22 February 2023 – Susan Harding and Mark Burley
Hide video Show video
(10.00 am)
Mr Beer: Good morning, sir.
Sir Wyn Williams: Good morning.
Mr Beer: May I call Susan Harding, please.
Sir Wyn Williams: Yes, of course.
Susan Harding
SUSAN HARDING (affirmed).
Questioned by Mr Beer
Mr Beer: Ms Harding, my name is Jason Beer and, as you know, I’m Counsel to the Inquiry. Can you give the Inquiry your full name, please.
Susan Harding: Susan Mary Harding.
Mr Beer: Many thanks for the witness statement you have provided to the Inquiry and for coming along today to assist us with our investigation. Can you look in the bundle in front of you. There should be a copy of a witness statement dated 23 September of last year, which is 8 pages in length.
Susan Harding: Yes, I have found that.
Mr Beer: Can you go to the eighth page, please.
Susan Harding: Yes.
Mr Beer: Is that your signature?
Susan Harding: It is.
Mr Beer: Are the contents of that witness statement true to the best of your knowledge and belief?
Susan Harding: They are.
Mr Beer: A copy of that witness statement will be uploaded to the Inquiry’s website and therefore become public. I’m not going to ask you questions about every part of it, you understand.
Susan Harding: Okay.
Mr Beer: Can we start, please, with your background and experience. I think you were employed by the Post Office for 40 years or so, is that right, between 1976 and 2017?
Susan Harding: I was.
Mr Beer: Do you have any professional qualifications that are relevant to the issues that you know we’re going to discuss and are considering today?
Susan Harding: Yes. I qualified through the Post Office as an accountant so I’m a CIMA.
Mr Beer: For the benefit of those who don’t know, what is a CIMA?
Susan Harding: Chartered Institute of Management Accountant, so it’s more about management accounting than financial accounting.
Mr Beer: When did you become chartered?
Susan Harding: Oh, heavens, I don’t know. Probably about 20 years into my service but I can’t remember the date exactly.
Mr Beer: Was it before Horizon was born?
Susan Harding: Yes.
Mr Beer: When was your first involvement in the Horizon project?
Susan Harding: It would have been in the initial Horizon project – would that have been around 1998 – something like that. I was working in a back office, transaction processing, which was the place that received the cash accounts from the offices and I was in the development team, so I was responsible for interacting with any projects that would affect that unit in the business.
Mr Beer: What was your job title there?
Susan Harding: Head of – I was probably head of development or something like that, yeah.
Mr Beer: Head of development?
Susan Harding: Yes.
Mr Beer: Whereabouts was that office?
Susan Harding: It was in Chetwynd House in Chesterfield.
Mr Beer: Did you manage a team?
Susan Harding: I did.
Mr Beer: How many were in the team?
Susan Harding: I can’t remember now but it wouldn’t have been a vast team. Maybe somewhere between 10 and 20.
Mr Beer: And –
Susan Harding: It depended on what projects we’d got as to how many people we’d have in the team.
Mr Beer: When you first became involved in the Horizon project, what did you do? What was you role?
Susan Harding: I was involved in looking at the impact of that on the business unit that I was working in, and signing off requirements and getting involved in testing and acceptance.
Mr Beer: You were involved in the testing of Horizon?
Susan Harding: Well, I was not actually doing the testing. Some of my team might have been there testing certain things but it was more about the outputs into the back office and making sure that the cash account, which was the output at the time, was still valid and still would represent what would have been normally produced through the manual process or through the other systems that were in place at the time.
Mr Beer: So was this in 1998, 1999?
Susan Harding: It would be around that time, yes.
Mr Beer: In that period, when you were involved, in the way that you’ve described, in the testing of Horizon, were you aware – were you told – that there were errors, bugs and defects with it that affected the reliability of the data that it produced?
Susan Harding: No, I don’t recall that. I mean, we were obviously – in the testing phase you’re looking at outputs and we did get involved in Acceptance Incidents, particularly any that would have affected the integrity of the accounts.
Mr Beer: So moving on to that phase, then, the acceptance phase –
Susan Harding: Yes.
Mr Beer: – if you were involved in Acceptance Incidents, AIs, I think it does follow that you must have been aware of errors, bugs and defects with Horizon that affected the reliability of the data that it produced?
Susan Harding: Well, yes, yes. Obviously, if there’s an Acceptance Incident that’s what tells you that there is a problem.
Mr Beer: Who did you report to?
Susan Harding: Um –
Mr Beer: Dealing with the acceptance phase.
Susan Harding: Well, probably I was linked into Ruth Holleran, but my direct report was Andy Radka at the time.
Mr Beer: Why were you probably linked in to Ruth Holleran?
Susan Harding: Because she was sort of in charge of managing the acceptance process and she worked for Dave Smith at the time.
Mr Beer: What was your job title at this time, when you were involved in the acceptance of Horizon?
Susan Harding: I was just the development team manager in transaction processing.
Mr Beer: You mention a couple of job titles in your statement: head of the operating process and business process architect.
Susan Harding: Yes.
Mr Beer: Did they come later?
Susan Harding: They did.
Mr Beer: What did you do in order to perform your role, accepting the system from an accounting perspective, which is how you put it in your statement?
Susan Harding: Yeah, well, we would see the outputs of testing and we would be – we would – if you’re doing that sort of thing, you’d normally have expected results and then you see what the actual results are for the system and you compare them. Remember that I wasn’t doing the detail here; I was managing a team that was doing that. But that’s a normal acceptance process that you say “What should the system produce and has it produced that?” Yeah.
And that would be initially in the test systems. It would not be in the live environment but, obviously, later – in later phases there would be some acceptance due to some live trials.
Mr Beer: Looking at the matter at a high level of generality, would you agree with the suggestion that the acceptance process for Horizon was extremely problematic?
Susan Harding: I don’t know. You’d need to say what you mean by “problematic”. I think it was challenging. It was a big system, it was complex. But I don’t think – yes, there were Acceptance Incidents but there were processes to make sure that those Acceptance Incidents were closed down to the Post Office’s criteria.
Mr Beer: So by the end of acceptance, everything was fine with Horizon, was it?
Susan Harding: As far as I’m aware. I mean, I’m not, you know, I wasn’t as high up in the chain. I wasn’t – I was only responsible for accepting certain – or getting involved in certain Acceptance Incidents. I wasn’t in the sort of roles that other people were in signing it off.
Mr Beer: So within that limitation that you’ve just described, did you work on the basis that, by the time that Horizon was rolled out, it was producing accurate, reliable and robust data?
Susan Harding: Yes, I would say that. I wouldn’t have signed it off if I didn’t think that was the case.
Mr Beer: Data that could be used in order to investigate, take proceedings against and criminally prosecute an individual?
Susan Harding: Yes, I would have said that, although I – of course, the Network would have been involved in having a say on that. So it wasn’t our role in transaction processing to do those prosecutions or to do that investigation. So we would simply – I suppose my role was simply to say “Are these statements that – or – that are produced” – because it produced a paper – it still produced a paper cash account at that time – “Are the expected results correct?”
Mr Beer: You worked on the basis that they were correct, reliable and the system was robust and infallible?
Susan Harding: In terms of producing those outputs, our evidence was that it was robust. We wouldn’t have signed – I wouldn’t have signed off something that I had any evidence of that it was producing numbers that were not correct.
Mr Beer: That’s slightly self-fulfilling: “I wouldn’t” – “It must have been robust because otherwise I wouldn’t have signed it off, if it hadn’t have been robust”.
Susan Harding: Yeah.
Mr Beer: On what evidence were you working? Who was telling you that the system was robust, that –
Susan Harding: My team, who were –
Mr Beer: Hold on. If we take it in turns, it’ll work better.
Susan Harding: Yeah.
Mr Beer: On the basis of what evidence did you come to the conclusion that the system was robust and was producing data that was accurate?
Susan Harding: Because we would, on a testing basis, have expected results based on the inputs that we’d reviewed that were going to go in. So if we knew what data was going to be put in the test system we would have expected results for what the output would be and our testing would have told us that those outputs were as we expected. And you have to remember, this would have been test systems to start with and then there would have been stuff during – when it went into pilot, et cetera, that we would have been involved in, as well, before ultimately accepting it.
Mr Beer: When did your role in acceptance end?
Susan Harding: I would say when the system went live. When it started to – when it was – well, probably when we finished pilot. We wouldn’t have got involved in anything after that. So we would have been involved in before the first office went live and then, as far as I recall, there was a pilot and we would be reviewing results through that pilot.
Acceptance would have been for it to go into pilot to start with but then there would have been another acceptance phase to actually then roll it out.
Mr Beer: What did you learn about the operation of Horizon in practice after it was rolled out?
Susan Harding: Nothing that – I was not aware of anything that I heard or was told about afterwards that would say it was any different from what we’d seen.
Mr Beer: You weren’t told about one or two people calling up helplines and saying, “We’re having problems balancing”?
Susan Harding: No.
Mr Beer: No?
Susan Harding: No, that wouldn’t –
Mr Beer: Not even a single call?
Susan Harding: That wasn’t really my role that would have been other people in the project team.
Mr Beer: So you worked on the basis that, up until rollout, the system had been got to a place where it was working perfectly well and then you didn’t hear anything adverse about it afterwards?
Susan Harding: No.
Mr Beer: When did you become involved in the IMPACT Programme?
Susan Harding: Right, so you’ve mentioned the other roles I did. So after being in transaction processing, at the head of development, I became head of the operating process and business process architect and, as business process architect, I was asked to redesign other parts of the process. So we still had old, antiquated back office systems. So Horizon was required to produce a cash account and what we wanted to do was put a SAP system into the back end that would take an automatic feed from the Horizon System.
And I’d come up with that all as part of my role as business process architect, et cetera. So as a result of that work that I was done, I was then asked to lead the project to implement that.
Mr Beer: So my question was when?
Susan Harding: I don’t know. Early 2000s. So it might have been three or four years after Horizon had gone live.
Mr Beer: Were you doing anything in relation to Horizon in the three or four years between Horizon going live and picking up what I’m calling the IMPACT Programme?
Susan Harding: Well, not really in that way because, as I say, I went into more future looking roles, which was where I ended up running IMPACT because that was the future – so I was looking into where do we go next because, basically, we’d left the back office as it was. We’d done the hard work on automating the front office but we were left with a back office which was a home developed system that was not – was very clunky, that required paper, you know.
So the whole concept that I developed was to – was to put SAP systems in the back office, which would take a daily feed, ultimately, from Horizon. So we would have the data faster, less effort to do the keying and all those sorts of things.
Mr Beer: Can I confirm that in that three or four-year period you weren’t told of any problems about the reliability and accuracy of the data that Horizon was producing in practice?
Susan Harding: I don’t recall that at all –
Mr Beer: Everything was perfect?
Susan Harding: – no. I don’t know as I thought everything was perfect, but I assumed that any – that through the problem management processes that are implemented as part of Horizon going in, that they would be picked up and dealt with.
Mr Beer: So when you picked up the IMPACT role, did anyone, when you were briefed on the IMPACT role – what you were going to be doing – say, “We’re looking to extend, essentially, the functionality of the system in this way. There have been problems in the operation on the ground with Horizon”?
Susan Harding: Not that I can recall, no.
Mr Beer: When did your role with the IMPACT Programme come to an end?
Susan Harding: I don’t know, maybe 2005, 2006. So when the programme was completed.
Mr Beer: What did you do after that?
Susan Harding: I can’t think, to be honest with you, where I went next.
Mr Beer: Did it have anything to do with Horizon?
Susan Harding: No.
Mr Beer: Until 2017, when you retired, did you have anything more to do with Horizon?
Susan Harding: Not that I can recall.
Mr Beer: So the last involvement with Horizon was at the end of the IMPACT Programme in about 2005, 2006?
Susan Harding: Yes, because next project was Horizon Online, which I wasn’t involved in. It was – that was Mark Burley’s project.
Mr Beer: You tell us in paragraph 4 of your witness statement – no need to turn it up – that you became an expert and that you were highly regarded in and for your knowledge of the end-to-end business accounting processes operated by the Post Office.
Susan Harding: Yes.
Mr Beer: That would be for many years, would that be right, before Horizon came onstream, whilst it was being rolled out, and for many years whilst it was in operation?
Susan Harding: Yes. So through my role as, initially – because I worked in transaction processing, so I knew the back end of it. I was given the role of head of development which meant that I needed to understand that and then, I say, as the process architect and head of the operating processes, I was considered an expert in the – I suppose more of the accounting side of it than – I mean, I wasn’t an expert in the day-to-day, you know, running of a branch office or a sub office, but I was an expert in the accounting process through the various systems.
Mr Beer: You tell us in paragraph 5 that you were promoted a number of times and held a number of key roles reflecting that expert knowledge?
Susan Harding: Yes.
Mr Beer: You’ve told us already that you’re responsible for accepting the Horizon System from an accounting perspective?
Susan Harding: Yes.
Mr Beer: So, at that stage, your involvement in the initial implementation of Horizon was like an expert customer; would you agree with that?
Susan Harding: It was initially, definitely, yes. Because I was an expert customer on behalf of transaction processing.
Mr Beer: Did you, in the light of those roles and in the light of your long service with the Post Office, become aware that the accounting data would be used – the accounting data from Horizon would be used not only for business purposes of individual subpostmasters and the Post Office, but also for the purposes of the audit of them, the investigation of them and might result in criminal or civil proceedings against them?
Susan Harding: Yes, of course I was.
Mr Beer: You say “of course”, just explain to us why “of course”?
Susan Harding: Well, because – because that’s what – well, I was in the Post Office for a long time, so I understood all the processes of the post offices and I understood that many people over many, many, many years had been prosecuted because they had false – they had, primarily, on the basis of signing a cash account saying it was accurate when it was paper, when it actually didn’t reflect the cash and stock that was in the office.
Mr Beer: So you can confirm that you were aware that Horizon and then Horizon plus IMPACT would be producing data that would form the basis of criminal and civil proceedings against subpostmasters pursued by the Post Office itself?
Susan Harding: Yes.
Mr Beer: You tell us in paragraph 31 of your witness statement – perhaps if we can turn that up. That’s WITN03980100 at page 7.
Susan Harding: Is that meant to be on my screen?
Mr Beer: It will come up on the screen. It’s paragraph 31.
Susan Harding: Okay.
Mr Beer: It reads:
“It was agreed during the design of IMPACT that the suspense account …”
We’re going to come back to the suspense account and its removal in a moment.
Susan Harding: I understand that, yes.
Mr Beer: “… would be removed, as historically it was used by Subpostmasters to ‘hide’ discrepancies in their accounts, rather than resolve them.”
Susan Harding: Yes.
Mr Beer: The suggestion that subpostmasters hid discrepancies in their account, on what basis was that suggestion made?
Susan Harding: This was a historic evidence. So on the basis that when a subpostmaster signed their cash account or pressed the button on Horizon, they were saying that the cash and stock, as well as the other transactions, but primarily that the cash and stock that was in that account was actually physically in the branch, and that was the whole concept of it, that – and a way to get rid of that was to put an amount in suspense which said that “I only have this cash and stock and there’s something over here”.
So it was decided, given that the Finance Director was my – was the sponsor of my project at the time and that was something that he wanted to do, because –
Mr Beer: Who was the Finance Director?
Susan Harding: Peter Corbett. So we wanted to get rid of what was basically a place to hide discrepancies.
Mr Beer: Are you – so “hide” in the sense of dishonestly place; is that what you’re suggesting?
Susan Harding: Yes, I would say that. So if you look back at the record of people who had been prosecuted successful in the past, prior to this, it was normally that they would inflate their cash and stock balances so that the account balanced or they would be signing that that cash and stock existed but it didn’t balance or they would move something into suspense, so the cash and stock was right but there was something else that wasn’t – basically, a suspense account is saying there’s an amount here I don’t – I haven’t accounted for.
Mr Beer: You thought the solution for this was removal of the suspense account because it would prevent people from dishonestly hiding money within it?
Susan Harding: Yeah, and I know you’re going to ask me about the contract in a bit but the contract said that subpostmasters were required to, basically, make that loss good, not to put it in a suspense account and hide it.
Mr Beer: Presumably, if the aim or one of the aims of the IMPACT Programme included the removal of the suspense account to prevent dishonest subpostmasters from hiding discrepancies in their account, you carried out an analysis of the amount of money that was in suspense accounts before Horizon was rolled out and then after Horizon was rolled out?
Susan Harding: No, I don’t think so. This was a concept. We were not – there’d been nothing to suggest that Horizon was creating discrepancies. I was never informed of that.
Mr Beer: No, that’s a different issue, whether it was creating discrepancies. I’m asking if the aim of the – one of the aims of the removal of the suspense account was to prevent dishonest subpostmasters from hiding discrepancies, you would want to see whether Horizon had contributed to that, wouldn’t you?
Susan Harding: Well, Horizon wouldn’t contribute to the suspense account. Horizon didn’t post anything to suspense. The subpostmaster posted amounts to suspense when they balanced and I would have assumed that, if there were issues, those issues would be reported to the call centre. But I was not aware, nobody said to me, you know, “There’s been an increase in calls saying the accounts don’t balance”, or anything.
That’s what – and in my programme, you know, we had representatives from the support centre in Dearne, NBSC. So we had subpostmasters involved in all of those. So this was not a decision of my own. It was taken in conjunction with stakeholders throughout the business, including subpostmasters and branch offices. So …
Mr Beer: Presumably now, you have heard that there were extreme problems with balancing on Horizon right from its outset?
Susan Harding: I’ve heard that through being involved in this Inquiry but there was nothing, absolutely nothing – you know –
Mr Beer: What did you think when you heard that evidence?
Susan Harding: Well, I did wonder why I was never advised of that or why I wasn’t aware of that.
Mr Beer: What did your wonderment lead you to think?
Susan Harding: Well, I suppose it leads me to think that maybe I would have taken different decisions or looked at different things. I would not deliberately have removed it, you know, if I thought the system was causing misbalances.
Mr Beer: You said that the decision to remove the suspense account was a concept and wasn’t based on evidence that Horizon had or had not contributed to any problem in the inflation of the suspense account, yes?
Susan Harding: Yes, the suspense account could only be – matters would only go to suspense if the postmaster put them there, so Horizon didn’t contribute for amounts in suspense. Horizon might have contributed for differences between the cash and stock that the system said they should have had and the cash and stock that they had.
I wasn’t aware that any – anything had been raised, if you like, by the subpostmasters or even branches – not just subpostmasters, because if it was going to affect – if the system was faulty, it would have affected Crown Offices as they were at the time, as well as sub offices, and there was nothing that I was aware of.
Mr Beer: For example, the Inquiry has heard from John Peberdy of the National Federation of SubPostmasters that by March 2001 there was £10 million held in suspense accounts, whereas 18 months before, before Horizon had been rolled out, there was only £2 million held in suspense accounts.
Susan Harding: I wasn’t aware of that.
Mr Beer: Did you think that “We need to conduct an analysis here to see whether Horizon is contributing to the problem”, not because Horizon puts the money in suspense accounts, but it’s creating discrepancies and balances –
Susan Harding: I –
Mr Beer: – that has meant that subpostmasters are putting more money in suspense accounts?
Susan Harding: I wasn’t aware that Horizon had made any change in the suspense accounts and we did have – you know, in the programme and stuff, we did have the unions involved, we did have subpostmasters involved, and I will – you know, I’ve taken an oath. I was not aware that the suspense account had increased as a result of Horizon.
Mr Beer: Did you look, as opposed to waiting for somebody to tell you?
Susan Harding: No, I don’t think so because I don’t – you know, somebody would have told me. The people, you know, involved in this would have told me about that. This was it was a design decision.
Mr Beer: That data would have been available to you. How much money is held in the suspense accounts at any one time?
Susan Harding: I assume I could have got that, yes.
Mr Beer: So do I take it that neither you nor anyone that you asked to looked at, over time, this is the amount of money that has been held in suspense accounts and, if Mr Peberdy is correct, it’s gone up, it’s multiplied by five, before and after Horizon was rolled out?
Susan Harding: No, I was not aware of that and, as I say, we did have – we do have subpostmasters involved in the design, et cetera. So – but nothing was ever raised with me, and I don’t – I’m assuming there’s no evidence that, you know, anybody had – that that was public knowledge, if you like, or that – I know you’re saying I could have found that but, you know, historically, that would have meant, you know, we looked at – we would have had to look at suspense accounts over time.
But it was a principle and that principle was signed off by – including representatives of subpostmasters.
Mr Beer: Sorry, which principle was signed off?
Susan Harding: The principle that we should remove the suspense account.
Mr Beer: Where did they sign?
Susan Harding: Well, they would have signed off the design document.
Mr Beer: So the – just explain: the National Federation and the CWU would sign a document, would they?
Susan Harding: Well, they would review it, they would be reviewers. So they would have been engaged in the – they were engaged in the programme.
Mr Beer: So we should look at the conceptual design and other similar documents for the names of people from the Federation and the CWU and, seeing those names, should take that as meaning that they had signed off what was being done in the name of their union; is that what you’re suggesting?
Susan Harding: That’s what I’m saying. Whether that’s – you know, it’s a long time ago, whether they actually signed off the conceptual design in total, I don’t know. But we did have a lot of representation throughout the design phase.
Mr Beer: That representation, do you mean presence at meetings?
Susan Harding: Well, document reviews, yes, and stuff like that. Given that, you know, impact was primarily – primarily – about implementing new back office systems which would automate the back office systems. So it wasn’t about re-looking at Horizon, except that obviously there were a lot of Horizon changes because it had to produce the data feed that would go into the back office systems.
But really, we were – IMPACT was what, a £25 million programme and there were lots of different streams in it, you know. But really the implementation of the back office systems was there, but – and I – if I’m honest, I can’t remember where the idea of removing the suspense came out, but certainly, as I say, Peter Corbett, who was my sponsor, I know was very keen on it.
Mr Beer: Can we look at paragraph 24 of your witness statement, please. That’s on page 5. It’s at the foot of the page. You’re speaking here about the removal of the suspense account, and you say:
“This decision was based on the core principle that branches (specifically agency branches) were accountable for the financial integrity of their accounts. The ‘suspense account’ had been historically used to ‘balance’ any discrepancies which covered up losses in their [I think you mean subpostmasters’] accounts.”
Yes?
Susan Harding: Yes.
Mr Beer: The suspense account had been designed, is this right, to allow subpostmasters to balance, even where there was an imbalance?
Susan Harding: Yes, and that was – that had been there for years and years when we were talking about paper cash accounts. So it was just a way for them to – I suppose there were two things. It would be one for branches that just couldn’t find what the problem was but it was also used for branches that had been removing money from the system, if you like, and it was to hide it for a length of time.
So I mean we had a lot of the sort of people who investigated, POID investigations and a lot of investigations into previous cases where people had jailed before Horizon existed, so this was on a paper cash account, you know, that they used suspense to hide that. They would either leave their cash and stock as numbers that didn’t exist in the office or they would simply move it to a suspense account.
Mr Beer: The language which you use in your witness statement and today is of hiding and covering up. Does that accurately reflect your core belief that that’s what was going on?
Susan Harding: I have to say, you know, that, yes, multiple – many, many, many subpostmasters, prior to Horizon, had been prosecuted for either – for falsely accounting, basically. Either saying the cash and stock was there or hiding it in suspense, and I could tell you lots of cases, you know, of somebody where the auditors – because the auditors only used to audit sub post offices, I think, once every three or four years.
And I can remember there was one, I think it was, Harrow on the Hill was quite infamous, where the auditors turned up at the door, because that’s what they did, and he said, “I want to fetch the keys out of my car”, and then he went; and that was it. And the Finance Director – so, you know, I ran this on behalf of my sponsor, the Finance Director, but it was clear that – and I’m not disrespecting any of the people that have been jailed if Horizon was wrong, but there had been many people –
Mr Beer: Sorry, you said “if Horizon was wrong”.
Susan Harding: Yes. Well, I – I’m not doubting it was wrong. I’m just saying I haven’t –
Mr Beer: So can we remove “if” from that sentence?
Susan Harding: Yes, okay. But people had been jailed for many, many years for false accounting because that’s what they got jailed for.
Mr Beer: So is it fair to say that this mindset, might I call it, that you operated under was that suspense was all about crime, it’s about cover-ups by dishonest postmasters hiding discrepancies, and that mindset continued in your 40 years in the Post Office?
Susan Harding: Well, I wasn’t 40 years in the Post Office. I was in Royal Mail and things before that. So – but once I was involved in that – it wasn’t me, you know, I had a sponsor for this, who was the Finance Director and we were trying to achieve something that meant that accounts were accurate and that the cash and stock that was in the office or the accounts were accurate and that the cash and stock that was in the offices was in the offices.
Mr Beer: Would you mind kindly answering my question?
Susan Harding: Could you repeat the question, please?
Mr Beer: Yes. Did you have a mindset in the entirety of your time working for Post Office, that the suspense account was used by dishonest subpostmasters to hide and cover up money that they were taking?
Susan Harding: My mindset was that it was a place where they could do that.
Mr Beer: And did do that?
Susan Harding: Yes, and did do that, because –
Mr Beer: And that it wasn’t used for any other purpose?
Susan Harding: Well, it might have been used for any other purpose. It might have been used for other purposes as well, but there were other ways those things could have been dealt with.
Mr Beer: Did you think it was used for any other purpose, like an innocent purpose?
Susan Harding: I don’t know. It could have been.
Mr Beer: Well, did you? Can you help?
Susan Harding: I don’t – I can’t remember. All – I think it could be used. I’ll rephrase it then. It could be used for any purpose but why would you, if your account balanced? So it must have been to do with something that either they knew was causing their account to misbalance or because their account misbalanced and they needed somewhere to put the difference; it didn’t have to be fraudulent.
Mr Beer: It could be that their account imbalanced and they didn’t know why it imbalanced?
