21 February 2023 – Philip Boardman
Hide video Show video
(10.03 am)
Mr Beer: Good morning, sir, can you see and hear me?
Sir Wyn Williams: Yes, I can.
Mr Beer: Thank you very much, may I call Philip Boardman, please.
Philip Boardman
PHILIP BOARDMAN (affirmed).
Questioned by Mr Beer
Mr Beer: Thank you, Mr Boardman. As you know, my name is Jason Beer and I ask questions on behalf of the Inquiry. Can you give us your full name, please.
Philip Boardman: Philip Kevin Boardman.
Mr Beer: Thank you very much for coming to give evidence to the Inquiry today and for the provision of two witness statements assisting us in our investigation. Those two witness statements should be in the hard copy bundle in front of you. Can we look at the first of them, please, which is dated 4 August 2022 and which, excluding the exhibits to it, should be 12 pages in length.
For the transcript the URN is WITN04790100. If you go to the 12th page of the witness statement, can you see a signature?
Philip Boardman: Yes.
Mr Beer: Can is that your signature?
Philip Boardman: It is.
Mr Beer: Subject to the corrections and additions you make in the second witness statement, are the contents of that first witness statement true to the best of your knowledge and belief?
Philip Boardman: They are.
Mr Beer: Thank you. Can we go to the second witness statement, please, that’s dated 8 November 2022 and is two pages in length. For the transcript the URN is WITN04790200. Is the signature on the second page of that witness statement true?
Philip Boardman: It is.
Mr Beer: Sorry, is that your signature?
Philip Boardman: Yes, it is.
Mr Beer: Are the contents of that witness statement true to the best of your knowledge and belief?
Philip Boardman: They are.
Mr Beer: Thank you. A copy of each of those witness statements will be uploaded to the Inquiry’s website and thereby be publicly available, so I’m not going to ask you questions about every passage within them, instead just ask you selected questions; do you understand?
Philip Boardman: I do.
Mr Beer: Thank you. I am only going to ask you questions relevant to Phase 3 of the Inquiry, in particular relating to the IMPACT Programme and not ask questions that may be relevant to later phases in the Inquiry, about which you may be able to give evidence, in particular Phase 7 of the Inquiry.
Philip Boardman: Okay.
Mr Beer: Can we start, please, with your background and experience. I think you joined ICL Plc in November 1989; is that right?
Philip Boardman: I did, in the manufacturing division, and I was working there for – developing systems to support the planning and management of manufacturing and logistics functions.
Mr Beer: You’re still employed by Fujitsu at this present time?
Philip Boardman: I am, yes.
Mr Beer: So you’ve been employed by Fujitsu and its relevant predecessor companies or company –
Philip Boardman: Yes.
Mr Beer: – for about 33 years or so?
Philip Boardman: Indeed.
Mr Beer: You are presently the service architect for the Post Office account; is that right?
Philip Boardman: That’s right, yes.
Mr Beer: Just tell us briefly what does the service architect role involve?
Philip Boardman: It involves defining the changes of services as Post Office business changes and they – more recently – I’ve been in that role since 2014, and that – since then, Post Office have been changing the services, bringing on new suppliers to get the services from other suppliers, other than Fujitsu, at various times.
Mr Beer: Now, I want to ask you some questions about your background and experience –
Philip Boardman: Sure.
Mr Beer: – because neither of those matters are dealt with in either of your witness statements. Firstly, do you have any professional qualifications that are relevant to the issues that we’re considering, for example in computing or information technology?
Philip Boardman: I have an MBA from Warwick University, and so whilst back at ICL Manufacturing, the field of business process modelling and analysis and business process management support systems was relatively new then and I got some training in that there, and had opportunities to practice that in some internal projects within ICL.
In 1995, I joined a newly formed consultancy practice in ICL that was offering business process modelling analysis, business process redesign services to ICL’s external clients, and so, by the time I was doing work on the IMPACT Project in 2002, I had had seven years’ experience of delivering business process modelling analysis consultancy to a range of clients –
Mr Beer: I’m just going to come on to experience in a moment. I’m just asking about qualifications at the moment.
Philip Boardman: Oh, sorry.
Mr Beer: Have you got any qualifications in anything relating to information technology or computing?
Philip Boardman: No, engineering mathematics degree.
Mr Beer: Sorry?
Philip Boardman: I have an engineering mathematics degree.
Mr Beer: Right. When did you take your MBA?
Philip Boardman: 2011, I finished that.
Mr Beer: Did you play any part in the procurement, design, build, testing or rollout of the Horizon System –
Philip Boardman: None at all.
Mr Beer: – between, say, 1996 and 2000?
Philip Boardman: None at all.
Mr Beer: When did you first become involved in the Horizon System?
Philip Boardman: 2002, as part of the end-to-end project programme that Post Office were running.
Mr Beer: That’s the first date that’s mentioned in your witness statement.
Philip Boardman: It is.
Mr Beer: Autumn 2002, you mention in paragraph 9, is that when you first became involved in the Horizon System: autumn 2002?
Philip Boardman: That’s right, yeah, I’d been contacted by Post Office accounts within ICL at the time. Post Office were intending running this end-to-end programme and wanted to take a holistic process/review approach to what they were doing.
Mr Beer: Between 1995 and autumn 2002, what jobs were you doing within ICL or Fujitsu?
Philip Boardman: So I was – like I say, I was working in ICL Manufacturing. Other internal roles within ICL generally, reviewing processes and defining new processes, and starting to work with external clients from – sorry, to ‘95, did you ask?
Mr Beer: No, from ‘95 –
Philip Boardman: Oh, from –
Mr Beer: – to sort of when Horizon –
Philip Boardman: From ‘95 –
Mr Beer: Hold on. It’s better that we don’t talk over each other.
Philip Boardman: Okay, sorry.
Mr Beer: It makes it difficult for the transcriber to transcribe and it makes it difficult for people listening online to hear.
So between 1995, which is the birth of Horizon, and autumn 2002, when you first became involved in Horizon, I am asking what jobs you did?
Philip Boardman: So I was working as a business process consultant offering services to ICL clients in – you know, a set of industries, retail, financial services, manufacturing, transport and local and central Government; a variety of different clients.
Mr Beer: Thank you. In that period, what knowledge, if any, did you have of the Horizon System?
Philip Boardman: None, other than ICL internal announcements about winning business and putting things together of ICL Pathway.
Mr Beer: Did you know anything in terms of any issues or problems with the robustness of the operation of the Horizon System in that period before you took up a role in the autumn of 2002?
Philip Boardman: No, I was working with other clients at that time.
Mr Beer: When you became involved in the IMPACT Programme in – or what became known as the IMPACT Programme –
Philip Boardman: Indeed, yes.
Mr Beer: – in autumn of 2002, I think you were a business process consultant?
Philip Boardman: That’s right, yeah.
Mr Beer: What is a business process consultant?
Philip Boardman: So I was – like I say, Post Office wanted to do a holistic review of their business processes and look at the ways that their system, internal systems, could support those better. So there was a group of business analysts from Post Office and I was supporting them in doing business process modelling, capturing information about the way their business processes worked and helping them understand and think about ways that things could be done differently.
Mr Beer: To whom did you report in Fujitsu?
Philip Boardman: In Fujitsu, it would have been the chief architect, Tony Drahota, and later Bob Gurney, who was working for Tony.
Mr Beer: What was the name of the team, if you were in a team, of which you were a part?
Philip Boardman: It was RASD, and what those letters stand for is somewhere in my witness statement but I can’t recall.
Mr Beer: Requirements, Architecture and Systems Design?
Philip Boardman: Thank you. That’s right.
Mr Beer: Who was the leader of the RASD team?
Philip Boardman: Tony Drahota.
Mr Beer: How many people were in the RASD team?
Philip Boardman: I think it would have been around about ten.
Mr Beer: Did you manage the team?
Philip Boardman: No.
Mr Beer: Who managed the team?
Philip Boardman: Tony Drahota.
Mr Beer: Where did you sit in terms of the team hierarchy?
Philip Boardman: Probably fairly low down.
Mr Beer: What were the jobs of the other people within the team?
Philip Boardman: Some requirements analysts, some architects, yeah, mostly requirements analysts and architects.
Mr Beer: Did you have an opposite number in the Post Office?
Philip Boardman: A number, in particular, David Parnell, and Karen Hillsden, Julie Pope and Karen White, at various times. But, initially, Dave Parnell and Karen Hillsden were the main contacts.
Mr Beer: Thank you. I want to turn to the feasibility study and Fujitsu’s input into it. You tell us in paragraph 10 of your witness statement, that’s on page 3, that what began or became to be known as the IMPACT Programme was initially known as the “End to End Re-Architecting Programme”; is that right?
Philip Boardman: That’s right, yes.
Mr Beer: That it included a series of workshops and analyses to produce a feasibility study document; is that right?
Philip Boardman: That’s right, yes.
Mr Beer: And that that document was called “End to End Re-Architecture Feasibility Study Business Requirements”; is that right?
Philip Boardman: Yes.
Mr Beer: And that document is dated 21 February 2003? I just want to chase down that document to make sure that we’re talking about the same one. The document, I think, is FUJ00098198. That will come up on the screen for you, Mr Boardman.
Philip Boardman: Yes.
Mr Beer: You’ll see this document has the same title as the document you mentioned in your witness statement “End to End Re-Architecture Feasibility Study Business Requirements”.
Philip Boardman: That’s right.
Mr Beer: You’ll see that it’s – the date on it is two years out, in the top right-hand –
Philip Boardman: That’s a typo.
Mr Beer: I just want to check that. It’s dated 21 February 2001.
Philip Boardman: Mm-hm.
Mr Beer: If we go to page 2 of the document, I think under the document history, we can see that it’s dated as Version 0.1, 21 February 2003?
Philip Boardman: That’s right.
Mr Beer: If we look at the foot of the page we can see there’s a Post Office copyright of 2003. So the date of this document we should take to be 21 February 2003; is that right?
Philip Boardman: Yes.
Mr Beer: This is a Post Office document; is that right?
Philip Boardman: That’s a Post Office document, signed off by Sue Harding, I believe, yes.
Mr Beer: It’s right, is it not, that Fujitsu jointly with the Post Office, however – that document can come down – identified the Post Office requirements for this programme?
Philip Boardman: Well, yes, we were working as a joint team.
Mr Beer: Can we look at that connection at FUJ00098169. We can see the title of the document is “Fujitsu Services Input to Feasibility Study for End to End Re-Architecting of Post Office Systems” and it’s dated 24 March 2003, so we’re about a month after the document that we have just looked at; is that right?
Philip Boardman: That’s right.
Mr Beer: You tell us in your witness statement that you had input, as you describe it, into an earlier version of this document; is that right?
Philip Boardman: That’s right. So the End to End Feasibility Document, effectively was the Post Office’s requirements specification. This was a proposal made by Fujitsu of what could be done to try to address some of those requirements.
Mr Beer: You had input into this document –
Philip Boardman: That’s right, yes.
Mr Beer: – the one we’re looking at on the screen?
Philip Boardman: But mostly the architects, the architect in the system, were the key writers of that document.
Mr Beer: I missed what you said. You’re dropping your voice very slightly at the end of each answer?
Philip Boardman: The architects were – had editorial control of this document. I was inputting in terms of requirements.
Mr Beer: To so you did have input into this document?
Philip Boardman: Indeed, yes.
Mr Beer: Thank you. You would have seen and approved the document before it went to the Post Office, presumably?
Philip Boardman: I’d have reviewed it, yes. I don’t think I had approval authority, but, yes, I – I’d have given my input.
Mr Beer: If there was anything in it that you thought was wrong or shouldn’t be said, you would have said so?
Philip Boardman: I would have, yes. I would.
Mr Beer: Thank you. Can we just look at page 6 of the document, please. Look under the heading “Management summary”. I’m going to take this document quite slowly because this is the first time we’ve really looked at what became the IMPACT Programme and the reasons for it. Can we read this together, just to get an outline of the programme. Fujitsu here say:
“Post Office is experiencing a major change in its operating and commercial environment. It must transform its cost base, processes and behaviours to meet the challenge.
“Embracing the Joint IS Landscape …”
What does “IS” mean?
Philip Boardman: Information systems, I believe. I think there’d been some sort of contract change before I’d joined the Post Office account, and this process of joint working had been agreed as part of that, I believe.
Mr Beer: Okay, so:
“Embracing the Joint [Information System] Landscape arrangements from the extended Horizon agreement, Fujitsu Services has been working with the Post Office analysing where cost benefits could be realised through re-architecting the current state of Post Office systems and through adoption of new business processes.
“This document sets at a blueprint for a programme of migration to a coherent system set which will deliver the target process improvements as quickly as possible and at least risk. It takes account of where natural process boundaries exist to define the logical demarcation lines between Fujitsu Services and the Prism consortium.”
That’s the first we’ve heard of the Prism consortium.
Philip Boardman: Indeed.
Mr Beer: Who or what was the Prism consortium?
Philip Boardman: As I understood it, before I’d joined the Post Office Account and been involved in any of this programme, Post Office’s internal IT systems department had been outsourced to a consortium of companies, CSC and Xansa were two that I knew of. I think there were others involved and they were known as Prism consortium, or sometimes Prism Alliance, in various documents. So this is the key supplier of Post Office’s other systems that – you know, all the systems involved in this review other than Horizon.
Mr Beer: It continues:
“It contains proposals to deal with the taking of contractual responsibility for delivery and operations but also considers how work might be shared in a controlled fashion among the various parties.
“Fujitsu Services is pleased to submit this document, developed as an input to the Post Office [End to End] feasibility study and looks forward to continued joint working in the development of effective systems to support the post Office business. All pricing and timescales assume this approach.
“This paper sets out Fujitsu Services approach to the systems re-architecture, explains the design aims, outlines indicative pricing and offers a proposed implementation plan.”
Then if we go to 1.1, please, underneath.
“Post Office requirements
“The analysis of the requirements has been conducted as a joint activity with Post Office IT Directorate, Business Systems and, critically, Post Office business departments. Business representatives contributed significantly through workshops and meetings with analysts and through validation and verification of findings.”
So this part of this paragraph is telling us that the requirements of the Post Office were not, in perhaps a more traditional way, set out by the Post Office; they were jointly identified between and in conjunction with each other, the Post Office and Fujitsu; is that right?
Philip Boardman: Um … Fujitsu were in the room. I don’t think any of the set of parties in that list includes Fujitsu, does it? Are they – Post Office IT Directorate, that’s – business systems, that’s Post Office. Post Office business departments, business representatives. None of those parties are Fujitsu. Yes, Fujitsu were in the room –
Mr Beer: So what were Fujitsu doing?
Philip Boardman: – and listening in, in terms of understanding requirements, but we weren’t telling them what their requirements were. That wouldn’t make sense anyway.
Mr Beer: So you were in the room and writing stuff down –
Philip Boardman: Indeed.
Mr Beer: – and listening silently?
Philip Boardman: Obviously not silently, but, you know, yes, asking questions, clarification questions, discussing requirements that were being – and trying to ask questions to elaborate requirements.
Mr Beer: So if I put it this way: Fujitsu were helping Post Office to identify its business requirements; is that right?
Philip Boardman: Indeed, yes.
Mr Beer: Is that a fair way of describing it?
Philip Boardman: I believe so, yes.
Mr Beer: That was done, it is said here, through meetings between Post Office and Fujitsu and workshops, and I think you were present at some of those; is that right?
Philip Boardman: And facilitated some of them, and they’re not through – between Fujitsu and Post Office but between Post Office – those sets of Post Office representatives. At times, I would have been the only Fujitsu representative in the room, and there would have been 13, 14 people – Post Office representatives. At other times, colleagues, including Gareth Jenkins, who was the lead architect for this programme, and who had a great deal of knowledge about Horizon, and Luxmi Selvarajah, who was a consultant from ICL’s SAP practice, was in the room, clarifying requirements in terms of, you know, understanding what was it that Post Office were trying to achieve.
It was identified pretty early on that Post Office were likely to need to replace their core financial systems and they had already invested heavily in SAP for their cash stock management system –
Mr Beer: Tell the chairman what SAP is, please?
Philip Boardman: It’s a large-scale system for managing accounts and businesses generally and has a number of areas of functionality.
Mr Beer: The paragraph continues – sorry, I should just ask you about the workshops and meetings. Who from Post Office attended these workshops and meetings?
Philip Boardman: So, as it says, Post Office business departments. So the workshops tended to be focused around particular areas of business process, so if it was around settlement, client settlement, then it might be with people from Post Office account and their client managers with – for branch processes, there were some people from Retail Line. I think there might have been some representation, example postmasters, but I don’t think there were ever any actual postmasters.
Mr Beer: What do you mean, “there might have been some representation, example postmasters”?
Philip Boardman: Sorry, people who had been postmasters before, who were then working in the Retail Line, I believe.
Mr Beer: Did anyone suggest – I’m sorry, I spoke over you.
Philip Boardman: Sorry, I was going to say the two business analysts, Dave Parnell and Karen Hillsden, that were involved in these particular workshops, had both worked in Post Office business, had risen through the ranks to come and join head office in Chesterfield. They were both Chesterfield based.
Mr Beer: Was there anyone in the room that was actually using Horizon in a Post Office?
Philip Boardman: I don’t believe so.
Mr Beer: Why was that?
Philip Boardman: Post Office were identifying who should be representing the various interests of the requirements.
Mr Beer: Did anyone suggest bringing subpostmasters into the workshops?
Philip Boardman: I did and at that – when planning workshops, as a – you know, trying to facilitate workshops, you’d talk about who should be involved and what the various communities were going to be and the answers that I got were that Dave Parnell, Karen Hillsden were – had used Horizon before regularly, because lots of people in Post Office then would also go off and work as either relief managers on a basis, or work in branches during peak times at Christmas. I seem to remember in that time, 2002, we were back in a time when there were such things as strikes, and they went and gave – did relief work in post offices in – during strikes, as well. So there were people who occasionally used the system but they weren’t regular users.
Mr Beer: You suggested bringing some regular users in?
Philip Boardman: Asking about representation, at least. It’s very difficult when you’ve got, I think – so I think I’ve seen some of the Inquiry witness sessions from people talking about earlier in the thing. Initially there were about 19,500 branches. At this time, I think there were around 17,500, so – but you’re still talking about, you know, 30,000-odd users and so getting full representation of systems is always difficult, but –
Mr Beer: What was the response to you suggesting that some actual real –
Philip Boardman: Post Office had –
Mr Beer: Hold on, I hadn’t quite finished yet.
