POL00115919
POL00115919
Confidential and legally privileged
Post Office Limited
Internal Briefing Note to Paula Vennells:
Second Sight review into Horizon -
Implications of Interim Report
Date: 2 July 2013
STATUS: DRAFT
THIS PAGE TO BE DELETED BEFORE SUBMISSION
FINAL BRIEFING NOTE TO BE IN PDF FORMAT TO ENSURE ALL META-DATA ABOUT PREVIOUS
DRAFTS IS REMOVED
4A_27053113_1 1
POL00115919
POL00115919
Confidential and legally privileged
Post Office Limited — For Internal Use Only — NOT TO BE CIRCULATED
To: Paula Vennells, Chief Executive Officer
Re: Second Sight review into Horizon - Interim Report
Date: 2 July 2013
Background
1. Since June 2012 Second Sight Support Services Limited (SS) has been reviewing
allegations that the Horizon system is the source of unresolved accounting shortages in
Post Office branches.
2. SS has been undertaking its review in consultation with the Rt Hon James Arbuthnot MP
(JA), and “Justice for Subpostmasters Alliance”, an organisation “established to raise
awareness of the issues within the Post Office Horizon.system”.
3. SS’s review is to:
a. review, consider and advise on whether there are any systemic issues and/or
concerns with Horizon;
consider both the old Horizon and new HNGeX (aka Horizon Online);
consider training and support.processes;
d. be reasoned and evidence based.
oo
Annex 1 provides more detail on SS’s review.
4. Post Office Limited, with assistance from Fujitsu, has engaged with SS, including by
providing branch files and transaction data, and detailed responses on specific issues
raised.
Annex 1 also provides more detail on Post Office Limited’s engagement in SS’s review.
5. 49 cases have been referred to SS. SS has now completed its review into 4 specific
complaints, which it will address in an interim report.
6. SS will release its interim report to:
a. Post Office Limited on Friday 5 July 2013; and
b. JA on Monday 8 July 2013.
7. Susan Crichton, Lesley Sewell, Alwen Lyons, Angela van den Bogerd and Simon Baker
met SS on Monday 1 July 2013 at 3pm and obtained a clearer picture of SS’s interim
findings and timing for delivery.
8. [[We believe JA may feel that any interim findings which disclose any issue with Horizon
should result in past criminal prosecutions by Post Office Limited being reopened and
overturned.]]
4A_27053113_1 2
POL00115919
POL00115919
Confidential and legally privileged
9. Paula Vennells and Alwen Lyons will be meeting JA on Wednesday 3 July 2013.
10. Alwen Lyons began communicating Post Office Limited’s position to JA via a face to face
meeting with his personal assistant Jane Walker on Monday 1 July 2013.
11. Post Office always has a right to respond to any findings. External communications
consultancy Portland has been engaged to assist Post Office Limited.
The Interim Report
12. SS’s Interim Report will focus on:
a. 4 individual cases; and
b. 2 anomalies in Horizon’s operation identified by Post Office Limited / Fujitsu.
The 4 Cases
13. SS’s Interim Report will focus on the following four cases:
Name Branch Referral — Issue Civil or Criminal
MP/JESA Action
Armstrong Lepton JFSA Whether Horizon I ****
provides adequate
and timely
information during
power or
communications
failures
Rudkin Ibstock Andrew Access to live ileal
Bridgen MP Horizon data
O'Dell Great Staughton Jonathan Transparency of iii
Djanogly MP stock adjustments
Hall Hightown Mike Wood MP I Recording scratch I ****
card stock levels
See Annex 2 for more details of these cases.
14. SS has considered some of the evidence provided by Post Office Limited, but due to
resource constraints might not have considered it all (e.g. the specific branch
transaction logs).
4A_27053113_1 3
POL00115919
POL00115919
Confidential and legally privileged
15. SS has also asked subpostmasters to comment on this evidence and its proposed
findings for the four cases in the Interim Report.
16. We believe SS has NOT found any evidence of systemic problems with the Horizon
computer system:
a. inany of the 4 cases in the Interim Report;
b. in any of the 6 other cases which SS has referred to Post Office Limited for
review; or
c. otherwise during its review.
The 2 Anomalies
17. We also understand SS’s Interim Report will discuss two anomalies in Horizon’s
operation.
18. These were found by Post Office Limited and voluntarily communicated to SS, i.e.
neither was identified by SS as part of its review.
