Boardroom Confidential with Penny Bingham-Hall

BENNETT MASON

Hello, and welcome to Boardroom Confidential, a podcast from the Australian Institute of Company Directors. My name is Bennett Mason. Thanks very much for joining us. In each episode will have candid conversations with some of Australia's top directors, leaders and experts, delving into their background and discussing many of the key issues that boards are grappling with. Our guest this time is Penny Bingham Hall. She's the co-chair at Supply Nation and a director with Fortescue. Penny has previously been a chair or board member with several organisations including Vocus Group, BlueScope Steel, and Taronga Zoo. In addition, Penny was one of the speakers for the AICD’s Essential Director Update events in 2025. Penny, thanks so much for joining us on the podcast.

PENNY BINGHAM-HALL

Pleasure to be here, Bennett.

BENNETT MASON

I mentioned the EDU or Essential Director Update a moment ago. Let’s talk about some of the areas you were talking about. One of your topics was artificial intelligence.

We know that's front of mind for a lot of directors now. How can boards and how can boards ensure their organisations are positioned to seize the opportunities we know are out there stemming from AI, but also at that same time guarding against the risks?

PENNY BINGHAM-HALL

Yeah. Good question. And AI certainly is the topic of the year I think for directors. question comes back to how do you leverage that sort of predictive power of AI, which is a huge opportunity, but also, as you say, comes with some big risks. So, I think directors need to get in the game. You need to understand what AI is. And most of us in our executive careers didn't have to understand it. So, part of it is saying, where do the opportunities play out for your organisation? There are no real easy answers to this because the technology is just evolving so fast. So, I think it is one of those areas where you just do need to seize the opportunities. I like to think of it as start small, think big and go fast, because this is evolving very fast.

BENNETT MASON

How are you seeing directors and boards themselves use AI to help them with their roles?

PENNY BINGHAM-HALL

I'm not sure actually what other directors are doing to use it, with their roles. I think within organisations, it's a whole range of things. And it does depend on whether you're looking at it in terms of operational efficiency, whether it's about providing better services for customers. There’s a whole range of applications that we're looking at. I think the first question you need to look at is around data governance, really, because data is kind of the fuel for AI. So what data is important to your organisation? Do you own it? Do your customers own it? Who's accountable for it in the organisation? Because data needs to be maintained. It needs to be sort of fed and watered and maintained. How do you do that? And then have you got the architecture or the systems there to be able to interrogate that data. That’s sort of where I start with it. And then it's really what are the problems you're trying to solve? I know at Fortescue, for example, we're looking at a lot of operational applications. Most people I talk to tend to look at more, sort of, productivity back of house, etc. But there are also some fantastic applications I've seen around supply chain efficiency, better communication. For example, when you've been on a mine site, how do you know what's happened on the last shift, how do you get better communication happening with supervisors, etc.? So, a whole realm of applications. I think you just need to get in there and get your hands dirty and do some pilots really and see how that goes.

BENNETT MASON

You mentioned Fortescue. That's obviously an enormous company with great resources to spend, but some of the organisations where you’re a director, aren't so big. Are there certain questions that directors should be asking management about AI, regardless of the size of the organisation?

PENNY BINGHAM-HALL

Yeah, you're right. It's a lot easier when you've got a big organisation with the resources behind it and the in-house capability. I think one of the things is before you launch into AI, is really making sure that you have at least someone in the management team, particularly if it's a small group, who has knowledge around AI. And that doesn't mean data scientists. Before generative AI, everyone talked about machine learning and having data scientists, it's really moved past that. There are a lot of off-the-shelf solutions now that you can bring into organisations, but you do need to make sure that someone in the management team have the skills to manage it, because it does come with risks. And it's like that old saying, you don't give a gun to children. You need to make sure that you've got someone that understands those risks. And if you don't have them in-house, if you've got a small organisation, I always think it's worthwhile probably investing in getting someone external to come in and talk to you about what off-the-shelf software there is that you could use. Have a look at what shape your data is in. Because cleaning up a bit of data before you get into AI is worthwhile. I know some of the big banks have spent years getting their data into shape before then really launching into the opportunities that come with artificial intelligence and that's a good starting point. And it doesn't mean that you need to spend two years doing it, but just understanding the baseline is probably worthwhile.