Philip Boardman: Sorry.
Mr Beer: What was the response by the Post Office to your suggestion that some actual real subpostmasters who used Horizon on a day-to-day basis come into the workshops?
Philip Boardman: They felt that they had sufficient representation.
Mr Beer: Were helpdesk staff amongst those who were present in the workshops?
Philip Boardman: I don’t recall any.
Mr Beer: Did anyone suggest the helpdesk should be present in the workshops?
Philip Boardman: I think the discussions were mostly around Retail Line and –
Mr Beer: Is that a no, that that wasn’t suggested, that people who were dealing on a day-to-day basis with the problems that subpostmasters felt.
Philip Boardman: So when you say “helpdesk staff”, do you mean Post Office helpdesk staff at NBSC or do you mean Fujitsu helpdesk staff?
Mr Beer: Any or all of the above.
Philip Boardman: Well, because Retail Line – as I understood it, from Post Office explaining, Retail Line and NBSC worked closely together, and so issues around use of Horizon would mostly – unless there was a fault with the system, issues would mostly be taken up with the use of the system, they’d be taken up by NBSC.
Mr Beer: Can we look at the foot of the page:
“Post Office and Fujitsu Services have identified the following as the key areas of potential savings and operational improvements …”
We’ll see there are six areas that are set out where it is said that money can be saved. There’s a bullet point, a square box for each of them, and then the saving or a range of savings is set out in a circular bullet point underneath.
So if we can just look at the second bullet point which is, in fact, on the next page – thank you.
Under “Accounting”, on the second of the six bullet points, it is said that Fujitsu and the Post Office had jointly identified a £9.5 million annual saving in accounting, as a result of, amongst other things, a decrease in debt, lower write-offs. Can you explain what that means, please, “lower write-offs”?
Philip Boardman: So, I think to explain that you need to understand these back-end systems that are being talked about in the last sub-bullet there, CBDB was – and CLAS(?) were the two financial systems that Post Office ran at that time, had been developed in-house by Post Office. OPTIP was the system acting as the interface between Horizon and those back-end accounting systems.
At this – well, the CBDB set of systems, as I understood it, had been developed in-house for Post Office. They were batch system based, overnight batch runs, lots of input put in during the day and calculations done overnight and they were built around weekly processes. And in some respects they were legacy systems that hadn’t been able to be updated sufficiently when Horizon started feeding daily information into them, such that there were – much of that debt – this is a summary of the requirements and the cost savings identified in the End to End feasibility document. Across there, it talks about the issues around settlement, client settlement.
By this stage, of course, those nightly feeds were also going off to clients. So large utility companies would be getting nightly feeds of – into their systems to say “This customer has paid their gas bill – this much of their gas bill”, and that would go into their account systems and be managed in the accounts against those people’s accounts.
But that meant that those organisations, utility companies that had invested in systems that could cope with daily feeds, nightly feeds, were coming to Post Office quicker than their processes were working out what they owed those utility companies.
In the times of those timing differences, with clients invoicing and Post Office having the data to be able to verify that that was the correct amount, those amounts were held as debt, and so there was those sorts of debt. That’s the majority, I believe. As we’ll discuss later, there were some in terms of postmaster debt.
Mr Beer: Did this bullet point intend to address all subpostmaster debt?
Philip Boardman: All of the above, yeah. All of those.
Mr Beer: Tell us in brief terms how this bullet point relates to a saving by decreasing the amount of written-off subpostmaster debt?
Philip Boardman: Because similarly, Post Office’s central systems were based on a weekly cycle and that caused a large amount of the timing issues that, just like with clients – can I give an example, and this is sort of an End to End life cycle of a debt that isn’t a debt. In the feasibility study document, it refers to a – how the aim is to reduce 95 per cent of debt, but it then says – the next bullet says that only 10 per cent of debt is real debt and that 90 per cent of debt that isn’t real debt, is not real debt, is these timing mismatches.
So if I give an example – I apologise, it’s a very low value example – but back then, when a clerk was selling a stamp, the majority of stamps were sold from large books and torn perforated sheets of stamps and a stamp would be torn from the sheet. If that – when performing that transaction in the Post Office, a clerk had accidentally ripped the postage stamp into two, that postage stamp couldn’t be sold but that created a discrepancy because, at that point, the stock had become obsolete but the stock was held in the Post Office – subpostmaster’s accounts as, let’s say, it’s a 10p stamp.
So what the process, as I understood it, as explained to me, was that the subpostmaster would take the two halves of that stamp and stick it on a form because there was a form especially for reporting obsolete and destroyed stock –
Mr Beer: Ruined stock?
Philip Boardman: Ruined stock, indeed. And the ruined stock, they’d stick that stamp on there and asked for the 10p of discrepancy, by passing 10p into their suspense account. Obviously, it’s more than 10p. Over the course of the week, there would be multiple stamps but let’s follow the End to End.
That suspense account would get added as a 10p discrepancy into the suspense. The form would get sent off. Apparently, it was quite common for forms – you know, subpostmasters would wait until multiple stamps had been stuck on and the form might sit in the Post Office for weeks, but let’s follow the rules. That week they send that form off with their cash account form. During that week, Post Office would then verify that that 10p was destroyed stock, and they could recredit the – or write off that stock and so Post Office would send an error notice, a paper error notice, back to the subpostmaster at the branch. That might arrive within the week, it might arrive the following week after the next cash account.
All the time that this – eventually that error notice allowed the subpostmaster to bring the amount out of suspense and to write that 10p off, but all the time that that 10p was in suspense, that was classed as debt for Post Office Limited accounts, but it wasn’t debt: it was known that it was going to be sorted out.
So much of this, in terms of subpostmasters’ debt, much of this is about allowing Post Office to see the wood for the trees, for want of a phrase. You know, they’re getting rid of all – wanting to reduce that – to sort those debt that isn’t debt out much quicker, so that they can actually address the other debt in a timely fashion.
Mr Beer: The explanation you’ve just given could be summarised as swifter and easier identification –
Philip Boardman: Indeed.
Mr Beer: – of debt, rather than lowering debt. This appears to contemplate an actual monetary saving rather than making the thing more visible, doesn’t it?
Philip Boardman: But I think the Post Office believed that the two would go hand in hand, that by addressing these things quicker, they would reduce it.
Mr Beer: How?
Philip Boardman: Because they could address it more swiftly.
Mr Beer: How? How, by making it more visible, do you lower it?
Philip Boardman: Well, I presume they believe that there was some that wasn’t their debt, it was someone else’s debt.
Mr Beer: Whose debt?
Philip Boardman: Sometimes subpostmasters, sometimes clients.
Mr Beer: Is it actually about squeezing the subpostmaster; is that a way of putting it?
Philip Boardman: I think they felt they weren’t addressing things correctly.
Mr Beer: The subpostmasters?
Philip Boardman: For any of the parties. Post Office Limited felt that they weren’t managing these things, that things were being lost in the system.
Mr Beer: Can we look at the third bullet point, “Cash Management, (£4 [million] annual saving)”. A £4 million annual saving in respect of cash management, seemingly, would this be right, by reducing the amount of cash centre write-offs; is that right?
Philip Boardman: That’s right, yes.
Mr Beer: What does that mean?
Philip Boardman: Again, I believe Post Office, in all of that timeliness, there were – cash was going missing, that they couldn’t account for it where it had gone.
Mr Beer: Subpostmasters – going missing with the subpostmaster?
Philip Boardman: Sometimes with subpostmasters, sometimes with cash centres, sometimes in delivery vans. I don’t know; it was a case of trying to tighten up on where all that money was going.
Mr Beer: So out of the, I think, £21 million annually envisaged saving that’s mentioned in this paper, the two things that we’ve looked at account for about 13.5 million of them; is that right?
Philip Boardman: Indeed.
Mr Beer: Can we go over to page 8 of the document, please, and look at paragraph 1.2, “Fujitsu Services Response”:
“This paper is Fujitsu Service’s response to the above requirements. The principles embodied in this proposal are …”
Then if we can just look at the four at the bottom of the list, please. Thank you:
“The proposed solution minimises costs and risks to Post Office by adopting optimum service boundaries and an incremental, step by step, approach to development, which moves the business progressively towards Post Office IT Directorate’s strategic architecture;
“The sequencing of projects is devised to deliver early benefits to support the Post Office objective of early return to profitability. We are however proposing an urgent start to the design work to maintain the proposed schedule …”
Skip the next one. Then, lastly:
“The proposed commercial arrangements aim to create the simplest possible structure within which change can be managed without undue contractual overheads.”
So those three bullet points that I’ve read, would this be fair, are Fujitsu emphasising a swift turnaround and simplicity, in order to maximise value for the Post Office?
Philip Boardman: That’s right, yes.
Mr Beer: I think we can see this further in page 14 of the document. Under 1.4, after the two bullet points:
“Other timetable considerations are considered in section 4.”
Then this:
“It is important to note that delays will result in release windows being missed and consequently will delay the realisation of the identified business benefits. Delays are also likely to cause some of the dependencies within the Horizon Agreement not being met in time for the scheduled SI commitment fee reduction in spring 2005. Such delays would increase the future Horizon costs.”
So, again, this is Fujitsu stressing to Post Office that there are costs associated with delay; is that right?
Philip Boardman: Indeed.
Mr Beer: Can we turn to what the document says about the new proposed arrangements, including the new financial system, and look at page 22 to start with, please. At the foot of the page, under paragraph 2.6, second sentence:
“The following arrangements … are proposed:
“New Financial System – to be deployed within the manned Horizon Data Centre and operated alongside other Horizon central systems. The co-location of the systems will allow consolidation of audit, archiving and back-up facilities and [over the page, please] services as well as maintaining close proximity of the Financial System to its main (volume) source of data (ie the Transaction Management System).”
Then this:
“The integration within expanded Horizon enables Fujitsu Services to take responsibility for the complete transaction processing activity culminating in the ledger outputs, without the need for mid-process reconciliation.”
In what way did Fujitsu take responsibility for the complete transaction processing activities?
Philip Boardman: Um, as it happens, I don’t think they did. I think that was the proposal that wasn’t taken up. The system that we’re talking about was Post Office decided to – that Prism Alliance would develop that instead, and so –
Mr Beer: Why was that?
Philip Boardman: I don’t know. I believe there was a – I believe there was a competitive tender or process to choose who would present that, and Post Office Limited, as a customer, chose to get Prism Alliance to do it. The proposal was to do it, and that’s one reason why Fujitsu at the time felt that that would be a good idea. It was a sales pitch.
Mr Beer: Can we go on to look at the projects that were proposed and go over the page to page 24. I’m taking this at some speed. This is a 109-page document, so I’m going through it –
Philip Boardman: Indeed. I think it’s also important to recognise that much of these proposals were sort of – weren’t adopted and were taken and changed by Post Office Limited later.
Mr Beer: We’re going to come on and look at those. So “Project 1 – Better Overnight Cash on Hand Data”. This is described in paragraph 3.2.1 and I just want to read this to understand what might be the drivers for the adoption of this process. It reads:
“Within the Cash Management function two fundamental changes have made Post Office’s funding position a critical business survival issue …”
First:
“The business is trading at a loss.”
Second:
“The migration of benefit payments from order books to ACT will be accompanied by the loss of pre-funding by government departments of the necessary cash in the network.
“The business will have to borrow funds to fund any trading losses and working capital needed in branches. Such borrowing is limited in availability and its costs reduce profitability. From April 2003 the DTI will provide a loan and will require a robust statement of cash holding as security.”
So is it fair to say that that, what is described there, the business trading as a loss, the move to ACT and the loss of pre-funding and the need to take out loans, are an important part of the background to the entirety of this End to End project?
Philip Boardman: Absolutely. Key – key.
Mr Beer: Key drivers?
Philip Boardman: Key drivers.
Mr Beer: So, to your knowledge, is this right, the Post Office was trading at a loss at this time?
Philip Boardman: As I understood it, yeah, that’s what I was told.
Mr Beer: So was the Post Office, to your knowledge, motivated principally by a means to ensure cash flow and to reduce losses to the business to offset the impact of the removal of Benefits Agency’s business to ACT?
Philip Boardman: I don’t think so. So, again, having seen some of the discussions around the early parts of the Horizon project and implementation – and I’ve seen some of the witness statements that mention some of the reluctance of Post Office to adopt ACT – by this stage, the conversations I was having with Post Office seemed to be that they’d become resigned to it, or embraced it even, and were seeing that this was opening up other markets as well, that, you know, in the same timescales, branches were closing through – around towns all over the country at a rate of knots.
Post Office had a very spread-out network, and people would be able to accept, because as well as benefit recipients being able to withdraw funds from their bank accounts then non-benefit – you know, the waged other people who couldn’t access bank branches could access post offices more easily.
So I think they were sort of trying to embrace this but had other problems at the same time, which reduced the amount of investment that they could make.
Mr Beer: As a whole, the paper seems to have a couple of overarching aims: (1) is to improve cash management and (2) is to reduce debt. Were each of those motivated by a need to plug and to plug quickly a gap in funding caused by the removal of the Benefits Agency business, caused by the move to ACT?
Philip Boardman: Not that I was informed, but it could have been, I don’t know.
Mr Beer: This is described as a “critical business survival issue”. Did that accurately –
Philip Boardman: As I understood it. I think, as much as all of what you’ve just said, the things that have come out of here to me are the additional costs that Post Office were going to take on, in terms of servicing this loan. They have a very broad network that involves providing lots of cash to lots of branches and so I think there’s a mention in here of £350 million of a loan to be held, and this is new costs to Post Office.
So just holding that cash on a – you know, in order to run their business, was going to cost them a lot more. They had previously been having that cash pre-funded to them and they were going to have to service that.
Mr Beer: Looking at the last sentence in that paragraph:
“From April 2003 the DTI will provide a loan and will require a robust statement of cash holding as security.”
So to understand exactly what’s being said here, the DTI was going to provide a loan to the Post Office, or loans to the Post Office.
Philip Boardman: Indeed.
Mr Beer: In order to provide the loan, the DTI needed to know that the information that was being provided to it, the DTI, by the Post Office was robust?
Philip Boardman: That’s right, yes.
Mr Beer: Was it not seen as robust at that time?
Philip Boardman: No. I think Post Office’s requirements were clear about that, that there was a lot – you know, all of the debt, and the timing debt that wasn’t debt, reduced the robustness of that statement. And so – and I can never – I never really got to grips with understanding when Prism Alliance or Post Office’s IT department before then, had implemented SAPADS – they may have implemented it by then or it was a project at this stage, I can’t remember the details – but before IMPACT the SAPAD system which had been developed mostly as a stock management system and a distribution system for cash – it wasn’t a cash management system, if I make that distinction. It wasn’t trying to manage the overall holding of cash downwards. It was – which would have to happen in order to be able to service this debt, I believe.
Mr Beer: Would this be a fair description: at the point of this proposal, you understood that the data produced by the Horizon System, together with the Post Office’s back-end accounting systems, did not provide a robust statement of Post Office’s cash holdings?
Philip Boardman: Um, well, yes, that’s true. But predominantly the sources that they were looking for, for that robust statement of cash holdings, was the back-end accounting systems and SAPADS.
Mr Beer: Can we go over the page, please.
At the top of the page, the proposal reads:
“To support the business in managing through this difficult situation, the business requirements, detailed below, will be addressed by this project …”
First bullet point:
“To be able to accurately identify physical cash at the branch rather than overall cash which can include cash equivalents such as cheques.”
Then the third bullet point:
“Drive down cash holdings and therefore reduce the DTI borrowing requirement which in turn will reduce the level of interest paid.”
Can we look, please, at Project 3 on page 30. It’s at the foot of the page, under 3.2.3, and this deals with the automatic remittance of cash into branches. Can we look at the business requirements being addressed, last sentence on the page:
“The particular business requirements being addressed by this project are …”
Then over the page:
“To improve the financial controls for cash remittances (where currently losses of £5 [million a year]).
“Improve management information, linked to financial statements, to support the management of cash (funds).
“To enable cash holdings to be driven down and therefore reduce the DTI borrowing requirement, which in turn will reduce the level of interest paid.
“To be able to forecast the managed cash flow within the DTI target …”
Then an explanation of the requirements is given. At the very foot of the page, it reads:
“When the barcode on the pouch is scanned, the Delivery Notification will be found and the content can be used to Remit-In the content as defined by the Cash Centre/Stock Warehouse. If the Postmaster subsequently finds any errors, then these can be recorded as Discrepancies.
“Note that the current system allows the postmaster to Remit-In whatever value he likes and it is left to some central processing to identify any mismatches between what is Remitted-In and what was Dispatched. Forcing the Despatched values to be Remitted-In and then highlighting any Discrepancies should simplify the central processes.”
Then under paragraph 3.2.3.1, the design solution, the document goes on to explain that – and if we look at the bottom large bullet point and then three in:
“The clerk will have the option to check the contents (now or later) and a separate dialogue will allow him/her to declare any discrepancy between the amount Remitted-in and the actual content. Any such discrepancy will then be handled as a suspense item until the matter is resolved. Note that the pouch number is used as a ‘link’ for any such transaction to allow any subsequent error correction to be managed.”
Can you explain, please, what is being described here?
Philip Boardman: Yes. It’s a proposal, which I think – yes, it ended up being implemented.
Mr Beer: It did.
Philip Boardman: Probably best if I described the process before and after. Before IMPACT, when a cash pouch was being delivered from a cash centre, then there was a barcode scan, and that would produce a receipt which the subpostmaster could hand over to the deliverer as their receipt for having delivered the cash, but that made no changes to the branch accounts.
In process discussion workshops, the scenario was always described as there was a queue of pensioners going outside the Post Office. At busy times, the deliveries would be made, the scan would happen and the pouch would probably be put in the safe to be remitted in later and the subpostmaster could go back to serving customers.
When remitting in later, bearing in mind that when it was remitted in, if that happened on a Wednesday morning – if that delivery happened on a Wednesday morning, then the remit in might not happen until after the cash account had been produced, so that cash account wouldn’t reflect that delivery. When the remit in happened, at whatever time that happened – sorry, if the cash account had been produced at that time then that would result in a reconciliation discrepancy in the Post Office’s systems, the cash centre had sent this money, it hadn’t shown up in the accounts, and would take time to resolve itself through various processes of error notices and things.
