POL00029625
POL00029625
Confidential and legally privileged
Post Office Limited
Internal Briefing Note to Paula Vennells:
Second Sight review into Horizon -
Implications of Interim Report
Date: 1 July 2013
STATUS: DRAFT
THIS PAGE TO BE DELETED BEFORE SUBMISSION
FINAL BRIEFING NOTE TO BE IN PDF FORMAT TO ENSURE ALL META-DATA ABOUT PREVIOUS
DRAFTS IS REMOVED
4A_27053113_1 1
POL00029625
POL00029625
Confidential and legally privileged
Post Office Limited — For Internal Use Only — NOT TO BE CIRCULATED
To: Paula Vennells, Chief Executive Officer
Re: Second Sight review into Horizon - Interim Report
Date: 1 July 2013
Background
1. Since [[summer 2012]] Second Sight Support Services Limited (SS) has been reviewing
allegations that the Horizon system is the source of unresolved accounting shortages in
Post Office branches.
2. SS has been undertaking its review in consultation with the Rt Hon James Arbuthnot MP
(JA), and “Justice for Subpostmasters Alliance”, an organisation “established to raise
awareness of the issues within the Post Office Horizon.system”.
3. SS’s review is to:
a. review, consider and advise on whether there are any systemic issues and/or
concerns with Horizon;
consider both the old Horizon and new HNGeX (aka Horizon Online);
consider training and support.processes;
d. be reasoned and evidence based.
oo
Annex 1 provides more detail on SS’s review.
4. Post Office Limited, with assistance from Fujitsu, has engaged with SS, including by
providing branch files and transaction data, and detailed responses on specific issues
raised.
Annex 1 also provides more detail on Post Office Limited’s engagement in SS’s review.
5. We understand SS has now completed its review into 4 specific complaints, which it
wants to address in an interim report.
6. We understand SS will release its interim report to:
a. Post Office Limited on Friday 5 July 2013; and
b. JA on Tuesday 9 July 2013.
7. [[We are waiting to see what precise interim findings SS has come up with.]]
8. Susan Crichton, Lesley Sewell, Alwen Lyons and Simon Baker are meeting SS on Monday
1 July 2013 at 3pm, when we aim to get a clearer picture of SS’s interim findings and
timing for delivery.
4A_27053113_1 2
POL00029625
POL00029625
Confidential and legally privileged
9. [[We believe JA may feel that any interim findings which disclose any issue with Horizon
should result in past criminal prosecutions by Post Office Limited being reopened and
overturned.]]
10. Paula Vennells will be speaking to JA on Wednesday 3 July 2013, with possibility of
escalating to a face-to-face meeting if necessary.
11. Alwen Lyons has begun communicating Post Office Limited’s position to JA viaa
telephone discussion with his personal assistance [[NAME]] on Monday 1 July 2013.
12. Post Office always has a right to respond to any findings. External communications
consultancy Portland [[FULL NAME]] has been engaged to assist Post Office Limited.
The Interim Report
13. SS’s Interim Report will focus on:
a. 4 individual cases; and
b. 2 anomalies in Horizon’s operation identified by Post Office Limited / Fujitsu.
The 4 Cases
14. SS’s Interim Report will focus on the following four cases:
Name Branch Referral — Issue Civil or Criminal
(Dates of Service) »I MP/JFSA Action
Armstrong Lepton, (UFSA]] Risks associated lela
(****) with power or
communications
failures
Rudkin Ibstock [JFSA]] Access to live iaiatal
(****) Horizon data
O'Dell Great Staughton Jonathan Transparency of iia
(01.01.09 to Djanogly MP stock adjustments
31.01.10)
Hall Hightown Mike Wood MP I Recording scratch I ****
(*#***) card stock levels
See Annex 2 for more details of these cases.
15. SS considered some of the evidence provided by Post Office Limited, but maybe not all
of it due to resource constraints.
4A_27053113_1 3
POL00029625
POL00029625
Confidential and legally privileged
16. SS has also asked subpostmasters to comment on what they think of this evidence and
(in at least one case) its proposed findings.
17. We believe SS has NOT found any evidence of systemic problems with the Horizon
computer system:
a. in any of the 4 cases in the Interim Report;
b. in any of the 6 other cases which SS has referred to Post Office Limited for
review; or
c. otherwise during its review.
The 2 Anomalies
18. We also understand SS’s Interim Report will discuss two anomalies in Horizon’s
operation.