BENNETT MASON

Another topic you were speaking about for the Essential Director Update was cyber security. And we know that's obviously tied very closely to AI and to data. But what do you think good cyber risk oversight looks like at the board level?

PENNY BINGHAM-HALL

Cyber has been on the agenda for quite some years now. And particularly in the current geopolitical environment, obviously, the sort of threat environment continues to escalate. And it is one of those things that I think all directors need to keep educated on and updated about the threat environment. Again, it's really about knowing where the weakest link in the chain is, whether that be your supply chain, how you onboard, where you onboard suppliers or customers, where that interface is, can often be a weakness. Legacy systems is another area that particularly older organisations that have been around for a while often have legacy systems which can't be securely patched anymore or protected. Knowing where they are, when they're going to be remediated, or when you're going to replace them, more importantly, is pretty important. The other thing is most cyber breaches are through human error. I think something like 95% of cyber breaches come from human error. So, it does actually need to be tied into your human resources function, whether that's training, running phishing exercises. But also, just making sure that people are very conscious and cyber conscious is pretty important. And things like also just automating exits, which is easier to do in a big organisation. But when people leave the organisation, making sure that you close off that avenue for unexpected people to come into the system, is the way I would say.

BENNETT MASON

“Unexpected people” is a nice euphemism.

PENNY BINGHAM-HALL

Or things bots or whatever it might be. These days It's probably not people, actually.

BENNETT MASON

We know that regardless of the size of the organisation or the sector of the industry, just about anyone can be a target of a cyber-attack now. and these incidents are usually a matter of when rather than if, sadly. So, what's your view on the role of the board when that cyber-attack does take place? When the organisation is attacked by hackers, there's a ransomware attack or whatever. What should the board be doing?

PENNY BINGHAM-HALL

Sadly, I've been involved in a few of these incidences, and this might sound a little tongue in cheek, but I think boards should actually just get out of the way and let management get on with managing the incident. The work of the board really needs to happen before that because as you say, it's when, not if. So, doing the right planning, making sure that you are doing whatever you can to prevent, detect, etc. before it happens. But when it happens, you really need the team to be able to step in and manage it. The chairman obviously would need to stay closely in touch with the CEO or as often happens, whoever is there because the CEO happens to be on holidays when these things happen. But whoever it is needs to be kept up to date in terms of particularly the stakeholder communications, what the response is, if it involves ransomware, sometimes there are critical decisions that need to be made, but you need to keep that communication short in any crisis, but particularly in a cyber crisis. And the chairman then can go back to the board and keep them informed. But you don't want to distract management from their day job by constantly updating the board. They really need to be getting in there and dealing with it. I think doing that planning like any crisis, if you've rehearsed it, if you've thought through the scenarios, thought about how you respond, make sure you've got the resources to deal with it. And for smaller organisations who often don't have the resources. Make sure you've got a good external team who are familiar with your organisation, who can jump in at short notice to support you because you really need all hands-on deck.

BENNETT MASON

You talked about the importance of planning. Is that where things like simulation exercises come in?

PENNY BINGHAM-HALL

Yeah, absolutely. And look, this holds more broadly for crisis management in general, not just in cyber, but I think thinking through scenarios of what's the worst thing that could happen, whether it's a cyber-attack or whether it's some other kind of crisis. How do you pull the team together? What options have you got if key people are away? Because that does happen. How do you handle it? Do you have enough people? Do you have enough resources? If not, do you have someone on standby, particularly if it's an overwhelming crisis? I mean, even just dealing with the media can be quite overwhelming, even for large organisations. Bringing in people who are very experienced to that, who can just man the phones, prioritise who you talk to, make sure your messages are right, are really important. In the cyber environment too, liaising with people like the Australian Signals Directorate or the Cyber Security Unit, who often will have very good intel, because this may have happened to another organisation which may or may not have hit the public arena, can be incredibly helpful.

BENNETT MASON

You said you'd gone through a few cyber incidents yourself, unfortunately. What were some of the key takeaways, key lessons from those?