When the cash pouch was being remitted in, the subpostmaster would open up the pouch and either using the delivery note or counting the cash, they would be presented with a form on the Horizon System to enter how much in 10s, how much in 20s, how much in 5s, et cetera, et cetera, and that would then remit that in. But by the nature of this, they would be remitting in what they were reporting, and that was – that could happen that mistypes happened at that point, typographical errors could come in. But of course whatever was being reported would be what the system felt.
So the system figure for cash hold in, if the figures hadn’t been entered correctly, the system figure could be incorrect for the actual cash holding and that might create discrepancies. Also, depending on whether they were checking against the delivery note and the actual contents, then there may well have been an error in packing. Because when people put deliveries together, sometimes they don’t put all of what was ordered into the – into the delivery, and so there were various areas of discrepancies that could occur at various times, and because of the week-based processes, would take, on average, three weeks to resolve.
What auto remittances was trying to do was say that the cash pouch delivery would be prepared the night before or the planned delivery would be prepared the night before, and passed to Horizon so that an electronic delivery note would be delivered to the Horizon System. When the cash pouch barcode was scanned, that amount would be automatically remitted in, according to the delivery note. But then later, instead of the remit in process, there would be the verify – I can’t remember what the function was called but it verified a remittance process, that allowed the subpostmaster to open up the pouch and check its contents and report any discrepancies.
Mr Beer: So cutting through it, this was intended to reduce the possibility of mistakes or fraud by subpostmasters?
Philip Boardman: Or at all of those different opportunities for errors, it was trying to reduce them. Indeed.
Mr Beer: Can we look, please, at page 34, which is “Project 4 – Branch Liability Management”. The goals are identified under the bullet points under the text there: to simplify the identification of debt; to reduce the amount of reconciliation; and increase the amount of debt recovered.
The proposal, I think, is set out halfway down the page – it’s towards the foot of the page – to refocus on debt recovery, financial recovery of money, a target of 95 per cent, but only 10 per cent of discrepancies are only debt, and you explained that to us already, I think.
Philip Boardman: That’s a restated of Post Office’s stated requirements of objectives from the feasibility study.
Mr Beer: At the foot of the page, it records that:
“Branch Debt is currently identified within the Transaction Processing system when the Cash Accounts are being checked. Generally this means that it is of the order of two or three weeks after the original Debt was incurred before it is spotted and investigated.”
The debts believed to be owed here, they are debts owed by subpostmasters, is that right, as well as client debts?
Philip Boardman: These ones are subpostmasters, yes.
Mr Beer: So these are just talking about subpostmaster debts, are they?
Philip Boardman: That’s right, yes. Client debts would be a – client debts would be identified in the central accounting system, CBDB, as well as –
Mr Beer: So this is just subpostmaster debt?
Then if we go over the page, please. The Fujitsu document goes on to describe how the project will address discrepancies in stock or cash declaration. So:
“The next (analysis) phase of the programme will carry out a complete analysis of what activities at the outlet can result in a need for Debt Recovery. The following are candidates …”
The first bullet point:
“Discrepancies identified during a stock or Cash Declaration process that the Postmaster is not prepared to accept.
“As part of the Declaration process, the Postmaster will be given the option of ‘making up the difference’ when a discrepancy is spotted (effectively selling him/her the stock if it is a stock discrepancy or topping up the cash in the till in the case of a cash discrepancy). Alternatively he can refuse to make up the discrepancy and force the discrepancy into a ‘suspense’ account for later resolution.”
So at this stage of the process, is this right, that Fujitsu envisaged two possible processes: forcing the postmaster to pay up or refusing to make up the discrepancy and forcing the discrepancy into a suspense account?
Philip Boardman: That’s right, yes. Well, effectively, either accepting that this was a discrepancy of the branch’s making, giving someone too much change in a transaction, say, or disputing it with Post Office by putting it into the suspense.
Mr Beer: Did you see or did Fujitsu see that second alternative: disputing it as being catered for by forcing the discrepancy into a suspense account?
Philip Boardman: Yes. The word “force” there is an intriguing word. I’m not sure what that was trying to say, but –
Mr Beer: Why is it intriguing?
Philip Boardman: Well, because transactions in systems can’t really be forced, you know, there’s a – you know, you chose whether to do one or the other. But yes, it’s – options would be given.
Mr Beer: Can we move to Project 5. We will come back to this in a moment when we look at the removal of the suspense account facility. Can we turn to Project 5, please, on page 40 of the document.
The priorities of the project here are to reduce the amount of reconciliation required; put the emphasis on clients and customers to validate data; and enable matching of cash at branches with the settlement with the client; yes?
Philip Boardman: That’s right, yes.
Mr Beer: Then if we go to 3.2.5.4 on page 43, under the heading at the top “Resilience requirements”:
“The new Harvesting process will ensure that no Transactions are lost and any duplicates … are eliminated.”
Can you just explain in general terms what that’s referring to?
Philip Boardman: Not sure. Sounds too technical for me. I don’t know.
Mr Beer: Okay. Taking a step back from the document – and that can come down from the screen, thank you – would you agree that some of the additional reconciliation steps that were being removed from the process describe the role that was previously played by a Post Office team at Chesterfield?
Philip Boardman: That’s right, yes.
Mr Beer: So IMPACT had the effect of essentially automating that part of an accounting process previously conducted at Chesterfield, error reconciliation, I’ll call it, by individuals, humans?
Philip Boardman: Indeed. Automating much of it. I’m sure there was still some left after IMPACT but, yes, there were – when I first went to Chesterfield to – for some of these initial meetings and workshops, very, very large open-plan offices, with huge numbers of people with piles and piles and piles of paper, 17,500 cash accounts – and a cash account wasn’t just as we’ve said, there’s all the forms and things that go with a cash account – 17,500 every week arriving in Chesterfield.
I never really understood what was happening there because we didn’t fully analyse the back-end systems, they’d already been decided that they needed to be replaced. But there seemed to be an awful lot of data entry happening as well, so these physical cash account forms would were being sent to Chesterfield and data seemed to – even though all the data had previously been sent overnight into systems that would be acceptable by those individuals, there seemed to be an awful lot of re-entry of data. I never really worked out what they were trying to – what they were doing with that.
Mr Beer: One of the reasons for what became the IMPACT Programme we’ve seen included decreasing operational costs by the Post Office.
Philip Boardman: Indeed.
Mr Beer: To your knowledge, did that include reducing the number of staff at Chesterfield previously processing transaction corrections and sums held in suspense accounts?
Philip Boardman: Yes.
Mr Beer: So were the processes – looking at it globally – introduced by IMPACT designed in part to shift the burden of and responsibility for the identification and rectification of errors onto subpostmasters?
Philip Boardman: Um –
Mr Beer: It drove it towards them?
Philip Boardman: I don’t think so. I think they already had those responsibilities. The identification of those errors were always going to happen in the branch when they were performing their accounts.
Mr Beer: Well, to take an example, we’ve seen how the rectification of errors in pouches remmed in would be by the subpostmaster having to raise an error for reconciliation or correction. So it’s placing the responsibility onto the subpostmaster, isn’t it?
Philip Boardman: Indeed. Just as whenever one receives a delivery it’s your responsibility to check it.
Mr Beer: But would the effect of this process mean that it was very important that the manner in which subpostmasters could raise errors with the Post Office and then how those errors would be addressed was going to be particularly important for the accuracy of the data that was produced by Horizon?
Philip Boardman: I agree. Yes.
Mr Beer: What steps were taken by Fujitsu and the Post Office to ensure that any debt recovery against subpostmasters was limited to what could properly be described as true debt?
Philip Boardman: Um … I think we just jumped a long way. We’ve been looking at your proposals and – but –
Mr Beer: Yes.
Philip Boardman: I think – well, so for example, in areas like remittances, as I understood it, most of the Post Office’s, if not all of the Post Office’s, cash centres had invested in CCTV over the packers and – pickers and packers functions. So they’d know – be able to – when errors were reported, they’d be able to verify those things.
In terms of other areas, like burglaries, fires, whatever, Horizon getting its sums wrong, then you rely on people identifying what went wrong where and how much it was impacted.
Mr Beer: Relying on the subpostmaster to identify it?
Philip Boardman: Ultimately, yes.
Mr Beer: Would this be right: that the safeguard that was introduced was that the subpostmaster would have to agree a discrepancy and any subsequent transaction correction?
Philip Boardman: They’d – yes, they’d have to agree that but have to agree – they had the option to not agree.
Mr Beer: What happened if they didn’t agree?
Philip Boardman: It would be further investigated, further disputed –
Mr Beer: By who?
Philip Boardman: – like any – by people in Chesterfield, as I understood it.
Mr Beer: Did the system allow for a dispute to be raised?
Philip Boardman: Well – so by posting into suspense, effectively, yes, although that, as I understood it, wasn’t the method of raising a dispute. The suspense account was the way you accounted for sums that were in dispute, not – the subpostmasters would have to raise a call to NBSC to get permission to enter amounts into suspense, and that was the raising of the dispute and the entering things into suspense was the way of accounting for amounts in dispute. That’s my understanding of the Post Office’s processes.
Mr Beer: We’ll come back to that in a moment later on. Also dealt with in this document, although rather briefly, is the subjects of data integrity and financial integrity. If we can look at page 87, please – if we just look at 86 first, I’m sorry. Under 7.6, “Service Boundaries”:
“The service boundary is designed to enable Fujitsu … to take responsibility for the integrity of complete business process outputs …”
Then, over the page, just after the bullet points:
“The integrity of the financial and cash information is achieved by applying best practice perpetual inventory and double bookkeeping methods and by ensuring that the transactions always flow from the counter to the financial system without manual intervention or service boundary.”
Does that description mean, in essence, that the integrity of the accounting information relied on the automated processes of Horizon themselves being infallible.
Philip Boardman: No, the flows being talked about here are from Horizon to a new financial system and a full chart of accounts from the transactions in Horizon, all the way up through to Post Office’s – the corporate ledger, and that’s what that’s trying to explain and describe.
Mr Beer: But it depends on the infallibility of the data being produced by Horizon, doesn’t it?
Philip Boardman: Correctness, yes.
Mr Beer: In order for such infallibility, ie genuine integrity, it was essential that Horizon contained no bugs, errors or defects, that produced false data?
Philip Boardman: Um, well, I think realistically there was always going to be bugs, errors or defects. So this is trying to say that it’s reducing keying errors, reducing something other influences on the correctness.
Mr Beer: If primary responsibility was being passed to subpostmasters to spot errors and challenge discrepancies, whose responsibility was it to identify and investigate bugs, errors and defects in Horizon as root causes of the discrepancies?
Philip Boardman: That’s a shared responsibility between Post Office – well, the postmasters or NBSC, identifying those and Fujitsu investigating them and resolving them.
Mr Beer: I’ve looked at the 109 pages of this document carefully and I can’t see any mention of that in here.
Philip Boardman: Well, I guess it was taken as a given, because all of this is within the context of the Horizon contract.
Mr Beer: Was the reliability of Horizon taken as a given?
Philip Boardman: Um … probably, yes.
Mr Beer: At the time that you were reading, contributing, approving this document, had anyone drawn to your attention a slew of issues that had arisen with the integrity of the data that Horizon was producing in its model office testing, its end-to-end testing, in the acceptance phase of Horizon and in the course of its rollout?
Philip Boardman: No.
Mr Beer: Did you work on the basis that the data produced by Horizon was therefore reliable?
Philip Boardman: Yes, I – it was being used on a daily basis, Post Office weren’t telling me that it had problems. If it did have, I’d presumed that they had been resolved by now.
Mr Beer: Was anyone in Fujitsu telling you that this was a project that wasn’t free from difficulty?
Philip Boardman: I don’t think so.
Mr Beer: Can we look, please, at where the document deals with data errors. Just under where we’re looking at:
“Data errors caused by system mismatches should be eliminated … by enforcing consistent end of day cut offs and reversal rules.”
Did that assertion that data errors be eliminated itself rely on Horizon functioning reliably?
Philip Boardman: Um, I’m sorry, I don’t know this. This sounds like a technical … I don’t know.
Mr Beer: The document continues:
“Reconciliation of online transactions as between transaction logs and client/agent system will identify transactions which broke or were cancelled after NWB authorisation …”
“NWB authorisation”?
Philip Boardman: NWB, I think, is network banking.
Mr Beer: “… (for example) …”
Philip Boardman: Authorisation presumably is getting the message back from the bank that the – that it’s okay for the transaction to proceed but sometimes the system can request funds from the bank. The bank can authorise it but if the system then doesn’t get back to the bank to say, “We’ve now taken it”, then the bank don’t process the transaction but the system at this end might think that it has successfully performed the transaction. That’s, I think, what’s being talked about by “broke” there.
Mr Beer: Then skipping a paragraph:
“Post Office personnel may inspect transactions, which are found to have been subject to EPOSS keying errors (where the value of the transaction is not captured automatically by the system from a token) and post messages to postmasters to correct such errors.
“Post Office personnel may inspect transactions subject to bad debts (eg bounced cheques) and post messages to postmasters to either recover or write off those debts. Alternatively, these messages could be generated automatically according to floor limits. Trend analysis by Branch could be considered as an additional aid to exception management.
“The need for reconciliation between TPS and OPTIP is rendered redundant and is eliminated.”
Again, did the system rely on the automated reconciliation working effectively and identifying where a discrepancy had arisen?
Philip Boardman: Sorry, could you repeat that question?
Mr Beer: Yes. Did the system that’s described there rely on the automated reconciliation process working effectively and itself identifying where a discrepancy had arisen?
Philip Boardman: It did. The whole system relies on an end-to-end reconciliation, yes.
Mr Beer: Then it required, if a discrepancy arose, for the subpostmaster to challenge the discrepancy?
Philip Boardman: Although this identifies – so the paragraph, three from the bottom:
“Post Office personnel may inspect transactions, which are found to have been subject to EPOSS keying errors …”
So presumably – “where the value of the transaction is not captured automatically” – that paragraph is giving an example of where errors might be spotted by Post Office Limited personnel, people in Chesterfield. So that’s, I don’t know, things like paying a utility bill of £40 and the clerk has typed in – has hit the “00” button twice and then ended up keying a transaction of £4,000 but not spotted that it’s gone through and accepted £40 in cash, and that’s created discrepancies.
Mr Beer: You told us already that you worked on the basis that Horizon was operating reliably at this date because nobody had told you otherwise. Do you know on what basis the Post Office and Fujitsu were satisfied that Horizon was operating in a way which was sufficiently robust to introduce these further automated measures, reducing the number of personnel at Chesterfield and placing the responsibility on subpostmasters?
Philip Boardman: I don’t think I knew that.
Mr Beer: Was there any discussion that you were a party to or you heard about the reliability and robustness of Horizon at this date, early 2003?
Philip Boardman: No.
Mr Beer: It just simply wasn’t a topic of conversation?
Philip Boardman: No. I think it was known that there were, you know, like any other system it would have its faults, but –
Mr Beer: But nothing more than that?
Philip Boardman: Nothing more than that, no.
Mr Beer: Sir, that’s an appropriate moment, if it suits you, for the morning break.
Sir Wyn Williams: Yes, of course. What time shall we resume?
Mr Beer: Shall we say 11.45, please, sir?
Sir Wyn Williams: Yes, by all means. See you then.
Mr Beer: Thank you very much.
(11.32 am)
(A short break)
(11.45 am)
Mr Beer: Sir, good morning, can you see and hear me?
Sir Wyn Williams: Yes, I can, thank you.
Mr Beer: Thank you very much. Can we pick up with page 71 of the document we were previously looking at, please.
This sets out a series of assumptions that Fujitsu made, principally concerned with pricing. I just want to look at what some of them are. If we look at the foot of the page, please:
“It has been assumed that the existing links between Horizon and Post Office data centres have sufficient capacity to accommodate the access requirements to the extended Horizon estate …”
Then over the page, please, two bullet points – sorry, four bullet points in:
“It has been assumed the End-to-End projects are implemented without any requirement for branch site visits by Horizon engineers …”
Then two from the end:
“It is assumed that arrangements relating to Post Office access to audit records are as detailed in the existing agreement …”
The suggestion that an assumption was made that the solution can be produced without the need for upgrading the correspondence servers or the data network, does it follow that no assessment or analysis of the underlying Horizon network and its reliability had been undertaken by Fujitsu before the IMPACT Programme?
Philip Boardman: Sorry, I don’t know whether that had happened. I think that is talking about links between Horizon and replacing – links between Horizon and TIP or OPTIP, as it was known, and replacing it with the new financial system, rather than any significant changes in the Horizon branch to data centre network. That set of links is talking about –
Mr Beer: So putting the document to one side, then, to your knowledge was any analysis or assessment made of the reliability three years into operation of the Horizon network before the changes that were proposed to be made by the IMPACT Programme would take effect?
Philip Boardman: I don’t think so, no. Not that I know of.
Mr Beer: Can we turn to page – on this page, six bullet points from the bottom:
“No increase in support for litigation investigations has been assumed …”
Then the bullet point I’ve just read:
“It is assumed that arrangements relating to Post Office access to audit records are as detailed in the existing Agreement …”
Can you help us what consideration there was of the level of litigation investigation support that was being provided already by Fujitsu to the Post Office.
Philip Boardman: No, I don’t know. I don’t think I was involved in assessing that.
Mr Beer: Does the inclusion of these bullet points suggest that Fujitsu and those working on IMPACT, including you, must have been aware of the role of Horizon in the potential liabilities of subpostmasters and, therefore, the role in Fujitsu in supporting litigation by POL?
Philip Boardman: I think that was known and what these assumptions are saying is that that won’t change.
Mr Beer: What did you know about the role of Fujitsu in the provision of evidence or data in litigation by the Post Office against subpostmasters?
Philip Boardman: Then? I think I knew that Fujitsu could be asked to provide evidence of transaction streams and accounts, and I think that was probably it at the time, that I knew of.
Mr Beer: Given that knowledge, what steps were taken, to your knowledge, by Fujitsu or the Post Office to consider how the automation of the process of reconciliation might impact on the potential civil and criminal liabilities of subpostmasters?
Philip Boardman: I don’t know.
Mr Beer: You’re not aware of that having been considered?
Philip Boardman: I don’t know whether it was or wasn’t.
Mr Beer: We are introducing a more automated process of reconciliation –
Philip Boardman: Indeed.
Mr Beer: – that may have consequences for the civil or criminal liability of subpostmasters.
Philip Boardman: Yeah, as I understood it.