19. These were found by Post Office Limited and voluntarily communicated to SS, i.e.
neither was identified by SS.
20. The “62 Branch Anomaly”: [[SIMON BAKER TO REVIEW AND AMEND AS NECESSARY]]
»
affected 62 branches (13 Crowns; 49:agency branches)
b. concerns a Receipts and Payments mismatch in HNG-X where discrepancies
were moved into’the.local suspense account
first appeared in March 2010
d. majorityof incidents occurred between August and October 2010
e. identified by Horizon’s built-in checks and balances which are designed to flag up
these type of discrepancies
f. could have been identified if the subpostmaster had carefully scrutinised his/her
Final Balance Report [[SIMON — IS THIS FAIR?]]
g. 17 subpostmasters were adversely affected, i.e. had a loss attribute to their
branch.
h. subpostmasters notified in March 2011 and (where appropriate) reimbursed
i. in the worst case, the subpostmaster was reimbursed c.£115
j. subpostmasters who gained through the anomaly were not asked to refund this
[[ALWEN — DID I UNDERSTAND THIS CORRECTLY?]]
k. anomaly pre-dates Separation, and therefore would have been dealt with by
Royal Mail Group Legal.
I. reason for delay in notifying subpostmasters:
i. priority and distinction from other service issues that were happening at
the time of the HNG rollout;
ii.complexity of understanding the root cause; and
iii. getting agreement and clarity on how best to communicate this
to branches.
+3)
RW - cover Mark Davies’ comments
4A_27053113_1 4
POL00029625
POL00029625
Confidential and legally privileged
21. The “14 Branch Anomaly”:
»
affected 14 branches (4 Crowns, 10 subpostmasters)
concerns an error where historic accounting entries in the 2010/11 financial year
were reproduced in accounts for 2011/12 and 2012/13.
first notified to Post Office Limited in January 2012
raised by 2 subpostmasters affected by the anomaly.
5 subpostmasters were adversely affected, i.e. had money improperly deducted.
In response, Post Office Limited suspended attempts to recover known losses
from affected subpostmasters.
g. subpostmasters notified on [[2 July 2013]].
h, the worst loss to a branch would have been £9,799.88. This was one of the first
cases notified, so recovery action was not progressed. Other losses ranged from
£113.14 down to a penny.
i. reason for delay in notifying subpostmasters:
i. irregular occurrence - it took over,42 months to realise that this was an
error in Horizon rather than an error by subpostmaster or Post Office
Limited;
ii.very few branches materially affected.
s
pao
22. [[We have implemented new processes having learnt lessons from these two bugs:
[SIMON BAKER TO PROVIDE DETAILS IF APPLICABLE OR DELETE]]
23. One of the branches affected by the 14 Branch Anomaly is within scope of the SS review
(Bowness Road branch)» That branch received a gain of £3,186.70 (i.e. there was no loss
to the branch).
24. The anomaly first manifested itself in the Bowness Road branch after the complaining
subpostmaster’s contract for services was terminated for branch mismanagement and
password sharing.
25. One other branch affected by the 14 Branch Anomaly (Merthyr Dyfan) was review by
Post Office Limited. That branch received a gain of £160.92 (i.e. there was no loss to the
branch).
26. We currently understand the branch to be operated by Costcutter, and that its
employee is being prosecuted over in-branch losses of c. £49,000 (£39,000 of which has
been repaid to Post Office Limited). [[RW TO UPDATE ON 02.07.13]
27. In line with our duties to the Courts, we are taking steps to contact the prosecuting
body so that they are aware of the anomaly and can disclose the information in any
criminal proceedings as they consider appropriate.
28. None of the subpostmasters affected by either anomaly have been prosecuted over it.
Other Anomalies - “Falkirk”
4A_27053113_1 5
POL00029625
POL00029625
Confidential and legally privileged
29. We are also aware of a further anomaly in Horizon which was been considered in both
criminal and civil Court proceedings — the “Falkirk Anomaly”.
30. The Falkirk Anomaly occurred when cash or stock was transferred between stock units.
It was resolved in March 2006 is therefore a different anomaly to either the 14 Branch
or 62 Branch Anomaly.