PENNY BINGHAM-HALL

The weakest link in the chain. BlueScope, for example, who were hit by a ransomware attack. It came in through an old legacy system in the US. It managed to make its way through our US organisation down to Port Kembla, in Australia and started to spread. Getting an external organisation who we had got an arrangement with to come in and basically block the ransomware very early on and then look for where else it was to make sure that we really understood what was going on, was incredibly important. So, I think weakest link in the chain, having an external resource to come in and support you in it. It took a long time to remediate. We were very fortunate that we managed to block it before it did significant damage. And interestingly, we were never held to ransom. which was a good outcome. But really then also doing that sort of post-incident review to really say, what else could we have done? And it probably sped up the investment in legacy systems, because BlueScope did have a lot of legacy systems as a lot of long-term organisations do. Saying actually, we really need to speed up the replacement of some of these older assets that are in the network.

BENNETT MASON

That's an important point about updating those legacy systems. But I do want to shift to another area. Your final topic for the Essential Director Update is climate governance. I should say you're also the deputy chair of the Climate Governance Initiative in Australia. You've been focussed on climate and sustainability issues for a long time. How did you first become engaged in that space?

PENNY BINGHAM-HALL

That's an interesting question. It actually goes right back to when I was at university. I always wanted to be an architect when I was a kid. I ended up doing industrial design because it was a shorter course. Sorry to admit that. But I was always fascinated by passive solar design of buildings and houses. And when I sort of took a break, I didn't do the gap year after school. I did the gap year in the middle of getting my degree, and I went off travelling and went to Colorado and New Mexico looking at solar design of buildings. And it just seemed to me that renewable energy was such a sensible, simple way of designing things. So, it goes back a long way. I've always been very interested in renewable power, and I think, as climate science has shown, we're getting closer and closer to a tipping point for the planet. As now a non-executive director, I was always just very interested. And that's really morphed into climate governance.

BENNETT MASON

You've been interested in these areas obviously for a while. For a period, certainly in corporate Australia, whether it was at the exec level or at board level, folks maybe weren't so interested in climate governance or sustainability. Did you find that was pushback when you would raise these issues?

PENNY BINGHAM-HALL

Look, I think if you go back and think about the history of sort of ESG, if we take it sort of more broadly than just climate, which has probably been a bit more recent. It really started as corporate social responsibility. It was really about what do we sponsor and how do we look like a good corporate citizen. And then people started talking about having a license to operate. They would probably couched as soft issues. That was the sort of term that was used for them. I think having worked for a long time in the construction sector, things like environmental management were a core part of doing business, and that was partly from a regulatory perspective. And making sure that we didn't pollute rivers or didn't do things that would upset the local community. So, I think I've always been very conscious of them and the impact when things go wrong, that the community can cause a lot of reputational damage, etcetera. And then suddenly it becomes a hard issue because it affects your bottom line. So, I've always been interested in that interplay. I think it started more on the social side, probably as then investors started realising that some of these softer issues were important to governance. I think the G came into ESG of saying, well, how the boards actually govern more broadly for long term wealth of shareholders. And then more recently, I think there's some that focus on climate as the world has woken up to the fact that we need to do something and do something quickly. So, it really has been quite an evolving journey. I think, for boards to come along with. And some of the boards I've been on, I actually think the board has driven the conversation around the importance of addressing climate change and the risk if we don't, ahead of management. Not always, but it has been a topic that has come up some time ago to say we're really exposed in this area, particularly because I’ve been on the boards of a lot of heavy emitters. So, it's quite a significant issue for those companies.

BENNETT MASON

The approach to these issues has certainly changed. It's now at the forefront of many directors’ minds. Part of the reason for that is the introduction of mandatory climate reporting, which we've seen in 2025. These measures are obviously very new. What lessons do you think boards should take from the first year of these laws?

PENNY BINGHAM-HALL

Well, thankfully the regulators aren't going to go too heavy in the first year. They don't expect 100% perfect. So, it's a good opportunity to learn from your own mistakes but also looking at your peers and other companies. So, the first thing is making sure you've got the right data that you need to report. And most big companies that are going to be in that first group have already been reporting emissions. So should have some of the data, but probably not all of it. Some of my organisations I know are doing a dry run, at the end of the FY 25 financial year. And we'll just look at with the current information and what we would normally be reporting where are the gaps for mandatory reporting, so that over the next financial year when we're going to need to report at the end of that year, we've got a good understanding of what new areas that we need to gather data to report. So, I think I'd categorise it as a learning year. And I do think it’ll be very interesting to see how those reports vary between different companies. And I would suggest that every director should have a bit of a look at their competitors and see what they're doing at the end of the first year.

