My contribution to a board
For five years I have explained technology risk to an audit committee in euros rather than acronyms, and that translation is what I would offer a board. Most boards of consumer companies now accept that technology can stop the business. Fewer have someone at the table who can tell a sound programme plan from a hopeful one, ask what a cyber-security report has left out, or judge whether management's continuity arrangements have been tested anywhere other than a meeting room. I have written the papers such boards receive and know where they tend to be optimistic.
I would bring specific experience of three things that consumer boards find hard to oversee: large replacements of store, warehouse or finance systems; incidents, including a ransomware attack, a payments outage and a personal-data breach; and the use of customer data under the GDPR. In each case I can tell a board which questions matter and roughly what good answers look like, without pretending that a director should manage the work.
Disagreement is part of the work, and I have practised it in writing. At Ravessa I opposed a supplier's timetable for the till programme, held our chief executive to a slower path on forecasting automation and argued for deleting customer data the commercial team prized. Each objection went into a paper with figures attached, and none of those working relationships broke.
Spain's Good Governance Code for listed companies works on a comply-or-explain basis, and Spanish company law requires a listed company's audit committee to be made up of non-executive directors, most of them independent, with an independent director in the chair. I would not claim the accounting depth that a committee needs from its financial expert. I would offer the technology and risk depth that most audit committees now need alongside it, and I would expect to serve as a member for at least a year before taking on any committee leadership.
Judgement in practice
01A cloud contract held back for its exit terms
In 2021 our till supplier's standard contract for the new cloud platform said little about how we would leave it: no commitment on the format in which our transaction history would be returned, no exit assistance and a termination period shorter than any replacement could take. Our finance director wanted to sign quickly to secure the price. I recommended delaying signature until the contract included data return in an agreed format, eighteen months of exit assistance at fixed rates and a termination period of two years. Negotiation took seven weeks and cost a small part of the discount. The board's lesson, which I would carry to another company, is that the cheapest moment to agree how to leave a supplier is before you depend on it, and that a board should ask about exit terms whenever a core system moves to a single provider.
02Deleting customer data that still had commercial value
In 2023 I reviewed our loyalty database and found 1.1 million profiles that had not been used for three years. The commercial team wanted to keep them, because the purchase histories were valuable for analysis sold to suppliers. The GDPR's principle of storage limitation does not make an exception for data that might be useful. With our data protection officer, I recommended deleting the profiles and setting a three-year retention rule, and I took the paper to the Audit and Control Committee because the decision cost revenue. The committee agreed. Supplier insight income fell by about €0.6 million a year. As a director, I would ask any consumer company how long it keeps customer data, who decided and whether the answer would survive a regulator's question.
03What to say to the market on the first morning
When ransomware hit our Guadalajara distribution centre in February 2023, our first draft of the notice to the market, prepared overnight, said that operations were continuing normally. That was true of the stores and untrue of 164 of them in the days ahead. I recommended that the notice say plainly that one distribution centre was not operating, that stores it served would see reduced availability, that personal data might have been affected and that no further estimate could yet be given. The chief executive and the chair agreed after a short argument. Our shares fell 4 per cent that morning. When empty ambient shelves appeared in 164 stores later that week, nobody could say we had hidden the cause. As a director I would ask of any first-day statement which sentence management would least like to have read back to it in a month.
My first year on a board
My first quarter would go on the places where systems meet physical work. Before my second meeting I would ask to stand in a plant, a warehouse or a store during an ordinary shift and watch what happens when a screen freezes. Alongside that I would work through two years of committee papers, the external auditor's letters on IT controls, the risk register and the last independent security review, and I would ask for time with internal audit and the security lead without their managers in the room.
After that I would stay a member and listen. I want to learn which risks this board revisits every quarter, which it has quietly stopped discussing and how its committees share the load. I would not ask to lead anything in year one. Twelve months in, I would ask the chair one question directly: which of my interventions changed a decision, and which only lengthened a meeting.