31. The Falkirk Anomaly was the subject of expert evidence in the “Misra” criminal
prosecution, where:
a, the defence expert asserted that its existence demonstrated Horizon had faults
which could cause losses, and therefore that possibility could not be excluded in
Misra’s case.
b. the prosecution expert (Gareth Jenkins from Fujitsu) asserted that it could not
have been responsible for the losses because its.clearly visible events had not
manifested themselves in the branch records, and that it had been fixed more
than a year earlier.
32. The jury convicted Misra of [[theft and/or falseaccounting]]. She was sentenced to
[[INSERT]]. Jury deliberations are confidential, and.therefore we cannot say how
central the expert evidence was to the conviction [[JARNAIL SINGH]
33. The Falkirk Anomaly was also considered by the High Court in December 2006/January
2007 when a subpostmater(Lee Castleton) raised it as part of his defence to a debt
recovery action for¢.£23,000.
34. The Court found “no evidence” of the Falkirk Anomaly in Mr Castleton’s branch, and
accepted the evidence of the Fujitsu witness (Anne Chambers), who was found to be a
“clear, knowledgeable and reliable witness”.
Criminal Prosecutions
35. We have undertaken prosecutions which relate to the old Horizon system and the new
HNGX Horizon Online system.
36. Since Separation we have never had a successful prosecution which has relied solely on
Horizon computer system evidence to convict. We have always had other evidence
which contributed to the prosecution, e.g. the behaviour of SPM, failure to mention
Horizon problems until trial, other staff using Horizon without incident.
37. Both before and after Separation, every time a defendant has raised a criticism of the
Horizon computer system it has been successfully defended by Post Office and Fujitsu.
Forward Strategy
38. Plan A: Meet JA and try to persuade him to postpone his meeting with Second Sight on
Tuesday 9 July.
4A_27053113_1
POL00029625
POL00029625
Confidential and legally privileged
39. If not successful, Plan B: We are preparing a full communications strategy and will
consider rebuttal and tactics in line with an approach aimed to minimise reputational
impact to Post Office Limited.
40. Do we attend the meeting with Second Sight and JA on Tuesday 9"?
a. asan observer? (attending may open us up to a cross examination); OR
b. not attend and pursue the communications strategy (Plan B above)?
41. Consider replacing or introducing a new Independent reviewer (such as one of the
Consulting / Accountancy firms)?
Key Messages [[MARK DAVIES TO REVIEW AND AMEND AS NECESSARY]]
42. Horizon’s size and user base —
a. 6 million transactions processed daily
b. over the past ten years, many millions of branch reconciliations have been
carried out;
c. Horizon used out by 25,000 subpostmasters and their staff in Post Office
branches with transactions and balances accurately recorded.
43. Horizon designed to maintain the integrity of transaction data. SS has not as yet
identified anything which challenges this core principle. [[SIMON BAKER TO CONFIRM]]
44, With respect to the 62 Branch and 14 Branch Anomalies:
a. We found the anomalies and, so as to be completely open, told SS (i.e. SS didn't
find them).
b, the anomalies were detected, resolved, and we communicated the problem to
sub postmasters
c. confirm the anomlaies did not affect the transaction data [[FUJITSU / GARETH
JENKINS TO CONFIRM]
d. no Post Office prosecutions relate to these bugs [[JARNAIL SINGH TO
CONFIRM]]
e. say we have addressed the problem (but acknowledge it has taken time)
4A_27053113_1 7
POL00029625
POL00029625
Confidential and legally privileged
ANNEX 1 — An overview of the Second Sight Inquiry process and how Post Office has
interacted with it
Overview of the Inquiry process
As part of the Inquiry process, Second Sight has submitted 10 scenarios relating to Horizon to
Post Office for its comments (the Spot Reviews). In light of its review to date and Post Office's
responses to these Spot Reviews, Second Sight is now preparing an Interim Report.
In accordance with the Inquiry process set out under the "Raising Concerns with Horizon"
agreement:
- Second Sight will prepare its report bearing in mind the primary need to ensure that
the report is reasoned and evidence based.
: The report and any recommendations will be the expert-and reasoned opinion of
Second Sight in light of the evidence seen during the Inquiry.
- Second Sight will consult with JFSA, Post Office and/or any other party as it considers
necessary before producing any report.
- Post Office may provide Second Sight with its own comments on any or all concerns,
and on Horizon generally.
- Second Sight will consider.and take into account any comments received from JFSA,
Post Office and/or any other consulted party.
Post Office's activity
Post Office has provided continuous support to Second Sight and has responded to all 10 Spot
Reviews.