BENNETT MASON

These measures we know only capture the biggest companies in Australia and the major emitters. But what do they mean for everybody else? What do they mean for smaller organisations? Why do these measures matter for them?

PENNY BINGHAM-HALL

 It comes down to your stakeholder expectations, really. I mean, yes, if it's mandatory for you, then obviously you have to do it. For companies that aren't caught up in that yet, they may be in the next round. So, they should be looking and learning. But look, I think for smaller organisations and particularly not for profits, it can be too onerous to do the mandatory reporting, but I think understanding what your key stakeholders are interested in and therefore what you should be thinking about. There may still be parts of your organisation where you can reduce emissions. I think it's always a good place to start of looking at how you can improve your energy efficiency, because the less energy you use, the less emissions you produce. So, I think there are a number of things that you can look at. And it goes back to that whole concept of licence to operate for any organisation. If you don't think these things through as a director of that organisation, then you’re probably not doing your job.

BENNETT MASON

I want to also ask you about your own career now. You never became an architect. There's still time. But you did have a very long career at Leighton Holdings. What made you want to say goodbye to your executive career and move on to board roles?

PENNY BINGHAM-HALL

Look, I think because I'd been in the same organisation for over 20 years, I did feel like it was time for a career change. So, I did kind of take another gap year. And I really thought about whether I wanted to take on another executive role in a different organisation, whether I perhaps wanted to do some consulting work, but the idea of a non-executive director was certainly in that mix. And I think as that year morphed on, the more I thought about it, my role when I left Leighton was head of strategy. And I really like that big picture view of looking across a global organisation in different industry sectors. And I was quite attracted to the idea of a portfolio career where you're involved in a range of different companies, with different diverse perspectives. And I was fortunate to be approached about some non-executive director roles, probably because it was pretty timely at that stage. This was 15 years ago now, where there weren't many women on board. So, there was this sudden realisation that perhaps having diverse voices at the table wouldn’t be a bad idea. And thankfully we've moved a long way since then. And I was fortunate, I think, to have been on the team in a big industrial company, and there probably weren't many women with that background. So, I was fortunate perhaps to do that.

BENNETT MASON

So, what was your first board role? How did that come about?

PENNY BINGHAM-HALL

Well, I actually took on an industry association board role when I was still an executive with what was then called the Tourism Taskforce that became the Tourism and Transport Forum. And ended up becoming deputy chair of that. That was just something that came out of connections in the industry. I quite enjoyed it, but when I decided to go down the non-executive director path, after leaving Leighton, the first board role I took on was BlueScope.

BENNETT MASON

Those were your first board roles. What about other execs? Other people who might be thinking about taking on their first board roles? What advice do you have for them about getting started?

PENNY BINGHAM-HALL

Look, I think the first thing, and I was fortunate that a senior advisor in a recruitment firm set me down and talked this through with me and said, you've really got to think about what's your value proposition. Why would you approach Penny to go on a board rather than Bennett? What is it that you actually offer? And so, he really helped me rewrite my CV to think about what I might offer a board. What were skills that were unique to me that I could offer to a board. Then I think it's trying to think about what kind of organisation you want to be on the board of. I think it's really important that you're interested in what that organisation does, whether it's a government board, an ASX listed board, a not for profit. If you're not interested in the business, then I'd probably counsel you not to go down that path. So, I think that's important. And then it's a bit of a matter of luck or timing, really, about whether those opportunities come up at the time that you're looking. And it can take a while for those things to align. But just really thinking about what you have to offer, what you're interested in, whether it's an industry sector that you like. And then it comes down to culture fit, really. So, meeting the chairman, meeting other members of the board. I know I've done interviews where I've just gone, “Well, that's an easy decision. Not really my kind of company.” And there are other ones where you think, wow, I really enjoyed that conversation. I think I could add some value to this board.

BENNETT MASON

Are there certain red flags you look out for when you are meeting the chairs and directors for the first time?