Mr Beer: What steps must we, Fujitsu and Post Office, take to ensure that people are not investigated, audited or prosecuted on a false prospectus?
Philip Boardman: And I don’t know. I wasn’t involved in that aspect of this solution.
Mr Beer: Did you know that subpostmasters were being prosecuted at this time on the basis of data produced by Horizon?
Philip Boardman: I don’t think I did.
Mr Beer: Was the use of data by Horizon in criminal or civil litigation against subpostmasters discussed ever, to your knowledge, as part of the IMPACT Programme?
Philip Boardman: Explicitly as part of the IMPACT Programme, no, I don’t think it was. I think, you know, I knew that those reports were being produced for such purposes but I didn’t know what was then done with them.
Mr Beer: Were you aware, at the very least, that subpostmasters had a contractual liability to make good shortfalls shown by the Horizon System?
Philip Boardman: Yes, that was discussed. I’m sure we’ll come on to the changes that were made.
Mr Beer: Where did you get that knowledge from?
Philip Boardman: From Post Office representatives.
Mr Beer: What did they tell you about the contract?
Philip Boardman: Sorry, which – between Post Office Limited and the subpostmasters?
Mr Beer: Yes, as to the liability to make good shortfalls?
Philip Boardman: Um, so as I understood it, ultimately, in order to operate a Post Office branch, Post Office gave the subpostmaster an amount of money and an amount of stock and had to account for that, was liable for accounting for that through the transactions and by producing a balance sheet which, in practice, was a cash account.
Mr Beer: What were you told as to the liability or the contractual liability of the postmaster to make good shortfalls?
Philip Boardman: That they had that contractual liability.
Mr Beer: Any shortfalls; any shortfalls for which they were at fault; any shortfalls for which they negligence could be shown; any shortfalls for which fraud could be shown; any shortfalls where the system showed a shortfall, irrespective of the cause of the shortfall?
Philip Boardman: So many of those, if the system could be shown to be doing it, no.
Mr Beer: Sorry, if the system?
Philip Boardman: If the system could be shown to be having got its sums wrong, if the system was getting those sums wrong but, you know, those had to be identified, investigated, verified.
Mr Beer: Did you understand that to be written into the contracts for subpostmasters?
Philip Boardman: I didn’t ever see a contract and I didn’t know the details of the contract. It was just a statement that, you know, shortfalls. So if a clerk were to tender incorrect change, give out change for a £20 note when only a £10 note had been tendered, that would be a discrepancy of £10 that the subpostmaster would be responsible for making good.
Mr Beer: Yes, I’m exploring what your knowledge was of the extent of the liability to make good shortfalls. Was it to that obvious example or was it any shortfall shown by the Horizon System?
Philip Boardman: I think it was most – my understanding was it was the obvious examples that – the things that were –
Mr Beer: Who did you get that understanding from?
Philip Boardman: From the Post Office representatives who were telling me about – I’d never run a Post Office, I’d never worked in a Post Office. I had to rely on their information.
Mr Beer: Can we turn, please, to POL00038878. You tell us in your witness statement – it’s paragraph 13, no need to turn it up – that although the substantive delivery of the project may have been undertaken by the Prism Alliance, your team was responsible for the conceptual designs which underpinned the project; is that right?
Philip Boardman: No, ultimately, Post Office were responsible for the conceptual – the conceptual designs were design – were requirements documents. Design proposals were – are still – design documents in response to those requirements. So this is a requirements document and –
Mr Beer: This is a requirements document, is it?
Philip Boardman: This conceptual design is Post Office’s business design for specifying their requirements.
Mr Beer: It’s written by you.
Philip Boardman: I am named as an author, I think, because I – I helped Dave Parnell put together the – there’s lots of business process models in there and documentation behind the business process models, and so I had experience of extracting the business process diagrams out of the tooling that we’d used as part of this process and the documentation behind those – in those models, and so I assisted in authoring this document but editorial control was Dave Parnell’s and was Post Office’s –
Mr Beer: So really –
Philip Boardman: – Post Office requirement document.
Mr Beer: – where it says “Authors” –
Philip Boardman: Sorry.
Mr Beer: – you and Dave Parnell, that’s not entirely correct?
Philip Boardman: I’d say this was Dave Parnell’s document. I helped him with some of the – I just – you know, the typing. This – at one stage –
Mr Beer: Couldn’t he type?
Philip Boardman: 19 years ago, collaboration systems weren’t as advanced as they are today and, in practice, typing things into documents would involve one author at a time editing. So he would send me the – give me the control of the document to type editing, add in the things like – that I added in, the process diagrams, that he’d asked me to put in. I think I might also have edited some of this in terms of Fujitsu feedback because we had feedback from a number of reviewers in Fujitsu who were asking elaboration questions, “Can you explain what this means? What are we trying to get at here?” and so I’d done those.
And I think at one stage I must have had control like that, of typing it into the document, and because I think I’ve seen some in the pack here, some minutes to documents saying, you know, “Dave Parnell to verify this, Phil Boardman to type it into the document”.
Mr Beer: Okay. Can we look, please, at pages 13 to 14, bearing in mind what you said as to your role in this document. So page 13, please. This sets out the “Business Proposition”, and then under 3.1.1.2, which is about halfway down the page, the “Key Priorities” are set out, and these echo some of the issues that we have seen in the document that we looked at before the break:
“Make the identification of debt easier …
“Increase the amount of debt recovered …
“Put the emphasis on clients and customers to validate the data.”
“Clients and customers” there, that’s including subpostmasters?
Philip Boardman: Yes, I think it will be.
Mr Beer: So it’s putting the emphasis on, amongst others, subpostmasters to validate data, yes?
Philip Boardman: Indeed.
Mr Beer: That was a key priority. Then under 3.1.1.3, “Business Drivers”, we can see again a repetition of some of the things we saw in the earlier document:
“Refocus on Debt Recovery (financial recovery of money), target of 95%
“Only 10% of discrepancies are actually a debt
“Establish a central debt monitoring environment to enable the identification of debt with a high degree of accuracy …
“Accounting and settlement on our data, not clients
“Manual journal documents and human intervention produce errors …
“Settlement estimating can produce positive or negative interest [situation] …”
Would you agree overall that the principal justifications for change were the recovery of debt and the shifting of responsibility in respect of reconciliation?
Philip Boardman: Yes, yeah. I think somewhere in this document this section explains that it’s effectively a restating of the – a section from the end-to-end requirements feasibility document, and so the document we were looking at earlier and this have derived from the same source.
Mr Beer: The Inquiry has heard evidence of a number of bugs, errors and defects, which arose during the development testing and rollout of Horizon. To take an example, the Inquiry has heard evidence that there was a document produced called the “EPOSS Taskforce Report”, which recommended that the whole of the EPOS System be rewritten. Were you and your team made aware of documents such as that?
Philip Boardman: The first I heard of that was through the – listening to – seeing some of the evidence from – at this Inquiry.
Mr Beer: Was that information which you think ought to have informed the work you were now undertaking in 2003?
Philip Boardman: I don’t know whether it would have changed anything. Ultimately, I was helping Post Office with their requirements.
Mr Beer: You don’t think it would have changed anything?
Philip Boardman: I don’t know.
Mr Beer: Can you think about it and help us? So we’ve heard – if you have been following, as it seemed to be the case, the Inquiry, quite carefully –
Philip Boardman: No, I watched some witness evidence sessions because I was prepared preparing. I’ve now prepared to come to the Inquiry three times because the Inquiry postponed twice, so each time I’ve watched some more, I’ve ended up watching a lot more than I ever intended to and I just wanted to prepare myself. So I’ve seen some of the evidence but I haven’t really been following it.
Mr Beer: Do you know that the Inquiry has heard evidence of the existence of a series of recurrent bugs, errors and defects in the testing, rollout and acceptance phase of Horizon that led to data integrity errors?
Philip Boardman: Now, yes.
Mr Beer: Do you think that’s information that you should have been aware of when assisting with the typing of a document like this?
Philip Boardman: Like I say, I don’t know whether it – I think – I presume that other people that were involved – that knew about that because I hadn’t been involved before 2002 but other people had been around, and they would have known about those sorts of things and would have presumably –
Mr Beer: Piped up?
Philip Boardman: Well, and come to the conclusion that those issues had been resolved by that stage but I don’t know whether I’d have –
Mr Beer: Who are the people that you’ve got in mind that had that continuity of knowledge?
Philip Boardman: Well, people in Post Office, who probably were involved.
Mr Beer: Who have you got in mind?
Philip Boardman: Well, Dave Parnell, Sue Harding, Clive Read, who was IT director at the time, and people in Fujitsu like Gareth Jenkins, like Tony Drahota.
Mr Beer: What did you know about Gareth Jenkins’ involvement in the development, acceptance and rollout phase of Horizon?
Philip Boardman: My understanding was that Gareth had been around for a long time and was very knowledgeable.
Mr Beer: Can we turn to page 14 of the document, please, and turn to paragraph 3.2.1. Underneath the diagram there’s a helpful overview of the system that is proposed and, if we can just go on – so it says:
“The specification of the requirement detailed in this document, including the descriptions of the new Branch Trading processes, where relevant and practical, have taken the following principles into account …”
Then if we go over the page, please, to page 15 and look at paragraph 11:
“Within the monthly trading period, branches should have facilities to identify and the flexibility to manage local variances between system generated and actual cash holding positions, in line with Principle 1 above. These variances will be identified through one of three mechanisms …”
Then four mechanisms are set out:
“A cash declaration …
“A stamp declaration
“A stock check or declaration
“Balancing the SU.”
The stock unit, yes?
Philip Boardman: Stock unit, yes.
Mr Beer: “All local variances identified at the branch must be actioned within the monthly trading period (ie Stock Units should not be allowed to roll over at trading period end with an outstanding local variance. Prior to balancing the Stock Unit at the period end, any outstanding variances should be forwarded to the branch manager/supervisor’s Stock Unit as local suspense items that should be addressed locally at branch level before the branch rolls over into next trading period.”
Then at 12:
“By the end of a monthly trading period, branches should be required to make good discrepancies between Horizon generated cash and stock positions and the actual physical position determined by branch office staff. To help facilitate this, existing Horizon facilities that permit branch staff to post cash discrepancies to a cash suspense account will be removed. Remaining branch suspense accounts should only be used following prior authorisation via Post Office central processes and will be restricted to use by branch staff with Horizon manager/supervisor roles.”
The document goes on to explain that suspense sums could be cleared in several ways, including to cash or by transaction, or by a subpostmaster paying from their salary or from a credit card and that, by contrast, in directly managed branches, supervisors would be able to clear values into a central write-off.
What provision was made here for subpostmasters to challenge a discrepancy as having been caused by a Horizon error?
Philip Boardman: I think two facilities there. So at the time of initially identifying the discrepancy – and can we go back up to the top of 12 there. So this idea of by the end of the monthly trading period, in practice, I believe the weekly cash account cycle meant that very little investigations of accounts, where they were, what was happening, whether they were correct, was happening within the week, and so this idea of by the end of the monthly period the branch should be required to make good, but – sorry, actually go to the top of 11. I misremembered.
“Within the monthly trading period, branches should have facilities to identify and the flexibility to manage local variances …”
So the idea was here that instead of always being found at the point of rollover of the cash account or the trading period, as it would be, that variances would probably be identified more often between times. So as part of another change, there was a nightly process of – the (unclear) process of declaring a total amount of cash held in the branch, which had been instigated purely to feed SAPAD’s data so it could do its planning. But then this was changed to a cash declaration which would compare the amount entered against the system-generated figure and tell you on a nightly basis, if that was operated, that – you’d identify variances within the month, rather than at the end of the month.
The other variation, I don’t think it’s really brought out in here but during the conversations, I think, Post Office were anticipating giving advice and guidance that the post offices would use balance periods between trading periods more than they had done previously with balance periods and cash account periods.
Have people explained the difference between balance periods and cash account periods to – Mr Cipione?
Mr Beer: Yes.
Philip Boardman: So you understand that.
But the expectation was that the branch wouldn’t go a whole month without doing the balance but they’d only rollover balance periods so they’d do maybe weekly or fortnightly balance periods. So it was to try to make it much more likely that those discrepancies would be discovered within the month rather than at the end of the month.
When they were discovered –
Mr Beer: So far, all of the things you’ve described are processes put in place that might make it – might make the identification of a discrepancy more timely.
Philip Boardman: Indeed, and so –
Mr Beer: So what happens –
Philip Boardman: – once they were identified, then the options were to dispute that with NBSC and put it into suspense, or – and if, having done that, the transaction – sorry, can we scroll down again? We’re just on the edge of a page. The transaction correction option there, if it had been raised into suspense and raised as a transaction correction, if Post Office had investigated and decided or felt that this should be pushed back from suspense back to the postmaster, they had an option within the transaction correction processing dialogues to dispute that again.
Mr Beer: You said “if Post Office investigated” and then you corrected yourself to “if Post Office felt”?
Philip Boardman: Well, having investigated, if they felt that they needed to – that the transaction correction was to bring the sum back from suspense on to the postmaster’s liability, if –
Mr Beer: Where’s the –
Philip Boardman: If the transaction correction were taking the suspense and writing it off, I think it would be unlikely that the subpostmaster would challenge that.
Mr Beer: Would complain, yes.
Philip Boardman: But they might. But transaction corrections could be challenged. That’s the –
Mr Beer: Where’s the description of that in here?
Philip Boardman: I’m not sure it’s there.
Mr Beer: You see, in paragraph 12 –
Philip Boardman: I think that was elaborated further in the later discussions.
Mr Beer: You see in paragraph 12, it’s in the second sentence, it says:
“To help facilitate this, existing Horizon facilities that permit branch staff to post cash discrepancies to a cash suspense account will be removed.”
But then:
“Remaining branch suspense accounts should only be used”, et cetera.
Philip Boardman: Yeah, there’s some really confused writing in here.
Mr Beer: So that appears to be in the one hand saying that a suspense account facility is going to be removed but then the remaining suspense account facilities have to go through a process, managed by managers and supervisors. Can you –
Philip Boardman: So –
Mr Beer: – explain what that attempting to describe?
Philip Boardman: – I think the first element of trying to explain this is that the term “branch staff” here is used to be two different things. In the first instance, I think it’s meaning anyone who worked in a branch, anyone who had a username and log-in into the system, and in the second – sorry –
Mr Beer: The same word is used –
Philip Boardman: The second it’s using that – in the first it’s trying to say those that aren’t managers and supervisors.
That way round, isn’t it?
Mr Beer: I see. So it’s a narrowing of the facility of posting discrepancies to a suspense account rather than the removal of a suspense account facility?
Philip Boardman: That’s the first element of reading that and correcting its language. The second bit is the cash discrepancies thing here and posting cash discrepancies to cash suspense account. So when posting – the phrase “post” or transfer discrepancies to suspense is used, but when performing that, what’s actually happened is a transaction.
Everything in Horizon is performed as a transaction and so what’s actually happening is that a transaction is happening to – is being created that takes liability out of the branch accounts and puts it into the suspense account. There were a number of suspense products that could do those things, that were seen as generic products. I think we might see a document later where it talked about loss A to table 2A, loss B to table 2A, loss C to table 2A, et cetera.
Mr Beer: Sorry to cut through you, it’s just a short point that the use of the word “cash discrepancies” is too narrow a description of the species of discrepancy?
Philip Boardman: Indeed, because, ultimately, all discrepancies were cash, the cash account was accounting for cash. Everything was turned into cash whenever – so if stock was lost, removed, as we discussed earlier, then it would be turned into cash to be accounted for. So all discrepancies were cash discrepancies. I think this is talking about a very specific set of cash discrepancies.
Mr Beer: So was the primary safeguard that this system adopted against subpostmasters being saddled with debt for which they were not responsible, that they were required to agree debt or post it to a suspense account?
Philip Boardman: Yeah. Yes.
Mr Beer: Without doing either of those things, though, they weren’t allowed to continue to trade in the next trading period, were they?
Philip Boardman: Yes, they were, and this is something you – I heard you say in the opening statements to Phase 2, and –
Mr Beer: You’re going to correct me?
Philip Boardman: – I think that’s incorrect. If you didn’t roll over – so in terms of – these checks, you couldn’t roll over without balancing the last stock unit, and you couldn’t roll over the branch without balancing the last stock unit and ultimately coming to a balance, but the net effect of not rolling over wasn’t to stop you trading. The net effect was that on the day after not rolling over into a period when the calendar said you should have rolled over, you would get a warning that you should have rolled over yesterday, which you could accept and carry on using Horizon –
Mr Beer: So you could just carry on –
Philip Boardman: Yes, indeed.
Mr Beer: – and just accept these warnings for months and years?
Philip Boardman: Well, indeed not.
Mr Beer: So what would happen if you just ignored these warnings?
Philip Boardman: Well, messages were created when rollovers happened and when they are not, when they didn’t happen, and Post Office would monitor that, and –
Mr Beer: And do what?
Philip Boardman: – and go and send Retail Line, NBSC to talk to the subpostmaster, as I understood it.
Mr Beer: To do what?
Philip Boardman: To ask them why they hadn’t rolled over.
Mr Beer: And let them carry on trading?
Philip Boardman: Well, no because –
Mr Beer: What would they do, then?
Philip Boardman: Sorry, I don’t know. That’s something you’d need to – as Post Office held, they’d get someone to do this. There were technical limitations that the Horizon counter had that meant that it could only, I think – I think it ended up being at 45 days, so it could only store, retain data for 45 days – we saw earlier, that it was assumed that no branch visits would be necessary. No engineering would – you know, they wouldn’t have to – no one would have to go out and install a larger hard disk into the counter PCs.
So I think, as part of these discussions, the trading period, the length of the trading period was set for the 4-4-5 calendar, as it was, and it was agreed that the data retention would be 45 days, and so Post Office would need to start doing – take actions pretty soon after a cash account didn’t roll to try to make sure that we didn’t get into the situation where data in the branch had been lost.
Mr Beer: So you followed the Phase 2 opening carefully. That was one of the things that you looked at, did you?
Philip Boardman: I downloaded the transcript and searched for “IMPACT” because I thought it would be pertinent to what I was going to be talking about.
Mr Beer: Your evidence is that a subpostmaster is, in fact, not prevented from trading if they don’t either accept a debt or put it in a suspense account – sorry, pay off the debt?
Philip Boardman: They wouldn’t be able to roll over the last stock unit and they wouldn’t be able to roll over the trading period.
Mr Beer: So what effect would that have on them?