Conflicts and their management
Ravessa employs me full time, and that comes first. I would refuse seats at grocery retailers, at anyone competing for Ravessa's shoppers and at any material supplier, including technology suppliers, and I would steer clear of companies tied commercially to the Ravessa family. My Ravessa shares, the Ravessa Online directorship and my trusteeship would all be declared at the outset, and nothing would proceed without our chief executive and board agreeing.
Should the company later start selling to Ravessa or tendering for its work, I would declare it immediately, step out of every related discussion and resign if the relationship looked lasting. The calendar matters as much. Holy Week, July and August and the run to Christmas are our peak weeks, so I would fix board dates twelve months ahead and protect twenty-four days that include reading time.
My independence statement
I work full time for Ravessa and own a modest holding of its shares through the employee plan. I would only consider a company where neither Ravessa, its founding family nor I have any meaningful commercial, family or financial tie, and I would set out every relevant fact in writing first. It is for each board, applying its own rules to those facts, to decide whether I count as independent there; I draw no conclusion about that myself.
Committee contribution
Chair and member readiness| Capacity | Committees |
|---|
| Ready to chair | A technology and cyber-risk committee, where a board has one, after a year as a member |
|---|
| Ready to join | Audit committee · Risk committee · Technology or digital committee |
|---|
Board and committee exposure
Presented to the Board or a committee
Ravessa Supermercados, S.A.
Board of directors: annual technology plan, the till programme, the ransomware incident and the payments resilience decision
January 2021–present
Presents technology investment papers and incident reports to the board; not a director of the company and holds no vote.
Reported to a committee
Ravessa Supermercados, S.A.
Audit and Control Committee: technology risk, cyber security, IT general controls and personal-data breaches
January 2021–present
Reports every quarter on cyber security, IT controls tested by internal audit and the external auditor, and data-protection incidents; not a committee member.
Served as a director
Ravessa Online, S.L.U.
Board of the wholly owned online grocery subsidiary
March 2021–present
Director in an executive capacity, approving the subsidiary's accounts, its fulfilment contracts and its data-processing arrangements with the parent.
Served as a director
Fundación Mesa Común Aragón
Board of trustees of a regional food-redistribution charity
June 2022–present
Unpaid trustee; oversees the charity's systems for tracking donated food from supermarkets to local organisations, and sits on its finance subcommittee.
Capacity and preferences
- Time available
- 24 days per year
- Current directorships
- 1
- Sectors
- Branded food and drink manufacturers · Pharmacy and health-product distribution · Logistics and cold-chain services · Household and personal-care goods sold through retailers
- Company type
- Listed or large privately held European consumer, food or distribution company with stores, plants or warehouses that depend on operational technology, and no material trading relationship with Ravessa
- Company stage
- A company replacing core systems, recovering from an incident or building its board's oversight of technology and cyber risk for the first time
The seat I am pursuing
I am looking for one independent non-executive seat at a listed or large private European company outside grocery retail: a branded food or drink maker, a pharmacy or health-product distributor, a logistics or cold-chain operator, or a household-goods manufacturer selling through retailers. All of them stop when their systems stop, hold customer or patient data under the GDPR and must fit big system changes around a production or trading calendar. Those are the problems I know.
I would join the audit committee or a risk committee, and help a board that decides it needs a technology and cyber-risk committee to build one. I do not want to be only the board's technology voice; I want to share in all of its work, including strategy and executive appointments. While I remain at Ravessa, one seat is my limit.
Governance learning and readiness
IICA Independent Directors’ Databank: Not yet registered
The IICA Independent Directors' Databank is an Indian requirement for independent directors of Indian companies, and it does not apply to the European seats I am pursuing. I have not registered with it. If a board in India ever considered me, I would take advice on the registration and assessment its rules require before going further.
- A twelve-month programme for prospective non-executive directors at Instituto Arbeyal de Gobierno Corporativo, completed in 2025
- Quarterly reporting to Ravessa's Audit and Control Committee since 2021, including meetings with the external auditor on IT general controls
- Board exercises on cyber incidents with Ravessa's executive committee and two directors each year since 2023
- Study of Spain's Good Governance Code for listed companies with Ravessa's company secretary