Susan Harding: That’s true, but that’s what I said. That’s – so that there were discrepancies that they couldn’t explain.
Mr Beer: So the suspense account was there to allow subpostmasters to balance where there was an imbalance?
Susan Harding: Yes.
Mr Beer: If there was a shortfall, the relevant sum would be put into, moved into, the suspense account, returning the branch to balance, permitting the subpostmaster to roll over and continue trading?
Susan Harding: Yes.
Mr Beer: The reason for the shortfall, would you agree with this, there could be various reasons: it could be a loss within the branch for a range of reasons?
Susan Harding: It could be but then subpostmasters were responsible for those losses.
Mr Beer: That’s a different issue.
Susan Harding: So they should have declared that a loss.
Mr Beer: Sorry, they should have?
Susan Harding: Should have declared a loss rather than put an amount in suspense.
Mr Beer: Well, they might not know, might they? You seem to be operating on the basis that it must be nefarious and, if that’s the basis on which you were operating, then you should say so.
Susan Harding: It was – yes. Their account should have reflected what they saw – what was in their office. It should have reflected the receipts and the payments they had made and the cash and the stock that then – so they’d have done the previous opening cash and stock on their previous cash account, they would have done a number of transactions which would be recorded and the difference should have given them an amount of cash and stock that was in the office.
Mr Beer: The reasons could include theft by the subpostmaster?
Susan Harding: Yes.
Mr Beer: They could include poor business practices by the subpostmaster?
Susan Harding: Yes.
Mr Beer: They could include a negligent mistake by the subpostmaster?
Susan Harding: Yes.
Mr Beer: They could include an innocent mistake?
Susan Harding: Yes.
Mr Beer: They could include, after Horizon, a bug or error in the system causing an imbalance?
Susan Harding: They could.
Mr Beer: Then if the sum was placed in suspense, that could be investigated before Horizon at headquarters?
Susan Harding: I think the thing was that they had the Network – the Network Support Business Unit was set up within Horizon, was there, and that should have been the place – you know, the contract said they should make good their losses. There was nothing that was a sort of grace period in them. But I would have thought if somebody was having large losses, they would have been raising hell with the support centre.
Mr Beer: On the phone?
Susan Harding: Yes, or with their Retail Line.
Mr Beer: Just explain what you mean by their “Retail Line”?
Susan Harding: Well, every post office was linked to Post Office’s – somebody in the Retail Line. So through – and I’m not an expert in the Retail Line structure but they would have people who supported their office from the Network Business Unit.
Mr Beer: What would you expect them to do if they said, “There’s an imbalance here, I don’t know why there’s an imbalance. I think it may be being caused by the system but I don’t know why”?
Susan Harding: Well, I would have expected them to investigate that.
Mr Beer: How would they investigate it?
Susan Harding: I don’t know because I’m – I’ve never worked in the Network side so I don’t know what the roles and how they played those roles in that. But somebody would be saying, you know, “You have to go through your accounts”, and a lot of the lines on the cash account had supporting documents, so is it a loss in a supporting document? But that was it.
I mean, clearly, you know, some offices did more transactions than others. Was there a transaction that they keyed wrong? But there must have been a way of investigating that, but that wasn’t, you know, my role. I wasn’t involved in Network support at all.
Mr Beer: The difference before and after IMPACT was, before IMPACT, if a sum was placed in suspense, it could be investigated by Chesterfield or by the audit and security team, yes?
Susan Harding: Yes.
Mr Beer: Then after IMPACT that could still happen, there could still be an investigation but, after IMPACT, placing the item in suspense could no longer happen, could it?
Susan Harding: No, but you’re saying, exactly the same resolution of what somebody thought, because clearly they would know if they hadn’t – couldn’t put it in suspense that there was a difference between the cash and stock on what the cash account said and, you know, their contract did they say had to make it good, they could have been straight on the phone to Network Business Support Unit saying, “This is saying”, – I’m assuming, you know, we’re not talking, I expect, £10 or 10 pence here; we’re talking large amounts generally. If it’s small amounts, making it good was what they would do but if it was a large amount, you would have thought they would have been scouring their transaction logs and trying to understand what had happened there.
Mr Beer: Scouring their transaction logs. Can you tell us how a subpostmaster in a branch scours a transaction log?
Susan Harding: Well, they would print it off and have a look for what they thought might be an erroneous transaction but a lot of the –
Mr Beer: Hold on. Just stop there. What would they print off?
Susan Harding: I can’t remember. There must have been a report that was a transaction log.
Mr Beer: Was there a report called a transaction log?
Susan Harding: I don’t know.
Mr Beer: Sorry?
Susan Harding: I don’t know. But, you know, every week before – and before any of the automation, people went through that on a weekly basis, following automation that became a monthly basis, although I imagine that some offices still did it weekly. A lot of lines on the cash account had supporting documents and that enabled them to check the accuracy of those things. So nothing changed as a result of doing this in how you would try and identify a discrepancy. It just said you can’t place it in somewhere – in a suspense account.
Mr Beer: You’ve said a number of times this morning it was their responsibility to make good any losses.
Susan Harding: Mm-hm.
Mr Beer: It was their responsibility under the contract, I think you said, a number of times.
Susan Harding: Yes, there is a clause, I know, that’s in the contract that’s in some of my documents.
Mr Beer: Yes, if we just look, please, at paragraph 24 of your witness statement, that we were on, and see what you say about the responsibility of subpostmasters for shortfalls under the terms of their contract. You say:
“This decision was based on the core principle that branches (specifically agency branches) were accountable for the financial integrity of their accounts.”
Then reading on:
“The processes for raising a dispute regarding a discrepancy were not changed by the Programme. Branches were supported by the helpdesk and/or the Network team and would raise any concerns through these channels.”
Then you say:
“As I have stated, agency branches were responsible for making good losses. This principle was not changed by the IMPACT Programme.”
Then in paragraph 25, if we scroll down, you say:
“This decision was based on the core design principle that, contractually, agency branches were accountable for the cash and transactions in their branch and liable to make good any and all shortfalls.”
I just ask you to highlight, in your mind at the moment, “any and all shortfalls”. If we go to paragraph 29, please. You say:
“In sub post office [sub post offices] the owners were required under their contract to make good any shortfall.”
I just ask you again to highlight in your mind the words “any shortfall”.
Then in paragraph 32, over the page:
“In contractual terms, they were liable, contractually, for any shortfalls which had to be made good.”
Why did you believe that subpostmasters were required, under their contracts, to make good any and all shortfalls.
Susan Harding: Because I think – I’d seen the contract and, on some of the documents in my folder, there is a copy of that paragraph.
Mr Beer: When you were working back in – say, between ‘95 and 2005, was it your belief that subpostmasters had to make good any and all shortfalls?
Susan Harding: Yes, although if you’re going to ask me, if the system didn’t work right, they were responsible for that, then no. But they were, unless, you know, they could – there was a bug and it was identified. I’m not suggesting that if the Horizon System didn’t work correctly, that they were liable for that but the contract said, if you’ve done these transactions, you’ve reviewed your account, when you press the button you’re saying that account is a true and accurate statement of the transactions.
Mr Beer: Where did, between ‘95 and 2005, your information come from that subpostmasters were required under their contracts to make good any and all shortfalls?
Susan Harding: Because we had – because I had copies of the contract.
Mr Beer: You had copies of the contract in your office or in folders?
Susan Harding: Yes, or somebody – we would have had people in the teams or stakeholders who were not in the team that confirmed that. So, you know, I mean this was a – you know, this was something – I didn’t make these things up. I was – you know, my stakeholder was the Finance Director, and this was something that we recognised and, certainly as far as I’m aware, we tracked all the contractual terms to say that was true.
Mr Beer: To summarise, it was based on actual possession of the contracts and conversations with other experts who would be expected to know what the terms of the contract were?
Susan Harding: Yes.
Mr Beer: Did it mean to you that a shortfall that was not the fault of a subpostmaster was nonetheless their liability to make good?
Susan Harding: No. Well, except that it could have been, you know, a member of staff or something like that. If there was a shortfall because they’d had a robbery, then clearly that didn’t apply and if I’d thought in any way that the system created incorrect transactions that they wouldn’t be able to question, then no, I wouldn’t expect them to be held liable.
Mr Beer: In your statement, you say on four occasions that they had a liability under their contract to make good any or, in another place, any and all shortfalls, without including exceptions. You’ve just written in –
Susan Harding: Yes, but I didn’t – I – you know, anybody would say, if you’ve got an account and you’ve signed it off, yeah, you’re signing it off to say that that is a true and accurate reflection. And, you know, I know from reading the stuff here that there were issues maybe in Horizon but, in many cases, you know, what I don’t understand and I don’t know the detail of the prosecutions, there’s – why they hadn’t been able to identify that the system had inflated, you know, receipts or said they hadn’t – that sort of thing.
Because, you know, the process of balancing required them to go through their accounts and to check things, as I say, in many cases with supporting documents, not always supporting documents.
Mr Beer: Sorry, just to stop there, you’re saying that the process of balancing –
Susan Harding: Yes.
Mr Beer: – required the subpostmaster to go through a series of documents, this is after Horizon?
Susan Harding: Yes, well, they’d go through a process that they’d done with the cash account. They would validate the lines that were on the cash account. So, for instance, if – and obviously things changed as technology changed but if they were having Giro deposits, for instance, they would have Giro deposit slips. So the process of balancing would say, “I’ve got a line on my system that says I’ve taken this much in cash deposits”, and you would expect that they would go through the supporting documents, which often had to be sent in when we used to have paper cash accounts, because that’s what Chesterfield would do when they got it.
They would check the lines on the cash account that the subpostmaster had submitted to the supporting documents –
Mr Beer: Just to stop you there, that’s what IMPACT removed, essentially?
Susan Harding: It didn’t remove supporting documents.
Mr Beer: They removed the checking by Chesterfield?
Susan Harding: Well, no, because there would always – there was still some products where, in the back office systems in Chesterfield, we would have a feed from the client which told us. So we would identify errors but that – those subpostmasters should have been able to find those errors. If they’d sent the supporting documents off, they – some of them may have been sent off at the same time as the cash account was completed and, therefore, they would be saying, “I have – my system says I’ve done these transactions and these supporting documents say I’ve done these transactions”, and if there was a difference they would look to identify the difference.
So it wasn’t a case of just pressing a button. It was all related to supporting documents and other information, to sign a cash account off.
Mr Beer: Getting back to where we were, I think you’ve said that you didn’t work on the basis, between 1995 and 2005, that all shortfalls were the responsibility of subpostmasters to make good. There were exceptions to that rule?
Susan Harding: Well, yes, there was a process for them to go through to work out why they had got a shortfall, so –
Mr Beer: What were the exceptions to the rule?
Susan Harding: Well, if they could – if they could prove that they got a set of supporting documents and that total on Horizon wasn’t there, they should have been – they would have been ringing the helpdesk and saying, “Why is my system not reflecting what I’ve keyed in?”
Mr Beer: What if the helpdesk said, “But you’ve got a responsibility under your contract to make good any and all shortfalls. Make good the shortfall, otherwise you can’t continue trading”?
Susan Harding: No, that contractual term “any shortfalls” is, after all these processes have gone. If they can’t resolve that shortfall, that’s what the contract said.
Mr Beer: What was your view of how onerous the contractual provision on any and all shortfalls was at the time?
Susan Harding: Well, that provision was no more onerous under IMPACT than it had been for all the years it had been they’re so that contract – that was – that had always been the case in subpostmasters contracts, as far as I’m aware. Certainly in my time of being involved, that was what was there.
Mr Beer: Can you recall a difference between sub offices and Crown Offices in this regard?
Susan Harding: Yes, because Crown Offices would report a loss. So you don’t hold a Crown branch – were not under the same contract. They were employed – they were employees, so you would deal with an employee who – a branch manager who reported that they had got more money than they really had in their tills, you would treat them differently. That would be a disciplinary offence and may lead to them being prosecuted, I suppose. But it’s obviously a different contractual situation.
Mr Beer: One of the desired outcomes of the IMPACT Programme was to pursue losses with more vigour in order to improve debt recovery, yes?
Susan Harding: Yes.
Mr Beer: Did you ever think that subpostmasters were therefore going to be pursued and pushed harder for losses?
Susan Harding: I think we were trying to make it easier for those losses to be identified and, yes, I would expect that the processes would be there – the process should have been there anyway, but it was trying – it was the visibility.
Mr Beer: But a deliberate design aim was essentially to squeeze the subpostmasters more to get onto the Post Office books the accounts that was otherwise held in suspense accounts? That was improving debt recovery?
Susan Harding: Yes, I don’t think that means squeezing them more. That’s a concept –
Mr Beer: But –
Susan Harding: We were trying to make it that the Post Office accounts and the sub office accounts reflected reality and that we didn’t have, if you like, a black hole that was called suspense.
Mr Beer: But a black hole that was filled by, in your view, dishonest subpostmasters hiding and concealing money that they had stolen?
Susan Harding: It didn’t mean they’d stolen it. It may have been lost. They may have given out the wrong change to somebody but the contractual liability was that they should make good those losses, even if they’d given out the wrong change. I wasn’t – I’m not – I wasn’t in any way reflect interesting on why I believe those losses had occurred.
I was simply reflecting what was a desire of the sponsors of my project, remembering I was here to implement a project, there was a programme – project programme manager and I had a number of sponsors, and they had numbers of requirements.
Mr Beer: But you were aware, you were conscious of the fact that one of the aims of the project was to pursue these losses harder in order to improve debt recovery –
Susan Harding: Yes.
Mr Beer: – and therefore subpostmasters would be pushed harder?
Susan Harding: Yes.
Mr Beer: That was the very aim of the process?
Susan Harding: Of that part of the process, yes.
Mr Beer: Can we just look at a couple of versions of the contract please. To start with, look at POL00000747. This is the 1994 edition of the subpostmaster contract and can we turn to page 49, please. Hmm.
Yes, sorry, internal pagination. So I think four pages on.
Yes, that’s it, under the cross heading “Losses” at the top and if we can look at paragraph 12:
“The Subpostmaster is responsible for all losses caused through his own negligence, carelessness or error, and for all losses of all kinds caused by his Assistants. Deficiencies due to such losses must be made good without delay.”
Susan Harding: Yeah.
Mr Beer: Can you keep that in mind and then if we can look at POL00003874. This is the “Post Office Community Subpostmasters Contract” for 2006. Can we look, please – there’s an error with my referencing.
I’m going to have to ask to take the break early because I can’t locate the paragraph within the 60 pages/70 pages of the document. Apologies for that.
Susan Harding: I think on –
Sir Wyn Williams: So we’re just after 11.00, so 11.15?
Mr Beer: Yes, that would be great. Thank you very much, sir.
(11.05 am)
(A short break)
(11.16 am)
Mr Beer: Sir, thank you for allowing me the time. The fault was entirely mine.
Sir Wyn Williams: It’s always nice to have that admission.
Mr Beer: So we were looking at POL00003874, please. Can we turn to page 71 in the document, please, and paragraph 12, please:
“The subpostmaster is responsible for all losses caused through his own negligence, carelessness or error, and also for losses of all kinds caused by his Assistants. Deficiencies due to such losses must be made good without delay.”
I’ve shown you the contract as it stood in 1994 and then as it stood in 2006, to sort of bookend the period that we’re looking at. You’ll see that they are materially the same.
Susan Harding: Yes.
Mr Beer: Do you agree that a postmaster’s losses due to his own negligence, carelessness or error is not the same thing as a postmaster being liable for any and all shortfalls, irrespective of their cause?
Susan Harding: Yes, because it describes those that they are liable for.
Mr Beer: Why did you say, in four places in your witness statement, that subpostmasters were liable to make good all or any and all shortfalls?
Susan Harding: Because I was meaning that it was like that. Clearly, if there was – you know, it was a loss that was a system error, that wouldn’t have been the same. Because you would have resolved the system error. But, you know, this was not something that I would have thought would have happened but –
Mr Beer: What wouldn’t you had thought have happened?
Susan Harding: I would have thought that somewhere somebody would have reported things that were happening, would have been able to identify maybe which of the transactions there was a problem with, and then that would have got resolved.
And that was a Network – that would have been an issue for the Network because you would have imagined that if you were getting a lot of losses caused in a lot of offices which they simply couldn’t explain, that through that process they had to go, which was before they signed off the cash account, that things would have been clear, particularly if there were large losses. You know, you would have expected you could see something in the accounts, but I wouldn’t – that contract has never – and I just paraphrased the contract, which was the first bit, for all losses.
Clearly, we were not ever attempting to make, in my project, losses – subpostmasters responsible for losses which were caused by a system bug.
Mr Beer: Isn’t it the case that what you told us in four places in your witness statement accurately reflected the view that you held at the time, back in the day, namely subpostmasters are responsible for any and all losses, and that’s the basis on which you were working, wasn’t it?
Susan Harding: No, I would have had access to this and we – you know, I wouldn’t have –
Mr Beer: But did you read it?
Susan Harding: I would never – you’re asking me to go back 20 years but I had people from the Network, I had people from commercial involved and that was where those decisions were made. It was never intended to suggest that if there were bugs in the Horizon System caused by Fujitsu, that that wasn’t there. I suppose what we would have expected is – maybe thought, is that those would have been identified by the subpostmasters because, I say, a lot of the lines on the cash account, as it was, had supporting documents, which they would be able to say “Well, this is” – and I don’t know what problems those bugs caused, I know they existed now but I didn’t know at the time. But I would have thought you would see a pattern of losses occurring because this line of receipts is overstated versus some supporting documents or evidence that I had to support it.
Mr Beer: Were the attitudes that you have displayed in your witness statement, namely that suspense accounts are used by dishonest subpostmasters to hide and cover up losses for money that they have taken and that, in any event, subpostmasters are liable for any and all losses, a common one in the teams in which you worked?
Susan Harding: No, it was not like that at all, not like that at all. This was about trying to reflect that part of the contract and this was a requirement passed to me from my sponsor, the Finance Director, and that’s what we intended to try to implement.
Mr Beer: Can I turn to the reasons for the removal of the suspense account. You tell us in paragraph 18 of your witness statement – and can we look, please. It’s on page 5, WITN03980100. We should probably just look at the foot of 17 first. It’s slightly oddly formatted:
“The principle objectives-off IMPACT [says 17] were to …”
Then 18:
“Deliver an integrated, automate solution utilising industry standard packages where possible.”
I think the second thing is:
“Reduce IT operating costs.”
Then the third thing is:
“Reduce losses and improve debt recovery.”
Was the objective that you’ve described there, reducing losses and improve debt recovery, something of an underestimate? This was seen as an issue critical to the survival of the business, wasn’t it?
Susan Harding: No. No. This was – I worked for the Finance – the Finance Director was my sponsor, you know, we did have a lot – we had a very large network of offices which were not supervised, which were not audited frequently and we did have, prior to any of the automation, numbers of postmasters who were prosecuted for false accounting: not theft but false accounting.
So these were agreed. This wasn’t my, you know, my programme. It was the Finance Director’s desire to do this and that was one of things he placed on us to say, “Do that, that’s one of the things that we want you to achieve out of this programme”.
Mr Beer: So it was actually more targeted to try to catch or remove the facility for those dishonest subpostmasters to hide or cover up losses in their suspense account.
Susan Harding: Yes, absolutely.
Mr Beer: That was an aim?
Susan Harding: Absolutely.
Mr Beer: Can we look, please, at POL00038870.
This is version 3.4 of the conceptual design of the accounting and cash management programme. We’ll see in a moment that I think it’s dated September 2003 and it details the design of the whole accounting and cash management programme. I think it was reviewed by you, is that right, as the programme manager for the entirety of the programme.
Susan Harding: Yes, I would have been a – not just reviewed, I would have been the final sign-off along with Clive Read who was the – he was the technical – so I was the programme manager but he was technical design authority.
Mr Beer: We can see you described as “Programme Manager” on the first page there. What did the role of programme manager involve?
Susan Harding: Right, so this was a significant programme so originally I was – because I said I was sort of head of design, or whatever it was at the time, so I was asked to design an improved process that would meet these – meet some of these objectives. And then, having created that design, which is not this conceptual design, this is later on, I was then asked to move to be programme manager to implement it and, as I say, my sponsor was Peter Corbett who was the Finance Director.
So those desires to reduce losses were passed to me as a requirement from the sponsor.
Mr Beer: We can see, I think, the date on page 5 of the document – at the foot of the page, 3.4, which is what this version is – is September 2003, and you can see the date above that in the box, yes?
Susan Harding: Yes.
Mr Beer: Then if we go forwards, please, to page 14. Under paragraph 3.2.2, which is just under the middle of the page, “Key priorities”, the document provides that:
“2 fundamental changes have made Post Office Limited’s funding position a critical business survival issue:
“[1] The business is trading at a loss
“[2] The migration of benefits to ACT will be accompanied by the loss of pre-funding by government departments of the necessary cash in the network.
“The business now has to borrow funds to fund its trading losses and to fund working capital needed in branches. Such borrowing is limited in its availability and its costs add to the trading loss. From April 2003 DTI will provide a loan and will require a robust statement of cash holding as security.”
Does that neatly summarise the reasons for the IMPACT Programme?
Susan Harding: No, not in totality, because the IMPACT Programme, a lot of it, which will come in the business drivers, no doubt, was to – we’d automated the front office through Horizon, and IMPACT – a lot of that, was around automating the back office, so we replaced the old paper cash account and put in new systems. So the majority of IMPACT was all about the back office systems, really, and then doing some things in the front office to facilitate that.
But it wasn’t – so that was the reason for it, really.
Mr Beer: The purpose of it, or the reasons why it was being done, are set out there, aren’t they?
Susan Harding: Well, yes. So we were trying to reduce the costs. So by replacing the old systems and putting in new – we’d put in a SAP system in the back end, which was very vanilla. We tried not to change SAP to work to the processes – we tried to change the Post Office processes to fit with the package.
So yes, putting in package solutions in the back end meant significant savings and much better control, et cetera. So that was one of the reasons behind that.
Mr Beer: Were suspense accounts to be removed because the Post Office desperately needed money that was held in suspense accounts?
Susan Harding: No, it wasn’t because it was desperately needed, it was just while we were making changes to the front end, and I say, it was a – I can’t really remember the – where it came from, but it would have been an idea that our losses were significant and were there ways to change those? And some of those would have been losses not – nothing to do with the counter.
They would have been losses because we couldn’t agree at the back end how much we owed our clients or they owed us, for example. So it was a very large programme and the removal of the suspense account in the counter was a very, very small part of it. It wasn’t a big driver for it at all. We wouldn’t have done this programme just to do that.
Mr Beer: Why was the suspense account removed?
Susan Harding: Because it was seen as a place where people would hide losses.
Mr Beer: So it wasn’t primarily aimed at getting the money that would otherwise be in the suspense account to reduce Post Office debt?
Susan Harding: No, losses ultimately – it’s not about debt. Losses ultimately appear in your profit and loss account. So yes, this was, so there were a number of things that said “How do we reduce the cost or the loss of the business?” And I can’t remember where that actual thing about the suspense account came up from, because we did number of workshops, you know, to develop obviously the programme and what it was going to look like but it was driven by – and we had all key stakeholders involved.
So we would have had people from the counter who would have said, you know, ultimately, we have a lot of losses in the network.
Mr Beer: Do I take from that that it wasn’t part of the initial plan to remove suspense accounts? That was something that was added as the programme developed?
Susan Harding: Yes, it might have been before we set off on the programme because, as I say, I was – I had a business architecture some of the time, so I was involved in that role or targeted to look at ways to improve that end-to-end process, and particularly in an accounting sense because, I say, I did have – this project was sponsored by Finance.
Mr Beer: Can I turn, then, to look at responsibility for the designing out of the suspense account facility and start by addressing what Chesterfield did before the IMPACT Programme designed out the local suspense account and therefore how it was changed by IMPACT. Can we start with paragraph 7 of your witness statement. That’s on page 2.
Thank you. At the foot of the page, you say:
“When Horizon was initially implemented it was built to replicate the accounting processes that were historically in place. This meant that a ‘cash account’ was still produced by Horizon as this was needed to feed the ‘back office’ accounting systems and processes in place [at] Chesterfield.”
Was there, essentially, a reconciliation and checking process undertaken at Chesterfield?
Susan Harding: Yes, so we had a – there were probably at one time 150 people in what was called transaction processing. The cash accounts were produced by the system. Obviously, pre-Horizon we had paper cash accounts coming in to a keying unit in Chesterfield, so there was a big process to key those cash accounts, which by itself could have created errors in the process, and then we had – the remainder of that unit in transaction processing was a large number of teams of what were called error resolution teams.
So their job was to understand the difference between – to resolve errors. And errors were created by – often by either us getting a separate feed from the client because that’s what the Post Office did, work on behalf of clients, it wasn’t – we weren’t selling our own products or services. We were acting on behalf of clients.
So for many of the products, we would get a feed from Horizon of what the branches were saying on the cash account and then we would get a feed from the client and a whole mass of error notices would be produced and then that all had to be dealt with by the teams in Chesterfield.
Mr Beer: So this 100, 150 people at Chesterfield –
Susan Harding: Yes.
Mr Beer: – was essentially manual reconciliation but based on weekly production of the cash account by Horizon?
Susan Harding: Absolutely. So this programme was intended to stop that. It was to put in a SAP system. So that’s what I said. The changes at the branch were minimal, except where it was needed to be. So it was all about the back office systems. So we were putting in a standard SAP accounting system, not a homemade built and a class system, as it was called in the past. So we would put in a standard SAP accounting system, which would make reconciliation much simpler and, out of that, somewhere in the requirements, came the thing that was about the suspense account.
But that – this was really to get things quicker and more accurate, in –
Mr Beer: And to get rid of the 150 people?
