Chief Technology Officer / India
Choices that slowed a programme so the control would hold
- Trivikaya revenue, year to March 2026
- ₹2,140 Cr
- About two-thirds from development and manufacturing for innovator customers
- Technology colleagues led
- 212
- IT, plant systems, laboratory platforms and security across Pune, Kurkumbh and Dahej
- ERP restored from clean backups, November 2025 drill
- 58 hours
- Against eleven days during the February 2025 ransomware recovery
Decisions & consequences
01Digitising 14 products deeply instead of 38 thinly
In early 2022 our Dahej plant ran 38 commercial APIs and intermediates for 21 customers, about 2,900 batches a year, on paper batch records. Quality review of a completed record took 6.5 days on average, documentation errors ran at 31 per 100 batches, and finished material waited in quarantine while reviewers checked arithmetic. Customers were asking when we would move to electronic records, and two had made it a condition of new projects.
Our head of manufacturing at Dahej, Jignesh Vaghasiya, proposed converting all 38 products within eighteen months by putting the existing paper records onto tablets, a ₹42 crore plan. His argument was sound: one method for the whole plant, and no period of running two side by side. I proposed spending ₹36 crore to digitise 14 high-volume products, 61 per cent of the plant's batches, in a deeper form. The system would enforce the order of steps, block charging into equipment not released as clean, read weights from balances and calculate yields itself, so that reviewers looked only at exceptions. The other 24 products would stay on paper for at least two years. Our managing director backed the narrower plan after we ran both designs on one product for a month.
The trade-off was felt on the floor. Supervisors worked with two systems, customer auditors had to examine both, and recipe authoring took fourteen weeks per product rather than the six I had budgeted. The first three months produced more exceptions than paper had ever raised, some because our limits were tighter than the process needed.
By June 2024, for the 14 digitised products, review time had fallen to 1.8 days and documentation errors to 4 per 100 batches. Faster release cut inventory awaiting release by about ₹47 crore. By March 2026 we had added 12 more products, covering 78 per cent of Dahej's batches. Review by exception is now how quality defines the reviewer's task, not a feature of the software.
I would do two things differently. I would put shift chemists on the screen-design team from the first week rather than the fifth, and I would cost master-data work honestly before committing to a date.
Eleven days to rebuild cleanly after ransomware
On a Sunday night in February 2025, ransomware encrypted our ERP application servers, most corporate file shares and part of our email. The attackers had entered through a maintenance contractor's remote-access account on a corporate jump server. The plant control and execution networks at Kurkumbh and Dahej, separated from corporate IT since 2017 and 2019, were not reached, and every batch in progress finished normally. But Dahej's execution system took material and dispatch data from ERP, and it was the last month of the financial year: ₹160 crore of shipments were due before 31 March.
Our chief operating officer, Kedar Ambardekar, wanted ERP restored from the latest backups within three days. I argued for rebuilding the identity servers from nothing and restoring only from offline copies once forensic investigators had established when the attackers first entered, because restoring a compromised directory could reinfect everything we brought back. That meant ten days or more. Ashwin Kolhatkar, our managing director, chose the slower path after the investigators found the attackers had been inside for nineteen days, longer than our oldest online backup. The Risk Management Committee met twice that week.
We reported the incident to CERT-In within six hours of identifying it, made the required disclosure to the stock exchanges and spoke to customers before the forensic report was final. Data had been copied from two file shares, including technical documents of five customers, and I called each of them myself. No ransom was paid, in line with a policy the board had approved in 2023. The plants dispatched against manual documentation checked by quality.
ERP was back in eleven days. About ₹63 crore of shipments moved into the first quarter of 2025–26, and the response cost ₹9 crore. Contractor access now runs through a brokered system that approves and records each session, offline backups are immutable, and we rehearse a full restore twice a year: the November 2025 drill brought ERP back in 58 hours.
What I would change: the contractor-access weakness had sat on our risk register for fourteen months, with remediation planned for the following year. I should have asked the committee for the money rather than waiting for the budget cycle.
Refusing a customer's live window into our plant
In mid-2023 a US innovator customer, for whom Kurkumbh makes a commercial API worth about ₹210 crore a year, asked for live read access to our process historian and execution system as part of its continued process verification. Its contract was due for renewal. Anirudh Sabnis, our head of business development, wanted to agree. The request was reasonable from the customer's side, other manufacturers were offering portals, and the renewal mattered.
I recommended refusing live access. The Kurkumbh historian recorded campaigns for several customers, two of them competitors of this one, and a live connection would have opened a path from outside the company into the plant's control zone. Instead I proposed a segregated data platform: for every batch, a validated extract of critical process parameters, in-process results and a deviation summary, delivered within two days of completion, with a monthly trend review between our process engineers and the customer's statisticians. Building it would cost ₹6.5 crore.
The customer's quality head escalated to our managing director, and the renewal was delayed by four months. We conceded quarterly supervised access to raw data on site, which costs our engineers about six days a quarter. A smaller customer with an ₹18 crore product moved it to another manufacturer that offered live access; I had judged that less likely than it proved.
The platform went live in January 2024 and the large customer renewed for five years. By March 2026 the platform served 31 customers, and batch-data turnaround had fallen from nine days to two. Its data-sharing terms became a standard schedule in our customer contracts, and the platform has never needed a connection from outside into the plant networks. Customer audit questions about data provision, once a regular source of findings, now take an hour of each audit rather than a day.
I would do one thing differently. We presented the customer with a finished design. Had we built the data set with its statisticians from the start, the four-month delay might have been one month, and the on-site concession might not have been needed.
Deferring an ERP upgrade to fix controls before the listing
In the 2022–23 audit, the year before our planned listing, our statutory auditors raised 11 deficiencies in IT general controls. The most serious were shared privileged accounts in ERP, developers with standing access to production, no periodic review of user access, and backups that had never been restored in a test. None had led to a misstatement. All of them would be examined again before an IPO, and an adverse finding on internal financial controls was the last thing an offer document needed.
The same window had been reserved for a ₹22 crore ERP version upgrade. Our CFO, Revati Sathaye, and our supply-chain head wanted the upgrade finished before listing, so that the first year as a listed company would not carry a major system change. Their argument was reasonable. Mine was that remediating controls on a system we were about to change would mean doing the work twice, and that upgrading a system with weak access controls would carry the weaknesses into the new version. I recommended deferring the upgrade by twelve months and spending the window on controls. The Audit Committee agreed after the CFO and I presented both options in a single paper.
We removed 214 generic and privileged accounts, introduced segregation-of-duties rules for 46 sensitive transactions, required independent approval for every change to production and began quarterly access reviews signed by business owners. We restored ERP from backup in a test for the first time in the company's history. All 11 deficiencies were closed by March 2023, the auditors' report on internal financial controls for 2022–23 was unmodified, and the company listed in November 2023.
The cost was real. Finance ran two reporting requirements on manual workarounds for an extra year, extended support for the old version cost ₹5 crore, and the upgrade, completed in January 2025, took longer because people who knew the old configuration had moved on.
I would have started earlier. Access reviews were on my list when I joined in 2016, and for six years I put plant projects ahead of them.