Philip Boardman: Like I say, they’d get a warning the next they when they logged on.
Mr Beer: What, they can just ignore that warning, can they?
Philip Boardman: Well, no, because Post Office would manage that situation but, like I say, you’d need to talk to Post Office as to how they’d manage that and what they’d do, but there’s an investigation.
Mr Beer: Can we turn to page 18 of the document, please. Look at 4.2, under the heading “Legal & Regulatory”. The document states:
“It will be verified that branch processes and reporting changes meet legal and regulatory financial reporting constraints (eg auditors) to ensure that there is sufficient information from the new system to support regulatory reporting, litigation and criminal prosecution.”
What steps were taken by Fujitsu and, to your knowledge, the Post Office at this stage to consider how data produced by Horizon was capable of supporting these legal and regulatory obligations?
Philip Boardman: I don’t think any particular work was done by Fujitsu. You can see there the second column in that table –
Mr Beer: Allocates it to POL?
Philip Boardman: – allocates it to Post Office Limited. I remember there being long conversations around this.
Mr Beer: Between who and who?
Philip Boardman: Between Post Office mostly, like I say, we were in the room listening to them talking, rather than actually being actively involved.
Mr Beer: Names, please?
Philip Boardman: Sorry, can’t remember. But –
Mr Beer: Can you try a bit harder –
Philip Boardman: Well –
Mr Beer: – if you wouldn’t mind.
Philip Boardman: I guess the Retail Line ops, I think was Ruth Holleran, and so there was a key sort of stakeholder there but, you know, some of this, a lot of the hoped-for – we talked about the huge amount of paperwork going backwards and forwards to Chesterfield, and so there was this requirement to try to truncate the branch trades and statements as it became, no longer having 17,500 cash account forms arriving in Chesterfield every week.
At the start of this morning’s session, you asked me to look at a particular page of this thing, and you said is that my signature, and I said yes, and you were happy to accept that response. But you and I know that that isn’t actually my signature; it’s a printout of a digital image of my signature that we separately and via the Fujitsu counsel have agreed to accept as my signature, because that’s the way the world’s moved on since then. But back in 2002/3 periods, Post Office were getting 17,500 signed forms, actual signatures –
Mr Beer: Just incidentally, pulling you up on that, I accepted your signature because you told me so, having affirmed.
Philip Boardman: Well, it is a representation of my signature but like René Magritte’s painting of a pipe, it’s not a pipe. I didn’t sign this piece of paper.
Mr Beer: I didn’t ask you that.
Philip Boardman: I know. But the point I’m trying to make is that this is – that Post Office were receiving 17,500 signed cash account forms in Chesterfield every week and, as a result this, they weren’t going to be receiving those, and they needed to try to work out whether they needed – what evidence of the subpostmaster accounting for their branch liability was likely to be sufficient.
Mr Beer: You said a moment ago that you remember a lot of conversations around this.
Philip Boardman: Yeah, because –
Mr Beer: What were the conversations about?
Philip Boardman: Well, ultimately, about the text that would have to be on a screen that would then get accepted, something about a true reflection of trading and remaining liability or whatever it was, I can’t remember the text –
Mr Beer: Text on whose screen?
Philip Boardman: On the Horizon screen that would be presented to the subpostmaster that that would then – they would confirm that this was their branch trading statement and that they were happy to roll over.
Mr Beer: This looks to be looking at a different issue, namely the production by the system of data to support litigation and criminal prosecutions. So not a screen that a subpostmaster signs off but branch processes and reporting changes that will support civil litigation and criminal prosecutions.
Were there discussions about those issues?
Philip Boardman: No.
Mr Beer: I’m sorry?
Philip Boardman: No.
Mr Beer: So you’re referring to discussions about what the SPM screen looked like when they were certifying something?
Philip Boardman: How confirmation of a set of accounts would happen.
Mr Beer: Can we look at that, please, at page 69 of the same document, at the foot of the page under “Discrepancy Management”. So this section of the design proposal concerns circumstances where an error has been identified in a transaction, correction is generated; correct?
Philip Boardman: Sorry, I can’t – I’m not working out which bit of the page are we looking at?
Mr Beer: We’re looking at 10.1.4, “Discrepancy Management”.
Philip Boardman: Right.
Mr Beer: We’re in the arena of an error has been identified and a transaction correction is generated.
Philip Boardman: Indeed.
Mr Beer: Yes?
Philip Boardman: Yes.
Mr Beer: Then if we go over the page to page 70, please, and look at 10.1.4.2, handling of transaction corrections. The “Automation” described:
“There will be a button for Transaction Correction Management within the menu hierarchy which is only accessible by users with the appropriate role. This will provide the user with a list of the unprocessed Transaction Corrections displayed in date/time order.
“Having selected the Transaction Correction to process, the system will display text making clear what will happen when they select any of the options presented.
“For each Transaction Correction the user will have up to three options – Each option, when selected, will perform an identified set of transactions, defined within the Transaction Correction (which may include an option to Do Nothing – requesting further investigation).”
Philip Boardman: Ah, so when you asked earlier where is this specified in this document, it’s there, about transaction correction. Effectively, that’s requesting further investigation.
Mr Beer: So was this button put in to effect a third button: “Do nothing, I request further investigation”?
Philip Boardman: I believe so.
Mr Beer: On what basis do you believe so?
Philip Boardman: Because it says so there. I don’t know what was fully implemented into the system.
Mr Beer: The Inquiry has heard evidence that there was in fact no means to roll over until transaction corrections had been processed, and the subpostmaster was required either to make good or accept the shortfall, and that there wasn’t a third option of “Do nothing, I request further investigation”.
Philip Boardman: Well, I don’t know why that didn’t happen.
Mr Beer: Can you help the Inquiry as to any discussions that you were a party to as to why that option wasn’t implemented?
Philip Boardman: I really don’t know. I don’t think I have – I can’t recall anything of discussing that not happening.
Mr Beer: Whose responsibility would it be to carry that into effect?
Philip Boardman: It would be between the architects, designers, and Post Office, accepting the design.
Mr Beer: Just look at the table underneath 10.1.4.2. Do you see in that next box, “There will be a button”, et cetera?
Philip Boardman: Yes.
Mr Beer: That seems to be allocated in that second column to Fujitsu Services, doesn’t it?
Philip Boardman: Yeah, so that would be implemented in the system. That’s the requirement was to implement that into the system.
Mr Beer: You can’t help us as to if it’s right that that was not implemented, why that wasn’t so?
Philip Boardman: No. I really don’t know.
Mr Beer: Can I turn to the issue of the removal of the suspense account. Can we look, please, at FUJ00126036.
Can we look at page 3 of this email chain, please. I should just look at page 4 to see who this email is signed off by.
Philip Boardman: This one is Clive Read.
Mr Beer: I just want it to be on the record so we can see it.
Philip Boardman: Sure.
Mr Beer: You may know the documents inside out –
Philip Boardman: No, no, this –
Mr Beer: – but I’ve just got to make sure that it’s on the record.
Philip Boardman: I haven’t seen this until – for 19 years until last week. But, yes, I’ve read it.
Mr Beer: So it’s signed off by Clive Read, the Chief Systems Architect within Post Office. If we go back to page 3, please. This email – I’m not going to go to the previous page – is addressed to Ruth Holleran. What did you understand her job to be?
Philip Boardman: I believe she was director of the Retail Line branch network.
Mr Beer: Tony Marsh, what did you understand his job to be?
Philip Boardman: I think he responds to this, so I think he worked for Ruth.
Mr Beer: And copied to Sue Harding. What did you understand her job to be?
Philip Boardman: Sue was programme manager for the IMPACT Programme.
Mr Beer: If you look at the email, Mr Read says:
“… we are currently in the middle of requirements workshops on the final phase of the IMPACT Programme. Although we have a scheduled Stakeholder meeting early in February, given the tight timescales there are some emerging concerns which I think I need to flag up.”
Then the first of them under “Suspense Account Threshold” essentially saying that the – well, you can read what it says:
“The current assumed position is that a single threshold of £250 will be applied by Horizon below which variances cannot be placed into Suspense Account … This is a new system control which does not currently exist.”
Can you recall what this was about, what the idea of an introduction of a floor of £250 was?
Philip Boardman: I never really fully understood this but this was – Post Office seemed to have this idea that they would give a threshold that anything under £250 would be at the subpostmasters’ liability and would be – anything above that would be – could go into the suspense account for disputes, discussions, investigation.
So this idea of the single threshold and the different ones for different – because they talk here about different branch types, rather than – or office types, rather than different suspense products. So they appear to be treating all suspense products as the same thing. So, again, I don’t fully understand how you wouldn’t be able to raise a dispute about a discrepancy of the cash pouch was £50 short if, you know, investigations showed that the packer had not picked that pack of – those packs of 50p pieces, or whatever it is that came up to 50p – £50, then clearly that would be a reasonable dispute to hold.
But this is eventually, in the email trail, I get –
Mr Beer: We’re going to work back in –
Philip Boardman: No, I know but I’m just going to say I get copied on this but I think this is effectively internal discussions with Post Office that we’d expect them to resolve between them to decide. But both of these things, it’s also important to say, are things that Post Office had complete control of, that this threshold would be specified if it was to be implemented by Post Office reference data. The product – a product can have minimum, you know, any product that could be traded in Horizon that you could specify amounts of the transaction for, it was possible to specify minimum – maximum, so that – and that would be used, say, in the utility bill example that I’ve used before, to try to stop the miskeying – so you might say back then, paying £1,000 on a gas bill was very unusual. Nowadays it might be more reasonable.
But you might, say, expect a maximum of £1,000 and any key-ins of a large transaction like that would probably be typographical error, hitting the “00” key too many times.
Mr Beer: Anyway, cutting you short –
Philip Boardman: But this – sorry, I’m just going to say but that that is something that the Post Office had to decide what –
Mr Beer: So this is an internal discussion within Post Office of whether there should be a single threshold of £250 –
Philip Boardman: Or a variable threshold –
Mr Beer: – or a variable threshold.
The Court Reporter: Sorry, you’ll have to go one at a time.
Mr Beer: We’re being reminded to go one at a time.
Philip Boardman: I apologise.
Mr Beer: The second thing in the list, “Suspense Account Authorisation”:
“The current assumed position is that subject to the threshold control above, the requirement to seek telephone authorisation for posting variances to Suspense would cease, on the understanding that improved timeliness and visibility of office liabilities (next day, single view of office cash and liability) would provide sufficient control (given that currently there is a two-week lag between suspense postings and visibility of these centrally).
“The Operations and Security view was that removal of this control would declare ‘open season’ on the use of Suspense postings, leading to loss of financial control, spiralling non-conformity, etc …”
Yes?
Philip Boardman: And so –
Mr Beer: He raises his concerns:
“While we can discuss and take a view on these issues on isolation, my preference is to assume that we can define new back office controls which fully leverage the timeliness, accuracy and completeness of the new systems, and therefore challenge any (understandable) reluctance to ‘give up’ controls that are already in place. The danger is that we spend significant amounts of time and money while not bringing about the fundamental changes the programme was given the mandate for.
“I think this is an important position to take in our approach, to underline our objective to simplify and leverage new capability but recognise the challenge is therefore to define a ‘fit for purpose’ control framework which tackles these fears head-on.”
So is this a discussion within Post Office which essentially involves the author recognising an operations and security view that pushes back against a greater use of a suspense account.
Philip Boardman: Indeed. It would appear so. I think the other element of this, that this way forward area is really talking about – the feeling that the IMPACT Programme would take an approach of empowering. You’ve used the phrase earlier of making responsible for, but you can also look at it from the positive spin point of view of empowering postmasters to manage their businesses for themselves, and only get involved in – or Post Office only needing to be involved in this when, you know, disputes were raised and, at this point, this appears to be possibly proposing that what I said earlier about disputes, that the suspense account wasn’t the mechanism of raising a dispute; it was the way of accounting for a dispute that you had raised.
This appears to be potentially proposing that a dispute could be raised by the posting of an amount to the suspense account and because Post Office had capable new financial systems, they would know about that within 24 hours and they would be able to do something about it.
Mr Beer: Anyway let’s look at the response from Mr Marsh, on page 2. Can we just go up to the top. Thank you. So this is an email from Mr Marsh back to Mr Read. Then in the second paragraph, he says:
“On the suspense account issue, I’m afraid I share the same beliefs as mine and other Ops reps, if there is no independent control and authorisation process for the use of suspense accounts then postings will rapidly increase to unacceptable levels. Irrespective of our aspirations for a simplified process to support commercially minded agents I believe that many of those of a more historic mindset will exploit the facility …”
That’s referring to subpostmasters of “an historic mindset”, isn’t it?
Philip Boardman: I believe that’s who we would be talking about there, yes.
Mr Beer: “[they’ll] exploit the facility, creating a large parcel of manual work for someone, NBSC or Retail Line, to do to agree terms to reduce each individual posting.”
Philip Boardman: Sorry, can I just make a comment about that, then? So what I said earlier about this approach that is being suggested in the first email about a sort of empowered management approach of managing the Retail Line, in this it appears to be a much more sort of command and control approach being proposed.
Mr Beer: In his third paragraph, he says:
“Given that the overall project should simplify reconciliation and settlement significantly and should therefore mean that errors will be identified more rapidly and will be even more clearly the fault and responsibility of the agent, is there any reason to have a suspense facility at all? This might mean that in extreme cases the agent would need to contact the Retail Line or NBSC and negotiate a ‘loan’ (at some level of interest?) to cover very high values of loss but in most cases the agent should be sufficiently capitalised to cover ordinary variations …”
Do you understand that to mean – “in most cases the agent should be sufficiently capitalised” – that, in most cases, a subpostmaster should have sufficient money in his or her pocket.
Philip Boardman: To accept the liability.
Mr Beer: Yes.
Philip Boardman: Indeed, that seemed to be what that’s saying.
Mr Beer: “… particularly if the opportunity were offered to make losses good via credit card …”
So that’s the parties borrowing money on their credit card to make good a loss?
Philip Boardman: Indeed.
Mr Beer: “… thereby enabling them to tap in to up to 56 days of interest free credit …”
Then he says:
“… (a facility favoured by the NFSP despite my early misgivings).”
In the meetings and workshops that you attended, can you assist as to whether the NFSP was involved in any discussions or negotiations as to IMPACT?
Philip Boardman: I – people mentioned them every now and again, in particular from this area of the business, the Retail Line, but I don’t think I ever met anyone from the Federation.
Mr Beer: So far as you can recall, in the workshops and meetings that you attended, was anyone from the Federation present?
Philip Boardman: I don’t think so. I can’t recall that.
Mr Beer: What this appears to suggest is the Federation suggesting that its members or some of them should have a credit card – should use their credit cards to borrow 56 days of interest-free credit in order to make up losses?
Philip Boardman: Indeed. I don’t think I ever found out fully whether – is this Tony Marsh, by the way, sorry – whoever it was, the author of this, was intending for this sufficient capitalisation to cover whilst a dispute was resolved or just full stop. “Sufficiently capitalised to cover it”; I don’t think I ever found that out. This sort of conversation happened not in my presence, to my knowledge.
Mr Beer: What this is mooting is the getting rid of the suspense account entirely. The SPMs are to bear the responsibility for any variances or discrepancies. Why do we need a suspense account at all? They can use their credit cards after all?
Philip Boardman: Like I say, I think next in the chain I’m trying to wonder what the implications are for requirements, and whether – like I say, is this – whilst the dispute – so if in the other side of the subpostmaster’s business, most subpostmasters being franchisees and most of them running other businesses in their convenience store or whatever, if a delivery had arrived short of, you know, some quantity of things that had been delivered but that they’d already paid for because, being a small, single outlet business, they wouldn’t necessarily have good payment terms, then they would be liable for the shortfall of the non-delivered stock until they’d raised the dispute with the provider.
And so I think this was trying to suggest this, but then I’m not sure whether it was, like I say, just, full stop, they should be liable for it or whether they should be liable for it until the discrepancy was resolved, and whether what he’s also then proposing is that transaction corrections, that some sort of dispute resolution – dispute raising and resolution process would then be able to do a transaction correction, to resolve those things. But, like I say, I don’t know where this was going.
Mr Beer: Would you agree that this appears to be proposed on the assumption that the system produced accurate data and was infallible and, therefore, discrepancies must be the result of the subpostmaster?
Philip Boardman: Like I say, I don’t know what the intention of this was. Whether it was to make them liable full stop or to make them liable until the dispute had been investigated and resolved. But, you know – but there is a proposal here, like you say, to fully remove the suspense account facility.
Mr Beer: That seems to be based on the assumption either the data that Horizon is producing must be accurate or, even if it’s not accurate, we don’t care, it should be the responsibility of the subpostmaster to make good the loss, if you’re removing the suspense account?
Philip Boardman: Like I say, I don’t know where this was going. I didn’t.
Mr Beer: Can we look – the email was forwarded on page – let’s just go to the top of that page, first. Clive Read forwards the email – if we just go a bit further up the page, please, thank you – to Dave Parnell, and we go to the top of the – or the bottom of the next page. You can see it’s forwarded to Dave Parnell, copied to Sue Harding, and then Dave Parnell sends it to you “for info … and we probably need to discuss”.
Then –
Philip Boardman: I forward it to Bob Gurney, don’t I?
Mr Beer: You forward it to Bob Gurney. What role did Bob Gurney perform?
Philip Boardman: He was my manager by this stage?
Mr Beer: And you add Gareth Jenkins into the chain.
Philip Boardman: Indeed because it appeared to be a big change in requirements – or could be. You know, I didn’t know what – what the consequences of this might be.
Mr Beer: Then, if we keep going up, Bob replies to you:
“Phil – shouldn’t it get reported as an interim response to the first part of action 56 so the workshop would then decide how it needs to be reflected in the process models/principles/etc. We will need to follow up with Clive to adjudicate if there is any difference in opinion expressed by Ruth. We also need to encourage Dave to chase people up so that we can get the actions closed down.”
Can you help what happened next?
Philip Boardman: As I understood it, there was a series of meetings next, and I still don’t know whether, when Clive Marsh said “remove the suspense account”, what he really meant was remove some of those suspense account products with the more generic names: loss A to table 2A, loss B to table 2A, et cetera. I don’t know what those were used for, but they appeared – they were ones that Post Office eventually decided to remove.