19. The “62 Branch Anomaly”:
»
affected 62 branches (13 Crowns; 12 Multiples; 37 Subpostmasters)
b. concerns a Receipts and Payments mismatch in HNG-X when discrepancies were
moved into the local suspense account,(i.e/the account which aggregates all
discrepancies intovaysingle gain or loss for a branch trading period).
first appeared in March 2010.
majority/of incidents occurred between August and October 2010
branch losses ranged from £777.96 down to 34p.
identified by Horizon’s built-in checks and balances which are designed to flag up
these types of discrepancies.
g. could have been identified if the subpostmaster had carefully scrutinised his/her
Final Balance Report.
h, 17 subpostmasters were adversely affected, i.e. had a loss attribute to their
branch.
i. subpostmasters notified in March 2011 and (where appropriate) reimbursed.
j. subpostmasters who made a gain through the anomaly were not asked to
refund this.
k. anomaly pre-dates Separation, and therefore would have been dealt with by
Royal Mail Group Legal.
I. reason for delay in notifying subpostmasters:
i. priority and distinction from other service issues that were happening at
the time of the HNG rollout;
ii.complexity of understanding the root cause; and
iii. getting agreement and clarity on how best to communicate this
to branches.
moan
20. The “14 Branch Anomaly”:
4A_27053113_1 4
POL00115919
POL00115919
Confidential and legally privileged
21.
22.
23.
24,
25.
26.
27.
»
financially impacted 14 branches (4 Crowns; 5 Multiples; 5 Subpostmasters)
b. concerns an error where historic accounting entries in the 2010/11 financial year
were replicated in accounts for 2011/12 and 2012/13.
first notified to Post Office Limited in January 2012
d. raised by 2 subpostmasters affected by the anomaly.
5 subpostmasters were adversely affected, i.e. had a loss attribute to their
branch.
f. Post Office Limited suspended attempts to recover known losses from affected
subpostmasters.
g. subpostmasters notified on [[2 July 2013]].
h, the worst loss to a branch would have been £9,799.88. This was one of the first
cases notified, so no recovery action was progressed. Other losses ranged from
£113.14 down to a penny.
i. reason for delay in notifying subpostmasters:
i. irregular occurrence - it took over,42 months to realise that this was an
error in Horizon rather than an error by subpostmaster or Post Office
Limited;
ii.very few branches materially affected.
°
Modifications have been made to rectify the 62 Branch Anomaly, and will be made to
rectify 14 Branch Anomaly.
One of the branches affected by.the 14 Branch Anomaly is within scope of the SS review
(Bowness Road branch)» That branch received a gain of £3,186.70 (i.e. there was no loss
to the branch).
The anomaly first manifested itself in the Bowness Road branch after the complaining
subpostmaster’s contract for services was terminated for branch mismanagement and
password sharing.
One other branch affected by the 14 Branch Anomaly (Merthyr Dyfan) was review by
Post Office Limited. That branch received a gain of £160.92 (i.e. there was no loss to the
branch).
We currently understand the branch to be operated by Costcutter, and that its
employee is being prosecuted over in-branch losses of c. £49,000 (£39,000 of which has
been repaid to Post Office Limited). [[RW TO UPDATE ON 02.07.13]]
In line with our duties to the Courts, we are taking steps to contact the prosecuting
body so that they are aware of the anomaly and can disclose the information in any
criminal proceedings as they consider appropriate.
None of the subpostmasters affected by either anomaly have been prosecuted over it.
Other Anomalies - “Falkirk”
4A_27053113_1 5
POL00115919
POL00115919
Confidential and legally privileged
28. We are also aware of a further anomaly in Horizon which was been considered in both
criminal and civil Court proceedings — the “Falkirk Anomaly”.
29. The Falkirk Anomaly occurred when cash or stock was transferred between stock units.
It was resolved in March 2006 is therefore a different anomaly to either the 14 Branch
or 62 Branch Anomaly.
30. The Falkirk Anomaly was the subject of expert evidence in the “Misra” criminal
prosecution, where:
a, the defence expert asserted that its existence demonstrated Horizon had faults
which could cause losses, and therefore that possibility could not be excluded in
Misra’s case.
b. the prosecution expert (Gareth Jenkins from Fujitsu) asserted that it could not
have been responsible for the losses because its.clearly visible events had not
manifested themselves in the branch records, and that it had been fixed more
than a year earlier.
31. Misra pleaded guilty to false accounting, and:was convicted by jury of theft. To reach
this verdict, the jury had to be satisfied that the charges were proved beyond all
reasonable doubt. She was sentenced to 15 months imprisonment. There has been no
appeal against the conviction.
