison: what the company has measured about its own losses, set beside what the market offers to insure.
02Ending a related-party software contract before the listing
In 2022 our laboratory systems were maintained under a contract with a small software firm in which a member of the founding family who sat on our board held a stake. The contract predated the private-equity acquisition and had been renewed every year without competition. Ahead of the listing, related-party transactions needed the Audit Committee's approval on arm's-length terms, and I was asked whether this one should continue. I compared its rates with three other providers and found them about 30 per cent higher, with weaker response commitments. I recommended a competitive tender, which the firm was free to enter. It entered and did not win, and the director concerned raised the matter with our managing director. The committee approved the new contract. The lesson I would take to another board is that a technology contract can be a related-party matter, and that the paper should show the benchmark before anyone has to ask for it.
03Telling customers about a near miss nobody had noticed
In mid-2024 a penetration test we had commissioned found that a configuration error on our customer data platform had, for six days, let users from one customer see the file names, though not the contents, of documents belonging to two others. The logs showed nobody had looked. Our contracts did not strictly require disclosure, and our head of business development preferred a quiet fix. I recommended that we tell all three customers, explain the error and the correction, and report it to the Risk Management Committee at its next meeting. The managing director agreed. Two of the customers asked for additional audit rights, which we granted. On a board I would want management to bring near misses as readily as incidents, because a company that discloses the near miss is the one whose later disclosures are believed.
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to chair | A board technology or digital committee, where one exists, after a year as a member |
|---|
| Ready to join | Risk Management Committee · Technology or digital committee of the board · Audit Committee, contributing on IT general controls and internal financial controls |
|---|
Capacity and preferences
- Time available
- 25 days per year
- Current directorships
- 0
- Sectors
- Speciality chemicals and process manufacturing that does not supply pharmaceutical companies · Food, nutrition and consumer manufacturing with automated plants · Hospital and diagnostics networks with large clinical-data estates · Paints, coatings and building materials with multi-plant operations
- Company type
- NSE or BSE-listed company with ₹1,000–6,000 crore of revenue, several automated plants or sites, and no commercial relationship with Trivikaya, its significant shareholder or that shareholder's other investments
- Company stage
- Within three years of listing, in the middle of a plant digitisation, or after a cyber incident, when the board needs an informed questioner rather than a second management team
The seat I am pursuing
I am pursuing one independent directorship at a listed company outside pharmaceuticals, most likely a manufacturer with several automated plants or a healthcare services group with a large clinical-data estate, with revenue between ₹1,000 crore and ₹6,000 crore. These businesses share the problem I know best: operations that depend on systems most directors cannot see, and a board that hears about those systems mainly when something has failed.
I want to join the Risk Management Committee and, where the board has one, its technology committee, and I would be ready to chair a technology committee after a year if the board wished. I would not take a second directorship while I remain an executive. The SEBI Listing Regulations would allow someone who is not a whole-time director more listed seats than one, but my employer and a new board both deserve the attention a single seat requires. I am not looking for a seat that needs a name on a cyber slide; I am looking for a board that wants its questions about technology to become harder.
Board and committee exposure
Member of a committee
Trivikaya Life Sciences Limited
Risk Management Committee: cyber security, business continuity, technology and data risks
January 2024–present
An executive member alongside three directors, two of them independent, under a director as chair; attends every meeting and takes part in the committee's recommendations to the board.
Presented to the Board or a committee
Trivikaya Life Sciences Limited
Board of directors: twice-yearly technology and cyber reviews, the February 2025 incident and capital approvals for plant systems
April 2021–present
Presents management's technology papers to the board; not a director of the company and holds no vote at the board.
Reported to a committee
Trivikaya Life Sciences Limited
Audit Committee: IT general controls, the statutory auditors' findings and their remediation
June 2022–present
Reports once a year, and whenever the auditors raise an IT control matter; not a member of the committee.
Presented to the Board or a committee
Saptadhara Organics Limited
Audit Committee: the data-integrity programme across three quality-control laboratories
2015
Presented the programme's scope, findings and timetable once, at the committee's request, as one of several management presenters.
Governance learning and readiness
IICA Independent Directors’ Databank: Registered
I registered with the IICA Independent Directors' Databank in June 2025. I have not yet taken the online proficiency self-assessment test, which the rules require a registered individual to pass within a set period unless an exemption applies. I am not designated a key managerial person and do not expect to claim an exemption, so I plan to take the test before the end of 2026. Registration does not make me independent of any company and entitles me to nothing.
- IICA databank registration in June 2025 and preparation for the online proficiency self-assessment test
- Executive membership of Trivikaya's Risk Management Committee since January 2024
- A structured reading of Schedule IV of the Companies Act and the committee provisions of the SEBI Listing Regulations with Trivikaya's company secretary
- Annual sessions with the statutory auditors on internal financial controls and IT general controls