1. Can you walk us through your role at Cromwell, Daniel? What are some of the key responsibilities you take on daily?

I’m the Chief Technology Officer and, though I’m based here in Australia, the remit is across the European and Singapore platforms as well. I am largely responsible for building and implementing our technology capability and IT roadmap, as well as looking at governance to support our current and future infrastructure.

Cybersecurity obviously is a large part of my role – I’d suggest that as much as 25% of my time is spent on cybersecurity initiatives, presentations, and considerations. Of course, many of our governance frameworks that relate to selecting, evaluating, or protecting technology links back to cybersecurity anyway.

It’s a very risk-based approach – we have risks that are managed at a corporate level, but we also need to embed risk assessments into every platform that we consider for implementation – as well as for all the change initiatives we undertake.

So, if there is an upgrade, or if there is some functional change that we are making to our environment, we need to consider all the risks involved.

2. Looking back, how did your career in information technology begin?

My father had an IT consulting company, so I was always around computers as a kid. I played a lot of computer games, and I went into a technology degree following school.

After pursing another passion for a short while, I then came back to the industry working with customer relationship management systems (CRM) systems, and spent a lot of time working with manufacturing systems and in investor relations systems.

My first engagement with Cromwell was nearly 20 years ago, and I was designing and implementing an investor management system with Richard Foster, one of Cromwell’s founders. Richard and I would build these big A3 investor reports using a platform called Goldmine – which was Cromwell’s first investor relations platform.

I think I certainly have an aptitude for work in IT – I’m very good at putting things in boxes; I have a lot of skills in developing methodology and proceduralising tasks, and I have a strong technical background, which has been helpful.

3. How does technology factor into the decision-making processes at Cromwell?

Cromwell sets out an annual business strategy – and we, as a technology function, look at the strategy and how it aligns with our roadmap. For instance, if the business wants to increase funds under management, we review our current platforms and capability to examine what we can do to support that goal.

So, when we look at technology factoring into decision-making processes, data obviously plays a large role in everything that we do. Much of the data we hold is stored on platforms that the technology department is largely responsible for – in conjunction with marketing or finance (for example) or whichever team owns the information. We help oversee the security of that information, and the consistency of that information, and help business stakeholders implement governance to manage the information effectively.

A lot of the decisions that we undertake from a business perspective are around streamlining, including questions like, “can we utilise technology to generate efficiencies in the business?” And, you know, a good percentage of the effort that we apply is in trying to identify, and then achieve those efficiencies – and we often succeed.

4. There have been some very public privacy/data breaches in some very large organisations recently, how does Cromwell manage risk and protect our business – and our investors? How do we minimise the chance of these kinds of hacks happening to us at present?

So, I guess the first question that comes up is, “what is the sensitivity of the information that we’re protecting?”. The most sensitive data we hold is information relating to our investors, so it’s essential we have robust protections in place.

When we look at things from a cybersecurity perspective, we’re looking at four key risk areas: integrity, accessibility, unauthorised access, and unauthorised disclosure. We look at the integrity of the information to make sure that it’s not corrupted, that it’s regularly backed up, and ensuring we have enough controls to protect against deliberate or accidental actions that may compromise files or important data.

We also need to look at accessibility of data– that is, “how can we ensure staff and stakeholders can access the information they need, when they need it?” So, we have systems and interfaces that are dependent on the latest cloud technologies to ensure our staff can securely access the data they need to run the business.

We also ensure that none of the data resides in a specific single location (such as a building’s server room) – we always have data distributed geographically to ensure we can maintain access in the unlikely event of business interruption.

Just as important as accessibility, is our need protect our data from unauthorised access. The two highest profile attacks from last year (Optus and Medibank) both resulted in unauthorised access of information, followed by unauthorised disclosure of that same data. Clearly, these breaches caused significant damage to both company reputation, as well as inconvenience and risk within people’s lives. Cromwell maintains a robust landscape of measures to ensure that the only people who access our data, are those authorised to do so. These measures include tools to confirm a users’ identity (such as multi-factor authentication) as well as tools and procedures to confirm suitable access levels.

We also have a very highly regulated information security management system, ISMS.

This is the basis of our ISO 27001 certification. Every year for the past four years, we have gone through ISO 27001 certification – where an independent auditor reviews and tests our information security management system. They also make recommendations as to where improvements can be made. We have a second external organisation to help us prepare for these audits, so that we can pre-empt issues that may occur. So, we have both internal and external audit functions in that space.