Susan Harding: Well, yes. I don’t think we got rid of them all because we would still have differences in the client data to the feed from the counters. So we wouldn’t get rid of them all but it removed a lot of the resource requirement, and that’s what you would expect for a business that’s making losses, to try to –
Mr Beer: Save money?
Susan Harding: – reduce its operating costs, yeah.
Mr Beer: So post-Horizon but pre-IMPACT, there was a team of people at Chesterfield undertaking manual reconciliation whose job it was to pick up errors, chase them down until they were corrected and resolved, either in the cash centre or in the cash accounting system of subpostmasters?
Susan Harding: Yes, and that hadn’t changed from pre-Horizon, if you like. That’s – the systems and the processes in the back end were exactly the same, and so IMPACT was all about really addressing that issue.
Mr Beer: So the purpose or one of the purposes of the IMPACT programme was to introduce automation to remove that manual reconciliation process to investigate, amongst other things, errors and discrepancies?
Susan Harding: Yes.
Mr Beer: If errors and discrepancies persisted, even under the automated back-end functions, who was to investigate those, under this new system?
Susan Harding: Well, there was still a team in Chesterfield and it was still their responsibility to do that.
Mr Beer: How many people were in the team in Chesterfield post-IMPACT?
Susan Harding: I can’t remember, sorry.
Mr Beer: Was it still at the 100, 150 level?
Susan Harding: It would have been less than that but it wasn’t – remembering that, really, the reduction in those teams was as much to do with the client processes and what feeds of data we got from them and whether they were automated as well. But the SAP system would have done some of that reconciliation but if it still produced differences, then they still had to be investigated.
But I can’t remember what size the teams went down to. I wouldn’t say – we certainly didn’t get rid of everybody because it was product design, really, that allowed the full automation.
Mr Beer: In your witness statement – no need to turn it up – at paragraph 13, you say Peter Corbett and David Smith sponsored the IMPACT Programme. Who took the decision to remove the suspense account facility?
Susan Harding: Well, all of the requirements would have been signed off by stakeholders and but, ultimately, it would have been the programme sponsors who I was reporting into to say this will deliver benefits.
Mr Beer: Can we translate that into some language that I, at least, understand. You said ultimately it would have been signed off by stakeholders?
Susan Harding: Yes.
Mr Beer: What does that mean?
Susan Harding: Well, when you’re doing a project you produce documents which describe what you’re going to do, yes? And those documents will have a set of reviewers and a set of approvers. So any document that affected the branches, would have to go through the Network – would have Network stakeholders as reviewers and signatories.
So documents always – when you set up a document and some of the ones you pulled up say, you would have to – right up front, you would have a product description, you would create a product description for that document you were going to produce, product descriptions for other things as well, system design, you know, other things, but you would produce a document, you would agree with the stakeholders, because we had, you know, stakeholder meetings, who wanted to see and sign off that document.
And you would have a whole – and you would see it on the front of documents like you’ve shown before, that those reviewers would be set before the document was created.
Mr Beer: So the presence of a name amongst somebody – a list of reviewers, you understand to mean signing off, ie approving?
Susan Harding: No. Reviewers were reviewers. They read the document and fed back comments. That was the initial stage, obviously, to get rid of any inaccuracies and errors and then, ultimately, there were signatories after that.
So each document would have a set of reviewers and then the people who were responsible for actually signing it off and they would normally sign it off on the basis that the reviewers, who were the people who worked for them very often, were happy that the review they’d done was adequate and that there were no significant issues that hadn’t been resolved.
Mr Beer: So if we get back up on the screen, please, POL00038870. If we look at the front page on that, does that tell us who signed off, ie approved, the contents of the conceptual design for the accounting and cash management programme?
Susan Harding: Yeah, what I probably can’t understand on that is we’ve obviously got business architecture and technical architecture – oh no, they’re the two people there, yes. So yes, that’s right.
So ultimately they were the signators, they weren’t necessarily the reviewers. There would be separate reviewers in advance of that.
Mr Beer: Who signed off this document?
Susan Harding: Myself and Clive Read.
Mr Beer: So you – if I asked the question “Who agreed that the things described in this document are accurate and that proposals in it should be implemented?” the answer would be “Me and Clive”?
Susan Harding: Ultimately, yes, there would be somewhere a set of reviewers, and Clive and I would only sign the documents off if those reviewers were satisfied with the document. If they raised issues, we would either resolve them or do something but there is a whole process before. This is just the signatory bit at the end. So …
Mr Beer: So if we look at page 7 of the document, where we see a list of reviewers in the top box, is that list of people people who have looked at the document before you have signed it off? They have not signed it off, you have?
Susan Harding: No, because they didn’t have the authority to sign it off. So they would be the minimum people – so at the beginning of the programme you create a product description, and that product description will tell you who are going to be the mandatory reviewers who are going to be the signatories, who are going to be the people that create it. And that would all go through – those documents at the beginning that tell you who those people are would go through its own review process to make sure that everybody that should be involved in that, in the review, was involved in that.
But Clive and I basically would ultimately, in most documents – not always – be the final signatories, because we – and we would do that not on the basis that we understood all the detail in that, but the people that we had agreed upfront in the product description should be involved in the review had been involved.
Mr Beer: Who took the decision, ie signed off the decision, to remove the suspense account facility?
Susan Harding: Well, if it’s in this document –
Mr Beer: No, no, it’s not.
Susan Harding: No. Well, you’d have to look at the – whatever document that was in.
Mr Beer: I can’t see one. That’s why. It seems to be in a collection of email chains.
Susan Harding: No, I can’t remember that far back because, obviously, it was a small part of the programme. I’m not saying it wasn’t an important part but if you asked me who, we clearly would have involved Network in that, as a primary owner, because they were the primary owner of that, but on the back end, Finance were, if you like, the people who were responsible for the outcome of that design, because it was about what losses they saw in the account.
So there would have been – there should have been something that said that. But I don’t know, you know, talking 20 years ago here, it’s –
Mr Beer: On a decision like that, we wish to remove the suspense account –
Susan Harding: Yes.
Mr Beer: – because we believe that it is used by subpostmasters to hide and cover up losses –
Susan Harding: Yes.
Mr Beer: – and it will have the benefit of saving the Post Office millions of pounds a year, would the board be involved – Post Office Board be involved in such a decision?
Susan Harding: No, they would have remitted that. So, actually, if you look at the bottom, “Business Review”, Stephen Hirst was in Finance, quite high up in Finance. Ruth Holleran, who I’m sure you’re aware of on this programme, was – I can’t remember exactly her role at the time but she was high up in sort of the IT. Vicky Noble was in Transaction – was the head of Transaction Processing at the time. Ann Cruttenden was the business change manager for the Network. Ann Clarke was in my team.
I can’t – Bob Lammin. I’m sure POID, either Bob Lammin or Neil Salter – Jack MacKenzie, I don’t remember Jack MacKenzie, so it’s a cross-representation –
Mr Beer: Sorry, just to stop there. You think that Mr Lammin or Mr Salter were from the Investigations Division?
Susan Harding: They could have been.
Mr Beer: Okay. My question was about the board and you said that you don’t think the board would have been involved in decision making on this.
Susan Harding: No, well at a high level, so the original programme initiation document would have said that that was one of the things we were going to do. So the project initiation document would have been signed off across the business by key stakeholders. This was just the implementation of something, so this is the conceptual design that talks about that, but that’s not the initial “This is what the programme is going to deliver”.
Mr Beer: I’ll try and ask it more simply. Was the decision to remove the suspense account a decision, to your knowledge, that was taken by the board?
Susan Harding: I think it was in the original business case, because we would have had a figure for the reduction of losses we felt was associated with that.
Mr Beer: So the board would have had knowledge of it?
Susan Harding: Absolutely.
Mr Beer: Can we look at some email threads, please. Starting with FUJ00126036. Can we look, please, at page 4. You’ll see the last email in the chain is from Clive Read. If we scroll up to the bottom of page 2, you’ll see that Mr Read send it to Ruth Holleran and Tony Marsh and it was copied to you; can you see that?
Susan Harding: Yes.
Mr Beer: What roles at this time, early 2004, did Ms Holleran and Mr Marsh perform in relation to you?
Susan Harding: Well, they would be my stakeholders on the project. So they may or may not have been on the board. I can’t remember now who was the constituents on the board. But Tony Marsh, I think, was to do with Investigations? But I’m not …
Mr Beer: If you can’t remember it’s best to say, “I can’t remember”.
Susan Harding: I can’t remember.
Mr Beer: Okay. Let’s look at the email. This is from Mr Read who was the Chief Systems Architect at Post Office. So if we go down rather than up. Thank you.
He says:
“As you know we are currently in the middle of requirements workshops on the final phase of the IMPACT Programme. Although we have a scheduled Stakeholder meeting early in February, given tight timescales there are some emerging concerns which I think I need to flag up.”
Number 1 is “Suspense Account Threshold”:
“The current assumed position is that a single threshold of £250 will be applied by Horizon below which variances cannot be placed into Suspense Account … This is a new system control which does not currently exist.”
Can you remember anything about that?
Susan Harding: No, I can’t. I mean, it was obviously some forerunner to us removing the suspense account.
Mr Beer: He continued:
“There is a requirement (from Operations [representatives]) to introduce a number of different thresholds depending on the Office type (eg Community offices to be at a much lower level).
“Although this could be accommodated I have concern it begins to add additional complexity both to the system build and subsequent operation … is this [a must-have]?”
Susan Harding: Mm-hm.
Mr Beer: Then under item 2 “Suspense Account Authorisation”:
“The current assumed position is that subject to threshold control above, the requirement to seek telephone authorisation for posting variances to Suspense would cease, on the understanding that improved timeliness and visibility of office liabilities … would provide sufficient control …
“The Operations and Security view was that removal of this control would declare ‘open season’ on the use of Suspense postings, leading to loss of financial control, spiralling non-conformity, etc …”
Does that tie in with what you were suggesting as to the nefarious use of the suspense account earlier.
Susan Harding: Yes, “open season”. That’s exactly what that means. Yes.
Mr Beer: He continues:
“I think this is an important position to take in our approach, to underline our objective to simplify and leverage new capability, but recognise the challenge is therefore to define a ‘fit for purpose’ control framework which tackles these fears head-on.”
Then if we go up the page, please, to the reply. You’re copied in to Mr Marsh’s reply. Can you see that?
Susan Harding: Yeah.
Mr Beer: Top right, “Sue M Harding”.
Susan Harding: Yeah.
Mr Beer: In his second paragraph, Mr Marsh says:
“On the suspense account issue, I’m afraid that I share the same beliefs as mine and other Ops reps, if there is no independent control and authorisation process for the use of suspense accounts then postings will rapidly increase to unacceptable levels. Irrespective of our aspirations for a simplified process to support commercially minded agents I believe that many of those of a more historic mindset will exploit the facility …”
So that’s again very similar to the views that you expressed earlier?
Susan Harding: Yes, as I say, this – the decision to remove suspense account wasn’t mine and mine alone, you know. This is business people saying, “We have an issue here and we need it to be tackled”.
Mr Beer: In the decision to remove the suspense account, was there ever any discussion that “Horizon may contain errors, bugs and defects that would cause discrepancies when it comes to balancing, we need to take that into account”?
Susan Harding: Not that I’m aware of but you can see from this, I was copied in on this, the decisions were around the people who worked for me and the key stakeholders. So I don’t know whether any of those people were aware of that. I certainly wasn’t aware of that.
Mr Beer: In the meetings that you attended, in the documents that you exchanged, in any workshops that you were present at, was it ever discussed “Hold on, look, Horizon in its design, its testing and its rollout, has been slightly problematic in terms of balancing. We’ve had hundreds and thousands of calls from subpostmasters saying they can’t balance and they can’t explain why they can’t balance. We need to take that into account in deciding to remove the suspense account facility”?
Susan Harding: No, I was never aware of that, I was never aware – I know right at the beginning I was involved in an Acceptance Incident, right at the beginning, about balancing and stuff, but I was never aware that in the live system there were bugs, et cetera.
Mr Beer: Was, instead, the focus on covering up, hiding and exploitation by subpostmasters and removing the facility for them to do that?
Susan Harding: Yes. I mean, there was absolutely no doubt that previously and prior to Horizon even being there, that subpostmasters – remembering that, you know, they were independent, they were sometimes only audited once every three years, that they did have losses and hid those losses. And, you know, it was part of the principle of not particularly IMPACT but it was one of our things to try to keep those to the minimum. And I can’t remember – the removal of the suspense must have come up in the initial requirements workshops and accepted by all of the stakeholders.
Mr Beer: Mr Marsh continues:
“Given that the overall project should simplify reconciliation and settlement significantly and should therefore mean that errors will be identified more rapidly and will be even more clearly the fault and responsibility of the agent, is there any reason to have a suspense facility at all? This might mean that in extreme cases the agent would need to contact the Retail Line or NBSC and negotiate a ‘loan’ (at some level of interest?) to cover very high values of loss but in most cases the agent should be sufficiently capitalised to cover ordinary variations, particularly if the opportunity were offered to make losses good via credit card, thereby enabling them to tap into 56 days of interest free credit (a facility faced by the NFSP despite my early misgivings.)”
Were you aware at this time that there had apparently been a suggestion by the NFSP that if large losses were shown, their members could always make it up by credit cards, tapping in, therefore, to 56 days of interest free credit?
Susan Harding: I may have been aware of it because I don’t – obviously, my name has been copied in on some of these things but you have to remember as programme manager I was copied in a lot of things and, you know, I trusted – we had some very competent people here. Clive was a very competent technical architect. Tony, if I remember, was head of security, was he? Something like that. So my understanding of things or my involvement in things was generally at a high level. I wasn’t – I was copied in on these things but I couldn’t have dealt with everything, if you like. But I do – I do remember that the decision was made, and it involved lots of stakeholders in that decision.
Mr Beer: Was that decision informed by a view of the contract “We can get rid of suspense entirely because subpostmasters have to bear the responsibility for any and all discrepancies anyway”?
Susan Harding: Yes, I think that’s true, although I don’t think anybody would have necessarily meant that that included bugs and errors in the system.
Mr Beer: Was there ever any consideration of what happens if there are errors, bugs and defects that are the fault of the system?
Susan Harding: Well, if anybody should have done that, I think that would have been Clive, who was the technical architect, who would understand much more about the technical architecture of the system, et cetera. But one would expect, you know, that the subpostmasters would be raising calls with the helpdesk if they could see that there were suspect transactions.
I don’t know what happened with the bugs and defects and what the result was in the accounts that were produced in the branch. So – but one would have thought that if somebody was having a very significant loss, they would try and pin it down to something and then take some action, either through the Network Support Business Unit on the helpdesk or through the hierarchy in the Network.
Mr Beer: What would you say if the helpdesk said to them “But it’s your responsibility to make good any and all losses: make good the loss”?
Susan Harding: Well, I don’t think – I think that’s different to somebody saying “I think there’s a problem with the system”. If there’s a problem with the system I would have expected somebody would deal with that or, you know, look into it.
Mr Beer: What if a subpostmaster was calling and saying, “When I’m balancing, it’s showing, week on week, increased cash that I simply do not hold”?
Susan Harding: I would have expected the Network Business Support Unit to do something about that.
Mr Beer: And not say “Under the contract you’re liable for all and any losses, make good the loss or stop trading”?
Susan Harding: No, you know, if branches were raising concerns that something was happening that they couldn’t understand, then if this was across a number of people, even if it was one office that kept saying, you know, it happens every week, I would have expected there would have been some – that’s what the Network Business Support Unit were there for.
Mr Beer: The Inquiry has hearing a good deal of evidence that there were numerous occasions when Horizon would create imbalances, that the system would fail to identify how that imbalance had been created and, even after investigation, a root cause of the creation of the imbalance could not be found.
Susan Harding: Mm-hm.
Mr Beer: Was it your view that the system was working robustly and well and, therefore, there was no need to make provision in the IMPACT Programme for such events or was it your view that, regardless of any bugs, errors or defects, the responsibility for any losses was that of the subpostmasters anyway?
Susan Harding: I would absolutely never have said that subpostmasters had to make good losses that were caused by the Fujitsu – the Horizon System. No. That’s not my way of working at all, and I wasn’t aware of any of that, so …
Mr Beer: Were you present at any meetings at which the NFSP offered a view similar to or the same as set out in this email here?
Susan Harding: A meeting with the NFSP, did you mean?
Mr Beer: Sorry?
Susan Harding: Did you mean was I at a meeting with the NFSP?
Mr Beer: Yes.
Susan Harding: No, I don’t recall that.
Mr Beer: Did you attend meetings with the NFSP or was that below your level?
Susan Harding: Um … I’m sure I did, because – oh no, I’m trying to think. No, it was probably – I would have had somebody in my team who had the relationship with the NFSP. I would only have gone to a meeting if that member of my team had said they thought I needed to attend.
Mr Beer: Can we look, please, at FUJ00126038. Thank you.
This is an invitation to a meeting by email dated 12 February 2004. The meeting was about branch trading, the treatment of the suspense account to be held on the 18 February. You’ll see that you’re not amongst the list of those who were invited to it.
Susan Harding: Mm-hm.
Mr Beer: But I just want to ask you about some text in the paragraph at the bottom of the page, under the heading “Suspense Account Manual Authorisation process and universal parameter”. It says:
“The decision was reached yesterday by key senior stakeholders to remove the Suspense Account altogether. This would force Branches to make good all losses immediately. This needs to be considered in terms of how Branches can adjust figures, hardship cases, how Branch accounts will be corrected with errors …”
Susan Harding: Mm-hm.
Mr Beer: Can you recall, would you have been one of the people described as “key senior stakeholders” who took a decision to remove the suspense account?
Susan Harding: I honestly can’t remember. If I was in a meeting with those senior stakeholders, it would not have been my decision. I was a programme manager of a project that the requirements came from the business, and so that would have been – I could have been at a meeting. I can’t remember. As I say, a wouldn’t see myself – you might prove me wrong in a minute by another document, I don’t know. But I would not have seen myself as making that decision. I was a programme manager, I wasn’t a business – I wasn’t somebody in the business.
Mr Beer: So who, if you can help us, would be key senior stakeholders who took a decision on 11 February to remove the suspense account altogether?
Susan Harding: Well, at the end of the day, they may have been – it may have been the programme board, which would have been people like – so my programme was sponsored by the Finance Director, Peter Corbett, and then there would be somebody, absolutely, from Network, and that might have included POID. So there would be those type of people who were – who would be making that sort of decision. I say, I may have facilitated the decision being made but it would not have been my responsibility to be one of the people who voted on the decision, if you like. I was just there to implement things if the business decided that’s what they wanted to do. But I don’t remember the meeting.
Mr Beer: I wouldn’t expect you to remember the meeting; I’m just trying to – we haven’t got a record of it or any other documents, I think, that refer to it.
Susan Harding: No, no. But that’s who would imagine. It would be somebody – it would certainly have been Peter Corbett, I would have thought, and then it would include people from Network, which would include people like Security and people like that.
Mr Beer: Would you agree with the view expressed there that this, ie the removal of the suspense account altogether, would force branches to make good all losses immediately? That was the aim after all, wasn’t it?
Susan Harding: Yes, after all, at the end of the day, that’s what contractually I think they were required to do. I think that would have been – not on the basis of that – those losses including errors and bugs in the system. I can’t imagine any of the key stakeholders saying that that was – but I wasn’t there, I don’t think.
Mr Beer: Was that ever considered by anyone? You made an exception today, “Ah, but not if it was caused by an error, bug or defect by Horizon”, but in the documents we’ve got we see no expression to that. In your witness statement you refer to an obligation to make good any and all losses and you said a number of times today yes, ultimately it was the contract to make good any and all losses.
Susan Harding: Yes, and I had no visibility, you know. As I say, I’ve taken an oath, I had no visibility that there were problems with the system. I don’t know whether people in POL knew there were problems with the system. I’m not saying they did or they didn’t, but I wasn’t aware of that. And, certainly, you know, it would not have been – I would not, hand on my heart, have ever expected a branch to make good a loss that was system created.
Mr Beer: Can we look at paragraph 38 of your witness statement, please, which is on page 8.
You say in 38:
“The ‘robustness’ of Horizon was not considered to be an issue and there was no evidence to suggest there were any ‘bugs’ affecting the efficacy of the system.”
Did you hold that view when you were involved as an expert customer?
Susan Harding: Sorry, what do you mean by “expert customer”?
Mr Beer: It’s a phrase you use in your witness statement when you were brought in to the design and testing stage of Horizon.
Susan Harding: Ah, right, okay.
Mr Beer: Did you hold that view?
Susan Harding: Yes, I do remember, as I say, that I was involved in an Acceptance Incident of the original design and I remember going to Feltham, and I think Tony Oppenheim was the – was he the main guy? And Tony had to – I think – and, oh gosh, you know, it is going back a large number of years – that they did some changes or created – I can’t remember but they did, on the face of it, in the meeting that we had, resolved what was – what was the Acceptance Incident.
So – and certainly would not have signed off that Acceptance Incident if I thought there were any. But this was acceptance – I can’t remember whether we did acceptance before it went in any offices or after there’d been a trial. I mean, my recollection –
Mr Beer: It was the latter.
Susan Harding: Was it, after the trial? So I was certainly not aware that there was anything that would affect the accuracy of the accounts. Otherwise I wouldn’t have signed off that Acceptance Incident.
Mr Beer: It was therefore – this, what we see in paragraph 38 – your view at the time that Horizon was rolled out?
Susan Harding: Yes.
Mr Beer: It was your –
Susan Harding: Well, and that I’d not heard anything since.
Mr Beer: Sorry?
Susan Harding: And that I was not aware of anything since then.
Mr Beer: When did you become aware that Horizon was bedevilled with bugs, errors and defects?
Susan Harding: Well, I didn’t know, I’m saying I didn’t know – well, until I’d got involved in this, actually.
Mr Beer: So even up until 2017 when you left, you still thought Horizon was working perfectly well?
Susan Harding: Yes, I had not been advised of anything. Obviously, I’d moved into different roles by then anyway so I wouldn’t have been involved in that sort of thing. I mean, I was working on totally different projects and nothing to do with branches.
Mr Beer: It follows that you held this view throughout your involvement with the IMPACT Programme?
Susan Harding: Yes.
Mr Beer: Were you actively told that there were no errors, bugs or defects in Horizon or no issues with its robustness?
Susan Harding: No, but I would have expected, given that the people who were on my board – because remember, you know, I was a programme manager and I had a programme board of people high up that somebody would have said, “Well, Sue, if you do this, you know, what’s the effect of these bugs, etc?” so I don’t recall that I was ever advised that there were any bugs.
Mr Beer: Yes, thank you. They are all the questions I am going to ask you. I suspect there are other questions from others.
Sir Wyn Williams: Mr Stein?
Questioned by Mr Stein
Mr Stein: Ms Harding, I represent a large number of subpostmasters and mistresses. One of those, his name is Mark Kelly. You’ve used an example today in your evidence which is that you wouldn’t have expected that someone who had suffered a robbery at their Post Office would be then asked to pay up for those losses. Do you remember saying that in your evidence today?
Susan Harding: Yes.
Mr Stein: Mark Kelly was robbed, and the robber took £47,000, was prosecuted as a result, and was given seven years for conducting that robbery. Mr Kelly was pursued by the Post Office for the £47,000. Are you aware of that?
Susan Harding: Absolutely not.
Mr Stein: He gave evidence about that and what happened to him, on 1 March 2022 last year. Did you by any chance see his evidence?
Susan Harding: No.
Mr Stein: Did you watch the evidence of any of those people, the subpostmasters and mistresses that gave evidence during that time?
Susan Harding: No.
Mr Stein: The date of his robbery was 14 November 2004. Now 2004, help us please understand the significance of that date: was that either just at the beginning or just after the start of the IMPACT Programme being born, essentially being discussed?
Susan Harding: Yeah, in – I can’t remember whether it was, but it was around that time when IMPACT was either in – it was certainly in progress or –
Mr Stein: So his robbery in November 2004 was just at the starting point of discussions about the IMPACT Programme and him being pursued, then, for the £47,000 by the Post Office was whilst the IMPACT Programme was being discussed, it seems.
Susan Harding: Possibly, yes.
Mr Stein: I see. Now your statement, which you’ve been asked a number of questions about by Mr Beer here, who has gone through different aspects of your statement, you make various references that – I’ll only quote one, paragraph 32:
“In contractual terms, they were liable [that’s subpostmasters] contractually for any shortfalls which had to be made good.”
You make a number of references throughout your statement in relation to that same topic, this contractual liability. You repeat it, I think, four times.
Help us understand a little bit more about how your statement was created. Did you have the support of lawyers, solicitors, in relation to that?
Susan Harding: No.
Mr Stein: No. So it’s a statement you wrote yourself; is that correct?
Susan Harding: Yes.
Mr Stein: Right. Did you – so we can just understand exactly what happened, was this a statement that you checked with your previous employers, the Post Office, at any stage?
Susan Harding: No.
Mr Stein: No. I’m grateful. Forgive me for asking those questions in that way.
Susan Harding: No, I’m –
Mr Stein: That’s the way your statement reads. It reads as a statement that’s made by someone that has done it themselves rather than going to someone like me, a lawyer; do you understand that?
Susan Harding: Yes.
Mr Stein: Right. Now your statement, in terms of the way it refers to the use of the contractual terms that SPMs, subpostmasters, were liable for any shortfalls, at paragraph 31 of the statement it says this:
“It was agreed during the design of IMPACT that the suspense account would be removed as historically it was used by subpostmasters to hide discrepancies in their accounts rather than resolve them.”
Now, you then have the repeated references to the contractual liability. Mr Beer has asked you a good number of questions about the IMPACT Programme itself and gone through some of the documentation.
