My contribution to a board
Most boards in Japan now publish a skills matrix, and many show a gap in the column for information technology or digital. I would fill that column with something more specific than a title. I have spent twenty-nine years on both sides of the contract that most Japanese companies use to buy systems, and I can tell a board what a fixed-price renewal proposal leaves out, how many subcontracting tiers sit beneath it and where the knowledge will be when it ends. I would bring the questions a director should ask before approving a major renewal, and the patience to keep asking them over several years.
I would bring experience of a cyber incident at a supplier, decided in the early hours with incomplete information. I know what a board needs to hear in the first day, what it should not ask the response team for, and what it should insist on in the weeks after. I also know what a pre-agreed decision right is worth, because we did not have one.
I would bring an understanding of workforce data. Our dispatch system holds a forecast of every driver's hours, and our drivers persuaded us that the people a system records are entitled to see the record. Many companies with field workforces are now building similar systems for care staff, maintenance crews or retail employees. A board will need someone who can ask how such data are used, who can see them and how a worker can correct them.
I would not bring accounting expertise beyond what an executive officer acquires, and I would not seek to chair an audit body. My contribution is to operational risk and technology, and I would be clear about its limits.
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to chair | A board risk or information security committee, where the company has one, after a year as a director |
|---|
| Ready to join | Audit and supervisory committee, in a company with that structure · Voluntary risk committee · Voluntary nomination advisory committee |
|---|
Capacity and preferences
- Time available
- 24 days per year
- Current directorships
- 1
- Sectors
- Regional railway and bus groups · Building and facility services · Food manufacturing · Hospital and care operators · Regional gas and water utilities
- Company type
- A company listed on the Prime or Standard Market of the Tokyo Stock Exchange, outside logistics, automotive supply and Seriyama's customer industries, whose operations depend on a field workforce and outsourced systems
- Company stage
- An established company renewing legacy systems or responding to a cyber or operational incident, where the board wants a director who has managed both from the executive side
The seat I am pursuing
I am looking for one outside directorship at a company listed on the Prime or Standard Market of the Tokyo Stock Exchange, with revenue of perhaps ¥50 billion to ¥400 billion, whose operations depend on people working in the field and on systems run by others: a regional railway or bus group, a building-services company, a food manufacturer, a hospital or care operator, or a regional utility. These companies face the questions I know: ageing systems, renewal decisions bought from integrators, workforce data and the risk that a supplier's incident becomes theirs.
I would expect to join a risk committee or, in a company with that structure, the audit and supervisory committee, and I would be willing to chair a risk or information security committee after a year. I would take only one seat while I remain an executive. I do not seek a board role to add a title, and I would not join a board that wanted a technology director to approve plans rather than question them.
Judgement in practice
01Reporting a control weakness before the auditors found it
In my first year as CIO I found that administrators at our IT subsidiary shared accounts on several production systems, so changes could not be traced to a person. Our external auditors had not raised it, and the subsidiary's management wanted to fix it quietly over a year. I reported it to the Audit & Supervisory Board in July 2021 with a plan to close it in four months, and we did. The lesson I would take to a board is that a weakness management finds and discloses is cheaper, in money and trust, than one an auditor finds. As a director I would ask management each year what it has found that nobody asked about.
02Declining a telematics contract that sent driver data abroad
In 2023 a telematics supplier offered our operations team a fatigue-analytics service at an attractive price. The data, including drivers' locations and working hours, would be processed in another country. Japan's personal information law requires particular steps before personal data are provided to a third party abroad, and our drivers had been told their data stayed in Japan. Operations wanted to proceed and resolve the consent question later. I recommended against signing until consent and disclosure were settled, and the President agreed. The supplier later offered processing in Japan at a higher price, which we accepted. On a board, I would ask where workers' data travel before asking what the analysis will show.