In supporting Second Sight, Post Office has:
- Worked with Second Sight to ensure that it is addressing all issues raised.
- Thoroughly reviewed each Spot Review through the leadership of senior
management.
- Consulted senior personnel inside Post Office on the issues raised in each Spot
Review.
- Liaised closely with Fujitsu so that its expertise on Horizon supports every response.
- Collated and interrogated Horizon transaction records where Second Sight has
referenced particular identifiable transactions.
4A_27053113_1 8
POL00029625
POL00029625
Confidential and legally privileged
- Addressed any follow-up questions raised by Second Sight or Subpostmasters.
- Promptly submitted all responses to Second Sight in accordance with agreed
timeframes.
Overview of Post Office's responses
Post Office remains confident that Horizon is a robust system that accurately records the
activities of Subpostmasters, and maintains the integrity of transaction data.
All 10 Spot Reviews have been fully addressed by Post Office and none of them have identified
any error in Horizon.
In fact, the Spot Reviews have demonstrated that Post Office's organisational processes and
the Horizon system are designed to:
- Consistently track user and transaction activity in atransparent manner.
- Provide complete audit trails that allow Subpostmasters to fully review their
transaction histories.
- Strictly control access to Horizon data.
- Mitigate the risk of user generated errors resulting in financial losses.
: Prevent fraud against Subpostmasters and Post Office.
- Withstand problems outside Post Office's and Subpostmasters' control such as power
outages.
- Constantly monitor Horizon use and user experience for possible improvement.
It is expected that Second Sight's Interim Report will address Spot Reviews 1, 5, 21 and 22 in
detail. Below is a summary of Post Office's position on each of those Spot Reviews.
4A_27053113_1 ®
POL00029625
POL00029625
Confidential and legally privileged
ANNEX 2 — DETAIL ON THE 4 CASES SECOND SIGHT ARE PROVIDING AN INTERIM REPORT ON
CASE 1 - Spot Review 1 — Risks associated with power or communications failures
This Spot Review principally asks whether Horizon robustly manages the risks created when it is
unable to connect to Post Office's central servers due to a power or communications failure
which is beyond a Subpostmasters' or Post Office's control.
Post Office's response to this Spot Review shows that the in-branch Horizon terminal has a
robust back-up and recovery system that prevents there being any discrepancies or errors in
the event of a communications or power failure.
In the particular case raised in the Spot Review, the root cause of the difficulties suffered by the
Subpostmaster was his failure to follow the on-screen and printed instructions given by
Horizon.
A comprehensive, line-by-line review of all the Horizon transactions for the period covered by
this Spot Review was undertaken by Horizon experts at Fujitsu. In light of this analysis, Post
Office Limited is confident that the SPMR knew that the back-up and recovery process had
actively managed the communications failure at the-branch in question because:
- When the transactions in question first failed to be processed, Horizon asked the
SPMR whether he wished to cancehor retry the transactions. The SPMR opted to
retry the transactions.
: When the transactions failed again, the SPMR opted to cancel the transactions.
- Horizon then automatically disconnected and printed a "disconnect" receipt that
showed the transactions that had been automatically reversed.
- A standard customer receipt was not produced — this would tell the SPMR that the
full transaction had not proceeded.
- Following the disconnect, the SPMR was required to log back on to Horizon and duly
did so.
- Following the log on, and as part of the standard recovery process, Horizon printed a
"recovery" receipt which again showed the transactions that had been reversed and
those that had been recovered.
The transaction logs evidencing the above conclusions have been provided to Second Sight.
CASE 2 - Spot Review 5 — Access to live Horizon data
This Spot Review principally focusses on an assertion by Mr Michael Rudkin that during a visit
to Fujitsu's site at Bracknell on Tuesday 19th August 2008, he observed an individual based in
4A_27053113_1 10
POL00029625
POL00029625
Confidential and legally privileged
the basement of the building who demonstrated the ability to access ‘live’ branch data and
directly adjust transactions on the Horizon system.
Given the amount of time that has passed, neither POL nor Fujitsu have any record of Mr
Rudkin attending the Bracknell site.
Post Office and Fujitsu have attempted to establish the Bracknell visitor logs for the day in
question to verify Mr Rudkin’s attendance and his contact on the day, however these records
are not retained for as far back as 2008.