32. The Falkirk Anomaly wasialso considered by the High Court in December 2006/January
2007 when a subpostmater (Lee.Castleton) raised it as part of his defence to a debt
recovery action for c.£23,000.
33. The Court found “no evidence” of the Falkirk Anomaly in Mr Castleton’s branch, and
accepted the evidence ofthe Fujitsu witness (Anne Chambers), who was found to be a
“clear, knowledgeable and reliable witness”.
Criminal Prosecutions
34. We have undertaken prosecutions which relate to the old Horizon system and the new
HNGX Horizon Online system.
35. Since Separation we have never had a successful prosecution which has relied solely on
Horizon evidence to convict. We have always had other evidence which contributed to
the prosecution, e.g. the behaviour of SPM, failure to mention Horizon problems until
trial, other staff using Horizon without incident.
36. Both before and after Separation, every time a defendant has raised a criticism of the
Horizon computer system it has been successfully defended by Post Office and Fujitsu.
Forward Strategy
4A_27053113_1
POL00115919
POL00115919
Confidential and legally privileged
37. Plan A: Meet JA and try to persuade him to postpone his meeting with Second Sight on
Monday 8 July 2013. This is unlikely to be successful.
38. If not successful, Plan B: We are preparing a full communications strategy and will
consider rebuttal and tactics in line with an approach aimed to minimise reputational
impact to Post Office Limited.
39. Do we attend the meeting with Second Sight and JA on Monday 8 July 2013?
a. asan observer? (attending may open us up to a cross examination); OR
b. not attend and pursue the communications strategy (Plan B above)?
40. Consider replacing or introducing a new Independent reviewer (such as one of the
Consulting / Accountancy firms)?
Key Messages [[MARK DAVIES TO REVIEW AND AMEND/AS NECESSARY]]
41. Horizon’s size and user base —
a. 6million transactions processed daily
b. over the past ten years, many millionsvof branch reconciliations have been
carried out;
c. Horizon used out by 25,000 subpostmasters and their staff in Post Office
branches with transactions and balances accurately recorded.
42. Horizon designed to maintain the integrity of transaction data. SS has not as yet
identified anything:which challenges this.core principle.
43. With respect to the.62 Branch and 14 Branch Anomalies:
a. We found the anomalies and, so as to be completely open, told SS (i.e. SS didn't
find them).
b. the anomalies were detected, resolved, and we communicated the problem to
sub postmasters
c. confirm the anomlaies did not affect the integrity of the transaction data
[[FUJITSU / GARETH JENKINS TO CONFIRM]]
d. no Post Office prosecutions relate to these bugs
say we have addressed the problem (but acknowledge it has taken time)
4A_27053113_1 7
POL00115919
POL00115919
Confidential and legally privileged
ANNEX 1 — An overview of the Second Sight Inquiry process and how Post Office has
interacted with it
Overview of the Inquiry process
As part of the Inquiry process, Second Sight has submitted 10 scenarios relating to Horizon to
Post Office for its comments (the Spot Reviews). In light of its review to date and Post Office's
responses to these Spot Reviews, Second Sight is now preparing an Interim Report.
In accordance with the Inquiry process set out under the "Raising Concerns with Horizon"
agreement:
- Second Sight will prepare its report bearing in mind the primary need to ensure that
the report is reasoned and evidence based.
: The report and any recommendations will be the expert-and reasoned opinion of
Second Sight in light of the evidence seen during the Inquiry.
- Second Sight will consult with JFSA, Post Office and/or any other party as it considers
necessary before producing any report.
- Post Office may provide Second Sight with its own comments on any or all concerns,
and on Horizon generally.
- Second Sight will consider.and take into account any comments received from JFSA,
Post Office and/or any other consulted party.
Post Office's activity
Post Office has provided continuous support to Second Sight and has responded to all 10 Spot
Reviews.
In supporting Second Sight, Post Office has:
- Worked with Second Sight to ensure that it is addressing all issues raised.
- Thoroughly reviewed each Spot Review through the leadership of senior
management.
- Consulted senior personnel inside Post Office on the issues raised in each Spot
Review.
- Liaised closely with Fujitsu so that its expertise on Horizon supports every response.
- Collated and interrogated Horizon transaction records where Second Sight has
referenced particular identifiable transactions.
4A_27053113_1 8
POL00115919
POL00115919
Confidential and legally privileged
- Addressed any follow-up questions raised by Second Sight or Subpostmasters.
- Promptly submitted all responses to Second Sight in accordance with agreed
timeframes.