PENNY BINGHAM-HALL

I think divided boards. Probably not when you meet the chair, but when you go around. And this happened to me fairly early on when I was looking at boards and it was pretty obvious there were factions on the board and I thought, I don't think that's a good place to start. Style of chairmen vary a lot. And that does affect how boards operate, actually. I mean, good boards have chairs who not only manage meetings well but manage the dynamics of the board well. And some are more formal; some are less formal. So, I think that's a bit of a style. And it’s sort of almost personality fit really about whether you like the style of the chairman, is important. Actually, I probably should say it's not just style, it's also values. What are the things that are important to you and does that organisation sort of fit those values? And that's not just what's written on their website, but through talking to the chairman, talking to the CEO, talking to the other directors. I think you get a good sense of what their values are, and that's important that they align with yours.

BENNETT MASON

Let's talk a bit more about building that board career. For a lot of directors, it's a portfolio career. And you yourself, you've been everywhere from a gigantic mining company to a zoo. So how have you put together your own board portfolio? What are you looking for? Are there certain factors you consider and weigh up?

PENNY BINGHAM-HALL

Well, as I said, having worked in one organisation for a long time as an executive, diversity was important to me. So, I sort of set off thinking I'd really like another ASX, or an ASX-listed company board, having come from that space, I knew it well. I really wanted to get a government board because I just thought I've done a lot of work on the other side of the table from government in the private sector. It would be quite interesting to go onto a government board and was always potentially interested in not-for-profit. Although, I think at that stage when, you’ve still got kids at school and all the rest of it, I was probably interesting commercial boards thinking, “Oh well, later in my career, like now, doing more passion projects and not-for-profits is probably where I want to focus.” So, I think it's quite important to deliberately build that portfolio. I have to say the first board that I went on was BlueScope, and then I went on Australia Post. With BlueScope, the year I joined was a year we nearly went broke. So that's when we had to close down a blast furnace at Port Kembla. We had 25 board meetings. We also potentially had a carbon tax coming in. Anyone who knows the chemistry of steelmaking knows that coal plus iron ore equals carbon dioxide. So, it was a pretty full on experience and I kind of put the brakes on going, oh, if this is what it's like being a director on a big publicly listed board, in a very changing marketplace because it was just when China was ramping up steel production and it really impacted BlueScope. And in a way that they couldn't control. It made me sit back and think about what I was doing. So, I kind of slowed down my approach to getting on other boards. So, it depends a bit on how it evolves. There is a bit of chance in this in terms of what you end up on first, how much time it takes, etc, and then how you want to sort of curate that mix of different boards. But when I look back, I feel like I've been very fortunate that interesting boards have come up at the right time, and it's probably more about what you say no to than what you say yes to.

BENNETT MASON

You've had this range of board experiences now, is there something that unites a high a high performing board, a successful board? Are there similarities?

PENNY BINGHAM-HALL

Yeah. Look, I do think this might sound a bit hackneyed, but I think having a diverse but cohesive and collegiate board is really important. And the chair's pretty fundamental to that. If I think back on my career, Fortescue and probably Taronga, are two of the most diverse boards that I've served on. And I mean diverse, not just in gender but cultural background, different life experiences, different education, different executive careers, and different locations. At Fortescue, we've got a very global board. And that really does make for very interesting conversations with very different perspectives. But it's also a very collegiate board. We have fun. That's important that everyone gets along. And we have a great chairman who chairs meetings very well and brings out the best in people. Interestingly, Taronga, I felt the same way. We had a really diverse board, even though it was New South Wales-based. So, you're not going to have people from all over the world. But we had representatives from Dubbo, we had representatives from the local community in Sydney. We have an indigenous director, we have corporate directors, we have people with science and conservation backgrounds, so very diverse views, diverse personalities. But again, always very collegiate and where you bring divergent views across the table to a sort of common goal, I think it can be very, very exciting to be on.

BENNETT MASON

You were talking a moment ago about how the chair can be really fundamental to a board being successful. You've now held chair roles yourself, at Vocus Group and previously with Taronga Zoo. How do you interpret that chair role?