03Asking the board for insurance against my own plan
By late 2024 it was clear the automotive wave of the settlement renewal would go live only two months before the old platform's maintenance ended. My team was confident in the date. I was less so, because one of the rate-engine veterans had retired and we were reconstructing his knowledge. I asked the board to approve ¥140 million for a year of extended hardware maintenance, money that would be wasted if we kept to schedule. Some directors asked why I was buying protection against my own programme. I said that a plan with no slack was a plan whose risk had been moved to the board without telling it. They approved it.
My first year on a board
In the first months I would learn the company before I offered views about it. I would ask for the last three years of board materials on major systems projects, the internal audit reports on IT and information security, the most recent incident reports and the company's own assessment of its dependence on outside vendors. I would ask to visit one site where field staff use the company's systems, without managers present, and to meet the head of internal audit and the person who leads incident response.
I would then ask one question per meeting, not five, and make sure it was one that the papers could have answered and did not. Over the year I would want to see whether the board receives technology risk in the same form as financial risk: owned, measured and dated. If it does not, I would propose a format rather than criticise the absence of one. At the end of the year I would ask the chair and two colleagues whether my questions helped them decide, and drop the ones that did not.
Conflicts and their management
My employer comes first. Seriyama's board would need to consent to any outside directorship, and I would offer it the full list of the company's relationships before seeking that consent. I would decline any company that is a Seriyama customer, competitor or vendor, including any carrier, warehouse operator, systems integrator or telematics supplier, and any automaker or parts maker. That excludes Amabe Industries, my former employer, which became a Seriyama customer in 2019.
If a commercial relationship arose after I joined, I would tell both boards at once, leave the room for any discussion of it and resign if it became material. My knowledge of vendors creates a subtler risk: I might favour or disfavour an integrator because of my history with it. I would declare any past dealings with a vendor whenever the board considered a contract with it.
Time is the last conflict. Seriyama's quarterly close and board calendar are fixed a year ahead, and I would agree the other company's dates against them before accepting, so that twenty-four days means twenty-four days of preparation and attendance.
My independence statement
I am a full-time executive officer of Seriyama and own a small number of its shares through the employee shareholding association. Any company I join would need to have no customer, supplier, vendor or shareholding relationship of substance with Seriyama, its founding family or my former employers. I would set out every relationship I have before a nomination is considered, and leave the judgement on independence to that company under its own criteria and the exchange's standards.
Board and committee exposure
Presented to the Board or a committee
Seriyama Logistics Holdings
Board of directors: settlement renewal, dispatch changes for the 2024 working-hours rules, cyber posture and the November 2024 incident
April 2021–present
Presents twice a year and at significant events; an executive officer, not a director, with no vote.
Reported to a committee
Seriyama Logistics Holdings
Audit & Supervisory Board: IT general controls under internal control reporting, audit findings and incident reports
April 2021–present
Reports each year on IT general controls, and reported the November 2024 incident and its remediation within the week.
Member of a committee
Seriyama Logistics Holdings
Group Risk and Compliance Committee, a management committee chaired by the President
April 2021–present
Member responsible for information security and technology risk; this is an executive committee, not a board committee.
Served as a director
Seriyama Information Systems
Board of the group's in-house IT subsidiary
June 2022–present
Representative director in an executive capacity, approving the subsidiary's accounts, contracts and personnel policies.
Served as a director
Amabe Industries (Thailand)
Board of the Thai regional subsidiary
April 2013–August 2016
Director in an executive capacity while regional IT director, approving capital spending and the flood-recovery programme.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
India's IICA Independent Directors' Databank is a register for people who seek independent directorships of Indian companies. I am not on it and have no reason to be: the seats I am considering are at Japanese listed companies, where outside-director status comes from the Companies Act and each company tests independence against the exchange's criteria and its own policy.
- Annual reporting to Seriyama's Audit & Supervisory Board on IT general controls since 2021
- Board presentations on the settlement renewal and the November 2024 incident
- Study of Japan's Corporate Governance Code and the board skills matrices of listed companies with Seriyama's company secretary
- Directorships, in an executive capacity, of a Thai subsidiary and Seriyama's IT subsidiary