So I don’t know whether, when he said “remove the suspense account”, he meant particular suspense account products that he felt might be being used generally, or whether he meant fully remove the suspense account, and the outcome was some sort of compromise situation of removing some of the suspense account product and leaving others. But –
Mr Beer: Did you work with the Post Office subsequently to ensure that the view expressed by Mr Marsh that the suspense account should be removed, which was the means by – the facility by which subpostmasters might previously challenge discrepancies, was carried into effect?
Philip Boardman: Um, I don’t recall doing any of that. I don’t think so.
Mr Beer: Can you recall whether you were informed of any further National Federation consultation or participation in the process about what should happen to the removal of the suspense account suggestion?
Philip Boardman: No, I don’t think so.
Mr Beer: Can you recall any participation, other participation, other than through the Federation of some Subpostmasters, in relation to this proposed change?
Philip Boardman: No, I wouldn’t have – wouldn’t have been involved in that at all. But I don’t think I heard anything about it, either.
Mr Beer: Can we go, please, to FUJ00126038. Ah. Good. So we were previously looking at an email exchange that ended on 23 January 2004, and we’re now looking at what appears to be an invitation to a meeting sent on 12 February 2004, the meeting being on 18 February 2004. Can you see all of that detail?
Philip Boardman: Yes.
Mr Beer: So the sent, time and date, second line. The subject matter in the fourth line. It’s an invitation to a meeting about branch trading, the treatment of suspense, at 1.00 on 18 February. We can see the invitees were Ann Clarke, Ben Gildersleve, Clive Read, Gareth Jenkins, Philip Godden, you – and it’s copied to Dave Parnell and Julie Pope?
Philip Boardman: Yes.
Mr Beer: You see that it says, “Two issues to be considered”. Was this effectively a rough agenda for the meeting?
Philip Boardman: I believe so, yes.
Mr Beer: “Two issues to be considered:
“Daily cash declaration
“The issue is whether to keep the daily cash declaration as now, or discontinue it.”
Then the part I’m interested in, “Suspense Account Manual Authorisation process”:
“Previous discussions on if to keep the manual authorisation process for Branches wanting to carry items in suspense, and whether to have one universal limit of something like £250 for items in Suspense.
“The decision reached yesterday by key senior stakeholders to remove the Suspense Account altogether. This would force Branches to make good all losses immediately. This needs to be considered in terms of how Branches can adjust figures, hardship cases, how [Branches] will be corrected with errors, etc.”
So this is an email sent on 12 February, and it says that a decision was reached “yesterday” by key senior stakeholders to remove the suspense account altogether.
Were you present at the meeting the previous day, if there was a meeting, at which senior stakeholders decided to remove the suspense account altogether?
Philip Boardman: No.
Mr Beer: Do you know who the key senior stakeholders were?
Philip Boardman: I don’t think I do, no, I don’t think. And this is an invitation to a meeting that happened on the 18th, I believe.
Mr Beer: Yes.
Philip Boardman: Yes.
Mr Beer: Yes.
Philip Boardman: But are we going to go on to talk about what happened at the meeting at the 18th?
Mr Beer: No at the moment I’m asking you –
Philip Boardman: I wasn’t involved, no, I don’t know anything –
Mr Beer: Do you know who was involved, who the key –
Philip Boardman: I would assume the people in the – in that email chain earlier but I don’t know.
Mr Beer: So amongst Clive Read, Ann Clarke –
Philip Boardman: Ruth Holleran, et cetera.
Mr Beer: – Ben Gildersleve, Gareth Jenkins, Clive Read, Phil Godden, Dave Parnell and Julie Pope?
Philip Boardman: Sorry, can we go back up?
Mr Beer: Yes.
Philip Boardman: Amongst that set, I think possibly only Clive Read, I think would have been, you know – the other people in the – sorry, in the previous email trail that we’d looked at, in the previous document, Clive Read, Ruth Holleran, Tony Marsh, those people would have been involved in making that decision. This –
Mr Beer: Were you told when you got to the meeting on the 18th why the decision had been taken to remove the suspense account altogether?
Philip Boardman: So my recollection of this, I think, by the 18th, the – that removal of the suspense account was elaborated to removal of some products and so, by that stage, it wasn’t removal of the suspense account. It was a reference data change that would be made by the Post Office.
Mr Beer: Who explained that to you?
Philip Boardman: Sorry, can’t remember, but one of the Post Office representatives in that list, one or more.
Mr Beer: Thank you.
Sir, that’s –
Philip Boardman: Possibly Chris Allen at that stage.
Mr Beer: Thank you.
Sir, that’s an appropriate moment to take a break, if it’s convenient for you.
Sir Wyn Williams: Yes, of course. Yes, so we’ll start again at 2.00, yes?
Mr Beer: Yes, please. Thank you, sir.
Sir Wyn Williams: All right, see you all then.
Mr Beer: Thank you.
(1.03 pm)
(The Short Adjournment)
(2.00 pm)
Mr Beer: Good afternoon, sir. Can you see and hear me?
Sir Wyn Williams: Yes, thank you. Yes.
Mr Beer: Mr Boardman, can we move on. We were looking at an email exchange in readiness for a meeting that was slated to take place on 18 February 2004. Can we look at a document that I think was produced on 27 February 2004. The reference is FUJ00126053.
Thank you. You’ll see the heading of the document “IMPACT R3”; is that Release 3?
Philip Boardman: That’s Release 3, I believe so, yes.
Mr Beer: “Branch Trading Issues”. You’ll see the date at the bottom right-hand side of the document, 27 February 2004.
Philip Boardman: Yes.
Mr Beer: This is version 9 of the document. This is a Fujitsu document; is that right?
Philip Boardman: I don’t know who was producing the minutes of these meetings. It’s come from Fujitsu, but we may have just had copies or we may have produced it. I don’t know.
Mr Beer: You said you don’t know who was producing minutes of these meetings; do you treat this as a minute of a meeting?
Philip Boardman: Well, I think there’s a series of actions to – and the branch trading issues thing here, I think, is – I think issues for clarification, things that hadn’t been resolved in that Branch Trading Conceptual Design document that we were looking at earlier, that we were, I think, at this stage tying to get that to an agreed approved state, and this is unresolved issues with producing that. So –
Mr Beer: We’ve got a series of these with different version numbers –
Philip Boardman: Indeed.
Mr Beer: – and successive dates going on after 27 February. What tends to happen is the first column and the second column stayed the same and in the right-hand column there’s additional information added in the status –
Philip Boardman: Indeed.
Mr Beer: – column. So they’re not minutes of meetings as such; is that right?
Philip Boardman: Well, so the outcomes may be minutes of meetings or they might be from phone calls or email conversations or whatever but they’re trying to drive down the number of uncertainties in the conceptual design document.
Mr Beer: Yes. So there might be the outcomes of meetings or there might be content of meetings –
Philip Boardman: Indeed.
Mr Beer: – included in these. So can we look at the third page of this document, please, at paragraph 2.4. You’ll see it’s the second row, the second populated row, 2.4:
“Following discussions between Tony Marsh and Clive Read, a review meeting has been arranged for [18 February] …”
We looked at that before lunch.
“… to examine a proposal to remove the current method of posting discrepancies into a branch Suspense account.”
Then the status is:
“To be addressed at Stakeholder review on [26 February].
“Action: Clive Read to confirm the requirement [I think on 27th February].”
Philip Boardman: Yes.
Mr Beer: Can you help with what stakeholder review was in fact conducted in relation to the removal of the suspense account?
Philip Boardman: I don’t know. I don’t know.
Mr Beer: Can you help with whether one was conducted?
Philip Boardman: Presumably. Is there a later one of these that says the outcome of this, that stakeholder review? I presume that there is. We were discussing earlier – sorry, before lunch – that my understanding at the meeting of the 18th was around the – by that stage, it was about removal of products in the suspense account. It’s still being talked about as removal of the suspense account here but I don’t know whether that’s just terminology and the documentation.
Mr Beer: Can you remember attending any stakeholder review?
Philip Boardman: I don’t. I’m pretty sure I wouldn’t have – I can’t remember and I’m pretty sure I wouldn’t have attended any.
Mr Beer: What would you understand a stakeholder review to consist of?
Philip Boardman: It would have been key people in Post Office’s business to make decisions on their requirements.
Mr Beer: Would it have included subpostmasters?
Philip Boardman: No idea, but, as we’ve discussed previously, not much of this included any subpostmasters so I doubt it. I would assume not.
Mr Beer: Can we look at the next iteration of this document at FUJ00126056. You’ll see in the bottom left that this is now version 10, whereas previously we were looking at version 9. This is dated 2 March 2004.
Philip Boardman: Indeed, which I think is very close to the date of approval of that branch trading. So I think we’re getting really close to the end of this process now.
Mr Beer: Yes. Can we look, please, at the second page. 2.4 is the last row. You’ll see that the first and second columns are the same, the number and –
Philip Boardman: Indeed.
Mr Beer: – what the issue is. Then what’s written is:
“Stakeholder review on [26 February] …”
Remember that was the date that it was said to be taking place in the previous document:
“… did not appear to address all issues. Review with DP …”
Can you help us, would “DP” stand for Dave Parnell?
Philip Boardman: Dave Parnell.
Mr Beer: Thank you.
“… proposed that working assumption for CD …”
Conceptual design?
Philip Boardman: Conceptual design.
Mr Beer: “… should be that [the Post Office] will withdraw Suspense products that enable cash discrepancies to be posed to Suspense requiring branches to make good or obtain pre-authorisation for discrepancies that special treatment. It is assumed that this requirement will be met by existing Horizon functionality and POL will revise reference data to obtain required effect.
“Action: [Dave Parnell] to review/confirm wording of working assumption.
“Action: PB …”
I think that’s you.
Philip Boardman: That’s me.
Mr Beer: “… to incorporate working assumption in [conceptual design].”
Philip Boardman: I think at this stage I had the pen on this document, because I was updating it presumably with diagrams and things, but as it highlights there, Dave Parnell was to tell me what to write.
Mr Beer: Okay, so you think you’re the now author of this document we’re looking at?
Philip Boardman: I had the pen, yes.
Mr Beer: Can you recall whether this accurately confirms or sets out the information that you were given, namely that a decision had been made to withdraw the suspense account facility, despite the stakeholder review not really addressing the issue?
Philip Boardman: No, my understanding of this was very much that the – as it says here about suspense products, it’s to remove suspense products but not the whole of the suspense account. So the working assumption will be that there will be a rationalisation of suspense products, and that but – where is the thing here – the stakeholder review didn’t address all issues. I don’t know what all the other issues were but presumably some people felt strongly that this didn’t go far enough. I think I mentioned earlier, it feels to me or it always felt to me like this was some sort of compromise.
Mr Beer: Why was it a compromise?
Philip Boardman: So we saw the email trail earlier and the opposite arguments about empowered – leaving subpostmasters to their own devices, sort of management approach, and a command and control management approach. This is a neither/nor. But that’s what Post Office, it would appear, seem to have decided to do, and from looking at later documents, I believe that’s what got implemented.
Mr Beer: Was there a working assumption by you that Horizon had any errors, bugs or defects in it?
Philip Boardman: I think, I believe, all IT systems have bugs, errors and defects.
Mr Beer: Did you have a working assumption that Horizon would identify its own bugs, errors and defects or there was a process in place to do so?
Philip Boardman: For Horizon itself?
Mr Beer: Yes.
Philip Boardman: I don’t think the system could know – be self-aware like that. But there were processes in place, in – within Post Office and within the support structures and processes to try to identify those.
Mr Beer: Were those, all of those, required to be triggered by a subpostmaster raising a discrepancy?
Philip Boardman: I don’t know. I mean, we talked about less reconciliation earlier but I don’t think anything ever suggested that there would be no reconciliation. It was reducing the numbers of points of reconciliation, and so there were still opportunities for Post Office to find bugs, errors and defects.
Mr Beer: On the evidence that the Inquiry has heard so far, both Post Office and Fujitsu were aware that there were a range of circumstances when Horizon operated when it was compromised by a bug, error or defect, where the system itself did not identify the fact of a bug, error or defect, and indeed where bugs, errors and defects had occurred and no root cause of them had been identified. Were those three pieces of information things that you were aware of?
Philip Boardman: No.
Mr Beer: Does it follow that others involved in the development process for IMPACT, for example Gareth Jenkins and Ruth Holleran, did not raise any of those issues with you?
Philip Boardman: Yes. Of course.
Mr Beer: In the process of the discussions that led to the partial removal of the suspense facility, were you aware if the proposal was ever checked in any legal teams operated by Fujitsu or the Post Office?
Philip Boardman: No, no, I wasn’t.
Mr Beer: Can I turn, please, to a little later than this. This is 2 March 2004. Can we turn to an email chain on 4 March 2004. That’s FUJ00126061. Thank you.
This is a nine-page email thread communicating information between a range of people at Fujitsu and POL in March 2004. Can we turn to page 9, please. Thank you. If we just scroll up a little bit. Thank you.
We’ll see that this is the start of the chain. It’s from Gareth Jenkins addressed to “All”, and he says – he start the conversation.
“I’ve put together a note on events generated within Horizon and those currently sent to OPTIP.”
The document is attached.
“I’d appreciate some feedback as to what is required from the MIS system …”
Can you explain what that is, please?
Philip Boardman: Management information system.
Mr Beer: “… for inclusion in the [conceptual design] so that we can include the necessary work in the S80 developments.”
Can you recall what the S80 developments were?
Philip Boardman: Also known as Release 3.
Mr Beer: If we go to the foot of page 8, we can see who that was distributed to. From Mr Jenkins, at the end of February, to Daniel Hawthorne. Can you help us with who he was?
Philip Boardman: I think – so I mentioned various business analysts within Post Office earlier and, by this stage, others had got involved, so Daniel Hawthorne was one of them, Ben Gildersleve was another.
Mr Beer: To Clive Read, copied to Dave Parnell, you and Bob Gurney?
Philip Boardman: Yes.
Mr Beer: Then if we scroll up the page, please, keep going on to page 7. Mr Jenkins sends out a further email, this time to Ben Gildersleve, copied to you Bob Gurney, Clive Read again and adding Tony Utting. Who was Tony Utting?
Philip Boardman: I think another of those business analysts that I mentioned earlier, Daniel Hawthorne, Ben Gildersleve, Tony Utting. I think Tony may well have had have come from Retail Line but still have some reports into Retail Line.
Mr Beer: Are you saying that from memory or?
Philip Boardman: From the way – I’ve read this conversation, so from the style of – where he takes this conversation suggests he was probably more interested in Retail Line management process.
Mr Beer: Do you think he might have come from security in fact?
Philip Boardman: Maybe, yes, Retail Line or security. I’m sorry, I don’t – I’m not really sure of the full distinction that Post Office made of those processes – those functions, rather.
Mr Beer: In any event, Mr Jenkins said:
“Following our conversation [Ben Gildersleve].
“You have indicated that there is a requirement to reprint old reports, so we potentially need to either store the raw data for a sufficient time to do this, or change the mechanism by which we produce reprints such that we store the original report and reprint the report rather than regenerate it. It is proposed that we do the latter.”
Can you help us with the context here, what the issue was and what was being asked?
Philip Boardman: So I think that what was being asked for was reprints of reports from – because the trading period was going to a 4-4-5 monthly period, the – and I mentioned earlier about the – it’s a retention limitation of the – within the branch. If you wanted to reprint previous branch trading statements, then they would – depending on – we’re trying to work out what the requirement is for how far back we need to go, and if it goes back more than one previous branch trading statement or possibly two, depending on the time of the trading period that you ask for, then unless we were to – the Horizon System were to store the reports, it wouldn’t have the data to recreate the report.
Mr Beer: What are the reports being referred to?
Philip Boardman: I think the well, there’s the list there: cash account reprint; office weekly counters revenue schedule reprint; office weekly Inland Revenue Tax Credits reprint; all of those, Track and Trace –
Mr Beer: Why was there a requirement to reprint old reports?
Philip Boardman: Well, so whether it was security or Retail Line, when someone like Tony went along to the branch to discuss, presumably, on the basis of some sort of perceived problem, they’d want to go and review what actions had been done to manage the accounts. So these – the requirement had come out that these needed to be reprinted as part of those review discussions.
Mr Beer: Mr Jenkins says underneath the bullet points, if we scroll down a little bit:
“I’ve copied this to Tony …”
That must mean Tony Utting.
Philip Boardman: I believe so, yes.
Mr Beer: “… in case he has any input to the requirements here from the security viewpoint.”
Can you recall, in the course of this discussion, were any of the legal teams from POL or Fujitsu involved in the discussion as to what documents ought to be retained or reprinted, as it’s described, for the purposes of audit investigation or prosecution?
Philip Boardman: No, I can’t recall any involvement.
Mr Beer: You can’t recall any such involvement?
Philip Boardman: No, I can’t recall any involvement.
Mr Beer: What is clear here though is that POL is saying that it needed to be able to access some raw data after the completion of a branch trading statement.
Philip Boardman: Well, now I think this is for getting reports from previous periods. So it’s not the raw data that they’re wanting access to; it’s the reports of – if you’re there in March you might want to go and look at February and January’s trading statements.
Mr Beer: But, okay, put my use of the phrase “raw data” to one side. Some previous data.
Philip Boardman: Indeed, yes.
Mr Beer: Does that mean that anyone copied in on this chain or reading this chain would know that the data produced by Horizon could be used to investigate the potential liabilities of subpostmasters to repay it?
Philip Boardman: I suppose so, yes.
Mr Beer: And their potential for civil or criminal proceedings to be taken against them on the basis of such data. That’s why you want to look backwards?
Philip Boardman: Yes, or, like I say, I wasn’t sure whether Tony was – when you referred to as security or retain line, whether that’s about going and helping the subpostmasters or investigating them.
Mr Beer: I think we’ll, in the –
Philip Boardman: In some respects it doesn’t matter. I agree.
Mr Beer: When we go up the chain we’ll see whether his viewpoint was to help them.
Two options are identified in this email, is that right: either keep the data for a sufficient time or create a process where reprints are stored rather than regenerated from the original; is that right?
Philip Boardman: Yes, that’s the potential options for the solution that Gareth is identifying.
Mr Beer: If we go to page 5 of the email, please, and look at the foot, we’ll see a reply from Mr Gildersleve to Mr Jenkins and we’ll see the copy list is the same, I think.
Philip Boardman: Mm-hm.
Mr Beer: Then scrolling down to see the body of the email.