Just help us understand a little bit more. This attitude, which is the contractual liability attitude towards subpostmasters liable for any shortfalls which had to be made good, we don’t actually see it phrased that way in the IMPACT documents and points that have been raised and have been discussed with you. It doesn’t appear that way to be referred to.
Susan Harding: Well, I mean, I was actually on holiday when I was writing my statement, so I wouldn’t necessarily have looked at all the documentation. So it’s just my words and my recollection.
Mr Stein: Right. But you’ve had number of questions being asked of you today about the IMPACT documentation. The IMPACT programme itself took in terms of development time about three years, yes?
Susan Harding: Yes, it was a very significant programme.
Mr Stein: Significant programme. It took a lot of discussions.
Susan Harding: It did but you have to remember the IMPACT Programme was mainly about replacement of the back offices, back office systems.
Mr Stein: Yes.
Susan Harding: It wasn’t – there was not a massive focus on the branch, because the – that data was already coming in to the incumbent systems that were there.
Mr Stein: All right but, nevertheless, three years of development of the programme and then you get the signing off of it. There must have been a lot of meetings involved in the development of the programme; is that correct?
Susan Harding: Yes.
Mr Stein: Were they minuted, these meetings?
Susan Harding: I’m absolutely certain they were, yes.
Mr Stein: Yes. Then there must have been a number of different iterations, number of different early copies of the final documents that were then signed off; yes?
Susan Harding: Yes, so ultimately there it was a business case that went right up to the group board, because of the level of cost associated.
Mr Stein: Now, all of these discussions, and the ones that were minuted, were they kept by you in a particular file on a laptop or a desktop that you had?
Susan Harding: We would have had a depository of those documents but I wasn’t, you know, I was programme manager so I had a programme support team that would have dealt with all those documents.
Mr Stein: The programme support team that dealt with documents in the repository, can you give us an idea of, if you like, who was in charge of that? Who had control of that documentation?
Susan Harding: I can’t remember that.
Mr Stein: The repository, any better idea about a way to identify that?
Susan Harding: No.
Mr Stein: Was it called anything? Would you say something to a particular repository within the system?
Susan Harding: No, I would rely on my team, if I wanted a document, to get that document for me.
Mr Stein: Right. Your team – the person that you would go to within your team would generally be who?
Susan Harding: The – my programme support team.
Mr Stein: Name, please, if you have it? Who in the programme support team would you routinely go to to say –
Susan Harding: I can’t honestly –
Mr Stein: – “Would you mind terribly, can you find me the meeting minutes of a year and a half ago”?
Susan Harding: I can’t remember, sorry.
Mr Stein: Who was in your team?
Susan Harding: So I had Torstein was my technical design –
Mr Stein: Torstein?
Susan Harding: Torstein Godeseth, who later moved to Fujitsu. Torstein was involved with me. I had Ann Clarke, who was – used to work in Transaction Processing, so – which was really – because the whole of IMPACT primarily, the main of IMPACT was to replace the back office systems. You know, the changes that were made to the Horizon System were only to facilitate that.
So we were putting a SAP system in to the back office. So that was primarily were there – Ann Cruttenden represented the Network.
Mr Stein: But in terms of people that can help us identify the documents, these meetings that you claim were minuted, that might be Ann Clarke and Mr Godeseth?
Susan Harding: They might be able to, yes, but neither of them are at the Post Office anymore so if they were – if they were somewhere, you know, that neither of them – or – are there any –
Mr Stein: But we should be able to find, should we, within the Post Office, a repository of documentation that deals with the development over the three years of the IMPACT Programme, basically, you would expect?
Susan Harding: I think you might do but I don’t know where that would be.
Mr Stein: Right. Now, help us a little bit more. I’ve asked a number of questions about the contractual liability side of things and then you’ve been asked by Mr Beer questions about the ability which was to use the suspense account used by subpostmasters to hide discrepancies.
I’ve asked you about the shortfall side of things not being in the IMPACT documentation. Have you seen in the IMPACT documentation that you’ve gone through a reference to subpostmasters hiding discrepancies in those accounts in that documentation?
Susan Harding: No, I guess it’s my – the wording is my recollection of what I was asked to do in the programme. Remembering that, you know, I was the programme manager. I wasn’t the owner of the requirements, although some of it – because I’d been business architect, the origins of the programme came out of me being the business architect because I was trying to design more effective system relationships. So the main focus of IMPACT was about putting a SAP system in the back office.
Mr Stein: Yes, so the points that I’ve raised, which are the – the potential for subpostmasters to use a suspense account to hide discrepancies, paragraph 31, one of the examples, paragraph 32 the contractual liability for shortfalls which had to be made good, those are in your statement; these are all things that you understood had to be dealt with by the IMPACT Programme.
Susan Harding: They would have been requirements that were provided to me by the programme board or people representing members on the programme board. So I say Ann Cruttenden represented the Network. We would have had people representing POID who would be the main people who would have come up with that as a requirement.
Mr Stein: So twinning these two things together, basically you understood that the IMPACT Programme was at least partly going to be designed to stamp out the use of subpostmasters hiding discrepancies and that they were nevertheless liable to make good any shortfalls. These were two big drivers for that part of the programme; is that correct? That’s what you understood?
Susan Harding: Yeah, well, yes. Yes. While we were – I wouldn’t say they were two big drivers. I would say they were things that were put into the programme. Because we had to make changes to the Horizon System in order to feed the new back office systems we were putting in, we would have had workshops and, at those workshops, there would have been the idea that we should clamp down, as I would say, on the suspense account.
Mr Stein: Right and these things – I’m using your words – these things that were put into the programme, who explained that these things needed to be put into the programme? Who was it that gave you those instructions?
Susan Harding: It would be the key stakeholders.
Mr Stein: Right. In particular, who? You mentioned Ms Cruttenden.
Susan Harding: Well, as I say, I would have suspected that there was – there were three areas – well, Network, which I would include, you know, the Network line, but also – and I can’t remember whether POID were part of that Network line at the time or whether they were in a separate area – and then it would have been from Finance because, clearly, Finance – and Peter Corbett was the sponsor who was in Finance, who was having to include those losses and, as we’ve seen in the documents, we were talking earlier about the scale of the losses that were in the accounts, and that was a big driver for the business at the time to reduce those.
So we would have – but because Peter was my sponsor, in the initial requirements workshop those sort of things would have – I imagine it would have come from key stakeholders. I can’t remember the exact –
Mr Stein: Right, and the way you described this earlier, you described Peter Corbett as being a Finance Director and you also referred to the fact that you were told to do certain things. The way I’ve recorded it was that you were told go “do that” and the “do that” includes these particular points, which relate to subpostmasters, “Get rid of these subpostmasters hiding discrepancies in the suspense account and make sure that they’re liable for all shortfalls”?
Susan Harding: Yeah, and some of it, because, as I say, because I’d been business process architect and a number of other things, they would be things that I would have – so I don’t know where the original idea came from. It could have come from me, the idea, and then the Finance Director said, “Yes, that’s a good idea”, or it could have come from the Finance Director. I can’t remember the order of how it came about.
Mr Stein: Now, just I’ve only got one point before I move on. I won’t take long on this. This question, this idea of subpostmasters hiding discrepancies in their accounts. Again, across the IMPACT documentation we’ve seen, there is no evidence that is set out saying that “We’ve got 30 postmasters and mistresses, these are the names, these are the dates, these are what happened, doing all of this?” There’s no reference to a whole bunch of evidence of subpostmasters doing this. Was there a document that you were given that’s part of your “go do that” programme that set out evidence that demonstrated that subpostmasters were doing this very thing?
Susan Harding: No, but I’m assuming because there was values of losses within there that those losses figures were given to me by people, and there would have been – because POID were involved, they would have had cases, numbers of cases, and done. So there would have been all that sort of thing. And remembering that, ultimately, the requirement is signed off by the programme board, they might have been created by me and my team but they were owned by the programme board and those areas were all represented on the programme board.
Mr Stein: Right, okay. So this seems to be the situation. You did not see any actual evidence that demonstrated that subpostmasters were carrying out this very programme of hiding discrepancies in the suspense accounts? There was no document that said, “We’ve got 60, 50 of these people doing this”? Is that correct; is that correct?
Susan Harding: I can’t recall that. But I’m sure that people gave me those – well, it wasn’t my decision to do it anyway. As I say, I was programme manager, so I was doing what the board, my program board, wanted me to do –
Mr Stein: Right.
Susan Harding: – which was documented in those requirements.
Mr Stein: So this is a two-step thing. First of all, you did not see such a document setting out the evidence that lurks behind this idea that subpostmasters were going around hiding? Right.
Susan Harding: I can’t recall seeing a document but I’m sure that I was provided with information from people who I would have trusted to provide me with the correct information.
Mr Stein: So are you assuming, is this your evidence now before this Inquiry, that your programme directors, the people that told you to “go do that” had such evidence?
Susan Harding: I would assume that. Yes. They were all decent people.
Mr Stein: Okay, so that’s your programming in terms of the “get this done”. I’ll just briefly move on. You’ve spoken about your knowledge of the system and you’ve spoken about the system you believed that was capable of rectification of any problems within the system. Let’s just take that one step further. You’ve spoken about the helpdesk, and you knew that the helpdesk was there as a line of support for subpostmasters; is that correct?
Susan Harding: Yes.
Mr Stein: Were you aware that there were four lines of support theoretically available to subpostmasters? First of all, the helpdesk, then beneath that, three other lines of support as and when the technical problem got more and more difficult? Were you aware of that?
Susan Harding: Well, I’m assuming the helpdesk would reach out to other people and experts. The helpdesk themselves were not experts in the system or anything like that. So the helpdesk would reach out to whatever they –
Mr Stein: Can we avoid assumptions for the moment. In the time whereby you’re starting off the IMPACT Programme, let’s find out what you knew at that stage. So you’ve got a first line support which the helpdesk answering the telephone call, yes?
Susan Harding: Mm-hm.
Mr Stein: You’re aware of that. Were you aware at that time, during this early stage of the development of the IMPACT Programme, aware that there were three other lines of technical support for subpostmasters?
Susan Harding: I can’t remember if there had been three other lines. I think there was a Horizon – was there a Horizon Helpdesk in Fujitsu? I’m not sure. No. So I’m not – I can’t recall but I would have been aware at the time, I’m sure.
Mr Stein: You’ve been asked a good number of questions by Mr Beer about your knowledge of bugs, difficulties with the system, software problems. So what I’m trying to establish with you is what you knew about any system that was there to deal with such problems. So you knew about a helpdesk, in other words people taking telephone calls?
Susan Harding: Yes.
Mr Stein: Right. You weren’t aware about three other lines of support to deal with more and more difficult problems?
Susan Harding: Well, if you could describe what they were –
Mr Stein: Yes, certainly I will.
Susan Harding: – I might say whether I can remember them or not.
Mr Stein: By any chance you might have spoken to Gareth Jenkins about this?
Susan Harding: I know Mr Jenkins very well.
Mr Stein: Yes, we see a reference to him on the documentation. During the period of time whereby the helpdesk was in operation, there were about 20 to 100 software designers and developers working in fourth line support at any one time. All of them were allocated bugs, errors and defects, depending on their experience and technical knowledge of the component parts of the Horizon System architecture. Did you know that?
Susan Harding: Yes, so I knew there was a Horizon Helpdesk. I didn’t know the constitution of it.
Mr Stein: Did you know, I repeat, that there were about 20 to 100 software designers and developers working in the fourth line support at any one time, all of them were allocated bugs, errors and defects, depending on their own experience with and technical knowledge of the component parts of the Horizon System?
Susan Harding: No, I didn’t know what the Fujitsu helpdesk looked like or how it was structured.
Mr Stein: Now I’ve read that from the statement of Mr Gareth Jenkins.
Susan Harding: Yes, because Gareth was in Fujitsu.
Mr Stein: Now if at the time of your development of the IMPACT Programme you’d have been told that we’ve got four lines of technical support for subpostmasters, including one of them, which is the really when it’s got sort of difficult line, fourth line support, dealing with 20 to 100 software designers and developers, looking at bugs, errors and defects, depending on their own type of qualification, all going on at one time, do you think that might have made you think “Well, hang on perhaps we ought to just give couple of thoughts to whether this system is really robust or not”?
Susan Harding: I wasn’t aware of that, so I can’t say what I would have done –
Mr Stein: If you had been told.
Susan Harding: I don’t know how I would have reacted if I’d been told because I need to understand more than what you’re telling me, you know. I mean, all systems have support teams behind them. So I don’t know. I can’t answer that and I was a business – you know, I was a business owner of the programme. I wasn’t responsible for the support desks and et cetera.
Mr Stein: It’s possible it might have put you on notice that you may need to ask a few more questions about the nature of these bugs, defects, software problems; do you agree?
Susan Harding: Yes, if I’d been made aware of them I would probably be – particularly if they were ones relating to accounting because that was really what – IMPACT was improved accounting, you know, so if I thought that there were bugs, et cetera, around accounting, I may have made different decisions. But I wasn’t aware of that.
Mr Stein: Lastly, just on this, Mr Jenkins didn’t tell you about that, he didn’t tell you “We’ve got this whole entire system, including a fourth line support system, with loads of people working on it, dealing with bugs and defects”; he didn’t tell you that?
Susan Harding: No, because my – I would have – so Torstein, who now works with Fujitsu, was my technical architect so he would be, if anybody, the person talking to Gareth. But I can’t say whether – I’m sure if Torstein had been aware of it then he would have told me. But I can’t say. Maybe he wouldn’t.
Mr Stein: Thank you, Ms Harding.
Questioned by Ms Page
Ms Page: Thank you, I have some questions for you as well. My name is Flora Page and I act for some of the subpostmasters. In your witness statement, you’ve told us that the processes for raising a dispute regarding a discrepancy were not changed by the programme, the IMPACT programme and branches were supported by the helpdesk and/or the Network team, and they would raise any concerns through those channels. Yes?
Susan Harding: That was my understanding, yes.
Ms Page: I think I understood from your answers just a moment ago that you haven’t watched any of the testimony from the subpostmasters in Phase 1, is that right, or read it?
Susan Harding: No, I haven’t.
Ms Page: What I’d like to do is take you through some testimony that talks about how the support that you were relying on actually operated. So I’m going to ask, please, for INQ00001035 to be brought up, please. This is the testimony of subpostmistress Ms Janet Skinner. We’ll just read through some of that evidence when it comes up.
Can we go, please, to page 24. We’ll start on what’s actually the sort of page 94 of the testimony, so we can sort of zoom in, please, on the top half of the page. I’ll just read it out if that’s all right, so that it’s clear for everyone:
“When you experienced an apparent discrepancy or shortfall shown by Horizon, what did you do?”
So that’s a question to Ms Skinner and she responds:
“Well, you’d have to go through everything that you had on hand, like giro things and making sure your rems had been done correctly, but the only thing you really had was what you had in front of you, and I think what the Horizon system installation did was it took away all of the paperwork that you had that you could cheque. So the only thing – information you actually had available was what the Horizon system gave you.
“Question: To whom did you look for assistance?
“Answer: The helpline. I rung the helpline on numerous occasions. To be honest, when you rang them, it was like they were reading from a script. You could tell what they was reading. It was something – it was a script written because of the way it was said to you over the phone, and if they couldn’t help you, they would just say, ‘Well, you just have to make it good yourself’.
“Question: According to the judgment of the Court of Appeal (Criminal Division), you contacted the helpline 116 times between 1 January 2004 and 31 January 2005; is that right?
“Answer: Yes.
“Question: What advice did you receive?
“Answer: Basically the same: if the office was short, it was my responsibility to make good, that I was wrong.
“Answer: You’ve explained in your statement that matters came to a head in 2006?
“Question: Yes.
“Answer: What happened?
“Question: The loss – my office was running at a loss of £40,000. I had a visit from two retail network managers. There’s only one of them I can remember her name and it’s Diane Oyles, and when they came I took them in the back, explained to them that my offices was running at a loss. They asked if they could do a cash check while they was there and they said, ‘Well, what we’ll do is we’ll keep the office open, we’ll just do a cash check’.
“So I said, ‘Well, to be honest, I’d rather close it, have an audit and sort it out’, and so they did the cash check, we closed the office, they removed the keys from me and told me I had to meet them there the next morning at 9.00 with the auditors.
“Question: How did you feel when you were told to leave your branch?
“Answer: Devastated, absolutely devastated, but I think I was more relieved, as well, because I thought now, obviously, they’re going to get to the bottom of what’s gone wrong. I think you, sort of, you put your trust in them because, as they keep portraying themselves, the Post Office are a trusted brand and their trust wasn’t to find a problem that, it was to find a solution, and I was the solution.
“Question: You have described employees of the Post Office coming to your branch to carry out an audit. What did they tell you about the outcome of that audit?
“Answer: They just said that it was actually running at a loss of 59,000 and I was suspended without pay. I was searched before I left and I was also informed that if I removed anything from the office, it would be classed as theft. So all paperwork, nothing, I couldn’t move anything. It all became the property of the Post Office.
“Question: How did you feel when you returned home later that day?
“Answer: I was devastated, absolutely. Everything just crushed. You just feel crushed.”
I’ll pick it up, if I may, by going to page 26 on our system, and picking up on page 101 of the page numbers that come up on the screen:
“Were you aware when you attended court on 2 February that you might be sent to prison?
“Answer: No, I really didn’t think I had, because to go to jail, you’ve got to have committed a crime and, if you can’t prove that you’ve committed a crime, because I couldn’t, I hadn’t and they couldn’t proved I had, but yet I still went to jail.
“Question: Where in court were you standing when the judge read out your sentence?
“Answer: In the dock.
“Question: What did the security guards do when the judge sentenced you to prison?
“Answer: You’re stood in the dock, and he said that he was giving me a nine-month prison sentence because of the amount of money that was involved, because I’d stolen from the Crown, and I heard the gate lock and then he told me that it was a custodial sentence. I’ll be honest, I though he was going to say ‘suspended’ but he didn’t.
“Question: How did you feel when you were escorted out of the courtroom?
“Answer: I was just an emotional wreck, I don’t actually remember. The only thing I remember is being in the holding cell and then going to Wakefield Prison.
“Question: How were you transported there?”
We’ll just go over the page for a few more lines:
“Answer: In – well, they took me out in handcuffs, put me in one of those police transport things.
“Question: What happened upon your arrival at prison?
“Answer: I was photographed, fingerprinted, told to remove my clothes so they could strip search me. So they put – made me stand behind the curtain and squat and then put a mirror underneath to make sure you’re not taking anything in with you.
“Question: Did you have an opportunity to speak to your children when you arrived into prison?
“Answer: I was given a phonecall there in the evening and my daughter wouldn’t actually speak to me because she was just – she was an emotional wreck and I didn’t want to speak to her, to be honest. I felt so ashamed. I was supposed to be there to protect them and show them what – you do the right thing but yet you do the right thing and I went to jail anyway.
“Question: Were your children able to visit you in prison?
“Answer: I didn’t want them visiting me. That was the only thing I could control and it was hard enough for me to have that memory of me being in jail, they weren’t having that memory of me being in jail. So I refused to see them.”
So what I’ve just read out there is the testimony that explains both the so-called support that was offered by the helpdesk and the Network team and the devastating consequences of that so-called support or lack of on the subpostmasters.
Now, the processes you say for raising disputes didn’t change, but perhaps the point is that they should have changed. So what I want to understand is, given that your programme board was putting in place a system that would remove the suspense account facility so that subpostmasters had to rely on these helpdesk calls and these so-called Network support processes, did anyone on the programme board offer any kind of challenge to the people responsible for those systems, any kind of constructive challenge to find out whether those processes were working?
Susan Harding: No, I don’t recall anybody. I mean, I got a set of requirements from the business, you know, through a series of Network – series of, um, of workshops, and I don’t recall, you know, anybody – in fact, you know, the requirement would have come from the Network to remove the suspense account.
Ms Page: Who was that, then? Who was responsible for the Network?
Susan Harding: I can’t remember who was represented at the time.
Ms Page: Who was on your programme board responsible for the Network?
Susan Harding: I can’t remember. I’d have to –
Ms Page: Do you want to take a bit of time to think about it because you’re saying that this is where it came from; this is who wanted it.
Susan Harding: No, I can’t – I mean, Peter Corbett was my sponsor and it may have come from Peter. He was in Finance, obviously the impact of that. And I know Ann Cruttenden was the representative at the next level. But I – I’m really, really sorry. I mean, my memory is – I have issues with my memory and I just can’t remember who was the Network representative on the programme board.
But, you know, it would have been signed off – there was some documents right at the beginning, the business case would certainly have been signed off at – well, it was signed off at the group board level. So it would have gone through all of that process.
Ms Page: Did Peter Corbett offer any sort of challenge to find out whether the Network support was as it should have been?
Susan Harding: Not – I can’t remember.
Ms Page: Well, thank you. Those are my questions.
Susan Harding: Okay.
Sir Wyn Williams: This programme board that you’re giving evidence about, I don’t expect you to remember precisely, but just help me a little. Was this a body which was three, four, five people or a larger body?
Susan Harding: It would probably have been about five or six people. So Peter Corbett was the sponsor so he would have been on there but then the Network would have been represented, and certainly Peter –
Sir Wyn Williams: Can I just stop you there. So Peter Corbett and we’ve got something specific about him, he’s the Finance Director, so if I imagine a Finance line so to speak, he would be the senior person on the board in Finance?
Susan Harding: Yeah, because remembering that the programme was primarily about implementing new system in the back office, a new SAP system, so the losses bit was not a – was a – was a byproduct of the fact that we had to alter the Horizon System. So it wasn’t particularly a big network impact project.
Sir Wyn Williams: No, in general terms, his main concern would have been to reduce losses, but reducing losses was only one part of what it was all about.
Susan Harding: Absolutely, which you saw in the document.
Sir Wyn Williams: Right. I’ve got that. So give me an idea of the equivalence of Peter Corbett in other spheres, if you would, so I can understand the make-up of this board? So you’d have had someone of similar seniority to Peter Corbett from which other departments, if I can put it in that way?
Susan Harding: I honestly can’t – I’m really sorry but I can’t – we would have had somebody from Network. Ann Cruttenden was the next level down because she was the business change manager from Network and –
Sir Wyn Williams: I’m sorry to stop you again, but when you say next level down, so in Network terms, there’d be – are you saying there’d be someone of Peter Corbett’s seniority but she was one below that? Is that what you’re trying to convey?
Susan Harding: No, I was – I’m not saying she was one below the Network Director. What I’m saying is the programme board may or may not – it may have not had a director from Network because, as I say, the change in the Network was nothing like the change in Finance so Peter Corbett ran the programme board. There would have been somebody from Network because there were implications on Network. Ann Cruttenden was the business change manager for the Network so she was the main – she was the person involved but she wasn’t a board member in that sense.
I’d have to find a document that had got the names of the board and apologies for not remembering.
Sir Wyn Williams: All right. So if I wish to enquire into this more closely, I’m looking for the names of four or five other people apart from Mr Corbett, by the sounds of it, roughly?
Susan Harding: I’d have to find a document. I honestly can’t remember back that far.
Sir Wyn Williams: I’m sorry to take you back to it again because you’ve been asked many questions about paragraph 31, one way or another, about – but I’m still slightly bemused, I have to say, about the use of the word “hide”. You’ve put it in inverted commas. What do you actually mean when you say that, historically, the suspense account was used to hide discrepancies? Explain it to me in your own words. What was happening?
Susan Harding: So there’s – there’s no doubt that in the past there had been people who stole from post offices, people who ran post offices –
Sir Wyn Williams: Can I just stop you there. I understand that to be, as a matter of fact, correct. But from my perspective at least, the last thing that anybody who had actually stolen money from the Post Office would do was to signal a loss by putting it in the suspense account, which is what’s bemusing me a little.
Susan Harding: Okay, so they’re either going to inflate their cash and stock balances, but that would trigger – that would have triggered an earlier investigation, because we had a big focus on cash management. So nobody wanted a branch to own significant cash. So if you’ve lost – if you’ve been taking something, at the end of the day you’ve got the transactions. The system has recorded, and then you have a declaration of cash and stock.
So the only way to cover up the difference, because clearly you won’t have the cash and stock in the system as you should have, and you’re meant to do a translation, then, of the cash and stock, yeah? So the only way to hide a discrepancy is either to inflate your cash and stock figures, and cash is probably – it would have been an easier one in the system than stock, because stock is all about stock in, stock out, et cetera – so you would either say “I’ve got more cash than I really have”, or you would report the cash you really have, and put the difference in the suspense account.
It’s an accounting – double entry accounting system, so we have to make it balance somehow. So if, when you actually count your cash and stock, it’s not what you expected, you either declare a loss or you try and put it somewhere and the suspense was a place that you could put it because you couldn’t alter the other transactions because they were system generated from having done the transactions. Does that make sense?
Sir Wyn Williams: Well, all right. You also used the word “historically” in that paragraph, which conveyed to me, when I first read it, that that was something that had happened in the past, but wasn’t necessarily happening at the time, ie 2003 to 2006.
Susan Harding: It didn’t mean that.
Sir Wyn Williams: Should I take that view or not?
Susan Harding: No, you should take the view that that meant that the evidence would have been historical, but then it was expected that that was still what they would do.
Sir Wyn Williams: But that’s surprising me, if I can put it in that way. The fact that there may have been illegal activity in the past isn’t a necessarily safe foundation for concluding it’s subsisting at the time, is it?
Susan Harding: No, I wasn’t saying it was subsisting; I was saying historically that had happened and therefore removing a way for that to continue to happen was why we had that requirement.
Sir Wyn Williams: Okay. Thank you very much for coming to give evidence, Ms Harding.
Mr Beer: Sir, thank you very much. Can we say 1.50, please, this afternoon?
Sir Wyn Williams: Always assuming Mr Burley is ready. I had some information that he wasn’t ready until 2.00 but if you know better, then we’ll say 1.50.
Mr Beer: I never know better. But if he is available can we say 1.50?