Fujitsu have additionally made the effort to go through all email, documents and archived
information to hand but do not have any information for Tuesday 19th August 2008 that would
suggest they had visitors to the site.
Further review into Post Office work logs indicates that there were just three POL test
managers present on site in Bracknell on the 19 August 2008. None of them have any calendar
records relating to a visit by Mr Rudkin.
It has however been determined that in August 2008 the basement of Fujistu's building
contained a Horizon test environment that would lookvery similar to a live Horizon
environment. This environment was not physically or technologically connected to the live
Horizon environment. It was therefore impossible foranyone.in this room to have adjusted any
live transaction records, though Mr Rudkin’may have witnessed some form of adjustment to
the test environment.
This separation of test andilive environments is\designed to guarantee the integrity of Horizon
data.
CASE 3 - Spot Review 21 — transparency of stock adjustments
This Spot Review principally asks whether Horizon automatically makes stock adjustments and,
if so, whether this could cause a subpostmaster to suffer a loss.
In summary, Horizon does not generate automatic stock adjustments. This function does not
exist within Horizon.
Each member of staff at Post Office branches should have and use their own unique ID. Each
subpostmaster, as a result, has a unique user ID. This requirement is detailed in the Standard
Subpostmaster's Contract for Services. Section 1, clauses 5, 14 and 15 of this Contract for
Services and the Horizon Online Help operational manual provide that passwords and login
details for Horizon are personal and are not to be shared between branch staff. This is
important to enable traceability of transactions for audit and review purposes.
On review of the Horizon transaction logs, every stock adjustment transaction inputted on 4
November 2009 at the Great Staughton branch (being the date and branch under consideration
in this Spot Review) was a manual transaction logged against the subpostmaster user ID
(JOD001).
4A_27053113_1 "
POL00029625
POL00029625
Confidential and legally privileged
Even if there were erroneous stock adjustments, these adjustments could not cause a
subpostmaster to suffer a loss due to the "double entry" balancing process inherent in Horizon.
Each manual instruction inputted by a subpostmaster creates a double entry (i.e. if the
subpostmaster adjusts the stock level down, the cash level on Horizon will be increased by the
same value as the stock). This has a balancing effect on the overall cash and stock position
even if an error is made by the subpostmaster. For example, if the branch position begins in
balance, an inaccurate increase to the stock level of stamps will create a shortage of stamps
but it will also cause a reciprocal decrease in the cash position thereby creating a balancing
surplus of cash. This shortage of stamps and surplus of cash balance out meaning the
subpostmaster will not have an overall shortfall.
This double entry system is designed to mitigate the risk of user errors by automatically
balancing out those errors to the Subpostmaster's benefit.
CASE 4 - Spot Review 22 — Recording scratch card stock levels
This Spot Review principally asks whether Horizon accurately records REMMED-in scratch
cards,
In summary, Post Office cannot find any evidence that there is a problem with the Horizon
system with regard to REMMED-in scratch cards.
National Lottery scratch cards are provided and)controlled by Camelot, the National Lottery
provider. In order to sell scratch cards, a Subpostmaster must (1) activate a pack of scratch
cards on the in-branch Lottery terminal and (2) REM-in the scratch card stock on Horizon.
"REMMING-in" a scratch cardhis the process whereby new packs of scratch cards are recorded
on Horizon as in branch stock.
During the period being examined in this Spot Review, if subpostmasters correctly REM-in
scratch cards to the Horizon system the final figures recorded in the Horizon system at the end
of each day will match the final figures in the Camelot system at the end of each day for the
activation of scratch cards.
On 17 February 2010 at the Hightown branch (being the date and branch under consideration
in this Spot Review) there were two remittance sessions relating to scratch cards in regard to
which two receipts would have been automatically produced by Horizon.
The Spot Review suggests that the Subpostmaster's printed records on this day do not match
Post Office's records. However, the alleged discrepancy in the figures resulted from the
subpostmaster presenting for the purposes of this Spot Review only one of the two receipts
produced on this day.
The transaction history in Horizon reflects the figures advanced by Post Office. [[This
transaction history has been provided to Second Sight. CHECK]]
4A_27053113_1 2
POL00029625
POL00029625
Confidential and legally privileged
In any event, the manual REMMING-in of scratch cards by Subpostmasters has now been
replaced with an automated process so the risk of a discrepancy occurring (such as the one in
the Hightown branch on 17 February 2010) has been largely mitigated.
4A_27053113_1