Takeshi Kato · Chief Information Officer · Japan

What an insurance CIO would bring to an outside directorship

My contribution to a board

Japan's Corporate Governance Code asks companies on the Prime Market to make at least a third of their boards independent outside directors, and to publish a skills matrix showing what the board knows. Most matrices I read now claim technology or digital skills. Fewer boards contain someone who has sat in front of a stalled programme and recommended writing it off, or who has run systems through a typhoon. That is what I would bring.

First, I can read the real state of a system programme. I know the difference between a programme that is behind and one that cannot finish, and I know which documents show it: the share of requirements specified to a testable standard, test evidence rather than status colours, and the old systems actually switched off. Second, I understand operational continuity in a disaster, for a company whose customers cannot wait. Third, I know personal-data protection from the side of a company that relies on many small partners to handle its customers' details, and I know how quickly good rules fail when the tools are poor.

I would not bring expertise in accounting, and I would not claim it. On an Audit and Supervisory Committee I would be the member who examines IT general controls, outsourcing and data incidents, alongside colleagues with financial and legal backgrounds. I would also bring the habit of disagreeing on paper. At Suzukaze Direct I argued against our own parent's preferred data location, and at Kotonami I recommended stopping a programme the board had approved. Both arguments were made in written papers with the evidence attached, which is how an outside director should disagree too.

Committee contribution

Chair and member readiness
Capacity	Committees
Ready to chair	A voluntary board committee on system and cyber risk, after a year as a member
Ready to join	Audit and Supervisory Committee · Voluntary risk committee · Voluntary nomination advisory committee, where technology skills are a gap in the board's skills matrix

Capacity and preferences

Time available: 24 days per year
Current directorships: 1
Sectors: Regional railways and bus operators · Gas and water utilities · Food manufacturing and distribution · Hospital and care operators · Warehousing and logistics
Company type: A company listed on the Prime or Standard Market in western Japan that depends heavily on operational systems, serves many older customers or carries disaster exposure, and has no insurance, agency or supplier relationship with Kotonami
Company stage: An established company renewing decades-old systems, or one rebuilding the board's oversight after a system failure or data incident

The seat I am pursuing

I am looking for one outside directorship at a listed company in western Japan, probably with revenue between ¥100 billion and ¥600 billion, whose business depends on systems that people notice the moment they stop: a regional railway, a gas or water utility, a food manufacturer with a cold chain, or a hospital and care operator. Many such companies are renewing systems that are thirty years old, serve customers who are getting older, and sit in districts that typhoons and earthquakes reach. Those are the problems I know.

I would expect to join the Audit and Supervisory Committee or a voluntary risk committee, and after a year to chair a board committee on system and cyber risk if the board wanted one. I am not seeking a seat to make up the proportion of outside directors, and I would not take a second while I remain an executive. I would rather give twenty-four genuine days to one board than divide them between two.

Governance learning and readiness

IICA Independent Directors’ Databank: Not yet registered

The IICA Independent Directors' Databank is an Indian register for directors of Indian companies, and it does not apply to boards in Japan, where I live and would serve. I have not registered, and the status shown records that rather than any plan. In Japan a company judges a director's independence against the Tokyo Stock Exchange's standards and its own published criteria, and I would expect to be assessed against both.

Study of Japan's Corporate Governance Code with Kotonami's corporate secretariat when the board revised its skills matrix in 2022
Every Kotonami board meeting since 2020 at which system risk was discussed, and the board's annual effectiveness review of technology oversight
Twice-yearly reporting to Kotonami's Audit and Supervisory Committee on IT controls and outsourcing
An outside-director preparation course for serving executives, run by a governance training body in Osaka, completed in 2025

Judgement in practice

Moving the recovery site out of Kansai

When I joined Kotonami, our recovery data centre was about 40 kilometres from the primary one, both in Kansai. The government's scenarios for a great earthquake on the Nankai Trough describe damage across western Japan, and a site that close could plausibly be lost with the primary. I recommended moving recovery to the Tokyo area at a cost of about ¥1.2 billion over three years. The CFO did not dispute the risk but asked for the spending to wait until the policy-platform programme was further along. The board approved a phased move in 2022, with the payment and policy systems first. As an outside director I would ask the same question of any company: what single event could take both the primary and the backup at once?