Sir Wyn Williams: Yes, so everybody should be prepared to start at 1.50, to use those that famous phrase: not before 1.50.
Mr Beer: Thank you very much.
(12.55 pm)
(The Short Adjournment)
(2.00 pm)
Mr Blake: Good afternoon, sir.
Sir Wyn Williams: Good afternoon.
Mr Blake: Can I call Mr Mark Burley, please.
Mark Burley
MARK BURLEY (affirmed).
Questioned by Mr Blake
Mr Blake: Thank you very much. Can you give your full name, please.
Mark Burley: Yes, Mark Richard Burley.
Mr Blake: Mr Burley, I’m going to ask for your statement to be brought up on screen and you should be able to see it, it’s WITN03850100. Is that your statement?
Mark Burley: It’s very blurred at my end. That’s better. Page 1 definitely looks good, yeah.
Mr Blake: Do you have a copy of it in front of you?
Mark Burley: I do, yes.
Mr Blake: On 4 January, is it right to say that you signed a statement of truth that was separate to that statement but it confirmed the truth of the content of that statement?
Mark Burley: I couldn’t confirm the exact date. Is it on my signed copy? No. It’s not on my copy either. I can’t confirm the exact date but it’s around about that time, yes.
Mr Blake: Yes. Is this statement true to the best of your knowledge and belief?
Mark Burley: It is, yes.
Mr Blake: Thank you. That statement will go into evidence and the questions I will ask you today will be supplementary to that.
Your statement is quite light on detail so I’m going to start by asking you a little bit about your background. When were you first employed by the Post Office?
Mark Burley: 1985. It could have been – I started on 31 December, so I’m just thinking was it ‘85 or ‘84? It might have been ‘84.
Mr Blake: Okay. Did you have another job before that, or was that …
Mark Burley: I worked for Sainsbury’s before that, just to – as – I mean, technically, it was a part-time role but I used to do full time hours for them.
Mr Blake: Can you give us an indication of the types of roles you held at the Post Office before becoming involved in HNG-X or what we know as Horizon Online?
Mark Burley: Yeah, I started off as a post office counter clerk. That was my first role. I then moved on to be an area manager support. I then moved on to be a branch manager at three different branches. I then moved on to an internal audit role, auditing various processing systems across the business. I then moved on to be a retail network manager, essentially accountable for the performance of around about 35 of the largest sub post offices.
I then moved into project work, held a number of project manager positions and then in 2003 I set up a PMO function, project management office function, before becoming the HNG-X programme manager in 2005, which I held until 2009 before becoming head of delivery, and then I left on a voluntary redundancy term in early 2011.
Mr Blake: Was your role as head of delivery until 2011?
Mark Burley: It was, yes.
Mr Blake: Can you tell us what the role of head of delivery involves, briefly?
Mark Burley: Essentially, it was to look across the whole of the technology delivery that Post Office were doing at that time. So HNG-X was one of those projects that came under that, but I was no longer the programme manager for the programme.
Mr Blake: Thank you. You’ve said in your statement that you had programme management qualifications. Did you have any other qualifications that are relevant, a computer science background, or anything along those lines?
Mark Burley: I didn’t have computer science background, no. I had lots of project manager qualifications, PMO qualifications and, as you say, programme manager, business analyst qualifications and – but not a computer science background, no.
Mr Blake: I’m going to go broadly chronologically this afternoon. I want to start with Legacy Horizon. In your witness statement, you say you weren’t aware of any faults with Legacy Horizon but there were bugs that were investigated and fixed, to the best of your knowledge. What do you see as the difference between a fault and a bug or a series of bugs?
Mark Burley: Well, I’m not even sure I said that in my statement. Could you tell me where I said that in my statement because I wasn’t that close to original Horizon. I was only on the periphery of original Horizon.
Mr Blake: Your statement is quite brief on that. Let’s have a look at page 2. So it’s WITN03850100. It’s the top 2 paragraphs that really address Legacy Horizon.
Mark Burley: Yeah, and point 6 that I wasn’t aware of any –
Mr Blake: You say:
“I was competent in the use of Legacy Horizon and was involved in an assurance rollover its development.
“I wasn’t aware of any ‘faults’ with Legacy Horizon but was aware it was essentially a modified EPOS solution and as such errors on data input could be made with consequential impacts on weekly accounts.”
So that’s a suggestion that human errors in input could have a consequential impact:
“As with any technology solution, bugs did occur but these were investigated and fixed – appropriately (to the best of my knowledge).”
So you have distinguished there between faults and bugs.
Mark Burley: Yeah, I mean, what I’m trying to distinguish there is when original Horizon went live, I wasn’t aware of any overarching faults with the system that could cause a real problem. A bug is something that may not be technically perfect but doesn’t cause a problem because there’s either a workaround or it’s not actually having a direct impact.
So, for example, I would describe a bug in this sense to be something in Arial font rather than Times New Roman, for example. It doesn’t really have any real impact on the user. Are you still there?
Mr Blake: Yes. So your evidence is that there were some problems but they were ones that didn’t really have any real impact on the user?
Mark Burley: Yeah, as I recall it, on the original Horizon System, it went through quite an extensive period of what they called acceptance, and that was validating that what the Post Office had asked for had indeed been delivered, and there were numerous examples and I did support some of these where there was a more serious error or a more serious bug, whichever word you want to use, that we would declare wasn’t fit for acceptance. In other words, we weren’t prepared for the system to go live whilst that bug persisted because it could have a more significant impact on a user.
Mr Blake: Your evidence from a moment ago is that you had quite a peripheral role in relation to what we know as Legacy Horizon; is that right?
Mark Burley: I’d have supported a few of the examples of working through the acceptance criteria.
Mr Blake: We’ll go through some of the documents, and your name does appear on quite a few documents, concerning Acceptance Incidents in relation to Legacy Horizon. Let’s look briefly at a couple by way of early background. We can look at FUJ00058445. This is a document from March 1999. This is a model office testing document. If we go over the page, it has you on the circulation list and you’re listed as being part of the TIP project. We know TIP as Transaction Information Processing?
Mark Burley: That’s right.
Mr Blake: Do you remember your role in relation to that project?
Mark Burley: I don’t remember the detail of the role but I would have been supporting it from a business assurance perspective, so making sure that the system being developed operated according to the required business controls.
Mr Blake: So when it came to testing, you were part of the TIP project, and your role was in relation to the business requirements for the TIP project; is that fair?
Mark Burley: Yes, that’s right.
Mr Blake: Then we’ll look at another document POL00090073. This a document from June 1999. It’s headed “Horizon Project – Acceptance Review Comment Sheet”, and it has your name there in the top right-hand corner, as part of a panel in relation to the acceptance review. Do you remember your involvement in that panel?
Mark Burley: Well, this panel, this acceptance sheet – I don’t recollect a panel as such – but this acceptance sheet would probably relate to one of the acceptance items that I was asked to look at.
Mr Blake: We’ve heard a lot of evidence, including expert evidence, of serious problems during acceptance and the rollout of Horizon. Do you accept that there were serious problems during the period of your involvement in the acceptance process and rollout of Horizon?
Mark Burley: All I can say on that is that the elements of acceptance I was involved in, we did the right degree of due diligence and made the recommendation accordingly as to whether it would either be accepted into – you know, as a minor bug that wouldn’t cause an impact or needed to be fixed and therefore would be fixed before we proceeded.
Mr Blake: Let’s look at the ones that you were involved in or certainly that the documents show you were involved in, let’s look at POL00090478. This is a document the Inquiry is familiar with. Can we look at page 75 it’s a list of various different Acceptance Incidents. I’m not going to spend too long on Legacy Horizon, I’ll just take you through a few of these documents.
So it’s page 75 and that addresses Acceptance Incident 410. I’m just going to read what it says about Acceptance Incident 410 and it’s got your name down as the owner there. It says:
“TIP have detected an instance where transactions received in the daily transaction file are not represented on the electronic cash account at the weekend.
“The transactions missing from the cash account are associated with a product changing from core to non-core.”
Do you remember that Acceptance Incident at all?
Mark Burley: I don’t remember the Incident, no but that would have been, in my view, you know, a high priority Incident that needed resolving.
Mr Blake: Do you know why you’re listed as the owner of that particular Incident?
Mark Burley: No, I can’t tell you why I was listed as the owner. I may have been the one leading the investigation into it but I can’t recall what at this time, and that’s 24 years ago, nearly.
Mr Blake: Yes. I mean, you would accept that issues with the cash account are quite fundamental to the workings of the Horizon System?
Mark Burley: Absolutely critical. I totally 100 per cent agree and that’s why, as I suggested, if I was investigating this one, it would have a severity of – using the scale on the right, it would have a severity of high. It would absolutely have to be understood before it was, you know, accepted to proceed, or indeed fixed.
You know, until you get into the detail of these things you don’t know the ins and outs of what’s truly happened. It could be that it was represented on a different line than the one it was expected to be on just from, you know, a typo in the coding. But, obviously, that’s part of the investigation that would need to take place on all these types of incident.
Mr Blake: Can we look at POL00030393, please. This is now moving from July 1999 to August 1999. This is an electronic memorandum from Ruth Holleran; do you remember Ruth Holleran?
Mark Burley: Yes.
Mr Blake: What was her role?
Mark Burley: As I recall at this time, I think Ruth led the acceptance process, I believe. I couldn’t be 100 per cent certain on that, so it would need checking factually, please.
Mr Blake: Thank you. You’re listed there. Can you see you’re copied into that memo, your name –
Mark Burley: Yeah.
Mr Blake: – appears? This is a list of high impact, high severity Acceptance Incidents. If we can turn to page 3, please, in the second column there’s reference to 376, that’s Acceptance Incident 376, that’s something the Inquiry is quite familiar with now and that relates to data and integrity issues. It’s described there as:
“TIP derived cash account not equal to electronic cash account received by TIP.”
As part of the TIP team, do you recall that particular Acceptance Incident at all?
Mark Burley: No, I don’t recall the specific Incident, no, but clearly that would be a high severity issue that we would not want to go live with.
Mr Blake: Having been – we’ve seen part of that TIP team, is that something you would likely have been familiar with at the time?
Mark Burley: Possibly. I can’t remember the specifics of which ones I was asked to get involved with and which ones I wasn’t. As I said, I was involved in some of the Acceptance Incidents but only a subset.
Mr Blake: If we turn over to page 5, we get to Acceptance Incident 410, which is the one that you mentioned you were listed down as the owner of, and that’s the second column. If that paragraph there could be expanded, please. It says:
“410
“This incident was previously recorded under AI376.”
So it appears they were linked:
“However as the effect is different, this now stands alone. It refers to a scenario resulting in the TIP derived cash account, calculated from Pathway’s daily transaction files, exceeding the transaction totals in the Pathway cash account. (Refer to description of AI376 for more detail on this process). It is this latter cash account stream that feeds the POCL accounting process via CBDB.”
Does this assist you at all in recalling this particular Acceptance Incident?
Mark Burley: It doesn’t assist me in recalling the incident, no. All I can say is I repeat what I said, that anything that impacted the cash account and data potentially being missing would have to be fully explained before I would recommend proceeding. Now, you know, as I say, I can’t remember this specific one, but we’d have made investigations of both the Pathway solution and also the TIP solution.
Mr Blake: Because that kind of an Incident, that’s not just a change from Times Roman Numeral to another font?
Mark Burley: Oh, no –
Mr Blake: That’s quite a significant –
Mark Burley: This is something that, you know – you know, as I said, I did not manage or lead the acceptance process but my recommendation would have been not to proceed with an Incident like this being open.
Mr Blake: You say “would have been”. Was it or is that something you don’t remember?
Mark Burley: I can’t recall. I mean, I can almost certainly say that – well, I can certainly say my recommendation would have been not to proceed with this being open without a satisfactory explanation. I can certainly say that, you know, as I’m on oath. I can’t say anything about the specific, because I don’t recall it. But, you know, looking at the detail, I’m, you know, trying to be absolutely honest with you.
Mr Blake: Thank you. Can we turn to page 6, please. Thank you. If we look at the fourth column there, it summarises the current position and a concern of Post Office Counters limited. It says:
“POCL also require evidence that integrity checks in support of R818/08 are sufficient for all business data. In the absence of this evidence, the integrity of the data that drives the central accounting process is in question. This incident is therefore adjudged high in line with AI376 and AI411.”
Is that consistent with what you’ve just told us about the significance of this kind of an Acceptance Incident?
Mark Burley: That’s absolutely exactly what I’m referring to. It would be adjudged high and we would not proceed.
Mr Blake: Looking at this type of a document, it seems as though from early 1999 you were aware of the importance of accounting data and that issues were being experienced in this regard with the new system; is that fair?
Mark Burley: During its development, yes.
Mr Blake: Can we look at POL00043681, and can we look at the second page of that, please. This was a management resolution meeting of 12 August 1999. You weren’t at that – sorry, if we could zoom out. Thank you very much.
You weren’t at this particular meeting, but it does address the Acceptance Incident you were listed as the owner of, 410. Can we look at page 3, please. It’s the first substantive line, it says “POCL advised”, if we could look at that or highlight those two lines, please. It says:
“POCL advised that they rate 410 and 411 as Low conditional on resolution of the controls proposed on 376. RH would provide further detail on this.”
So it seems as though 410 becomes a low issue because it was going to be in some way tied up with resolution of the controls proposed for Acceptance Incident 376.
Mark Burley: Could you just zoom back out to the full page because I thought there was something on the page that might explain that. Yeah, if you look lower down the page, under point 3, it says:
“JD reported as follows:
“Pathway recognise that not all transactions had been harvested and sent to TIP. A provisional fix went in on 2nd August and this has worked satisfactorily so far with the effect that all records had been sent.”
So my assumption would be at this stage – as I say, I’m trying to remember back over 23 years – but my assumption would be at this stage so they’d put a fix in, we’d done some provisional early testing of that fix and all looked good but naturally, on something so significant, we wouldn’t want to close it until we’d done sufficient testing to be confident that it’s truly fixed. I’m sure you probably appreciate that there’s lots of different scenarios that contribute to a cash account. So we’d want to make sure all those scenarios are suitably tested.
Mr Blake: Absolutely. If we look at that paragraph, it then goes on to say:
“Pathway cannot guarantee however that all problems have been trapped. They will need to see evidence from the fix of 8 known problems and will continue to monitor the problem for 3 months to be confident of its resolution.”
So at that stage they can’t guarantee that all problems have been trapped; does that mean fixed or resolved?
Mark Burley: No, as I say, we would want to do sufficient testing to have a degree of confidence that they have been and then, as you say, keep it under monitor. You know, that’s standard practice.
Mr Blake: Do you recall that there was a second supplementary agreement in September 1999 which permitted errors of up to 0.6 per cent of all cash accounts?
Mark Burley: I don’t. I’m not aware of that at all, no.
Mr Blake: Perhaps if we go to POL00090428, and it’s page 21. This is the Second Supplemental Agreement between the Post Office and ICL. You may not have seen this because this is a contractual document. I don’t know if this jogs your memory at all?
Mark Burley: I think it’s one of the documents I have been sent but I wasn’t party to this and I don’t recall it – I’m just looking –
Mr Blake: If we look at (i), there is a period in which:
“… the percentage of Cash Accounts received by POCL across the TIP Interface containing Cash Account Discrepancies shall not exceed 0.6 per cent of all such Cash Accounts.”
Is that something –
Mark Burley: It’s not something I’m aware of and, you know, I can interpret what it may mean but I may be taking it out of consequence. This could refer to the fact that we wouldn’t pay Fujitsu – or sorry, Pathway, as they were called then, unless it was in that parameter but that’s not saying that 0.6 per cent was acceptable because I can’t believe we’d have agreed to anything being acceptable, is my personal view.
Mr Blake: Was there, do you recall, an acceptance that there would still be some degree of cash account discrepancies moving forward?
Mark Burley: No. No. There definitely was no acceptance of that. There may have been an acceptance that we believed the fix had resolved the issue, but there is inevitably a risk that something else does arise because you cannot test the system to a degree where you can 100 per cent hand on heart say it will never occur again, and that’s what this may relate to, that it is, you know, such a rare transaction or rare sequence of events that causes it that it would be 0.6 per cent. But I can’t believe we accepted or anybody would have signed up to accepting that there could be discrepancies on a cash account, if that was the fundamental accounting document to which all branches were held.
Mr Blake: Were you still part of the TIP team at this stage? So this is 24 September 1999.
Mark Burley: I honestly can’t recall if I was on TIP or on a project at this stage. I’m guessing I would have still been on TIP because it’s only a couple of months after the last document you showed me.
Mr Blake: Would you have been expected to be consulted about a contractual agreement of this kind, given your involvement in TIP and being responsible for business aspect of TIP?
Mark Burley: I think the answer will be, yes, if it referred to an ongoing allowance but no if it refers to an allowance, you know, over the period of time, such that we would pay Pathway as long as they met this criteria but wouldn’t accept it as an incident. I personally believed that’s what it would be. It would be a contractual payment term, not a business acceptance term. Otherwise, I would expect to be consulted, yes.
Mr Blake: Do you remember a Third Supplemental Agreement or were you aware of a Third Supplemental Agreement on 19 January 2000?
Mark Burley: I wasn’t aware of a second so no, I wasn’t.
Mr Blake: Let’s look at that. FUJ00118186. I’ll only take you to that document very briefly. It’s page 4 of that Third Supplemental Agreement. It addresses enhanced integrity control, which was something that was implemented to address the concerns relating to the cash account that we’ve already gone through. Do you remember something called the Enhanced Integrity Control at all?
Mark Burley: No, nothing that I would have dealt with would have been called Enhanced Integrity Control. It might have been called a fix, it might have been, you know, the process they were coding to ensure that the cash account was robust but I don’t remember it being called an Enhanced Integrity Control.
Mr Blake: If we go over the page, it’s paragraph 5.3 of the next page that the Inquiry has gone over some time over previously in Phase 2. This seems to be an agreement, I’ll read it to you. It says:
“The Contractor shall, from the date of this Agreement until the end of the TIP Integrity Checking Period make available to POCL promptly upon request appropriate experts to explain to POCL the Contractor’s analysis of all root causes of Cash Account Discrepancies and the measures which the Contractor shall have implemented in order to prevent the recurrence of any Cash Account Discrepancies which would not have been detected by the Accounting Integrity Control Release.”
Do you recall at all there being a likelihood that there would be cash accounting discrepancies which couldn’t be detected by a control that was put in place?
Mark Burley: I don’t recall anything, no, because the TIP system was designed to ensure that what was sent in reconciled with the – you know, the two sides fully reconciled so, no, I don’t recall that at all. Not that – in other words, I don’t recall that it wouldn’t have been detected so I’m unclear what that refers to.
Mr Blake: Do you recall an acceptance that, because of the nature of the system, there would always be a degree of unreliability with the cash account?
Mark Burley: Sorry, just phrase that question again?
Mr Blake: Sure. Were you aware or do you recall, that because of the nature of the system, there was an acceptance that there would always be a degree of unreliability in the cash account, however small?
Mark Burley: No, I don’t agree that, I don’t accept that. The cash account is only formulated from all the inputs to it and there’s no reason that it would ever have to accept or be prone to errors. There’s no reason. Effectively, every transaction that is done over a post office counter has double entry on the cash account.
Mr Blake: Can we look at POL00028507, please. We’ve now reached January 2000 and this is an email, the bottom email, that is sent by you to Min Burdett, regarding something called “Receipts Not Equal to Payments”. That’s what we know as Acceptance Incident 211, where the receipts and payments didn’t equal on the cash account.
Mark Burley: Yes.
Mr Blake: Again, do you remember being involved in that issue?
Mark Burley: I vaguely remember this one, yes.
Mr Blake: Because that’s obviously quite a significant thing if the receipts and payments don’t match. What’s your recollection of that?
Mark Burley: Well, as it says on the subject, the receipts weren’t equal to payments and the fundamental thing about the cash account is your receipts payment and your payments total have to match, and any then balancing entry between the two is the amount of loss or gain for the week in question. And, typically, every branch would make, you know, a few pence, a few pounds potentially, difference on a weekly basis. You know, you accidentally give out, you know, a 20p instead of 10p, so you’ve got a 10p discrepancy straight away and there were –
If I recall at the time, there were examples where it genuinely happened because – and I think it was books of stamps. If they bought ten stamps they got a slight discount as a customer but it went in effectively at the price – so the subpostmaster would make, I don’t know, 10 pence, 15 – I can’t remember what the product was, so don’t quote me on stamps, please, but there was a product that was sold where, if you bought in bulk, you got a bit of a discount. But it worked in favour that you made actually, a slight profit on those.
So, you know, that fundamental part of the cash account, the two columns are totalled, and any difference is your loss or gain on the week. It becomes a balancing entry.
Mr Blake: We’ve gone through quite a few of those Acceptance Incidents. Am I right to say that your evidence, certainly your oral evidence today, is that, despite those, as far as you were aware, the cash account was flawless upon acceptance and rollout?
Mark Burley: I believe the cash – you know, my recommendation would be that all cash account errors, as part of the development, have to be either 100 per cent explained, and therefore understandable and wouldn’t cause an issue to any integrity, or, ideally, completely fixed ahead of any rollout.
Mr Blake: In the passage I took you to earlier from your witness statement, you said that the system was essentially a modified EPOS solution. Were you aware of any concerns about the EPOS system and the coding of the EPOS system, for example?
Mark Burley: Um, it depends what you mean by was I aware of any concerns. During the development there were, you know, numerous defects identified, you know, that would have been identified through testing. Some of it identified through Pathway’s own testing, some through Post Office testing and they would all go in this part of – you know, ultimately to try to get fixed and, ultimately, against the acceptance criteria, if they remain open.
Mr Blake: What point in time did this all get resolved, do you think?
Mark Burley: To the best of my knowledge and from my part in it, I believe it was all resolved before, certainly, any extended trial was done. It may have been – there may have been a few small issues outstanding at the onset of the first trial. I can’t 100 per cent confirm they weren’t, but sometimes that does happen. But before it went out to any extended number of sites, I would believe they would all be resolved, such that integrity-wise, it was robust.
Mr Blake: If we’ve heard evidence to the contrary, would that surprise you?
Mark Burley: It would surprise me as far as my involvement would go. I would just say one thing. Of course the system, once the system is live, it’s not completely left alone because we do – you know, like most systems, you develop new products, so you do make changes to it. So it’s – you know, could something have happened after that? I can’t comment for certain, but possibly.
But if you’re saying to me original integrity issues were allowed to be rolled out, were allowed to be included in the rollout, I’d be 100 per cent surprised and shocked.
Mr Blake: At the beginning of your evidence today you said you had quite a peripheral role in Legacy Horizon. Having looked at those documents and your name on various documents including ownership of an Acceptance Incident, do you think that was underplaying things somewhat?
Mark Burley: No, because I wasn’t looking at the development to the Horizon System as a full-time role. You know, I was involved with acceptance but I wasn’t leading acceptance. I was potentially, you might describe it as leading a few of the items under acceptance.
Mr Blake: Once you had finished your work on the acceptance of Legacy Horizon, did you go on to a different role before getting involved in what we know as Horizon Online?
Mark Burley: Yes, yes.
Mr Blake: I’m going to move on now to the development of HNG-X. We’ll see, in documents we’re going to come to, references to a medium volume pilot and a high volume pilot. Can you tell us briefly what that means, what the difference is between the two?
Mark Burley: It’s just the scale of which we would roll out to the number of sites. So I can’t remember the numbers but a medium volume pilot might be extending from an initial pilot of ten sites up to, let’s say, 150, 200 sites, and the high volume would be where we’re migrating from that and perhaps doing 100 sites a night to roll out the entire estate.
Mr Blake: You weren’t a technician. You weren’t – as you have explained, you didn’t have a computer science background or anything of that sort. What was your role in relation to the pilots? Was it driving things forward?
Mark Burley: So my role as HNG-X programme manager was to ensure we delivered a quality system.
Mr Blake: Let’s start in January 2010. Can we look at FUJ00092754. This a document from 28 January 2010. It’s the “Notes of the Horizon Next Generation Joint Progress/Release Board Meeting”, and you are listed there as chair of this meeting. Can you tell us what was this board? What was its purpose?
Mark Burley: The purpose of this board, it was a weekly meeting to discuss the progress of the development, you know, and obviously development leading into testing, leading into deployment, on the new Horizon next generation system. So it’s a weekly meeting we held jointly with Fujitsu to discuss anything to do with ongoing development activities.
Mr Blake: Can we look at page 3, please. Thank you, it’s the first shaded entries. We have there “AD”, that’s Alan D’Alvarez. Do you remember Alan D’Alvarez?
Mark Burley: I remember Alan, yes.
Mr Blake: He worked at Fujitsu; is that right?
Mark Burley: He did, yes.
Mr Blake: He’s listed there as programme director, HNG-X, Fujitsu. I’m going to read that third column. It says:
“The delay in the commencement of volume testing means that we will not be able to perform a significant amount of testing before commencing the Medium Volume Pilot. Hence we will need a significant amount of data to be collected from the live branches and Data Centre. The data will also require careful and thorough analysis.
“AD to confirm how this will be achieved.”
Do you recall there being less testing than originally planned before going to pilot?
Mark Burley: No, there wasn’t less testing. We may have varied how we did the testing but there wasn’t less testing. One thing that was very, very clear on Horizon Next Generation was that quality was of the utmost importance. With any project that is delivered, you generally have three criteria: you have the time it takes to deliver it; the cost to deliver it; and the quality criteria that it must meet. I can honestly say, as programme manager, that quality criteria was the utmost of those three.
Inevitably there’s always a little focus on all three and the amount of forecast varies from project to project, but quality was the most important. And, you know, I know several times throughout the development and testing of the solution, we paused, we took a step back, and because of testing, because of – we couldn’t get the right data or whatever, to absolutely make 100 per cent sure we’d got the right answer before proceeding.