“Gareth
“My requirements are to keep all the reports below with reprint facilities, except perhaps the redeemed savings stamps, depending on what happens with the remittance transaction for dockets and vouchers. Also, I assume the Cash Account reprint will become the Branch Trading statement reprint? I would also like copies of the Cash Variance report to be available as well. You’ve picked out the reports with the reprint in their title, but are there any others? I’ve checked with John and he can’t think of any.
“I would like reports to be available from Period 1, until the end of Period 2. Then when the Branch rolls into Period 3, the reports for Period 1 become unavailable. I would like the reports to be available quickly and easily, so whichever is the best solution to do this is fine with me. If the idea of storing the report is the best for speed of production, but is hugely expensive then come back. I’m sure Dave and Clive will have a view on this.
“If you want to check anything today come back to me, but next week I’m off”, et cetera.
Philip Boardman: Mm-hm.
Mr Beer: So this is essentially Mr Gildersleve indicating to Mr Jenkins his requirements.
Philip Boardman: And presumably the requirements that he’s found from other parties in Post Office.
Mr Beer: It appears that the priority here for the Post Office appears to be speed of production, yes?
Philip Boardman: Yes.
Mr Beer: But costs as always may be playing a role in decision making?
Philip Boardman: Indeed. And, as we discussed earlier, there’s a potential very large cost if large numbers of counters have to be – have their disks upgraded.
Mr Beer: There doesn’t appear to be a discussion in this thread as to whether retention of data itself may be a preferable option over reprints of earlier reports?
Philip Boardman: I think that discussion was going on separately at the same time. I think there were, you know, how long can this be – this be?
Mr Beer: Again, there doesn’t appear to be any discussion here about what might happen if there were defects, errors or bugs in the system that led to errors in the original report, which is now being kept as a reprint?
Philip Boardman: Indeed not.
Mr Beer: Again, in the context of this discussion, did anyone turn their mind to the potential for the system to have bugs, errors or defects within it?
Philip Boardman: Not to my knowledge.
Mr Beer: If the system did have bugs, errors and defects within it, would the raw data, as I’ve called it, been a useful tool to have retained in order to be able to investigate that issue, as opposed to a reprint of a report produced on the basis of flawed data?
Philip Boardman: This is a requirement for reprints in the branch. The raw data was being retained back at the data centre.
Mr Beer: But for the subpostmasters –
Philip Boardman: But for the subpostmasters, yes.
Mr Beer: Can we turn to page 3 of this document or this chain. Halfway down, we can see an email from Bob Gurney to John Dutton. Can you help us what Mr Dutton did?
Philip Boardman: I think – sorry, I don’t know. I think he must have been – well, does it mention Ben’s on leave? He must have been standing in for Ben whilst he was on leave.
Mr Beer: So an equivalent?
Philip Boardman: Presumably, yes.
Mr Beer: He says, if we scroll down a little bit, we’re to come to you, essentially, for guidance. Then topic 1, “Horizon Events to be Accessible”, I’m going to skip over that, and go over the page topic 2, “Branch Reporting”. At 2.1, “Reporting on ‘Previous’ Trading Periods”:
“Ben’s email below confirms the requirement to be able to produce reprints of the following reports relating to the previous trading period …”
Then they’re listed.
“We understand that these are the only reports that are required to relate to a ‘previous’ trading period. We are currently investigating how we can cost effectively meet this requirement, given that the underlying transaction data will no longer be available to recreate the reports.”
What does that mean, “the underlying transaction data will no longer be available to recreate the reports”?
Philip Boardman: I presume he’s replaying the options that Gareth outlined at the start of the thread, where data for previous trading periods will have been purged from the system, and so – and this – “currently investigating” is effectively saying we’re thinking about the second option, the storing of reports for reprinting.
Mr Beer: It appears to confirm, does it not, that there’s no plan to retain the raw data from which a branch trading statement could be produced, correct?
Philip Boardman: Yes. Well, yeah. I think the “currently investigating” is, it’s not definitive, is it?
Mr Beer: Would you agree that it also suggests that the retention or creation of this kind of audit trail data wasn’t accounted for or budgeted in the initial contracting and negotiations over the IMPACT Programme?
Philip Boardman: I think so. I think the IMPACT Programme – the expectation in those initial was that Horizon would be changed to support the other system developments but the main investments were to be other system developments, the financial system, upgrading SAPADS, MI system and updates to the reference data systems.
Mr Beer: Can you help, to your knowledge, did it remain a responsibility for Fujitsu that the system should be able to produce reliable audit data for production to POL so that it, the Post Office, could comply with the evidential requirements of the criminal law?
Philip Boardman: Not to my knowledge. I don’t know whether that was – I’ve seen from previous parts of the Inquiry that that was something originally there. I don’t know whether it was still there then.
Mr Beer: Was it a discussion within the context of this conversation?
Philip Boardman: No, it wasn’t.
Mr Beer: So the requirement on Fujitsu, if it still existed, to produce material to a sufficient evidential standard for use in criminal proceedings wasn’t a discussion that occurred in, to your knowledge, in the context of the IMPACT Programme?
Philip Boardman: No.
Mr Beer: Can we turn to page 2 to of the email chain, please. We can see that Mr Utting reduces the distribution list to just Bob Gurney and John Dutton. So that’s essentially cutting out Fujitsu; is that right?
Philip Boardman: No, Bob Gurney’s Fujitsu –
Mr Beer: I’m so sorry, but cutting out number of people including you?
Philip Boardman: Indeed, yes.
Mr Beer: He says, Mr Utting:
“I am a little unsure about the query around interim trading statements.
“In the case of an investigation, we would need to be able to go into an office and complete a full office balance which in the absence of a cash account would mean a Trading Statement would be required to provide a full office view.
“If we then close the office down having removed an offender …”
The offender being the subpostmaster; is that right?
Philip Boardman: Presumably, yeah.
Mr Beer: “… and the Retail Line replace the subpostmaster and this happened mid-period, then the office would need to produce another Trading statement as usual at the end of the trading period.
“I am not sure that the second Trading statement would need to have the data from the first included in this case, but we would need to be able to produce the two statements within the same period.
“I believe we also discussed doing something similar for office where there was a large variance, in order that the postmaster was able to get a view of his office situation after checking his stock and cash, but this could be achieved through balancing all of the individual stocks and then doing an office snapshot presumably.”
“If I am confused and have got this all wrong, please let me know.”
Does that help you to remember the role that Mr Utting had, perhaps part of the security team within the Post Office?
Philip Boardman: Perhaps. Like I say, I wasn’t sure whether that was security or Retail Line, but …
Mr Beer: Now, although you’re excluded from this chain at the moment, you’re then copied back in to the chain which included this email. Mr Utting is here spelling out the need for the Post Office to have access to the data he’s talking about in order to support his investigations of subpostmasters; isn’t he?
Philip Boardman: Well, I think he’s moved the conversation on, actually. So rather than –
Mr Beer: He’s talking about whether there’s a replacement?
Philip Boardman: Well, where he’s sort of describing his process for putting in a replacement would be to roll over previously a cash account, to give the replacement a clean start, a balanced office to begin with. So –
Mr Beer: So the offender has been removed.
Philip Boardman: It would appear to be the process that Mr Utting is describing, yes, and the process at that stage was to run a cash account but with lengthened trading periods, then running a mid-period trading statement had the potential of causing problems with when the next trading statement was required.
Mr Beer: To your knowledge was there any discussion over what data do security need when they conduct an audit or an investigation in order to establish whether a subpostmaster has committed any wrong or not, or was the focus on how do we clean the slate for the new guy that’s being brought in, which is what this email tends to suggest.
Philip Boardman: I presumed that the emails – the previous emails in this email chain was looking at the former but that’s a presumption from reading between the lines in the email chain and this – like I say, this has moved on to talking about the latter, the creating a clean slate.
Mr Beer: On page 1 of the email, if we scroll right up – sorry, a little bit towards the bottom, my mistake, thank you – Mr Gurney –
Philip Boardman: Forwards that to Gareth and myself.
Mr Beer: – sends it to Gareth Jenkins but copies you in. Please could you cast your eye over the following draft response to Tony [Utting].”
So this is an intra-Fujitsu conversation?
Philip Boardman: I think so, yes.
Mr Beer: Is that right?
Philip Boardman: Yes, it is. Yes. There’s only –
Mr Beer: There’s only three of you party it to –
Philip Boardman: There’s only –
Mr Beer: – all Fujitsu.
Philip Boardman: – Fujitsu involved in this conversation and it looks like Bob is coming to ask Gareth and myself to check a response to Tony Utting’s email to him.
Mr Beer: He says the draft response could be:
“The production of the Branch Trading Statement takes place following successful completion of all of the ‘end of trading period’ activities required before the branch rolls over to the next trading period, eg [stock unit] balancing activities, resolving variances, making good, clearing dockets, etc. On completion of the statement, all trading across the branch is performed in the next trading period.
“We had understood that Ben’s requirement for an ‘interim’ Branch Trading Statement was to obtain a local branch management view of the branch trading position during a branch trading period, ie not to roll over to the next trading period. Currently the Office Snapshot Report is used for this purpose and there is no ‘interim’ Cash Account facility.
“So, if I have understood your concern correctly, I suggest we need to consider what your current process is. If you currently produce a Cash Account and roll the branch over to a new [cash accounting period], then you will be able to do the equivalent with the Branch Trading Statement, ie this is not the situation we had assumed was meant by Ben’s ‘interim’ statement. If, however, you currently use the Office Snapshot to assess the branch position, then you would continue to do so at S80.
“So in summary, I suspect that your requirement will be met by producing additional Branch Trading Statements. This will have no effect on the back-end accounting system which will run from the daily trading summaries produced by Horizon and not the trading statement which is different from the current situation where CBDB is driven directly from the Cash Account. The daily trading summaries used by POL-FS will include the results of any changes needed to balance the branch, address variances, processing of Transaction Corrections, etc.”
Can you decode what he is suggesting, please?
Philip Boardman: Um, so I think Tony had moved the conversation on from reprints to an interim branch trading statement. Bob had explained – Bob’s trying to explain here how an equivalent to an interim branch trading statement, without rolling the branch, could be performed, but pointing out that the alternative is to roll over the branch.
And I think he’s looking to try to elaborate Tony’s requirement further and give Tony options for what he might want – Post Office might want.
Mr Beer: Was it the case that daily summaries were fed to POL-FS by Horizon?
Philip Boardman: Would be, POL-FS didn’t exist by this stage, but it would be. That’s the design, yes, I think.
Mr Beer: So the daily trading summaries fed back to the back end accounting systems in POL –
Philip Boardman: Effectively, that’s –
Mr Beer: – hold on –
Philip Boardman: Sorry!
Mr Beer: – could be providing different figures to those in the branch trading statements?
Philip Boardman: Sorry, which – the daily trading summaries that would go to POL-FS would be the same daily trading summaries that would previously go into OPTIP and I don’t know where you – which bit of this that you’re meaning how it could be different to …
Mr Beer: Well, Mr Gurney is suggesting, isn’t he, that the production of additional branch trading statements ought not to affect the process of altering the summaries by including changes needed to balance the branch?
Philip Boardman: Sorry, I don’t –
Mr Beer: You don’t read it that way?
Philip Boardman: – understand what he’s trying to say there. I think the next thing is that Gareth explains why this isn’t a good idea to propose this.
Mr Beer: Let’s look at the top of page 1, then, and see Mr Jenkins’s reply. Again it’s a conversation between the three of you. Mr Jenkins, Mr Gurney and you:
“I’m happy with the proposed response to Tony, however this raises some interesting questions:
“Consider the following scenario:
“A branch is considered by Tony to be ‘Dodgy’ and he goes in there one week into a 5 week trading period (say period 2). Then roll the branch into period 3, which is a 4 week Trading Period. For the next 4 weeks, the new staff will get a warning message at each log-on indicating that they are running in the wrong Trading Period (is that acceptable?). At the real end of the Trading Period, there is no need to roll over the branch since it is already in Period 3, this makes Period 3 an 8 week Trading period. After 6 weeks we start losing Transactions!”
Just asking a few questions about that paragraph there and your knowledge of it. The “After 6 weeks we start losing Transactions”, to what is that a reference?
Philip Boardman: That’s a reference to the changed data retention policy that had been specified somewhere in some requirements.
Mr Beer: Within IMPACT?
Philip Boardman: Within IMPACT, yes, and so – which I thought was 45 days, but I guess that’s six weeks and a bit.
Mr Beer: So his concern is what happens if there’s a problem, transactions are lost because of the disruption policy and the trading period continues on rolling on for a number of weeks?
Philip Boardman: Indeed. And, as he indicates there, in the meantime, users will be warned that they’re running in the wrong trading period. They’ve rolled over too soon.
Mr Beer: Now, despite saying that it raises some interesting questions and posting a scenario, Mr Jenkins says that he’s happy for the response that had been drafted to go to Post Office; yes?
Philip Boardman: Yeah.
Mr Beer: So what happened next?
Philip Boardman: Um, I think it was raised to Clive and as – one of the email chains that you sent me last week has some level of resolution, I think, where I proposed that that these interim trading period – interim cash account things could be performed by some rewriting of procedures.
Mr Beer: The last line there:
“Is it one for Clive? (It clearly isn’t one for Tony – unless we have to constrain what he does!”
What did you understand that to mean, the constraining what Tony Utting might do?
Philip Boardman: Presumably it’s a case of feeling that this had to be raised to the appropriate level of authority, and I don’t know why constrain Tony, but I think it might well be something to do with the fact that to any appears to be coming out with new requirements, and new requirements at this stage, close to finalisation of the conceptual design document, where once we’d got to an approved conceptual design document, we’d turn that into a proposal or a design proposal against it, new requirements are, you know, dangerous with – you know, represent scope creep.
Mr Beer: You’ve rightly mentioned that this email chain progresses and ends up with a discussion about the implications for a new subpostmaster installed in a post office when the previous offender had been identified as “dodgy” and has been removed, using the language of the email chain –
Philip Boardman: Indeed.
Mr Beer: – and the implications for them of the loss of transaction data. Was there ever any discussion about the implications of the loss of transaction data that might be important for the investigation of the offender in the dodgy Post Office?
Philip Boardman: I don’t think so. I don’t recall any.
Mr Beer: We need to retain some data in order properly to be able to investigate a person who has been suspended, had civil proceedings taken against them or is criminally prosecuted: was that ever, in the many months that you were involved in this project, the subject of discussion?
Philip Boardman: I don’t believe so.
Mr Beer: Can we move forwards, please, to the IMPACT 3, Release 3 design proposal, and look at POL00038903. Thank you very much.
You’ll see the title to this document “Fujitsu Services IMPACT Release 3 – Balancing and Trading Statement Production User Interface” and the date of the document, it’s version 1 dated 18 August 2004.
So this is a design proposal for the user interface; is that right?
Philip Boardman: A part of the user interface, yes.
Mr Beer: Thank you. Part of the user interface involved in balancing and producing a branch trading statement under the revised IMPACT Release 3?
Philip Boardman: That’s right.
Mr Beer: Now, it’s a very detailed document, it’s 72 pages, and includes descriptions of the changes to the processes and the screens that would be seen by a subpostmaster under the new design, under of the new process?
Philip Boardman: Mm-hm.
Mr Beer: Now, I think we can see from this page that there were a number of people involved in the design, but that you, along with Peter Jobson – Pete Jobson – were the contributors; is that right?
Philip Boardman: We were the contributors, Roger Donato was the author.
Mr Beer: What role did Pete Jobson perform?
Philip Boardman: So I think Pete may well have been – provided knowledge of the existing flows and interface. So that – we’ll see, I’m sure, in the rest of the document, there is a lot of flow diagrams and a lot of screenshot images with notes around them saying, “This needs to change to this and that should change to this”, that sort of thing. I think Pete will have provided those screenshot images and may well have provided the flows for the – the flow diagrams of the existing user interface for producing cash accounts, rather than trading statements.
Mr Beer: Can we look at page 71 of the document, please, which deals with “Local Suspense” under paragraph 4.7.4. If we just read it together:
“One of the steps in the rollover process is to check the variances (discrepancies) and to warn the clerk of their value. There are various ways he may be able to correct them but if all else fails he will commit the discrepancy …
“When the stock unit is rolled over into a new Trading Period any discrepancy is written as a transaction to one of two new products Gain to Local Suspense or Loss to Local Suspense. (This will later appear on the Branch Trading Statement as Discrepancy OVER Transferred or as Discrepancy SHORT Transferred for that stock unit).
“When the last stock unit is rolled over into a new Trading Period the system will calculate the net figure for local suspense across all the stock units in the Branch. Only if this value is zero will the clerk be able to roll this stock unit over into the new Trading Period. Otherwise, if the value is not zero the clerk will be warned of the amount and whether it is a gain or a loss on the screen shown in [a figure].
“The Manager/Supervisor may choose to investigate further by printing the suspense report but if he is prepared to accept the figure then he can clear the local suspense immediately by using the screen in Figure 13 – Settle Local Suspense Screen: the value will be moved automatically from Local Suspense into his stock unit. (This will then appear on the Branch Trading Statement as Discrepancy OVER Resolved or as Discrepancy SHORT Resolved for that stock unit).”
That I think involves the subpostmaster making a payment; is that right?
Philip Boardman: So far we’ve only got to the subpostmaster accepting a discrepancy from other stock units posted into local suspense into their stock unit, where they may then take action to resolve it.
Mr Beer: I’d understood he can clear the local suspense immediately by using the screen “Settle the local suspense” as meaning settle by paying?
Philip Boardman: No, it then says, “Moved automatically from local suspense into his stock unit”. So what that’s doing is – local suspense was really just a convenient way of moving discrepancies around from stock unit to stock unit. Ultimately, the intention was that the last stock unit would take that into the stock unit and resolve it in whichever method was chosen, make good, move to suspense or choose not to roll over, as we discussed earlier.
Mr Beer: Continuing, then:
“If the Manager/Supervisor decides to investigate further he delays rollover until his investigations are complete.”
This is still in branch; is this right?
Philip Boardman: Indeed, yes. So the roles in – because it sort of uses the term “clerk”.
Mr Beer: On one hand, and manager/supervisor on the other; is that right?
Philip Boardman: So users when they’re created in Horizon can be given one of either manager/supervisor or clerk user access set of permissions. I think, in the previous uses of “clerk” they mean clerk or manager or supervisor. The last stock unit could only be rolled over by the manager or supervisor.