In the unlikely event we experience some kind of breach, we have a cybersecurity incident response plan that is tested every year. These tests involve a wide array of stakeholders from across the business, to ensure we are all aligned to respond to any kind of cyber breach or attack. While we believe our cyber-response capabilities are strong, we are always looking for ways to enhance the way we work, and these tests often highlight opportunities for improvement. We also have a range of vendors that we engage to support us in the unlikely event of a cyber incident.

5. What are some changes or shifting attitudes/trends/practices that you currently see playing out in the corporate IT space, particularly around cybersecurity?

I think there’s been a lot of activity in the proptech space. Proptech is the application of technology to help optimise the way people buy, sell, research, market, experience, and manage real estate. At Cromwell, we have a proptech working group that involves participants from both Europe and Australia. My primary interest is focused on governance of our proptech initiatives.

For example, let’s imagine we decide to implement a theoretical occupant management system – a system (with associated mobile app) to allow building occupants to order coffee or lunch to their desk; get their dry cleaning picked up and delivered; turn the building lights on and off; or possibly report safety incidents, etc.

Before beginning such an implementation, we’d need to make sure that we understand the requirements and resources necessary to make the implementation successful.

In the event we start deploying the system and realise we have underestimated the resources required to be successful, the damage could be profound – and could severely impact any future technology activation. So, part of our governance is to ensure we fully understand what that implementation looks like before we take the first steps. Sometimes it can just be a matter of managing people’s expectations and enthusiasm.

6. What opportunities in the IT space excite you, and how do you think Cromwell’s use of technology overall could be developed moving forward?

There seems to be a shift towards presence-based interactions and immersive VR experiences. This is the progression of technology so that, rather than just sitting on a video call and looking at a laptop screen, attendees of a meeting from across the world can all experience sitting in an interactive, immersive virtual reality office space. We know big tech vendors such as Microsoft and Meta are spending huge amounts of money on research and development in this area. While, at the moment, these investments have largely been realised in the gaming market, it’s only a matter of time before these developments start driving mainstream change in the way we work as well.

In my view, I think in 10 years we’ll all have VR headsets to join Microsoft Teams (or Zoom) calls. While we’ll still be using a laptop for documents and information systems, our meeting experiences will be more like a virtual reality-based exercise. We’ll be able join meetings in virtual rooms; we’ll be able to draw on whiteboards; we’ll be able to sit and turn and talk to each other. I think this will be a big improvement in driving the productivity of virtual meetings and, with the current trends in remote working, this technology will improve the productivity of many teams as a whole. It’s a really exciting time!

So, my expectation is that we’ll probably start going down that pathway. Right now, Microsoft’s not quite there, but the licenses that we are buying, and our roadmap, allows us to leverage these developments when the technology is ready.

7. What do you enjoy most about your role?

I like that I’m genuinely able to make a difference. When we sit down as a team to look at a problem, we know that we’ll be able to solve that problem and drive an initiative through to achieving a positive outcome for the business.

My background is in consulting, so I’ve always been able to go and make a difference in businesses. However, in consulting, you find that you just go from organisation to organisation to organisation, making a difference in the same space over and over – you are rarely able to build upon your past accomplishments. At Cromwell, this is an ongoing journey and we’re continually able to leverage the team’s past achievements to improve the future of the business.

1. Tell us about your role. What are some of the key responsibilities you take on daily?

I’ve been with Cromwell for 18 months – and stepped into a newly created role as Cromwell’s first Australian designated head of risk. I’m responsible for our enterprise-wide risk management and compliance functions, especially relating to our AFSL obligations. Essentially, this links to ensuring our investors have the right level of protection; ensuring that all our regulatory risks are managed; and that we’re compliant where we need to be.

It’s a broad remit – because risk is present in everything that a company or individual does. You can’t silo off risk to one side because, at the end of the day, we all manage risk – from choosing to cross a road; or whether we holiday overseas; or whether we choose to invest in certain products or with certain companies. When you strip it all down, managing risk is about making good decisions, and part of my role is to assist people to do that. Our frameworks and policies are designed to support informed decisions, so that the right information is included; the right people are part of the process; and that we do things in a timely way. Similarly, being able to see the impact of that decision is important, as is being able to quickly change tact, if needed.

I really enjoy my role, because it draws together a number of functional threads. This allows us to think about risk and compliance as more than just a ‘tick a box’ exercise. Embodying good risk management leads to better decision making; it includes always being ethical and focused on the right considerations, including ESG and risk factors in our actions. Above all, we want to make sure that our investors’ interests are protected – and that our products and services reflect that priority.