Mr Blake: Thank you. That’s what you’ve said in your statement but if we look at this particular entry:
“The delay in the commencement of Volume testing means that we will not be able to perform a significant amount of testing before commencing the Medium Volume Pilot.”
What do you understand that to mean?
Mark Burley: I took that to mean that we’ve got a different way of doing it because we’ve actually got – if you’re looking on the right, Dave John’s was leading on it and LF is Lee Farman. Lee Farman was my test lead at the time and, you know, I would have taken, you know, his advice on this, that if he said, you know, he was comfortable that the slight change to the approach on testing gave him sufficient confidence, then that was acceptable, and that’s why it would have been closed. Because you’ll see data has been pass to Lee Farman, Lee Farman believed this is adequate for now.
Mr Blake: Tell me if I’m wrong on this but it doesn’t seem to suggest that there’s a different type of testing. What it seems to suggest is that there won’t be a significant amount of testing, and instead there’s going to be a collection of data. Am I wrong on that?
Mark Burley: It depends how you want to read it. Lee has looked at the data that has been collected from the existing sites, you know, from looking at this detail here, and has satisfied himself that what we needed to be assured, through the testing, has actually been done. Now, whether that’s through a test or through the data that’s effectively been through the system, it’s given us the same result, is what that’s telling me in the fourth column.
Mr Blake: Forgive me for – I don’t quite understand what you’re saying there because, I mean, certainly a plain reading of that is there won’t be a significant amount of testing and instead there’s going to be provision of data. Am I wrong to think that there is a difference between getting hold of data and actual testing or are you saying they’re the same thing?
Mark Burley: They’re clearly different things but the data can give you the proof that what you’d have done in the testing is actually sufficient. So the data can give you the same proof, is what I’m saying.
Mr Blake: So is data, collection of data, an adequate and an equivalent to a significant amount of testing, or is it less than a significant amount of testing?
Mark Burley: In this particular scenario it was clearly considered to be an equivalent to the test.
Mr Blake: What gives you that impression?
Mark Burley: Because Lee Farman who was a robust external tester, so he wasn’t Post Office, he wasn’t Pathway, he was actually bought in from external, gave me that confidence and would have explained it to me at the time.
Mr Blake: It says there “adequate”, it doesn’t say “equivalent”. Adequate seems to be less than significant testing, doesn’t it?
Mark Burley: Well, I think the testing at any point it’s adequate for now. You’d want to do more testing before you went into a high volume pilot is what that says. Adequate to get into the medium volume pilot. That’s what it’s saying. It based on my interpretation of the word “adequate”. The way I read that is it’s adequate for now. In other words, Lee is happy that it gives us what we need for the medium volume pilot.
Mr Blake: If somebody were to say that you were, at this stage, desperate to get on with the medium volume pilot; would that be right?
Mark Burley: That would definitely be wrong because nobody ever put me under pressure to get on with anything. We were always wanting to progress to timescales but we wanted to progress to timescales in the right way.
Mr Blake: Was the impression that you got from Post Office – more broadly rather than just yourself – one that you were desperate, as a company, as an organisation, to get on with the medium volume pilot?
Mark Burley: That’s what I – I totally refute that suggestion. That is 100 per cent factually not correct. At times, you know, there were times definitely when, you know, people would say to me, you know, “Why are we not ready?” And I would explain why we’re not ready. And at no point under my time as HNG programme manager was I under pressure, or as delivery manager, was I under pressure to hit a timescale at the expense of quality. I would be expected to explain it in certain situations, but never under pressure.
Mr Blake: In your statement, you say at paragraph 18 “With any computer system there’s always likely to be bugs and this is the purpose of testing.”
Less testing might mean more bugs, mightn’t it?
Mark Burley: In theory, yes, but not necessarily in practice. With testing what you do, you agree an approach to testing of a strategy and an approach for specific phase of testing, if you like, that gives you sufficient confidence. Now, with any system I would suggest it’s almost impossible to be 100 per cent guaranteed that no further bugs remain, but you do sufficient testing, depending what it is you are developing, rolling out, deploying, that gives you the confidence it will work satisfactorily against what it’s intended to do.
So, obviously, something like, you know, I don’t know, a space rocket, you would do much more testing on. So you’d vary the testing according to what it is you’re developing. It’s a standard approach called a risk based approach to testing but you cover off the things that are absolutely going to cause the – any risk.
Mr Blake: If you intended to carry out significant testing, and that was replaced with a lesser form of testing or a different or a collection of data, might that mean that there may be more bugs?
Mark Burley: No, because in that scenario, as I’ve said, Lee has affirmed that what he saw in the data gave us the same result as he would have expected from testing to move into that medium volume pilot. That was the key of that bit: it was to move into that medium volume of pilot and it was to look at the performance of the system and performance in that sense would be is it holding up speed-wise to be able to process transactions? You know. It’s not functional.
Mr Blake: Can we just go back to FUJ00092754. Page 3. Does Lee there say that it gives the same result?
Mark Burley: Is that a question for me?
Mr Blake: Yes. Your evidence was that Lee has said to you that the collection of data, rather than significant testing, gives the same result. But I was just wondering if that’s your recollection or if that’s something that’s stated there?
Mark Burley: Well, yeah, in my opinion. I mean obviously this is written by a PMO who takes the notes and their choice of wording. Now, can I edit the choice of wording? Of course I can. As program manager, anybody can challenge the wording in hindsight but my absolute recollection is Lee is saying this is adequate for now, for what we would have tested, to get into the medium volume pilot. That’s what I am recalling on this one. We wouldn’t have gone into that medium volume pilot without a sufficient confidence.
Mr Blake: Can we look at POL00000874, please. This is the Fujitsu’s own testing and integration strategy. If we have a look at this document it’s a Fujitsu document but if we look at the bottom it has external distribution and it’s something that has been sent to the Post Office library and Andrew Thompson – do you know Andrew Thompson? Do you recall who he was?
Mark Burley: Andrew was one of the test leads with Lee.
Mr Blake: I’m going to –
Mark Burley: I dealt with Andrew primarily – if I recall correctly, Andrew primarily looked after functional and Lee looked after non-functional performance.
Mr Blake: Can we look at page 12 of this strategy and it’s paragraph 1.25 on page 12 that I’d like to look at.
This is Fujitsu’s testing strategy and it says:
“As a general philosophy, it is important to accept that no system can ever be confirmed as completely error-free. It is not possible to prove it. Tests can prove that an error exists. They can prove that a previous error has been corrected. They cannot prove that no further errors remain. However, by concentrating on the important characteristics of the system operation, tests can be used to demonstrate the progressive removal of errors to the point where these characteristics are seen to conform to expectation. So, testing can be seen as a method (the primary method) of reducing the risk of serious defects remaining in important areas of the system.”
Is that something you agree with?
Mark Burley: Yeah, that’s the risk-based approach to testing that I referenced a couple of minutes ago.
Mr Blake: Yes. So it says testing there is either the primary method of reducing the risk of serious defect, it doesn’t say there that data, gathering data is an adequate replacement for tested, does it?
Mark Burley: Well, it doesn’t say it, no.
Mr Blake: If Fujitsu had the impression, rightly or wrongly, that POL were desperate to get on with the pilot and, as a consequence, reduced the testing, what kinds of problems would you envisage?
Mark Burley: Well, Fujitsu couldn’t reduce our testing. They could reduce their testing but not our testing.
Mr Blake: If testing, any testing, was reduced, because of an impression, rightly or wrongly, that was given, that you needed to get on with the pilot, what was the risk in that?
Mark Burley: Well, but it wasn’t. Testing wasn’t reduced because we were under pressure to get on with the pilot.
Mr Blake: I’ll ask once more. If it was, what would the risk be? Reading that, what is the risk of reducing testing?
Mark Burley: Well, the risk is you’re risking more bugs going forward.
Mr Blake: Thank you. Can we look at FUJ00097159, please. We’re still on 28 January and this seems to be a different board meeting. This is called the “Horizon Next Generation Release authorisation AG3 – Joint Board”. How is this board different? Do you remember this board?
Mark Burley: This will have been the board – I vaguely remember it – this will be the board that looked at, you know – very similar to the acceptance on original Horizon. This is the board that looks after are we ready to authorise the release of Horizon into the branches.
Mr Blake: Can you tell us what AG, Acceptance Gateway, 3 was?
Mark Burley: I can’t remember what AG3 was. I’m assuming it was, looking at the date, probably entry into pilot but I can’t be 100 per cent certain.
Mr Blake: Can we turn over the page and it has there “New Actions and points to note from combined meeting of [21 January 2010] – ACCEPTANCE”. It’s that first shaded section I’d like to look at first. It says there:
“DC [that’s, I think, Dave Cooke the Fujitsu acceptance manager] confirmed that there were no outstanding High Severity Acceptance Incidents and that all other thresholds are within tolerance for Acceptance Gateway 3.”
I just want to look at the third paragraph. It says:
“However it was agreed that the high priority fixes in ‘Reset 4’ – to be delivered as part of Maintenance Release 01.08 – could constitute a High Severity AI if not delivered in time for the High Volume Pilot (over 272 branches).”
Then if we scroll down to the next entry, it seems clear from that that there weren’t any outstanding high severity Acceptance Incidents, but, as we’ve heard, there’s the potential for there to be one –
Mark Burley: Yes, it strikes me from that that there was high severity Acceptance Incidents that had been fixed but the fix hadn’t actually been deployed yet, reading those words and therefore was subject to fully being signed off, if you like.
Mr Blake: Then we have look at that final entry. It says, “Non-High priority items in Reset 04”:
“MB [I think that’s yourself] offered an option to remove items from Reset 04 which are not regarded as High priority – if they are risk of missing the High Volume Pilot deadline or affecting the delivery of items which are High priority. AD will consider if any items are at risk [that’s Alan D’Alvarez], and liaise with Post Office …”
Is this something you remember at all?
Mark Burley: I don’t recall it, not as such.
Mr Blake: It seems as though you’re offering there to remove some items from what’s called Reset 4 which weren’t regard as high priority.
Mark Burley: Yeah, and that’s quite possible, if there were things on there that weren’t high priority and therefore weren’t considered material risk, then to proceed through this gateway – and don’t forget I think it’s important to recall that when we’re in a pilot you’re getting more evidence from the pilot of any potential problems. So, you know, we would have, you know, looked at anything that wasn’t classed as high priority and said “Is that material to proceeding to the next phase?” It’s not saying we’re actually going to remove them; it’s saying we’ll look at removing them.
Mr Blake: Was that because the priority at that stage was to get the high volume pilot going and get on with acceptance, given previous historic delays?
Mark Burley: No. The priority was to deliver a quality system, but with any system you would look at the lower priority items and say “Is this important for moving forward at this stage?” Yes, no. And you’ll see there that it is being progressed by the POL and Fujitsu testing and requirement teams. So we wouldn’t have put anything, given exception to anything that we didn’t get approval from.
Mr Blake: Absolutely, but were you making it easier there for Fujitsu so that they could meet the high volume pilot deadline by removing non-essential items?
Mark Burley: Not easier, no. It’s a standard approach to saying we need to look at the items on the list that are outstanding.
Mr Blake: So again, at this stage, still at 28 January, would it be unfair, I think you’ve said yes before, to say that you were desperate to get on with the pilots?
Mark Burley: Would it be unfair? Yes, it would be unfair. I think the word you’re using there is “desperate to get on with”. Keen to get on with, I’d say, is fair. But “desperate”, definitely not.
Mr Blake: Can we look at page 9 of this document. It’s the bottom of page 9 I’d like to look at. “New Actions and points to note from the combined meeting of [28 January]”.
I’m going to read to you the first three entries. So the first one:
“Branch Trading Statements at Coton House and Warwick. It was confirmed that onscreen error messages had occurred at both offices which meant that their Branch Trading Statements could not be completed.
“The root cause position at Coton House was understood, but the Warwick office had additional complexities.
“It was confirmed however that in both cases the underlying data integrity and external feeds to POL-MI and POL-MS were not affected.”
Next entry.
“Double settlement at Derby. In addition to the above, there have been 2 instances of a transaction appearing to be settled twice. This was picked up by the standard reconciliation process and corrected via BAU processes. However, the root cause is yet to be identified and investigation is under way”.
The third entry “Decision – Postponement of the next 10 branches. Based on the lack of a known root cause for AG3.70 [so AG3.70 is the branch trading statements issue] and AG3.71 [that’s the double settlement issue], it was agreed that the next 10 branches should be postponed until the impact and way forward is fully understood.”
Do you recall those issues at this time?
Mark Burley: No, I recall the Warwick and Coton issue. I vaguely recall – I don’t recall the Derby specifically but I recall a double settlement, yes, and I think the decision in 372 absolutely reaffirms, you know, this was not a time pressure; this was, you know, getting it right. And I can explain to you the 371 and 370, if you like, if it helps.
Mr Blake: We can get on to them but your evidence is that, 28 January, the postponement of the next ten branches shows that you weren’t in a rush to get on with things, is that –
Mark Burley: It shows we weren’t pressured into getting on with things, yes.
Mr Blake: Can we look at FUJ00092875. It’s page 3 of that document. Thank you. This is an email from Alan D’Alvarez of Fujitsu, of 3 February. So very shortly after that, just a few days later. This is, I believe it’s an internal Fujitsu email but do correct me information I’m wrong on that. Do you recognise the names there? You’re not copied into that?
Mark Burley: I think they’re all Fujitsu resources, yes.
Mr Blake: Thank you. Let’s look at point 1. It says:
“The decision has been taken to deploy HNG-X to a further 10 branches with the migration button being pressed tomorrow for migration to complete Friday.”
So the decision to postpone due to, for example, the branch trading statement issue that we just saw and the double settlement issue that we just saw seems just a few days later to have been reversed. Do you remember that?
Mark Burley: Yes, I do remember that.
Mr Blake: Then we look at point 2:
“There are two issues that require fixing prior to being able to enter into a medium volume pilot:
“Branch Trading Statement: This is where the in day migration process that happens once a branch hits the migration button is not correctly migrating across the summary data. This data is used to produce the branch trading statement. The base data is being migrated correctly and therefore the central accounting is unaffected. However, should a post office manager do a trading statement in branch there is a high chance that the statement produced, which uses the summary data, will not reconcile. We are manually ‘fixing’ the summary data prior to the BTS being run for those branches already migrated.”
Just pausing there, what do you understand by “manually fixing” the summary data.
Mark Burley: So basically when the branches were migrated on to HNG, it was an automated system that migrated the data from their existing solution on to Horizon Next Generation, and this was an error that occurred in certain circumstances. So what happened, we identified the root cause of the error, and what happened was Fujitsu knew where it was, but we decided to continue with the ten because this migration process – obviously it only happens when you migrate a branch. So, you know, the best test for this is when you migrate a test but you just need to make sure you’ve absolutely got a control total, which you can then manually fix should any other data not migrate successfully. That’s what that manually fixing meant.
Mr Blake: How would it be manually fixed?
Mark Burley: Well, by the migration team comparing what should be there with what’s actually there and then making the appropriate entry onto the Horizon System so that can be remigrated onto Horizon Next Generation.
Mr Blake: So would the entry that’s created by Fujitsu technicians show up on the branch trading statement as a different figure?
Mark Burley: I can’t actually remember how it worked in terms of the correction, I’m sorry.
Mr Blake: Turning to the second one:
“Counter Pauses In Live: Yesterday and today a number of branches reported ‘screen freezes’ while operating HNG-X.”
So you have two uses there that require fixing before entering into the medium volume pilot. Then paragraph 3 it says:
“Currently the team are still investigating both issues above and, as yet, have not determined the root cause for either.”
Do you remember that at that stage?
Mark Burley: I remember that, yes.
Mr Blake: Then it’s paragraph 4 that I want to spend a bit of time on, and it says:
“We had a meeting with Post Office this evening which Mark Burley led from the Post Office side. Post Office are desperate for a date to start planning/rescheduling medium volume pilot. They accepted our position that we were not able to give this today. I expect that Mark will be keeping Dave Smith briefed and my reading is that if we are not in a position to give a target date by close of play tomorrow it is likely to result in an escalation to Mike Young.”
So that’s where we get the phrase “desperate” from. Was Alan D’Alvarez wrong when he said you were “desperate”?
Mark Burley: I don’t know why he used that word, so I think that’s a question for Alan.
Mr Blake: Was there pressure being put on Fujitsu by the Post Office and by yourself to get on with things?
Mark Burley: Not to the extent that it would be desperate. Clearly, for the migration, we have to plan and schedule the migrations. You know. So we have to give the officers that are due to migrate due notice because, you know, we would do that out of hours, typically. They may need resources in place. They have to, you know, prepare themselves for that migration. So, you know, in terms of, you know, we would want a date that we are targeting. Now whether that date was tomorrow or next week or next month, we want a date because we want to start the planning process, not desperate to get it going, necessarily.
I think it’s – the – not a term I would have used. You know, we need a date, such that we can continue with our planning rescheduling exercise.
Mr Blake: Can we keep that on screen but just put alongside it your witness statement, WITN03850100. It’s page 4 of your witness statement, paragraph 16.
Thank you. Paragraph 16. You say there:
“As Programme Manager, the one person who would have been under pressure to migrate to HNG-X quickly would have been myself. Through demonstrating how we, as a team, were holding Fujitsu to account on quality, there was never any pressure to migrate before we had signed off readiness.”
Do you see the contrast there between what you’ve said in your witness statement and what Mr D’Alvarez was saying at the time?
Mark Burley: No, I don’t. I’m sorry, but you’re reading that different to how I’m reading it. “Post Office are desperate for a date to start planning/rescheduling”. It doesn’t say we’re desperate for a date that has to be imminent. At no point – I repeat, at no point was I put under pressure from a timescale perspective. I think it’s just how you’ve chosen to read the two statements are different.
Mr Blake: By that stage, how long had HNG-X been planning for?
Mark Burley: It depends what you mean by “planning”. It had been running, if this was February, the best part of three and a half years.
Mr Blake: Was one of the reasons that you were brought in to the project to drive things forward?
Mark Burley: Sorry, was it what, sorry?
Mr Blake: Was one of the reasons you were brought into the project to drive things forward?
Mark Burley: In the sense that a programme manager drives anything forward, yes.
Mr Blake: Yes. Do you not think that Fujitsu might have felt some time pressure by this stage?
Mark Burley: I think that they felt time pressure for themselves, yes.
Mr Blake: But your evidence is that that pressure wasn’t coming from the Post Office?
Mark Burley: As I said, what is said and how things are interpreted can be two different things. Would I have said, “Alan, come on, I need a date, we need to start, you know, and get these replanned, rescheduled”, yes, I probably would say something like that. But, you know, there’s a difference between saying that and saying, “Come on, Alan, I need to get these started again tomorrow, we’re already behind plan”. That is definitely not something I would have said.
And you’ll notice there they accepted our position that we’re not able to give this today and, yes, I would want to keep them, you know, under a little bit attention that we’re wanting a date because, as I said, scheduling and planning the branches, it wasn’t a dead straightforward task. It takes time. You have to accommodate, you know, things that the office might have planned, you know, and, you know, we have to share appropriate evidence with other parties who were, you know, who, you know, for example with the National Federation of SubPostmasters, who I brought in to also give assurance before we deployed.
Mr Blake: Thank you, sir. That might be an appropriate moment to take our 15-minute break.
Sir Wyn Williams: All right, 15 minutes. So 3.20-ish, I suppose to be imprecise.
Mr Blake: Thank you.
Sir Wyn Williams: Have a short break, Mr Burley, all right. We have a break in the afternoon and the morning because the person transcribing the evidence needs a break, all right?
Mark Burley: Okay, do I dial off?
Sir Wyn Williams: No, mute yourself and go off screen and go for a walk but don’t break the connection, all right?
The Witness: Okay.
(3.10 pm)
(A short break)
(3.22 pm)
Mr Blake: Thank you very much, Mr Burley. We’re back. I’m going to return to the issue of the BTS, the branch trading statement and can we look at FUJ00094268, please. We’re still in February 2010. This is an email chain. It’s an email chain that’s not ideal from a formatting perspective, so it may take us a little bit of time to go through. This is page 10 and you’ll see there is an email from Geoff Butts, and if you look down it is to Will Russell, yourself and Barry Evans. Who are the other two?
Mark Burley: Will and Barry led the migration activity.
Mr Blake: Thank you. If we scroll down and over the page, there’s the email from Geoff Butts. He says:
“Both,
This is to confirm the position on a fix for the BTS [the branch trading statement] issue whereby printing the Trial Balance Report for BTS results in incorrect data being displayed in the Final Balance Report. A fix can be delivered and tested for inclusion within the 01.08 Maintenance Release as a counter fix. In the meantime, branches need to use the BTS Trial Balance Report, which is correct, and discard the BTS Final Balance Report, which is incorrect.”
Do you remember this issue?
Mark Burley: Vaguely, yes. I think it’s linked to the one we talked about before.
Mr Blake: So we saw the one related to Coton House and Warwick.
Mark Burley: No, this is the one relating to the migration and the incorrect, when they migrate, this will be the – because they used to run a BTS, branch trading statement, when they’d migrated the data, to prove that it had migrated correctly.
Mr Blake: Here the suggestion is that a work around is possible until it can be fixed.
Mark Burley: Yeah.
Mr Blake: You respond, page 9 is your response. You say there:
“Geoff
“Thanks but can I ask who you have agreed this workaround with? This is a legal document and there is a difference between a trial balance and a Final Balance? I would also expect CS …”
Is that Customer Service or?
Mark Burley: I can’t – I’m guessing so.
Mr Blake: “… to have a KEL [Known Error Log] for this – if agreed – to be able to explain the position to any subpostmaster who calls in.
“Graham to confirm please.”
Do you remember this response?
Mark Burley: Well, vaguely, yes. I mean, it is a long time ago but vaguely I remember it, yeah. It’s back to the cash account. It’s basically, you know, it’s their accounts.
Mr Blake: Can you tell us what you’re saying there?
Mark Burley: Well, basically, I’m saying that why do you rely on the trial balance and not the final balance because the final balance, ultimately, is the one that’s important. Now, I don’t know what his response was on this but it might be it was just on the printout that it was causing the problem and not on the actual system stored data, you know, but you’d still expect there to be a Known Error Log, even if it is just on the printout.
Mr Blake: That’s so that the message can be communicated to subpostmasters that there is a problem with quite a significant document that, as you’ve said there, is a legal document or used in legal proceedings?
Mark Burley: Well, I’m – 100 per cent. And don’t forget, I think it’s worth pointing out at this stage that we had a subpostmaster group as part of our release authorisation process. You know, I bought in the part of the NFSP to support and be comfortable with what we were doing. So they would also – you know, I’d expect them to sign it off as well.
Mr Blake: So are you saying they would have known about this specific issue?
Mark Burley: Yes, because, you know, absolutely. I brought the NFSP in because I wanted them to be comfortable with what we were doing and what we were deploying.
Mr Blake: How would you share this kind of information?
Mark Burley: Well, we had tripartite meetings with them, and, you know, I would just share it open and honestly because, you know, they need to be clear, you know. What I’d typically do with something like this is ask for some sort of demonstration of what’s happening and for them to sign up to that it’s either okay or, actually, if I didn’t think it was okay, I might not even share it because there’s no point sharing something that I’ve said no – you know, if we agree it’s not fit for purpose with Fujitsu and they have to put a full fix in with the final balance, and that’s why I’m asking the question I’m asking, you know, who they’ve agreed it with.
Mr Blake: So you do recall or don’t recall this specific issue being mentioned to the NFSP?
Mark Burley: I don’t recall whether this specific issue was mentioned to the NFSP or not.
Mr Blake: Can we look at page 7. It’s been escalated to Alan D’Alvarez within Fujitsu or sent to Alan D’Alvarez. It says there – sorry, it’s the page before. Thank you.
It says:
“Alan
“Just rang Geoff but he is on leave – would you be able to help with this one please.
“Would you please send any history regards this issue – specifically what the differences in the Final report are, and can you advise how Fujitsu have established that the trial report is correct – and that there is no corruption of the data.
“A speedy response would be appreciated as I need to explain this issue to our Finance colleagues in more detail.”
That’s from Phil Norton, who is at the Post Office, that’s a colleague of yours?
Mark Burley: Yes, who used to work for me on Horizon Next Generation, yes.
Mr Blake: So what’s happening with these branch trading statements is it’s the final report that’s wrong but there’s another report earlier on in the consequences that is right and that they want to place reliance on that earlier report rather than the final report?
Mark Burley: Yes. But what it doesn’t tell us here is, if that’s the system report or just the printed version.
Mr Blake: Yes. Can we look at page 4, please, which is an email from Gareth Jenkins of 19 February to Phil Norton, copied to Alan D’Alvarez.
As I said, they’re laid out slightly strangely, but if we go over the page, that’s the substance of that email. It says:
“Alan D’Alvarez has asked me to respond to your concerns below. I’ll try to explain the issue and what has caused it.
“I assume you’ve seen the attached write-up of the issue which was sent to Barry Evans …
“To expand on this a bit further:
“When the BTS is being produced, it is done based on data written to the Branch Database … whenever a Stock Unit Rolls Over.
“BTS Production retrieves this data from BRDB to the counter.
“The counter then uses it to generate the Trial BTS.
“There is a bug in the way that the report is produced such that some of the in-memory copy of the data is overwritten when the Trial BTS is produced.
“A consequence of this is that when the final BTS is produced it is using incorrect data.
“The problem has been fixed by ensuring that the final BTS uses the original data retrieved by the counter at step 2 rather than the data left over after step 4.
“The problem was first reported by Warwick …”
So that’s the issue we saw earlier that originally paused the rollout to further branches but that was quickly resumed:
“… and they point out that the trial Balance figures were correct and the Final Balance figures were incorrect.