PENNY BINGHAM-HALL

Well, I always think of a board as a team sport. And so, the chairman's really the leader of that team. And you want it to operate as a team. That doesn't mean that you don't encourage diverse points of view and have good discussions, but you do want the team, along with management, all pulling together. So, I think there's a lot of relationship management in it. Obviously as the chairman, you also need to really be across the business in detail. So, you make sure that board meetings focus on the topics that are the top priority, that you've got a good mix of short term, long term, financial performance, market dynamics, strategic direction, etc. So, getting those agendas right is important. I think also just getting the mix in the meeting of perhaps how important it might be to have an in-camera session at the start of the board meeting to get topics on the table that are on everyone's mind. And I'll often ring directors before meetings if there are some pretty significant meaty issues coming up, just to talk to the other directors before the meeting, to make sure that they really focus on those and have a good think about them before the meeting. What time you might have one-on-one with the CEO before the rest of the management team comes in, and then how long are they in the meeting? Are they in there just for their topic? Or the parts of a broader operational financial overview or strategy discussions where you want the whole management team there? So, thinking that through is important, I think. But at the end of the day, you want to have a respectful relationship with management. You want to make sure that meetings are a safe space for people to speak out and get their points of view across. Yeah. Look, I think they're the main things I would think about.

BENNETT MASON

You said meetings are a safe space for getting your opinions out, Your feelings out. That can lead to maybe not conflict, but certainly disagreement in the board meeting. What's your approach to that, either as a chair or a director?

PENNY BINGHAM-HALL

Look, I think as a director you want to encourage diverse perspectives. Hopefully, you want to bring everyone to a common place where you can move forward. Sometimes that's not possible. Sometimes you have to do a bit of a captain's call and go, well, the majority of the room things X, even if you know there’s someone that probably is not 100% signed up to it. So, it's always good if you can bring it to conclusion. But if you can't, I think you've got to summarise where you've got to as a board, where you've got common views, where you've got divergent views and then take it offline and say, look, we'll come back to it and take it forward from there. Because there's no point in continuing a conversation where people obviously are uncomfortable. I think you just have to take that outside of the boardroom and take it from there. I’ve very rarely been in board meetings where there's been conflict. Where there has, I think it's a chair’s role to in the conversation respectfully and again take it out of the room. And that probably means some one-on-one conversations, but I don't think there's any room for conflict in a professional board meeting.

BENNETT MASON

I wanted to shift to your role at Supply Nation, the NFP, it's somewhat unusual. You're the co-chair of that board. How does that work?

PENNY BINGHAM-HALL

Yeah, I've wondered that too when I took it on. We have an indigenous chair, Damien Barnes, and I’m obviously the non-Indigenous chair. It's relatively new. When I first joined the board, we just had a chair. It actually works really well. The purpose of Supply Nation, and I was actually involved when it was set up 15 years ago, was really to generate a vibrant, sustainable indigenous business sector. And we do that really through sort of three avenues. And one of them is about facilitating connection between indigenous business and our government and corporate members. So having someone like myself who's got that background as a corporate member with an indigenous business owner, so Damian's a lawyer, has actually worked on the corporate side as well, etc. You bring those different perspectives together and different cultural nuances, as co-chairs. But look, we meet regularly as a team, really, with the CEO to discuss issues that come up. And it just means it's a three-way relationship rather than a two way one. But it works.

BENNETT MASON

We were speaking about Supply Nation’s purpose or mission, which is about First Nations procurement. What do you think boards at other organisations can do to help encourage more or greater First Nations procurement?

PENNY BINGHAM-HALL

I think the first thing is to have a conversation at the board about whether your organisation wants to participate in Reconciliation with our First Nation Australians. And if you do, what's the right way to do that? Indigenous procurement is actually, in some ways, a relatively easy way to engage with Indigenous people. And I think one of the objectives of Supply Nation is to really drive an understanding of how purchasing power can provide social outcomes. And we've seen that and we've got a lot of evidence to prove that. So having that conversation about how you might play, for a lot of organisations having an indigenous employment program can work, particularly if you're a mining company in the Pilbara. But if you're a small business in the city, that might be more difficult. But there are a lot of fantastic indigenous businesses around. One of the core functions that Supply Nation does actually, on behalf of the federal government, is manage Australia's biggest directory of indigenous businesses. We've got a very comprehensive audit process to verify that they are actually Aboriginal businesses. So, it's quite easy to get involved in that. And just thinking about when you go out to tender for products, could you throw an indigenous business in the mix? And of course, I'd say join up to Supply Nation as a member.

BENNETT MASON

Penny, we might leave things there, but I know you'll be talking about all these issues much, much more, at this year's Essential Director Update event. So, thanks for coming on the podcast.