2. How do you make sure that risk management at Cromwell is a day-to-day process?

It’s a mix of a ‘top-down’ and ‘bottom-up’ approaches. It starts with our Boards thinking deeply and often about the key risks that lead us to unexpected outcomes, and how much and what type of risk they decide we should take, in executing the business strategy. On the other side, we also engage with our people and include a bottom-up aspect. Everyone in the business manages risk in their individual roles, so it’s important that we consider risks at every level.

Ultimately, making risk management come alive day-to-day requires exploring the psychology of risk – it’s a fascinating topic. Managing risk largely involves humans, who all think, behave, and react differently. Trying to understand the risks that you may not see, because you have a particular bias or different set of experiences, very much requires a psychological approach.
We invest in property – bricks and mortar – but it’s ultimately our people that make us strong, and it’s up to us to make sure they are supported in doing their best work because we all want great outcomes for our investors.

3. Looking back, how did your career in risk and compliance begin?

I took a job as the first in-house lawyer with a small financial institution in Brisbane many years ago.

I’m fortunate that my role there expanded rapidly. In addition to the legal and regulatory function, I was managing multi-disciplinary teams, including securities and mortgage production; adding company secretarial and governance functions; and our financial planning business was restructured and expanded, requiring a wider remit. At the time, the regulator, APRA, was implementing changes to ensure financial institutions prioritised risk management and required licensees to have a dedicated risk management function with direct reporting lines to boards.

Before that, I was an ‘escapee’ from about 15 years of private law practice. For me, it was often frustrating to provide legal advice in a private firm environment – as it can be difficult to get under the hood of a business; you may not understand why decisions are being made. Sometimes it feels like you’re looking in through the window, rather than being in the action. I’m an extrovert, so I enjoy engaging with people and I was always drawn as a lawyer to explore the context and inner workings of clients’ businesses to make sure any advice is practical well as being legally correct.

I enjoy being part of a business; being not only an advisor but also understanding and creating strategy and implementing it. Of course, being a lawyer, regulatory stuff is interesting for me, so that’s set me up well for my current role. I do genuinely love the work that I do.

4. There have been some very public privacy/data breaches in some very large organisations recently, how does Cromwell manage risk and protect our investors? How do we minimise the chance of these kinds of hacks happening to us?

It’s about making sure that we have the fundamentals right first, which includes having strong processes and mechanisms to make our systems sound. At Cromwell, we have a three ‘lines of accountability’ approach to ensure that everyone in the business manages risk, knows their role, and that there is checking and testing to give assurance, as well as to help us continually improve.

The first line of accountability are our teams performing their roles – from creating products and providing services, dealing with investors, managing IT or accounting functions – and managing the risks relating to their role. As a risk and compliance team, or in ‘line 2’ we provide expertise, support and consider how our people can have the right boundaries and steps in place to comply with laws and manage risks.

We also make sure the right framework is in place to enable the Board and management to oversee performance and know when there are concerns. To help us monitor risk levels, our team also performs independent tests and investigations and assist managing issues.

An extra layer is the third line. This involves Cromwell obtaining independent and objective assurance, mainly via external professionals such as auditors, consultants, or certifiers. As well as meeting regulatory audit requirements, we consider particular areas of risk – cybersecurity is a good example – that are so important that we obtain extra assurance from experts to do a review or deep dive to identify if and where we should make changes; to benchmark ourselves and continually improve. So, our three lines approach defines accountability and includes focus on aspiring to always enhance our business.

5. What are some changes or shifting attitudes/trends that you currently see playing out in the governance, risk, and compliance sector?

Change, and the speed at which it occurs are the standout factors.

We know that change is constant – there will be property cycles, interest rate rises, pandemics and other headwinds – but being able to trust in your people; give them the tools to perform their roles well; and have the right framework in place to navigate unpredictability all helps in responding confidently. By definition, managing risk is responding well to impacts – both positive and negative – on the achievement of goals, so uncertainty is inherent in that. You must be comfortable with navigating uncertainty, which can be difficult, and be prepared to adapt to suit.

6. How is Cromwell responding to the growing importance of ESG for both investors and tenants? Is it a case that ESG is now as important as all other business considerations, do you think – and how do you see businesses adapting to this changing stakeholder sentiment?

Cromwell has always prioritised ESG factors as part of its business and Cromwell’s previous work in sustainability was one of the reasons I was attracted to this role.

Including ESG factors in decision-making and business processes is part of managing risk well. It’s not really that ESG of itself is as important as all other business considerations, because ESG issues, being so wide and varied, are part of all of our decisions and activities.