“comparing the Trial and Final balance figures with the corresponding Stock Unit Balance Reports shows easily that the Trial Balance is correct and the final Balance is incorrect.
“None of the incorrect data is stored to BRDB so there is no possibility of ongoing corruption of stock levels.
“Does this clarify the situation for you?”
So what do you understand the position to be in simple terms?
Mark Burley: I understand it to be some sort of corruption between the trial balance and final balance that isn’t actually corrupting the data but it is corrupting the way the data is being reported, such that the final balance hasn’t got the correct data on it any more. But it’s not actually impacting the balance as carried forward and, if that’s the case and it’s been validated as the case and that it doesn’t invalidate the data going forward, then I guess that may have been acceptable. But, as I say, I don’t remember the detail of the, you know, I’m assuming that – well, that would have been tested and proven to be correct before we’d have made the decision to accept this.
Phil would also have checked with his Finance colleagues in what was known as P&BA, pension and branch accounting, I think, something and branch accounting. To validate that they were comfortable there was no risk of corruption.
Mr Blake: We’ll see what happens. We can look at an email, another response from Gareth Jenkins. That’s page 2. Just pausing therefore briefly, what was your relationship like with Gareth Jenkins?
Mark Burley: I didn’t have a real relationship with Gareth, to be honest.
Mr Blake: What did you know or understand his role to be?
Mark Burley: I couldn’t recall what his role was at this time. I am guessing he was some sort to analyst within the Fujitsu team. That’s why he’s responding to Phil.
Mr Blake: You raised earlier in the email chain the issue of this being a legal document. Did you have any discussions at any time with him about legal proceedings?
Mark Burley: No.
Mr Blake: Were you aware of his involvement in legal proceedings at all relating to the Horizon System?
Mark Burley: No.
Mr Blake: So this is the response from him. Now, this one is slightly difficult to understand and it may need a bit of explaining from me. The indented parts of this are Phil Norton’s email that Gareth Jenkins is responding to. So where he says, “Phil” and then it goes indented, actually the bit that is indented seems to be Phil Norton’s comments and Gareth Jenkins is commenting below.
So Gareth Jenkins’s words seem to be – and if we look at the penultimate paragraph and final paragraph on that page, the bottom of that page, if we could highlight those entries, thank you – he says:
“It is not practical to explain exactly which figures are wrong and which are correct on the Final Report. However it is restricted entirely to the Stock levels of Volume Stock (ie the second part of the BTS). From the examples we have seen it is likely to be many of the Stock levels are wrong) and the figures will be too high, so indicating that the Branch’s Stock levels should be higher than they really ought to be).”
Do you remember being satisfied by that kind of an explanation, that it’s not practical to explain exactly which figures are wrong?
Mark Burley: Was I put onto the distribution list for this one?
Mr Blake: Well, you do appear in the chain later on, so you certainly did receive this within the chain.
Mark Burley: I mean, my view is that this would be looked at by Phil and by Will’s team, so Will or Barry, to ascertain exactly what’s going on and whether that’s acceptable and they would determine its acceptability or not by consulting others, as I said, the head of P&BA, for example, to make sure there is no financial risk.
Mr Blake: Can we just zoom out. You are in fact on this particular email. You’re there, you’re one of the copy recipients.
Mark Burley: Yeah.
Mr Blake: So at the bottom there again, we move to Phil Norton’s email, which says:
“Given the legal status of these reports …”
This is the issue that you had previously raised –
Mark Burley: And I ask (unclear) on my original question.
Mr Blake: Exactly:
“… (they – the final – are often used in court proceedings when we are trying to recover monies from dismissed subpostmasters) and the potential ‘integrity’ challenges that could be levelled against the HNG system as a result of any differences; POL need assurance from Fujitsu that they could/will explain the cause of the problem and prove the system has integrity should we be challenged.”
Gareth Jenkins’ response on that is:
“I understand this, though I would have [I think that must have been ‘thought’] most legal proceedings would be based on the first part of the report (which covers cash levels) rather than the second part.”
Then we have, again, Phil Norton’s email:
“I know this is not your area, however in order to help us get concurrence from our Finance Team we do need the commitment. I know Mark has asked Chris for that assurance …”
Is that “Mark” yourself?
Mark Burley: Probably. I don’t know for sure.
Mr Blake: “… however dependent upon the outcome of the meeting schedule with POL Finance on Monday we may need to request more specific assurances.”
Gareth Jenkins’ response is:
“I’ll leave others to respond to that.”
There’s another point that he’s responding to, from Phil Norton, which said:
“Would you please advise who within FS [that’s Fujitsu] would be in a position to provide the assurances/agree to any such request.”
Gareth Jenkins again says that he would leave that to others.
Can we look at page 1 of that email chain, please. This is followed up by an email from Phil Norton to Alan D’Alvarez – thank you very much.
You’re copied in to that, and he says:
“Alan
“Further to the correspondence detailed below – I have now met with our finance team to discuss this issue and to establish their position regards any requirements that they have to ensure POL does not incur additional expose [I think that must mean ‘exposure’] as a result of this defect.
“As previously stated the Final Balance Report is a legal document and as such POL rely on the accuracy and integrity of the report during any legal action we undertake to recover monies from the Subpostmasters. Given the Trial report can be planted several times – usually following stock adjustments made during the balancing process, this has no standing from a legal perspective.
“Based on this, and the understanding of the defect, how it arose, and the proposed rectification (as provided by Gareth); our Finance team require certain specific deliverables from Fujitsu in order for them to be able to manage the risk this poses and to give them the confidence to support the continued rollout of HNG.
“The deliverables required [include]”
They want a list of all products where the volumes on the final balance differ and they want a definitive statement explaining how it has happened, et cetera.
They also want a commitment to support POL improving the integrity of the system, that’s number 5. Over the page:
“POL Legal to ‘sign off’ the Fujitsu Definitive Statement as fit for purpose.
“There are several internal processes that will be implemented to ensure any impact is minimised, however I do need Fujitsu’s agreement to the above to gain the support of our Finance teams.”
Was the fact that the final balance that was produced by Horizon Online at this stage, that it was inaccurate, was that a serious issue for the Post Office?
Mark Burley: Absolutely. I think, as you can see, you know, from the investigation that was done of it.
Mr Blake: The workaround that had been suggested that the final balance was simply discarded, was that appropriate? Was that considered appropriate by the Post Office?
Mark Burley: Well, based on the above comments, no, and that’s why I asked with Phil to check with P&BA because they’re the owners of the financial integrity.
Mr Blake: Do you think that Fujitsu were taking the legal implications of this seriously enough?
Mark Burley: I’d like to think so. I mean, you know, in my discussions with them, I never had any reason to doubt that, you know. So I’d like to think they were taking that seriously. But without seeing how they responded to this, you know, it would be interesting to see what their response was. But, certainly in my discussions with Alan, he would always, you know, absolutely support what we were trying to do to make sure this was really of good quality.
Mr Blake: It’s quite significant, of course, that a document that might be used in legal proceedings is inaccurate in showing the final balance. How far up within the Post Office do you think this issue was raised?
Mark Burley: I honestly can’t – cannot tell you. It doesn’t have to be raised anywhere, unless we were put under pressure from Fujitsu to accept their workaround. You know, from everything I’ve read so far, we did absolutely the right thing. Asked Phil to look into it with P&BA, as I say, who owned the financial integrity. They’ve given us a very clear statement that they need to understand and to be able to have absolutely definitive proof that the integrity of the data is not compromised in any way and also ensure our legal team to sign off to that effect.
You know, so really important to us and them, you know, that this is, you know, absolutely integrity is at the heart of it.
Mr Blake: The workaround is not relying on the final report and having some sort of side assurance that everything is okay. Given that people were prosecuted by the Post Office, do you think that that was sufficient?
Mark Burley: Well, sorry, I don’t believe we went live with this workaround.
Mr Blake: But do you think that attitude of reliance on a side statement, rather than fixing the problem then and there, was sufficient?
Mark Burley: I think that’s an unfair question, to be brutally honest. I think Fujitsu were proposing a potential workaround. At no point are they saying this workaround has to be accepted. They were proposing what they deemed a potential workaround. Clearly, it set alarm bells in my head when I saw it, hence I asked who’d agreed to it, and asked Phil to look into it.
And, you know, I don’t see anything on here that’s, you know – there’s a little bit where, you know, he’s trying to explain why he thinks it’s okay but, clearly, doesn’t have the full understanding of the significance of the final balance statement in any potential legal proceedings.
So I don’t see any pressure from them, you know. Clearly, in hindsight, it wasn’t a good proposal and, as such, I believe it was rejected on this basis.
Mr Blake: Given the significance of Post Office’s ability to prosecute people, based on information provided to a court in arising from a printout from the Horizon System, do you think that an approach that looks for workarounds is the right approach or do you think, for example, that should have caused the Post Office to take a deep look at the system?
Mark Burley: As I said to you, it set alarm bells in my head. A deep look at the system, this is one issue that arose that absolutely we were trying to do the right thing to make sure it was resolved.
Mr Blake: How would this information be cascaded down to individual branches?
Mark Burley: Well, it wouldn’t be because, as I said, unless you’re going to tell me we went live with it, which I don’t believe we did, and I’ll be surprised if we did, you know, why would we cascade it, because we’d expect it to be fixed.
Mr Blake: Your suggestion, though, was to make sure it was on the Known Error Log, so that any subpostmasters who phoned in would – the message somehow would be linked?
Mark Burley: No, no, my – can you put my words back on the screen, please?
Mr Blake: Yes, it’s the same document, and it is page 9.
Mark Burley: My words don’t say that. My words say, first of all, who has it been agreed with? This is a legal document so instantly registering my concern about it and there’s a difference between a trial and a final, you know, if we were to go ahead with anything like this, you know, we would expect – if CS is customer service, I don’t know – but certainly a Known Error Log, if it was agreed. And, as I said, I don’t know – my first question is: who has agreed to it? And then, as you see, I asked Phil to determine if it’s acceptable and that’s what leads to all the investigation that says it’s not acceptable.
So you wouldn’t have a Known Error Log for something that we’re not accepting because, actually, we’d be asking Fujitsu to fix it.
Mr Blake: It’s the attitude that I’d like to drill down on, really, because we’re talking about very early days of Horizon Online here, and there is a problem with the balance, the final balance, and what you’re saying there is that you would expect there to be a Known Error Log, if it was agreed, so that subpostmasters – any subpostmaster who calls in would – the two would be linked. But what about all those subpostmasters who don’t call in?
Mark Burley: Sorry, you know, it’s not about being able to explain it; it’s about being absolutely 100 per cent certain it’s got integrity and that’s what I said at the beginning. It’s absolutely critical that the system had integrity and we could support that integrity. And, hence, I asked Phil to look at that. And there’s no way we would have proceeded without the system having integrity.
Mr Blake: But where there were problems in the system, known problems, was the attitude to have a Known Error Log for the problem to be able to explain the position to any subpostmaster who calls in? Was that a common response to problems that, put it on the error log and all will be okay?
Mark Burley: No, I think that is really not a fair reflection at all. A Known Error Log is more for things that are genuine workarounds that have no real impact. It’s almost back to my font example. You know, it’s things that do not impact the subpostmaster, do not impact a counter clerk, do not impact, you know, any of our clients at the time.
They’re just things that, you know, are, shall we say not quite, you know, as we expect them to be, but aren’t causing any financial or other material impact or questioning of integrity, and we wouldn’t proceed with it. We wouldn’t have something on the Known Error Log for something that is an integrity question.
Mr Blake: So if the Known Error Log did have things that were more significant than just the font issue, that affected the real lives of subpostmasters, would that have been poor practice and unexpected by yourself?
Mark Burley: I mean – sorry, font example is a very, very simplistic example. A Known Error Log will contain certain scenarios, you know, and they’re generally what are classed as low-level issues that will be fixed over time. But they shouldn’t have any impact on the integrity of the system. If they have impact on the integrity of the system, I will be surprised, if they’re on the Known Error Log.
Mr Blake: Can we look at POL00032999, please. This is the same period, so we’re looking here at 23 February 2010. This is the acceptance report for HNG-X. Can we look at page 12 – just to look, the external distribution, you’re on the list there as having received this document.
Can we look at page 12 and it’s paragraph 1.3 that I’d like to look at.
It may be slightly earlier than that. It may be the page before. Thank you very much. “Acceptance Decision”, could we highlight the “Acceptance Decision”? I’m just going to read that. It says:
“The AG3 Acceptance Board … was held on 21/01/10 and approval to proceed through AG3 was granted. The decision stated that ‘… it was agreed that the high priority figures in “Reset 4” – to be delivered as part of the Maintenance Release 01.08 – could constitute High Severity AI if not delivered in time for High Volume Pilot …’ As such, ‘Qualified Acceptance’ at AG3 was agreed, subject to the successful delivery of the high priority items in Reset 04.
“Whilst not an exact match, this the closest to the Acceptance Board Recommendation 3: ‘Proceed at risk through Acceptance Gateway’.
“These associated conditions were discussed at the corresponding release authorisation board and recorded in the minutes of that meeting.”
Do you recall in terms of the acceptance of Horizon Online that it was effectively “proceed at risk”, as in there still were some concerns but the agreement was to proceed despite some concerns?
Mark Burley: But the concerns are not to do with anything that is high severity and therefore not an integrity question. It is clearly called out there but yet a number could combine to form a high severity, if whatever the fix was, didn’t actually complete successfully, and therefore we would end up pausing again if that was the situation.
Mr Blake: Can we look at page 9 of this document. It may be at the bottom of page 8. The bottom of this page says:
“It should be noted that there are also defects that are not linked to POL Requirements and which are not the subject of an Acceptance Incidents. A separate assessment of the status and significance of these has been undertaken and this will be available for consideration at the Release Authorisation Board.”
Are you able to assist us with that at all, that there were defects that weren’t linked to POL requirements?
Mark Burley: Not specifically. I cannot think what would be a defect that wouldn’t be specifically covered, you know, other than going to back to my font example, which probably wasn’t a specific requirement. But other than things like that, you know, I’d have to see some examples to recall that.
Mr Blake: Can we look at FUJ00094265. This document, when it comes up, goes back to the issue we were talking about a moment ago. This is an internal Fujitsu document and it has the recipient there was the general council at Fujitsu, and it says that the issue has been flagged as critical to fix before the start of rollout. This is the branch trading statement issue that we talked about a moment ago.
There’s a draft email there from Geoff Butts, it’s a draft response to the Post Office, so it’s essentially responding to that request for assurance, and it’s a draft of that. If we could scroll down.
It’s drafted to Phil, and it says – for example the problem description, it says:
“On the final report, the stockholding figures in the second section of the report are incorrect on the final balance.”
So that’s the problem we’ve already talked, about and it provides the reassurance that is asked for. If we look over the page, it has “Key questions” and answers:
“Can Fujitsu provide a complete and comprehensive list of all products where the volumes on the final balance report differ from those on the trial balance report? All figures relating to the volume stock holdings can be corrupted by the bug but not necessarily all the figures will be incorrect.”
If we go down:
“How has the defect arisen?”
It’s a software issue.
“What is Fujitsu doing to resolve the defect?
“Fujitsu has developed a software fix that resolves the issue by ensuring that the final report uses the original data retrieved by the counter at step 2 described above rather than using the data left after step 4. This is a counter fix that is currently scheduled to be delivered within the next maintenance release for HNG-X – 01.08. In the short-term, before the fix is deployed into live, Fujitsu has written a KEL which includes instructions to the HSD to give advice to Postmasters. The advice is to use the Trial Report, which is correct, and to discard the Final Report.”
This is something again, we were talking about earlier and it was your suggestion in your email that it certainly needed, if accepted, to go on to the Known Error Log, and the workaround there seems to be to rely on that earlier statement and not the final report. So you rely on the trial report not the final report.
Mark Burley: Yes.
Mr Blake: So it certainly seems from this that that was the position and that was agreed at that time.
Mark Burley: Where is it saying it was agreed? I think this –
Mr Blake: Well, this is – certainly, the intention here seems to be to respond to the request that was made to Fujitsu. Is your evidence that it wasn’t agreed or that you don’t recall it was agreed, or something else?
Mark Burley: Well, all I know is the previous email from Phil said it wouldn’t be agreed without all these caveats being put in place. I’ve yet to see all those caveats being answered in this draft email.
Mr Blake: Well, let’s look at the final entry. It says:
“Can Fujitsu provide a commitment to support POL in proving the integrity of the system in any subsequent legal action (specifically where the difference in the two reports is used as a means to challenge the integrity of the system?
“Yes, Fujitsu is willing to provide commitment to prove the integrity of the system in any subsequent legal action.”
Is that something that you recall ever happening?
Mark Burley: I don’t recall it ever happening. I think the one above as well is interesting as well and important. Please don’t lose that one.
Mr Blake: Absolutely. So it says:
“Can Fujitsu provide a statement proving in the integrity of the data is not compromised in any way and the only impact is incorrectly reported data?
“Fujitsu confirms that this defect relates specifically to the printing of report data and is not related in any way to the underlying branch data held in the operational HNG-X system.”
Mark Burley: If you recall at the start of this section I talked about is it just the printout that’s reporting it incorrectly or is it the system.
Mr Blake: Yes.
Mark Burley: By that, it sounds like it’s just the printout not the actual system. But, as I said, we still need to go on but I still haven’t seen, you know – yes, they’ve said they’re willing to provide a legal assurance to the – to the integrity and, you know, there’s still more missing for me, you know, because this would go to Phil, Phil would, you know, take it to the Finance team and also to the – our internal lawyers for advice.
Mr Blake: If this had been accepted as the means to get around the issue, do you think it would be a bit shoddy or would it be satisfactory to provide this kind of workaround where you rely on a trial report not a final report and then you have Fujitsu provide a statement in criminal or civil proceedings saying that everything is fine?
Mark Burley: I think, if it is just the printout that is correct and Fujitsu have proven and demonstrated that, and the integrity of the system has been absolutely proven to be 100 per cent, then I think it is reasonable. It’s not ideal, but it is reasonable. But, as I said, it’s proving that it is only the printout. It’s proving that, you know, the system does maintain a full integrity.
Mr Blake: Would the attitude of the Post Office be that they had to rely on Fujitsu in those circumstances to guarantee those kinds of assurances that you’ve just talked about?
Mark Burley: No, I think you’ll recall on Phil’s email he wanted assurance from our Finance team and from our lawyers.
Mr Blake: Yes, but who would be able to prove the integrity of the system? Were you reliant on Fujitsu or would that be a joint effort?
Mark Burley: We would run various tests to prove, you know, and produce examples whereby the report was incorrect but we’d proved the data – underlying system data was still – had the integrity.
Mr Blake: We’ve seen certainly at the Fujitsu end that this has gone to the General Counsel. Do you recall how high up this particular issue went within the Post Office?
Mark Burley: I don’t recall, no.
Mr Blake: Can we go to FUJ00094472. This is the “Notes from the Horizon Next Generation Joint Progress Meeting” of 11 March 2010. Can we look at the bottom of page 3 into page 4, please. Thank you, the bottom of that page. “PN” is Phil Norton?
Mark Burley: Yes.
Mr Blake: It says there:
“Trial report final balance issue
“PN to check if the proposed workaround is acceptable to the business. Permanent fix targeted for R1.08. However, this is dependent on the acceptability of the workaround. It may need to be a hot fix.”
What was a “hot fix”?
Mark Burley: So Fujitsu would do releases, I can’t remember how often they would do a release, maybe once a week, maybe once a fortnight. A “hot fix” is where they’d put a fix in between that because we’d deemed it urgent.
Mr Blake: “GB will also prepare a statement that confirms the legality/integrity of the trial balance report if that needs to be used.”
So that’s the draft of which we saw earlier or document relating to that we saw earlier. Can we scroll up again, so we can look at the next entry, it says:
“25 February. POL have requested that this be a hot fix as it is required before we migrate any further branches. Fujitsu to ensure deliverables listed in PN email dated 24 February for current five branches are included.
“4 March. GB has received feedback on integrity statement from Fujitsu legal. Info will be forwarded to PN.
“11 March, PN has passed statement to P&BA …”
You were talking to about P&BA earlier, weren’t you. Can you remind us what they were?
Mark Burley: I can’t remember what the “P” stands for, I think it was pensions and business accounting or – I can’t remember what the “P” stands for. It’s basically the central Finance team who look after the cash accounting data and reconciling with the clients, et cetera.
Mr Blake: “… who are reviewing with POL legal team. PN will feed back to GB.”
Do you recall at all how this issue ended?
Mark Burley: I don’t recall how the issue ended, no, and if you note, I wasn’t at this particular meeting.
Mr Blake: Had you moved into a different position by then or were you just no longer involved in that particular issue?
Mark Burley: No, at the top I’ve given my apologies. I was actually on holiday at this point.
Mr Blake: Thank you. Can we look at FUJ00094471. This is a Post Office highlight report, 17 March 2010. It has your name at the top there. It’s the third paragraph down, it says:
“Fujitsu are now providing evidence to POL which indicates an improvement in stability and therefore the pilot has been scheduled to restart this week, as agreed by the POL internal Release Authorisation Board on 17 March.”
Then it goes on to talk about high volume of calls to the helpdesk. It says:
“The average number of calls per Horizon Online branch remains significantly higher than that of the Horizon branches and the concern remains that the HSD will fail to cope with a significant increase in migrated branches.”
If we look down, an entry that relates to quality. This is all six days later, and it seems as though the pilot is restarting and these are the issues that are still occurring. Screen freezes and – it says the rate of screen freezes and recoveries has been greater than expected. “User opinion”, it then says, “The number of calls”, as I just explained, to the HSD:
“… the rate of calls from Horizon Online branches is significantly higher from Horizon branches.”
You’re not aware whether the branch report issue had been resolved by this stage?
Mark Burley: I’d have thought it would have been, if it isn’t mentioned explicitly.
Mr Blake: But there were still at that stage other issues, despite the pilot having resumed?
Mark Burley: Well, and that’s what makes me infer that it was resolved. But, again, I wouldn’t have been around at this time because I know by the dates I was away.
Mr Blake: Looking back at all the things we’ve been looking at, do you think that HNG-X, Horizon Online, was rolled out too soon?
Mark Burley: No. I regard we did the appropriate testing. We did validate the integrity fully before we migrated. We stopped in the event of any suggestion there was any issue that impacted the integrity or anything else that couldn’t be explained, you know. As I said, I personally brought in the NFSP, National Federation of SubPostmasters, to form part of our – (a) we bought them in to the testing so they could actual get directly involved in the testing but also part of our release authorisation process, and they were party to every decision to proceed.
Mr Blake: Can we look at POL00022842, please. This is appendix 2 to the judgment of Mr Justice Fraser and it lists or summarises bugs, errors and defects in Horizon. Can we go to the second page of that and there’s the summary of bugs, errors and defects. I’m just going to take you through the bugs, errors or defects that relate to Horizon Online.
We have there number 1:
“Receipts and payments mismatch bug
“This is a bug present in Horizon Online. The bug occurred in 2010. The majority of incidents are recorded as occurring between August and October 2010.”
Number 3:
“Suspense account bug
“This is a bug present in Horizon Online. Its identified years of effect are 2010 to 2013.
Number 4:
“Dan Wellington(?) ** Bug/branch outreach issue. This is a bug present in Horizon Online. It’s effects were experienced between 2010 and 2015.
Number 5:
“Remming in bug. This is a bug present in Horizon Online. It was present for about five months in 2010 between March and August.”
Number 7:
“Local suspense account issue. Not the same as 3, suspense account bug. This is a bug present in Horizon Online. This was reported in 2010 and recorded as fixed in September 2010.”
Number 8:
“Recovery issues. These are bugs, errors and defects present in Horizon Online with years of effect from 2010 to 2018.”
Over the page, number 13:
“Withdrawn stock discrepancies. This is a bug present in Horizon Online mentioned in 2010 and 2011.”
Number 14:
“Bureau discrepancies. This is a bug present in Horizon Online. It arose in 2017.”
Down to number 19:
“Post & Go/TA discrepancies in POL SAP. This is a bug present in Horizon Online. Occurred in 2012.
“Recovery failures. This arises in Horizon Online. This is referable to Horizon issue 4 and not Horizon issue 1. Two of the PEAKs show errors and defects, they do not show bugs. Mentioned in 2010, 2012 and 2015.
Over the page to number 23, please:
“Bureau de Change. This is a bug present in both Legacy Horizon and Horizon Online. Arose in 2005, 2006 and 2010 onwards.”
25:
“Lyca top-up bug. This is bug present in Horizon Online. Occurred in August 2010.”
Number 28:
“Drop and go. This is a bug present in Horizon Online, occurred in July 2017. The date of the KEL suggests HNG-A but the KEL is expressly headed HNG-X.”
You were asked to specifically address a list of bugs in you statement but you didn’t address these bugs. Is there a reason why you didn’t address these bugs in your statement?
Mark Burley: I didn’t know I was expected to address these bugs in my statement but all I would say is there’s far too little information on these for me to make a comment on them. It doesn’t tell me what the actual bug is, it just says there’s a bug present. For example, Lyca top-up, it just says there’s a bug present in Horizon Online. It doesn’t tell me what the nature of that bug is, and, you know, whether it was, you know, if you recall back, one of the things I said to you was, you know, you don’t develop a system, deploy it and that’s it. You’re constantly making improvements to that system, be that new products, be that changes in how we operate products, et cetera.
And, therefore, there’s always a risk that bugs do creep in and that’s why you have to, you know, keep testing it and, you know, keep on top of it. But on none of these have I got sufficient information to be able to comment on them, I’m afraid.
Mr Blake: Do I take it from that that you didn’t follow any of the court proceedings relating to Horizon?