Disclosing a contractor's lost laptop before we knew the scale

In 2022 a subcontractor's engineer lost a laptop on a train in Osaka. It held test data that should have been masked and was not, including details of about 3,100 policyholders. Our forensic work would take weeks, and some colleagues wanted to wait for it before reporting. I recommended reporting to the regulators and writing to the affected policyholders within days, on the basis of what we knew, and saying plainly what we did not yet know. We also banned unmasked production data from every test environment, which delayed two projects by a month. The lesson I would carry to another board is that the first account of an incident should be accurate rather than complete, and that the control failure behind it matters more than the device.

Keeping policyholder data in Japan against the parent's preference

In 2019 Suzukaze Direct's European parent proposed hosting our new systems in a European cloud region, which was cheaper and simpler for the group. I recommended a Japanese region, at about ¥180 million a year of extra cost, because recovery, regulatory access and policyholders' expectations all pointed that way. The parent's CIO disagreed firmly. The Japanese board supported my recommendation after the group's own lawyers reviewed it. A subsidiary board sometimes has to tell its parent no, with evidence, and I would expect to support management in doing so where the local case is sound.

My first year on a board

My first year would have two halves, and I would not try to change anything in the first one. In the opening six months I would ask management for three things beyond the usual induction papers: the last three years of internal audit findings on IT and data, the list of the company's systems with their age and the people who still understand them, and the account of its most recent significant outage or incident, told by the person who handled it. I would visit one operational site where a system failure would be felt within the hour, such as a control room, a depot or a ward, and talk to the people who would feel it.

In the second half I would agree with the board chair the two or three technology questions the board should be able to answer every quarter, and help management present them in a consistent form. I would meet the other outside directors without executives present, as many Japanese boards now arrange, and the internal auditors on their own. At the end of the year I would ask the chair whether my questions had changed any decision, because if none had, I was asking the wrong ones.

Conflicts and their management

Kotonami has the first claim on me. I would decline any seat at an insurer, an insurance agency or broker, a car dealer or repair group that sells insurance, a bank that distributes insurance, or a system integrator, software vendor or data centre operator that works for Kotonami or bids to. I would also decline a company that is a material policyholder of Kotonami. Before any appointment I would ask Kotonami's board for consent and disclose my shareholding and my subsidiary directorship to the company.

A quieter conflict could arise later. If the company I served invited Kotonami to quote for its insurance, I would tell both boards at once and take no part in either decision; if the relationship looked likely to continue, I would offer to step down. Information runs both ways, too: I would not bring Kotonami's supplier terms or incident details into another boardroom, nor the reverse. Finally there is time. Kotonami's catastrophe season and a board calendar may collide, so I would agree meeting dates a year ahead and say honestly that a major typhoon could cost me one meeting.

My independence statement

I work full time for Kotonami as an executive officer and hold its shares through the officers' shareholding plan. Before any company considers me, I would set out every relationship between that company, Kotonami, our agencies and our integrators, so that its board can test me against the Tokyo Stock Exchange's independence standards and its own criteria. That judgement belongs to the company. My part is to disclose fully and to decline where a relationship exists.

Board and committee exposure

Presented to the Board or a committee

Kotonami General Insurance Company, Limited

Board of directors: the policy-system halt and replacement, catastrophe readiness, the recovery data centre and the annual technology plan

October 2020–present

Presents papers in person whenever a system decision is material; an executive officer, not a director of the company, with no vote.

Reported to a committee

Kotonami General Insurance Company, Limited

Audit and Supervisory Committee: IT general controls, outsourcing oversight, personal-data incidents and cyber risk

April 2021–present

Reports twice a year and after any significant incident; the committee commissioned a second firm to review the rewrite before the board decided.

Served as a director

Kotonami Information Systems Co., Ltd.

Board of the wholly owned systems subsidiary

April 2021–present

Director and chair of the board in an executive capacity, approving the subsidiary's accounts, staffing plans and subcontracting arrangements.

Presented to the Board or a committee

Suzukaze Direct Insurance Co., Ltd.

Board of directors and its risk committee: cloud migration, data location and outsourcing

April 2017–September 2020

Presented the technology plan and the data-location recommendation; not a director.