It’s been exciting to be closely involved in reviewing Cromwell’s forward ESG pathway including refreshing our ESG Strategy. I’ve been so impressed that everyone at Cromwell – from the Board to our people – are actively engaged, enthusiastic, and committed to playing our part in responding to critical issues, including climate change and decarbonisation. I am proud that this enthusiasm has been matched with authenticity, so that a thoughtful and pragmatic approach is taken when setting our goals. We’re about to release our ESG Strategy shortly.

While there’s a growing importance placed on ESG by investors, it’s also important for our people, just as it is important for our communities and society generally. Our response to the growing awareness of environmentally conscious investors must focus not only on reducing harm but equally, on contributing positively to the broader societal response to these urgent issues.

7. Where would you like to see Cromwell’s ESG strategy in five years’ time?

I’d like to see that we don’t talk about ‘ESG strategy’ at all, we just talk about strategy – because it’s integrated in every part of the business, and the outcomes we seek financially, from risk management and from environmental, social and governance related goals become more ambitious over time, are consistently achieved.

8. What’s the benefit of taking an ESG-centred approach to our investors?

The community, and the world more broadly, expects more to be done in the ESG space – so, we must constantly strive to do good and be better. From an investor perspective, financial returns are of course an imperative. Ensuring that our investment approach includes ESG issues is also part of managing physical risks to assets, such as potential climate and weather impacts. The steps we take to future-proof our buildings may also result in reduced operational costs from infrastructure that is aligned positively with environmentally positive initiatives, e.g., using solar power and implementing energy efficiency upgrades. Because ESG factors will also shape and influence the value of real estate in the future, considering ESG may become increasingly important as a potential value driver in future investment decisions and impact return outcomes.

9. What do you enjoy most about your role?

The variety of work resulting from my role is hugely stimulating but most importantly, being able to link together various issues and make them simpler and more understandable is rewarding. Undoubtedly though, it’s the people at Cromwell that make my role enjoyable. The talent and experience within the Cromwell team is incredible, but it’s a bonus that they are genuinely great humans and colleagues as well.

10. What do you do to relax? / How do you spend your time outside work?

Home’s really important to me and, like many people, COVID-19 reminded me of the importance of family and trying to get the balance between work and play right. My husband and I enjoy escaping to our pad at Kings Beach when we can, with our daughter and dachshunds, Frank and Connie, in tow. We’re also currently making up for lost overseas travel time, with a couple of quick trips this year. I’m addicted to true crime podcasts, good books and, so far, I’m yet to meet a champagne I don’t like.

Between all of that, I do try to contribute to the greater good. I’m a director on several not-for-profit boards, including YMCA Brisbane. I am also on the board of Mercy Partners, who is the overall governance body for some hospitals, schools, and community service businesses. The work that these incredible companies do is something I’m very proud to play a small part in. Importantly, these opportunities give me opportunity to continue to learn and expand my own skills which, hopefully, makes me a better Cromwell team member.

GPT Group – similar assets, different pricing

The same holds in listed property securities. While we’re happy to acknowledge listed markets are sometimes just volatile for the sake of being volatile (and that does keep some of us awake at night) they must also be respected for attempting to factor in new information as efficiently as possible.

In August 2021, Australian 10-year Government Bonds were trading on a yield to maturity of around 1%. Today, they are well over 3%. The value of almost any asset is impacted by this.

The listed property market has reacted, and investors can now buy a stock, such as GPT Group (ASX:GPT), for a material discount to its underlying asset backing. At the same time, GPT manages two unlisted wholesale funds, which in some cases hold assets in common with GPT’s own balance sheet. These wholesale unlisted funds are valued at book. They too have an apparent risk that is lower than GPT, but do they really?

Redcape Hotel Group – beer does help you sleep

Redcape Hotel Group was a listed owner and operator of pubs in NSW and QLD. However, after less than two years as a listed entity, the responsible entity determined that the listed market wasn’t properly valuing the stock, so a complicated proposal to delist was announced.

Phoenix took advantage of the transaction, to buy into the listed stock, and to ultimately sell the unlisted stock, locking in a listed versus unlisted arbitrage along the way. Our Redcape position rallied almost 40% in the first six months of 2022. Over the same period, the listed property sector fell by 23%.

We fully accept that markets, stocks and portfolio construction are complex matters. However, at times, there are low risk opportunities to take advantage of market dislocations. Listed volatility might keep us awake at night, but those investors who don’t bury their head in the sand and make decisions based on a clear understanding of exactly what they’re investing in, are likely to prosper.