Mark Burley: Well, I followed bits of it but, you know, I didn’t follow in detail, you know. I looked on from afar and –
Mr Blake: You were given a specific list in your Rule 9 Request that identified bugs and asked to comment on them, and can we take you to your response. It’s WITN03850100, that’s your statement, and take you to paragraph 19, page 5. You said there:
“I had confidence in HNG-X throughout, in terms of the development and testing process, but we were deploying a system to over 10,000 branches and some bugs had been identified, and whilst they were fixed naturally there was some noise as we were very open and honest with the NFSP. Ultimately their support was a vital part of our rollout.”
I mean, it was a bit more than some noise, wasn’t there, in terms of the number of bugs that I’ve just taken you to, the implications of it all? Do you think, again, you’ve minimised the issues in your statement?
Mark Burley: Sorry, let me explain to you how I’ve answered this question. The documents I received were several thousand pages, and as I said to you, you know, none of those – some of those bugs were well after Horizon HNG-X was rolled out. Some of those, you know – and therefore presumably introduced by a subsequent release. None of those bugs have enough detail for me to comment on, and I’d be commenting from, you know, a guesswork, and that’s totally the wrong thing to do, you know.
I’ve never said there weren’t bugs in the system. As I said, of course there was noise. We managed it very closely with the – as I said, we involved the Federation of subpostmasters in all our decisions. We worked with them. You know, they were very much part of the team that agreed, you know, in terms of any known errors, would we go live with them? Absolutely. They were part and parcel.
Mr Blake: Are you still there?
Mark Burley: Yes, I’m still here.
Mr Blake: Thank you. Is your evidence that after rollout there weren’t significant bugs that were drawn to your attention that addressed issues that affected the cash account and affected the lives of subpostmasters?
Mark Burley: No, I can truthfully say that from the point we rolled out HNG-X/Horizon Online, that I wasn’t aware of any bugs that impacted the integrity of the system. I wasn’t aware of them. I’m being very specific.
Mr Blake: They weren’t drawn to your attention by anybody?
Mark Burley: Well, no, and in part probably because I’d left the Post Office by then.
Mr Blake: Well, let’s say the rollout of Horizon Online was 2010. After 2010 did anybody draw to your attention significant errors or bugs with Horizon Online that affected the cash accounts of subpostmasters?
Mark Burley: Not to my knowledge, no. I’m not saying it didn’t happen, but not to my knowledge, no.
Mr Blake: Can we look at POL00029618, please. It’s page 2.
This is an email from Ron Warmington of Second Sight to Simon Baker. Do you know who either Ron Warmington or Simon Baker are?
Mark Burley: I’ve no idea who Ron is. I think Simon – I don’t know what his role was. He joined the Post Office before I left, but I don’t know what his role was at this time.
Mr Blake: Were you aware of an investigation being carried out by Second Sight into issues with Horizon?
Mark Burley: I broadly recall it, but I thought it was, you know, with Legacy Horizon.
Mr Blake: We have here an email from Ron Warmington that says:
“Simon, this is a draft section of the report dealing with two defects.”
And he asked two questions. He wants to know how there were shortages, or how the shortages or surpluses that arose from certain problems were impacting on subpostmasters, and he also wants to know when and how and who knew about those problems. I’ll take you to the extract from the interim report. If you scroll down, he has sent Simon Baker an extract from his report to assist him. It says:
“POL has recently disclosed to Second Sight that in 2011 and 2012 it had discovered defects in Horizon Online that impacted 77 sub post offices. The first defect, referred to as the ‘Receipts and Payments Mismatch Problem’, impacted 63 branches. It was discovered in September 2010 as a result of Fujitsu’s monitoring of the system events (although there were subsequent calls from branches). The aggregate of the discrepancies arising from this system defect was £9,029, the largest shortfall being £777 and the largest surplus £7,044. It is not yet clear whether subpostmasters with the surpluses profited from them, or whether those showing shortages had to make them good.
“The second defect, referred to as the ‘Local Suspense Account Problem’, affected 14 branches and generated discrepancies aggregating to £4,486, including a shortfall of 9,800 at one branch and a surplus of 3,200 at another. POL was unaware of this defect until a year after its first occurrence in 2011.”
So it’s referring to issues in 2011 and 2012 that affect the cash account of subpostmasters.
If we go on to the page before, page 1., Simon Baker says – he’s sending this on, and he says:
“Just got this from Ron.”
Sorry, it’s further down. It’s the bottom.
“Just got this from Ron.
“I can get back to him on most of the questions but need your help on who in Post Office knew about it. I know from the email that Rod sent that Mike Young knew, but don’t know if it went any higher.”
This is to Lesley Sewell. Do you know who Lesley Sewell was?
Mark Burley: Lesley Sewell was the new head of IT that was brought in shortly before I left.
Mr Blake: Can we go to the top, email from Lesley Sewell. She responds, 25 June 2013:
“Simon, I don’t know if it went any higher than Mike. Andy Mc …”
Who is “Andy Mc”?
Mark Burley: Andy Mc – it was the Head of Service Management. I can’t remember his surname.
Mr Blake: “I don’t know if this went any higher than Mike. Andy Mc also managed the service at the time, and if I remember correctly, Mark Burley was also involved.”
Now is Lesley Sewell wrong to say that you were involved?
Mark Burley: Involved in what?
Mr Blake: Well, he is asking who in Post Office knew about these problems.
Mark Burley: So I think the one on receipts not equal payments we’ve discussed and, you know, I didn’t believe that was found when we were actually live. I thought that was found before we were live. But from the below, it might have been when we were live. But, you know, the suspense one doesn’t ring any bells with me at all, and certainly I wasn’t informed of the 2011 one.
Mr Blake: Did Lesley Sewell ever raise, following receipt of this email with you, any questions that Second Sight had raised, or –
Mark Burley: No.
Mr Blake: – or any issues concerning Second Sight’s report?
Mark Burley: Nobody from the Post Office contacted me with anything to do with the system after I left.
Mr Blake: So you think the extent of your involvement was the involvement in the local – was it the receipts and payments mismatch, or the suspense account issue?
Mark Burley: Sorry, say the question again?
Mr Blake: The extent of your involvement in the underlying bugs, errors or defects, you’re saying that it was the first, which is the receipts and payments mismatch, or the second, which is the local suspense account problem?
Mark Burley: No, I’m saying I remember the receipts not equal payments issue. And we did discuss that earlier. I don’t –
Mr Blake: I think we looked at that earlier in relation to Legacy Horizon rather than Horizon Online, although I may be wrong on that.
Mark Burley: Yeah, and that’s what I think I’m getting confused now, because I don’t recall it. I definitely recall it on original Horizon, but all I can say is, you know, obviously there were defects during the development of HNG-X. If we found defects that had any chance of impacting the integrity, we would make absolutely certain they would be fixed. And if that involved pausing, if that involved delay, that’s what we would do.
Mr Blake: Why do you think Lesley Sewell has mentioned you in connection with these particular defects, what are described at that time as “defects”?
Mark Burley: I don’t think she’s saying that in connection with the defects. I think she’s saying because I was programme manager when she first joined.
Mr Blake: And what would that mean? The question that’s been asked here by Second Sight is … I can tell you, but it’s asking who knew what when, effectively. And you’re being – it seems to be that you’re being suggested as somebody who was involved.
Mark Burley: Yeah, but as I’m saying to you, I don’t recall being involved. As I say, the receipts and payments is an interesting one because I was clearly getting confused with the original Horizon. But, you know, as I say, during my time as programme manager, during my time as Head of Delivery, if any defects had come to my attention that would remotely put at risk the integrity of the system, I would have raised it and insist it was fixed. There was absolutely no question in my head whatsoever about that.
Mr Blake: The question in Ron Warmington’s email is:
“Can you please let me know whether, when, and who at board level was informed of the defect, and also the later local suspense account defect, and whether any press release was issued, et cetera?”
Simon Baker emails Lesley Sewell to say:
“I can get back to him on most of the questions but need your help on who in Post Office knew about it.”
Then Lesley Sewell’s response is:
“I don’t know if it went higher than Mike. Andy Mc also managed the service at the time and if I remember correctly, Mark Burley was also involved.”
Is that recollection of Lesley Sewell wrong?
Mark Burley: Well, I think one, it’s saying Lesley clearly knew about it, reading this. And just saying “If I remember correctly.” All I’m saying is my recollection is I wasn’t aware of those two specifics. But as I’ve said, it’s my recollection, you know, at this stage, which is 12 years since I left.
Mr Blake: Would you not have remembered such significant impact on the cash account, given how significant you have said, in your evidence today, that it was to the very system that you were managing?
Mark Burley: I don’t remember a specific instance, not necessarily. Would I remember if anything was raised regarding the risk to the integrity of the cash account, then one hundred per cent I would have insisted it was dealt with. But if you ask me do I remember every single incident that was raised that was connected to the cash account? No, I don’t.
Mr Blake: And do you think that Lesley Sewell was wrong in naming you there?
Mark Burley: I think that’s a question you have to ask Lesley, why she named me. I don’t know why she named me.
Mr Blake: But do you think it was wrong for her to name you, given your level of involvement, or might it actually have been right?
Mark Burley: She’s saying “If remember correctly.” My view is she wasn’t remembering correctly, because I don’t recall those two specifics, especially, as I said, at that date. But I can’t be a hundred per cent certain, as I’m saying.
Mr Blake: I’m going to move on very briefly, before we finish, to a couple of other matters. Can we look at POL00055100. This question relates to your involvement in matters relating to criminal proceedings.
This is an email exchange of July 2010, so we’re going back in time now. And rollout of Horizon Online hadn’t been completed by this stage, I don’t think.
It concerns a disclosure request that was made by solicitors for somebody who was being prosecuted, Seema Misra. She was a defendant in criminal proceedings that related to an incident in 2008.
Mark Burley: I vaguely remember her name, yes. I do. From the news. Not from this.
Mr Blake: So Merlin Benjamin, on behalf of Jarnail Singh – do you remember Jarnail Singh at all?
Mark Burley: No.
Mr Blake: That’s the bottom email. In fact it’s Jarnail Singh who is sending the email. You can see over the next page. But if we highlight that bottom entry, it says:
“I enclose a copy of an email received from Issy Hogg, the defence solicitors, on 22 July 2010, the content of which is self-explanatory. Could you please be kind enough to let me have your urgent instructions as to the access and information she is requesting in respect of the system in the Midlands and the operation at Chesterfield and the error logs. I will contact Gareth Jenkins to find out what transpired at the meeting with Charles McLachlan.”
So this was essentially a disclosure request made in criminal proceedings. If we scroll up we have Andrew Winn; do you know Andrew Winn?
Mark Burley: No.
Mr Blake: Andrew Winn says there:
“John, Rod Ismay, the head of P&BA …”
Do you remember Rod Ismay?
Mark Burley: I remember Rod, yes.
Mr Blake: “… is not happy at the prospect of an open-ended invite. He has asked the question of what are the legal parameters we are working with. Simplistically, if we refuse or impose conditions do we lose the case? I think we need more guidance on how something like this might reasonably operate.”
If we go up, who is Jon Longman?
Mark Burley: I don’t know who Jon Longman is.
Mr Blake: Jon Longman is responding to Jarnail Singh, and he’s saying:
“Jarnail, I’ve spoken to a few people regarding the three points raised by Izzy Hogg.”
That’s the solicitors for Seema Misra.
“I’m awaiting comments from Penny/Gareth at Fujitsu but the general consensus of opinion is that these points are too vague and more information is required exactly from the defence as to exactly what they require. Our guidance is required as per the email from Andrew Winn below in relation to …”
Ah, sorry. If we scroll down, sorry, there’s a key passage I missed off there which is the email from Andrew Winn to Jon Longman which says:
“I think Mark Burley would be the route into IT to identify who might be best placed to deal with this aspect.”
Mark Burley: Yes.
Mr Blake: Why is your name being suggested in relation to this disclosure request?
Mark Burley: Probably because at that time I was the head of delivery for IT in the Post Office.
Mr Blake: And was it usual for you to have a role in relation to criminal proceedings?
Mark Burley: I never had a role in relation to criminal proceedings. I don’t even believe I was contacted in respect of this.
Mr Blake: So why is your name being mentioned in respect of this?
Mark Burley: I’m afraid you’ll have to ask Andrew Winn that.
Mr Blake: Did you ever recall being involved or asked to assist in any way with evidence or matters relating to criminal or civil proceedings?
Mark Burley: I don’t believe I was ever asked to deal with that unless it was, you know, without me knowing it was a criminal thing.
Mr Blake: Would you be asked to produce statements, or to produce – to carry out investigations, or to –
Mark Burley: No, I mean the only thing I can recall in anything connected – and I don’t know if this is connected to this, or something completely different, was Rod did do a piece of work to investigate the integrity of Horizon – I don’t know if it was original Horizon or Horizon Online, because the two blend, but Rod did an investigation into the integrity of the system at the time, whichever one it was. And I’m sure there are records of that, because I’m sure it’s in one of the packs that I’ve seen, where he confirmed that, you know, in his view and the view of people he had looking at it, it was operating with integrity.
Now I’d been told that was before this time, and as I said, it could even be original Horizon. As I said, I don’t ever recall being consulted on anything with a legal connection like this.
Mr Blake: So you don’t recall being consulted about the Second Sight – the matters raised by Second Sight, and in relation to these criminal proceedings, you don’t recall being –
Mark Burley: No.
Mr Blake: And in both times, people have proposed your name?
Mark Burley: Yeah.
Mr Blake: Thank you.
Sir, I don’t have many questions left. I have about ten minutes left. I see it’s 4.30. I’m hoping that there will not be any or many further questions. There may be something from Mr Whittam. I may address it very briefly.
Sir Wyn Williams: I’m reluctant, for a number of reasons, to go much beyond, say, quarter to five. And we have got the witness remote, not in being, so to speak, so that if necessary we could have ten minutes, quarter of an hour, in the morning. Subject to his availability – I should add, Mr Burley.
The Witness: I have no availability tomorrow. I wasn’t informed it was going to risk carrying on.
Sir Wyn Williams: I appreciate – anyway, don’t let’s debate it for the moment.
Mr Blake: Can we see how we get on?
Sir Wyn Williams: Let’s see where we get with Mr Blake.
Mr Blake: Thank you.
You’ve just mentioned the Ismay report. Can we go to POL00088991, please. That report is 2 August 2010, so it’s actually very shortly after this email about the Seema Misra case. So Seema Misra was 27 July 2010, the top email. And this report is 2 August 2010. Was this the report you were talking about? The Rod Ismay report?
Mark Burley: It looks like it, yes.
Mr Blake: And you’re copied there?
Mark Burley: Yes.
Mr Blake: And this is called Horizon Response to Challenges Regarding System Integrity. Do you remember why this report was produced?
Mark Burley: I think, you know, because of the reasons in the first paragraph.
Mr Blake: “Post Office Limited has, over the years, had to dismiss and prosecute a number of subpostmasters and Crown staff following financial losses in branches. A small number of those have made counterclaims that they were not guilty of the charges made but that Horizon System was faulty.”
So he was asked to produce a report that effectively defended the position, or?
Mark Burley: No. So the first paragraph talks about, you know, a small number of claims were not guilty of the charges but the Horizon System – so that’s the original Horizon System. But it’s actually then just validating that the new system has got integrity. Obviously you can’t validate that the old system had got integrity because we’d replaced it by then.
Mr Blake: Can we scroll down to the executive summary, please. It says there:
“POL has extensive control spanning systems, processes, training and support. Horizon is robust but like any system depends on the quality of entries by the users.”
So it seems there to be suggesting that the quality of the entry of users is the issue, or the significant issue.
“Horizon Online builds on this and brings benefit to running costs and change management. It is not being done because of any doubt about the Horizon of integrity.”
It then says:
“The integrity of Horizon is founded on its tamper-proof logs, it’s real time back-ups and the evidence of ‘backdoors’ so that all data entry or acceptance is at branch level and is tagged against the log-on ID of the user. This means the ownership of the accounting is truly at branch level.”
Now that wasn’t correct, was it, about the absence of backdoors and everything being at branch level?
Mark Burley: How do you mean?
Mr Blake: Well, was that correct? Did you agree with that proposition?
Mark Burley: To a degree. I might have worded it slightly different. And the absence of unauthorised backdoors.
Mr Blake: So there were backdoors, but they were –
Mark Burley: Well, any system has to be maintained, yes. So you do need, you know, a control system such that you can go in and make appropriate, you know, new coding, for example, et cetera, that needs to be done on any system. But it’s that authorised backdoors that I’m emphasising.
So on Horizon Online, it was certainly always built and tested as a two-person entry. So there had to be two persons involved to make sure it had that authorisation.
Mr Blake: When you read this for the first time, did you say, “That bit’s not right”?
Mark Burley: I didn’t say it’s not right; I just questioned the wording.
Mr Blake: Who with?
Mark Burley: Myself. I read it – you said when I read it for the first time, so when I –
Mr Blake: You received it 2 August 2010, you’re copied in. On reading this, did you say, “Hang on a minute, what it’s saying about backdoors is wrong”?
Mark Burley: I don’t recall, to be honest, at that point, who I raised it with. I was more interested in what were the important lessons that we had to learn from it.
Mr Blake: The final paragraph on that page:
“There are several improvement opportunities for POL, and these are set out in Appendix 1. They do not undermine POL’s assertion regarding the integrity of Horizon but they would tackle some of the other noise which complainants feed on.”
That phrase, “noise”, that was something that you – that was a phrase that came up in your witness statement, as well, that I took you to earlier. Was that a common word that was used at the Post Office to describe the complaints about the Horizon System?
Mark Burley: Yeah, but only in the sense of, you know, noise can be good or bad. So, you know, don’t interpret it as being necessarily negative. It’s negative in this context, and obviously we had to take note of the noise and make sure we acted upon it. And that’s one of the reasons, as I said, we had the Federation in with us – so they could help us with that noise and help us either (a) understand it, or (b) you know, they would help promote the right communications that would help alleviate the noise.
One of the biggest bits of noise that we had was in the early days of deployment, because we made a conscious decision to substantially change the user interface, and because of that, we had quite a bit of what I’m going to use the term “noise”, because people were not used to it. But actually, very quickly that noise died down from the users, but it almost kept a balance because as new users came on, you got the same noise because they just weren’t used to that new user interface. And it was specifically done that way because, had we kept the user interface as it was, that was part of the problem with original Horizon and why some transactions were taking longer than they needed to: because they had to navigate several screens, whereas we made it much quicker and easier to navigate to transactions.
Mr Blake: Thank you. That’s not quite the point I’m making, but I’m going to have to move on because of time. But I just ask, are you really saying that the phrase “noise” there is used in a neutral term, as a neutral term, or is it being critical?
Mark Burley: I think on this one it’s critical. It’s a negative in this one.
Mr Blake: Can we look at POL00091384, please. This is document from November 2010. It’s an email. It’s an email from Lynn to Mike and Rod, so including it to Rod Ismay. It’s the second – Lynn Hobbs. If we look over the page, sorry. Who was Lynn Hobbs?
Mark Burley: At the time, Lynn would have been probably a regional manager, I think, at the time.
Mr Blake: This is November 2010. She says:
“I found out this week that Fujitsu can actually put an entry into a branch account remotely. It came up when we were exploring solutions around a problem generated by the system following migration to HNG-X. This issue was quickly identified and a fix put in place, but it impacted around 60 branches and meant a loss/gain incurred in a particular week in effect disappeared from the system. One solution quickly discounted because of implications around integrity was for Fujitsu to remotely enter a value into a branch account to reintroduce of the missing loss/gain. So POL can’t do this, but Fujitsu can.”
Was this the point you qualified earlier, that actually, it is possible for Fujitsu to –
Mark Burley: Yes. That should have been two people doing that. I don’t know, obviously, in this particular case whether it was, but it should have been.
Mr Blake: If we look at page 1, we have, at the bottom of page 1, an email from Lynn Hobbs. She says there in the third sentence:
“I haven’t seen anything further, but I did have a conversation with Mike and the whole remote access to Horizon issue. This was being looked into by Andy McLean and Mark Burley.”
Do you remember being asked to look into it at all?
Mark Burley: I don’t remember being specifically asked to look into this one, no.
Mr Blake: Do you think that’s likely, or again, was your name being misused?
Mark Burley: I honestly don’t recall. At 3 December 2010 it could have been I was asked to, and I would have then passed that on to the then Horizon programme manager, which was Will Russell, because I would have been in a head of projects role at this stage. And, you know, I’d have actually given an honest answer that Fujitsu can access it, as long as there’s two people doing the piece to give that control.
Mr Blake: If we look up to the top of this chain, from John Breeden. Do you know who John Breeden was?
Mark Burley: No.
Mr Blake: He was the national contract manager, North Post Office. He’s emailing Angela van den Bogerd. Do you remember Angela van den Bogerd?
Mark Burley: Yes, to a degree, yes.
Mr Blake: And who was she?
Mark Burley: She was something in the network, but I don’t remember what her exact role was.
Mr Blake: Okay. Do you recall how high up within the Post Office this issue of remote access, and the ability of Fujitsu to remotely access the account, was known?
Mark Burley: No, I don’t know.
Mr Blake: Do you think it would be higher than Angela van den Bogerd?
Mark Burley: I don’t know what level Angela van den Bogerd was, but yes, I’d like to think so.
Mr Blake: Having read the Ismay report in the summer –
Mark Burley: – to be unauthorised access. That’s the key thing here. If it’s just a misunderstanding and it turns out that Fujitsu have legitimately accessed the system, then I wouldn’t expect it to go higher.
Mr Blake: Having read the Ismay report in the summer, and we’re now in December of 2010, did you tell anyone, “Hang on a minute, the Ismay report, once again this has reminded me, that bit about remote access, that’s wrong”?
Mark Burley: I’m not sure why I would, because I’m not on this, am I?
Mr Blake: Well, no, but you’ve been mentioned about looking into the problem, looking into the remote access. So you were in 2010, it seems, according to the email from Lynn Hobbs at the bottom of this page, charged with looking into the remote access with Horizon issue. Having looked into it, did you consider raising any flags?
Mark Burley: As I said to you, I was only asked to look into it in December 2010.
Mr Blake: You can’t recall looking into it, did you say?
Mark Burley: I don’t recall being asked to look into it. I’m not definitively saying I was or I wasn’t, but I don’t recall.
Mr Blake: Thank you. One final, very small issue – and I will only take five minutes on this – it’s the issue of training. Can we look at FUJ00000559. In your witness statement, paragraph 8, you say you can’t comment on training for Legacy Horizon. There is a document that I’ve been asked to bring to your attention. It’s 12 May 2000. It’s the final – at the bottom of it – it’s a Change Control Note and it refers to you in that bottom paragraph:
“A number of discussions have been held to identify a suitable mechanism for delivering the results requested, and Mark Burley confirmed to John Pope by email on 12th May 2000 that the only change Pathway was now being asked to make was the one detailed below.”
And we go over the page, the Change Control Note in itself isn’t important. The passage that I’m going to draw to your attention is this, it’s the second paragraph:
“This Change Control Note is based on the assumption that to minimise costs, the training systems will not be updated.”
Do you recall, during your involvement with Horizon – Legacy Horizon/Horizon Online – training systems not being updated because of costs issues?
Mark Burley: I don’t recall it, no, and I’m surprised that it wasn’t. But looking at the actual detail of the change, this was a change to a non sort of financial value cash account entry. It’s not a financial entry. My guess is it’s not that it won’t be updated; it will not be updated at this time. I can’t believe it wasn’t updated, full stop.
Mr Blake: Thank you.
And the final question also relates to training. You have said in your statement – you refer to the NFSP in the context of the training and assurance with HNG-X. You say that there was a test before official use of the system was approved, and that this was developed across multiple parties including the NFSP. Can you tell us who else was involved, briefly, and your recollections of what the NFSP involvement in developing that was, vis à vis any others?
Mark Burley: Yes. So one of the things that I put in place was – we called it a tripartite way of working, and it involved the NFSP, who represented all of the subpostmasters; the CWU, and some members of my programme team. Now, on occasions that created conflict in itself because sometimes the CWU, who represented the directly owned branches, and the NFSP would have different priorities. But they were all involved in putting together the testing, which my Business Change Team would have led. And probably – I can’t recall exactly, but probably – undertook that testing to assure it was fit for purpose, would be my guess, that they had got involved with.
Mr Blake: Put very simply, what was the difference between the NFSP and the CWU, in very simple terms, to the best of your recollection?
Mark Burley: Well, the difference is a priority of things, because it depends on how their members get paid. So the NFSP might want to prioritise a transaction of, you know, to a higher screen than the CWU because their members get a higher payment for it, whereas for the CWU, you do more of transaction X which wasn’t as important to be higher up on the Federation because they didn’t get paid as much for it.
It was always resolved amicably. We had discussions, we had – it was just, you know, one of the examples that I recall where there was a conflict.
Mr Blake: Thank you very much. Mr Whittam has a brief comment or question.
Mr Whittam: Sir, given the hour, a document has been referred to. We can address the issues we want to address at a later stage. I don’t need to ask any questions.
Sir Wyn Williams: Yes. I think that we’ve now run our course, Mr Blake. And if anybody did have any further questions, I was going to say that they would have to submit them to me first so I could decide whether it was necessary to ask them. And if I so decided, we’d have to arrange with Mr Burley when he could be asked them. There’s a limit for both him and the transcriber and, I have to say, me, as I get older. After 4.30 it’s quite difficult.
Mr Burley, that’s it. Thank you for coming to give evidence. And I suspect that we won’t trouble you further, but that’s not an absolute guarantee, all right, because I have cornered people into being quiet for the moment.
The Witness: Well, any help I can give.
Sir Wyn Williams: Right, fine.
10.00 tomorrow, Mr Blake?
Mr Blake: Thank you.
Sir Wyn Williams: Fine.
(4.47 pm)
(The hearing adjourned until 10.00 am the following day)