Four decisions where the system had to say no

Retiring the settlement system I had helped to build

When I joined Seriyama in 2016, its freight-charge settlement system was the one I had worked on as a junior engineer fifteen years earlier: about 2.1 million lines of COBOL on an office computer, with 14,200 customer-specific rate tables. It calculated ¥186 billion of annual billings and the payments due to 820 partner carriers. The hardware maker had announced the end of maintenance in March 2027. Four people understood the rate engine, all employed by a third-tier subcontractor of Kotoshiro Systems.

Kotoshiro proposed a full rebuild on a package platform: thirty months, one cutover weekend and a fixed price of ¥9.8 billion. Our CFO, Ryoji Nakatsugawa, favoured it because it capped the price. I proposed a phased renewal by business line, with requirements and design kept in-house, engineering bought under quasi-mandate contracts, and rate tables reduced before any migration, at an estimate of ¥7.4 billion over six years. I argued that a fixed price would not cap the real risk, which was a failed billing month for small carriers, and that one cutover weekend left no room to learn. The board approved my plan in February 2021 with a contingency reserve the CFO asked for.

We gave things up. There was no ceiling on cost. Parallel running costs about ¥410 million a year. Our sales executive, Yasunori Hanzawa, had to retire many bespoke tariffs, and two shippers with ¥1.2 billion of annual revenue left rather than accept standard terms.

Food contract logistics moved in November 2022, chemicals in September 2023 and Asian forwarding in May 2025. Rate tables are down to 2,900, billing disputes have fallen from 1,900 a month to 620, the month-end close takes five working days instead of nine, and 99.8 per cent of carrier payments go out on the due date. Spending to March 2026 was ¥5.9 billion. Automotive billing moves in January 2027, and we bought a year of extended hardware maintenance for ¥140 million as insurance.

What I would do differently: I would have made the sales organisation own the rate-table reduction from the start, rather than presenting it as an IT prerequisite. And I would have kept all four rate-engine veterans on retainer; one retired in 2023, and the automotive wave lost four months reconstructing what he knew.

Making dispatch refuse a run that breaks the hours rules

In October 2022 my team modelled the next year's driving patterns against the overtime cap due in April 2024. Of our 2,150 line-haul drivers, 640 would exceed 960 hours on current schedules. Restraint time was checked monthly in the attendance system, after the fact. Our 180 dispatchers at 68 depots planned with whiteboards, spreadsheets and a dispatch module from 2004.

We built a dispatch planning system that reads digital tachograph and attendance data nightly and forecasts every driver's remaining allowance. The disagreement was about what it should do with that forecast. Our operations executive, Tetsuo Kanamaru, wanted warnings only. His concern was real: an assembly plant short of a part can stop a line, and a dispatcher needs room to respond. Our human resources executive and I argued that statutory limits should be enforced as hard blocks, with warnings reserved for our stricter internal limits. The President decided for hard blocks in June 2023.

The cost was immediate. Relay points at Kakegawa and Fukuyama, where drivers exchange trailers and return home the same day, needed new yards and new run patterns. We declined about ¥3.1 billion a year of spot and night business we could not staff within the limits. Because drivers lost overtime pay, the company raised line-haul base pay by 6 per cent in April 2024, at about ¥1.9 billion a year, and renegotiated rates with major shippers.

In the years to March 2025 and March 2026, no line-haul driver exceeded the 960-hour cap. Average annual overtime fell from 1,020 hours to 780. About 41 per cent of Kanto runs now pass through Kakegawa. Line-haul driver turnover fell from 14.2 per cent to 10.6 per cent, and on-time arrival at assembly plants held at about 99.6 per cent. Dispatchers now plan a week ahead against remaining allowances rather than reacting at month-end.

What I would do differently: for the first four months, dispatchers saw a fatigue-risk score for each driver that drivers themselves could not see. The workers' union objected, rightly. Drivers now see their own hours and the score's inputs on their handsets. I would have designed that access, and consulted the union, before the first release.

Putting a measured price on waiting at shippers' docks

In 2023 we fitted arrival logging to the gates of our sixty busiest shipper sites and found that our drivers waited an average of 112 minutes between arriving and starting to load or unload. Under the 2024 rules that waiting counts against a driver's restraint time. Every hour at a dock was an hour we could not drive.

I proposed three steps. First, berth booking at our own 41 warehouses, so that we stopped doing to others what shippers did to us. Second, a reciprocal data agreement offered to each shipper: advance shipment notices from them a day ahead, monthly waiting reports by site and cause from us. Third, a charge for waiting beyond thirty minutes, written into renewed contracts in line with the government's indicative freight rates, which now set out charges for waiting and loading work. Mr Hanzawa disagreed. He feared that showing customers evidence of their own inefficiency would damage relationships built over decades, and he wanted the charges dropped. The President supported the data agreement and the charges, on condition that sales led each conversation.

One large chemicals shipper declined to share data or accept charges, and in 2024 moved about ¥1.4 billion of annual volume to another carrier. We did not exempt it. Nine other sites took months to sign because we had not agreed when waiting starts: at the gate, at the booked slot or at the dock.

By September 2025, 41 of the 60 sites had signed. Average waiting at those sites fell from 112 to 44 minutes over eighteen months. Waiting charges brought in ¥640 million in the year to March 2026, and several shippers moved loading crews to match the booking data. Our sales team now opens renewal talks with the site's waiting report.

What I would do differently: I would publish the data definitions before the first report, since the arguments about when waiting begins cost more time than any argument about price. I would also have started with shippers' logistics heads rather than their purchasing departments, who saw the reports as a demand for money before they saw them as information.

Cutting the link to our own warehouse vendor

At 02:40 on Saturday 16 November 2024, Hoshikura Data Services, which hosted the warehouse management system for our fourteen food and daily-goods warehouses, told our duty engineer that ransomware had encrypted servers in its data centre. Those warehouses dispatched about 9,000 store orders a day to three supermarket chains, a third of them chilled. Hoshikura said the attack was contained to another customer's environment.

I was on the call by 03:15. Mr Kanamaru, our operations executive, argued for keeping our connection open: Hoshikura's assurance was specific, our warehouses had never run without the system, and chilled stock would spoil if picking stopped. I argued that we had no way to verify the assurance, that the same vendor held administrative access to our environment, and that an attacker inside our network could reach dispatch and settlement. At 04:10, seventy minutes after the first alert, the President agreed and we severed every link to Hoshikura.

The fourteen warehouses picked from printed stock lists for four days. About 86 per cent of orders shipped complete and on time, against 99.2 per cent normally. We wrote off ¥86 million of chilled goods, and the incident cost ¥520 million in total, including overtime, forensic work and rebuilding. Two supermarket customers asked for weekly reports on our recovery.

The forensic investigation found that the attackers had used a Hoshikura maintenance account valid across two customer environments, one of them ours, and had logged into our environment three hours before encryption began elsewhere. Nothing in our environment was encrypted, and the investigators found no evidence of data being taken from it, within the limits of the logs available. We restored restricted connections on the fifth day and moved the system to a rebuilt environment on the ninth.

The decision to sever external links now rests with the duty incident lead, without waiting for an executive. Vendors must use a separate maintenance account for each customer and notify us within four hours of a suspected compromise. Operations and IT rehearse paper procedures every six months.

What I would do differently: an internal audit in 2023 had flagged the shared maintenance account as a medium risk, and I accepted a remediation date a year away. I would have closed it within the quarter, and I would have written chilled-goods paper procedures before we needed them.