Mr Beer: So:
“If the [Manager] decides to investigate further he delays rollover until his investigations are complete. He may decide to use other options on the Housekeeping menu to process the suspense or he may decide that he wants to settle some local suspense via cash payment and the remainder by some other option. Two new buttons ‘Gains from Local Suspense’ and ‘Losses from Local Suspense’ will appear on the Housekeeping menu which can be used by the Manager to clear amounts of local suspense for the whole branch: (these will be done by clearing to cash). These buttons will return a screen similar to that in [a figure].
“If the Manager processes the Branch local suspense via the Housekeeping menu the clerk will have to redeclare his cash before rolling over the stock unit.”
This mentions a manager deciding further to investigate.
Philip Boardman: Indeed.
Mr Beer: Can we go to paragraph 4.2.11, please, which is on page 50, “Local Response Outstanding for Branch”:
“This is a new screen for IMPACT Release 3, which may be returned if the clerk touches the Next [Trading Period] [F1] button on the screen in Figure 9 …”
Then if we scroll down underneath the figure:
“There will be alternative ways to resolve the Suspense total …”
The first:
“If user is a Manager/Supervisor who wants to resolve it immediately he may touch Continue to return the screen in Figure 13 … Local Suspense …”
Then option 2, over the page, please:
“Alternatively, further investigation may be required; so the clerk touches Cancel to cancel the rollover and the counter returns to the Stock Unit Balance Menu. (Two new buttons, ‘Gains from Local Suspense’ and ‘Losses from Local Suspense’ will appear on the Housekeeping Menu and can also be used to process the Local Suspense).”
The evidence that the Inquiry has heard from a range of subpostmasters in Phase 1 of the Inquiry was that there was effectively this choice available to them and an inability to challenge any discrepancy through the use of the system. They were forced, whether effectively to continue trading or not, by settling. Does this design proposal broadly reflect that position?
Philip Boardman: I don’t think so, but I think it depends on how this was presented to subpostmasters, I presume. But I think the intention was that this was a convenient way of – so local suspense was a convenient way of moving any discrepancies in stock units from stock unit to stock unit. I think – can we scroll up so we can see the screen?
Mr Beer: Yes, figure 12.
Philip Boardman: Indeed, figure 12. So in order to get to that screen, you will have to have – in this last stock unit, to rollover, you’ll have to have performed all the actions of balancing that stock unit, which would have involved printing all of the reports, performing a stock, which included the suspense account report, which included the local suspense element so that you would know whether there was something in local suspense at this point. You’d have done your stock unit – stock declaration for the stock unit, you’d have done a cash declaration for the stock unit, both of which would have told you whether there were any discrepancies in that stock unit, which may or may not have cancelled out the discrepancy in the local suspense by this stage.
So if you got to this screen – sorry, and before you got to there, you’d have selected to roll over the suspense account, and so if you got to that screen and didn’t know that there was something in local suspense, then you ought to have done, I think, is the –
Mr Beer: But on the face of it, this presents you with a binary option, this screen, doesn’t it?
Philip Boardman: If you get there.
Mr Beer: You can either pay up –
Philip Boardman: Well, although there’s always the –
Mr Beer: Hold on.
Philip Boardman: Sorry.
Mr Beer: You either pay up, touch “Continue” to settle local suspense or you “Cancel”, in which case you cannot roll over?
Philip Boardman: Well, you can cancel, in which case you can then go to post to suspense or one of the suspense products that are still remaining after this. But …
Mr Beer: This appears to present a binary option: pay-up or don’t rollover?
Philip Boardman: Well, “Cancel” takes you back to the housekeeping menu on which there are buttons for suspense account, rolling over, making good.
Mr Beer: How could you roll over if this is preventing you from rolling over?
Philip Boardman: Well, you’d have to resolve the discrepancy first, but –
Mr Beer: By paying up –
Philip Boardman: By cancelling and – either choosing to pay up or transferring to suspense, contacting NBSC and saying – raising –
Mr Beer: Getting on the phone?
Philip Boardman: Indeed.
Mr Beer: Saying, “There’s a discrepancy I can’t explain”?
Philip Boardman: Indeed.
Mr Beer: What was the procedure provided for in this document for the investigations that then would to be conducted?
Philip Boardman: I don’t know. That’s Post Office procedures.
Mr Beer: Do you know what investigations managers were expected to conduct if they believed that a failure to balance was the result of an error, including an error caused by Horizon?
Philip Boardman: No, I don’t.
Mr Beer: What was to happen to trading at the branch whilst any such investigations were conducted?
Philip Boardman: Well, depending on what those investigations were, either the – this discrepancy would have been transferred to suspense and trading would carry on or the – that last stock unit wouldn’t roll over but all the other stock units would have rolled over and trading would carry on in those stock units and whoever was logging on to this stock unit would have been warned that they were trading in the wrong trading period.
Mr Beer: We saw that I think this document had been approved by Mr Jenkins.
Philip Boardman: Mm-hm.
Mr Beer: Maybe if we just go back to the beginning. Page 1, sorry. I may not have highlighted it at the time. If you just scroll down, please. Approval authorities, Gareth Jenkins. Can you see that?
Philip Boardman: Yes.
Mr Beer: In the approval process, to your knowledge, did Mr Jenkins raise any concerns about discrepancies or variances that might be caused as a result of any bugs, errors or defects within Horizon itself?
Philip Boardman: I don’t know. I wasn’t involved in the review process of this. I’m marked as a contributor but don’t believe – I’m not one of the reviewers, so I think I had conversations with Roger Donato and Pete Jobson to put input into this document but I’m not on the review list. I didn’t review it or – I think I may, because, like I said, there are flow diagrams and screenshots of – I may well have arranged because I was the sort of key link to Post Office.
So I may well have arranged meetings with Post Office business analysts to review early drafts or – you know, or review the content to go into this document, but I don’t think I reviewed this document. I don’t think, you know.
Mr Beer: Just help me: you contributed to it?
Philip Boardman: I think I may well have, you know, reviewed some of the input into the flow diagrams, the – possibly the screenshots, but I don’t think I would – I didn’t review the document.
Mr Beer: But more generally, when we’ve gone through each of the documents, I’ve asked you at each stage whether anyone raised the issue: Horizon has historically had some problems in its operation; it may create data that can’t always be relied on; we ought to take account of that in the systems that we’re now designing so that harm isn’t caused to people.
Philip Boardman: It wasn’t raised, wasn’t discussed.
Mr Beer: Do you know why?
Philip Boardman: I don’t.
Mr Beer: You’ve said that all systems have errors, bugs and defects?
Philip Boardman: I believe so.
Mr Beer: And all systems have errors, bugs and defects that are capable of producing faulty data?
Philip Boardman: Probably, yes.
Mr Beer: Was even that level of consideration, never mind the actual knowledge that some people had as to the difficult birth that Horizon had had, was even that level of consideration brought into account in the design of these new systems?
Philip Boardman: Well, yes, like I say, I believe there were always options there in terms of going back and, you know, raising this as a disputed discrepancy.
Mr Beer: How would the subpostmaster effectively do that?
Philip Boardman: I don’t know. That would be – that would rely on Post Office’s processes.
Mr Beer: Sir, that might be an appropriate moment for the afternoon break. Could we take just ten minutes, please?
Sir Wyn Williams: Certainly, yes, ten minutes. What time is that, so we’re going by the same clock?
Mr Beer: Say 3.20, please, sir.
Sir Wyn Williams: Fine. Thank you.
(3.09 pm)
(A short break)
(3.23 pm)
Mr Beer: Good afternoon, sir can you see and hear me?
Sir Wyn Williams: Yes, I can.
Mr Beer: Thank you very much, can we turn to a different topic now, Mr Boardman, please, and look at POL00038866. You’ll see this is version 2 of the conceptual design document for Release 1 of the Accounting & Cash Management Programme. Could I invite you just to look at the bottom of the page. You’ll see the authors, the sign-offs and the delivery manager. Is this a POL document, a Post Office document?
Philip Boardman: Yes.
Mr Beer: Would it have been shared with Fujitsu at the time?
Philip Boardman: Did it say Release 1?
Mr Beer: It did.
Philip Boardman: Probably not. It may have been but I can’t recall it particularly. I think Release 1 was mostly Post Office things. There were some changes to SAPADS. Oh, Release 1 may well have included auto remittances, so it may well have been but –
Mr Beer: Just have look at the fourth page, please. If you look at the top box, the contributors include you.
Philip Boardman: Indeed.
Mr Beer: So does that mean you would have had sight of the document at some point?
Philip Boardman: It may have done, I may have contributed, because there was an accounting in cash management but not for Release 1, general conceptual design, I believe, that this may have come from, that I was involved in, so –
But I don’t have a recollection, if you – but if there are particular things you’d like to discuss, I’m quite happy to.
Mr Beer: I just want to understand, to start with, where this document sat between the Post Office, on the one hand, and Fujitsu and the other, and whether it was a Post Office creation or a Fujitsu creation or a joint production?
Philip Boardman: So we talked earlier about the end-to-end feasibility study, and we talked at length about the Fujitsu proposal to that. At some point – sorry, I’ve got a reference. This was 3886 something, did you say? POL000388 –
Mr Beer: 66.
Philip Boardman: So there’s a POL00038870 document that was accounting and cash management programme, but not just for Release 1; it was a generic conceptual design for the entirety of the IMPACT Programme at that stage, which was then – so this presumably has been split out from that, and but also – so that’s something that Post Office were producing at that stage. And then later, the two documents, the ones that we – POL00038878, that’s the Branch Trading Conceptual Design, and the reference –
Mr Beer: For the moment, Mr Boardman, all I’m trying to establish is whether, at the time, anyone in Fujitsu would have seen this document?
Philip Boardman: I’m sure someone in Fujitsu saw it. I just can’t recall whether I did.
Mr Beer: When you’re listed as a contributor, how would you contribute to the document without seeing it?
Philip Boardman: So because I was involved in the programme before this was produced.
Mr Beer: So if you’re generally involved in a programme, you could be listed as a contributor to a document, could you, even if in fact you made no contribution to it?
Philip Boardman: I’d have to see the document. I can’t recall the document in particular.
Mr Beer: Can we approach it from a different angle, then. You see underneath the contributors, in terms of distribution of the document, there is “Post Office distribution” and then “supplier distribution”. The supplier would be Fujitsu; is that right?
Philip Boardman: Well, if this is Release 1, I think the main changes there were in SAPADS, with some changes in Horizon.
Mr Beer: Would Fujitsu be a supplier?
Philip Boardman: A supplier, yes.
Mr Beer: If we go over, it says, “As per review details”. If we go over two pages to the review details. The top box, please. “Supplier Review” is listed Gareth Jenkins, Bob Gurney and Bob Cragg. Does that suggest that somebody within Fujitsu reviewed the –
Philip Boardman: Gareth Jenkins, Bob Gurney –
Mr Beer: Hold on.
Philip Boardman: Sorry.
Mr Beer: Does that suggest that somebody within Fujitsu, namely at least Mr Jenkins and Mr Gurney, reviewed the entirety of the document?
Philip Boardman: Yes.
Mr Beer: Right. Good. We can now look at the document, then. Can we go to page 24. This is part of a list of the programme requirement descriptions, and I think that’s what “RD” stands for; is that right?
Philip Boardman: I don’t know.
Mr Beer: Requirement description?
Philip Boardman: I don’t know. So the other document that I was referring to earlier, that also had “accounting and cash management programme” but not “Restricted to release on conceptual design”, had a number of requirements in there which had different starts. So they weren’t all RDs; they were all – so, I don’t know whether RD is something to do with this area or whether RD is just generally a requirement description.
Mr Beer: Well, I’ll just call it number 38, then?
Philip Boardman: Indeed, yes.
Mr Beer: Rather than Requirement Description number 38. Number 38:
“Operation staff need to have direct access and visibility to the system to enable them to maintain network records.”
Can you help; what would “operation staff” mean for these purposes?
Philip Boardman: Without context, could be anything. It could be people in – like I say, I think this is to do with – this particular area is mostly to do with SAPADS, and so it could be people in cash centres. We were never really involved in making changes to SAPADS, and so these could well be requirements for SAPADS.
Mr Beer: Can we look, please, at page 25, and look at the foot of the page and look at number 59:
“Remote access for data entry is required.”
Do you know what that refers to?
Philip Boardman: No, I don’t think so.
Mr Beer: Page 26. Number 64:
“Both internal and external access will be required, eg POL and Fujitsu.”
Do you know what that refers to?
Philip Boardman: I don’t know what access is being talked about, which system it’s – so, for example, you can see just at the bottom of the page there, you’re asking me about RD64, that’s fine, but MIH, that’s not an RD. That’s talking about – I think that – I’m guessing that would be about the management information system. So these are requirements for different systems, I think, is what RD – but I don’t know which system RD is asking a requirement about.
Mr Beer: Maybe if we just go back, then, to page 23. The reason I suggested that RD might refer to requirement description is that the heading –
Philip Boardman: It’s reference data.
Mr Beer: Sorry?
Philip Boardman: It’s the first one, RD001, it’s reference data.
Mr Beer: So it’s not the requirement description at the top there?
Philip Boardman: No, it’s talking about – these are requirements for the updated, changed, new Reference Data System, which Post Office were specifying for Prism Alliance.
Mr Beer: So operation staff would need to have direct access to reference data; is that right?
Philip Boardman: I presume that’s what that is saying, yes. I think –
Mr Beer: And –
Philip Boardman: Sorry to interrupt, but as you scrolled back past there, it said something about NBSC requiring data as well. So reference data, amongst all of the information about products, also had all sorts of information about branches, branch data. So Subpostmaster contact details, and things like that, and that’s presumably the sort of thing that NBSC would be looking for.
Mr Beer: Looking at the question more broadly, then, what remote access to reference data did you understand Fujitsu had?
Philip Boardman: I’m sorry, I don’t know. I thought our only access to the Reference Data System was via an interface. So Post Office managed the reference data in their reference data systems, and we had an interface to feed the data to our reference data management system that was used to – or still is used, actually – to verify the reference data. And when I say verify, we can’t verify that the data is correct, but we can verify that it’s formed in the correct way. You know, that it will work as reference data. That it’s not badly specified reference data. So we can test it and then deploy it out to branches.
Mr Beer: We saw that you were working and exchanging emails with Mr Jenkins in the course of the development and implementation of the IMPACT Programme. How long did that working relationship last?
Philip Boardman: All the time I was working with Post Office Accounts.
Mr Beer: When did that end?
Philip Boardman: 2007.
Mr Beer: So for five years or so?
Philip Boardman: Yes.
Mr Beer: In that five-year period, how well would you say you knew Mr Jenkins?
Philip Boardman: He was a colleague. We had a good working relationship.
Mr Beer: Did you work in the same building?
Philip Boardman: No, he was – well, he was originally at Feltham, I think, and then Bracknell. I was based at Crewe.
Mr Beer: You exchanged emails on a relatively frequent basis and attended meetings?
Philip Boardman: Indeed.
Mr Beer: In the course of that five-year period, did he ever discuss with you the provision, by him, of evidence as an expert witness in criminal proceedings?
Philip Boardman: No.
Mr Beer: Were you a party to any discussion over the provision by Mr Jenkins of expert witness evidence in criminal proceedings?
Philip Boardman: No.
Mr Beer: Were you ever party to a discussion as to who was best within Fujitsu to provide expert evidence as to the existence or non-existence, as it turned out, of any errors, bugs and defects in the Horizon System?
Philip Boardman: No.
Mr Beer: Thank you very much, Mr Boardman, for all the help you’ve given us.
Sir, they’re the only questions I ask. I think Ms Page has some questions, not Mr Stein, not from Mr Moloney and not from any other person. So it’s just Ms Page. Thank you.
Sir Wyn Williams: All right, over to you, Ms Page.
Questioned by Ms Page
Ms Page: Thank you, sir. Mr Boardman, can I talk to you about the case of Lee Castleton. Over a nine-week period in early 2004 – so we’re talking about before the rollout of Release 3 or S80, thousands of pounds went into his suspense account. The reason for that was that his counter went haywire, and week after week he experienced very large discrepancies.
He kept meticulous records and he would not sign off on incorrect accounts. So by the end of that nine-week period, £23,000 had built up in his suspense account.
Now you’ve told us that you don’t recall – this was in your witness statement – you don’t recall why the “yes/cancel” screen was decided upon. Does that maybe jog your memory at all?
Philip Boardman: Sorry?
Ms Page: Does that account of Mr Castleton’s experience jog your memory of yes/cancel screen was decided upon as a way of dealing with suspense accounts?
Philip Boardman: I don’t understand the question. The yes/cancel was about choosing whether to roll over or not, and options that were to be presented to the subpostmaster as part of rolling over.
Ms Page: Were your POL counterparts keen to ensure that sums like that, £24,000, didn’t build up over weeks in suspense accounts?
Philip Boardman: I’m sure they would have been keen for that not to happen, but it was never discussed.
Ms Page: Was it not discussed, perhaps, by those advocates of the ‘command and control’ way of doing things?
Philip Boardman: When I discussed – when I described that approach that was internal to Post Office, those discussions – and I didn’t really witness them, by the time decisions –
Ms Page: Not in any of those workshops that you held?
Philip Boardman: I don’t think so, no.
Ms Page: How would the yes/cancel screen have empowered Mr Castleton?
Philip Boardman: So, like I say, the idea was that the subpostmaster would be given some facilities for managing their accounts, accounting for the transactions, and facilities for reviewing and investigating discrepancies, and ultimately mechanisms then for either agreeing them or posting them to suspense.
Ms Page: Once the posting to suspense was no longer an option, as it was for Mr Castleton, how would he have been empowered if his position had been replicated after S80 had rolled out?
Philip Boardman: So I’m not sure that – I don’t know, for Mr Castleton, did you say, sorry? How Network Business Support Centre/Retail Line were managing that situation, but I would expect, by that stage, for it to get to that situation, they would have been, you know, very heavily involved, and those facilities were not changing.
Ms Page: Thank you. Those are my questions. Thank you.
Sir Wyn Williams: All right. Well, I think that concludes the questioning, does it not, Mr Beer?
Mr Beer: Yes, it does. Thank you, sir.
Sir Wyn Williams: Thank you very much, Mr Boardman, for spending the day at the Inquiry answering very many questions. I’m grateful to you.
Mr Beer: Sir, 10.00 am tomorrow, please, with Susan Harding.
Sir Wyn Williams: Yes, of course.
Mr Beer: Thank you very much.
(3.42 pm)
(The hearing adjourned until 10.00 am the following day)