Overview of Post Office's responses
Post Office remains confident that Horizon is a robust system that accurately records the
activities of Subpostmasters, and maintains the integrity of transaction data.
All 10 Spot Reviews have been fully addressed by Post Office and none of them have identified
any error in Horizon.
In fact, the Spot Reviews have demonstrated that Post Office's organisational processes and
the Horizon system are designed to:
- Consistently track user and transaction activity in atransparent manner.
- Provide complete audit trails that allow Subpostmasters to fully review their
transaction histories.
- Strictly control access to Horizon data.
- Mitigate the risk of user generated errors resulting in financial losses.
: Prevent fraud against Subpostmasters and Post Office.
- Withstand problems outside Post Office's and Subpostmasters' control such as power
outages.
- Constantly monitor Horizon use and user experience for possible improvement.
It is expected that Second Sight's Interim Report will address Spot Reviews 1, 5, 21 and 22 in
detail. Below is a summary of Post Office's position on each of those Spot Reviews.
4A_27053113_1 ®
POL00115919
POL00115919
Confidential and legally privileged
ANNEX 2 — DETAIL ON THE 4 CASES SECOND SIGHT ARE PROVIDING AN INTERIM REPORT ON
CASE 1 - Spot Review 1 — Risks associated with power or communications failures
This Spot Review principally asks whether Horizon robustly manages the risks created when it is
unable to connect to Post Office's central servers due to a power or communications failure
which is beyond a Subpostmasters' or Post Office's control.
Post Office's response to this Spot Review shows that the in-branch Horizon terminal has a
robust back-up and recovery system that prevents there being any discrepancies or errors in
the event of a communications or power failure.
In the particular case raised in the Spot Review, the root cause of the difficulties suffered by the
Subpostmaster was his failure to follow the on-screen and printed instructions given by
Horizon.
A comprehensive, line-by-line review of all the Horizon transactions for the period covered by
this Spot Review was undertaken by Horizon experts at Fujitsu. In light of this analysis, Post
Office Limited is confident that the SPMR knew that the back-up and recovery process had
actively managed the communications failure at the-branch in question because:
- When the transactions in question first failed to be processed, Horizon asked the
SPMR whether he wished to cancehor retry the transactions. The SPMR opted to
retry the transactions.
: When the transactions failed again, the SPMR opted to cancel the transactions.
- Horizon then automatically disconnected and printed a "disconnect" receipt that
showed the transactions that had been automatically reversed.
- A standard customer receipt was not produced — this would tell the SPMR that the
full transaction had not proceeded.
- Following the disconnect, the SPMR was required to log back on to Horizon and duly
did so.
- Following the log on, and as part of the standard recovery process, Horizon printed a
"recovery" receipt which again showed the transactions that had been reversed and
those that had been recovered.
The transaction logs evidencing the above conclusions have been provided to Second Sight.
CASE 2 - Spot Review 5 — Access to live Horizon data
This Spot Review principally focusses on an assertion by Mr Michael Rudkin that during a visit
to Fujitsu's site at Bracknell on Tuesday 19th August 2008, he observed an individual based in
4A_27053113_1 10
POL00115919
POL00115919
Confidential and legally privileged
the basement of the building who demonstrated the ability to access ‘live’ branch data and
directly adjust transactions on the Horizon system.
Given the amount of time that has passed, neither POL nor Fujitsu have any record of Mr
Rudkin attending the Bracknell site.
Post Office and Fujitsu have attempted to establish the Bracknell visitor logs for the day in
question to verify Mr Rudkin’s attendance and his contact on the day, however these records
are not retained for as far back as 2008.
Fujitsu have additionally made the effort to go through all email, documents and archived
information to hand but do not have any information for Tuesday 19th August 2008 that would
suggest they had visitors to the site.
Further review into Post Office work logs indicates that there were just three POL test
managers present on site in Bracknell on the 19 August 2008. None of them have any calendar
records relating to a visit by Mr Rudkin.
It has however been determined that in August 2008 the basement of Fujistu's building
contained a Horizon test environment that would lookvery similar to a live Horizon
environment. This environment was not physically or technologically connected to the live
Horizon environment. It was therefore impossible foranyone.in this room to have adjusted any
live transaction records, though Mr Rudkin’may have witnessed some form of adjustment to
the test environment.
This separation of test andilive environments is\designed to guarantee the integrity of Horizon
data.
CASE 3 - Spot Review 21 — transparency of stock adjustments
This Spot Review principally asks whether Horizon automatically makes stock adjustments and,
if so, whether this could cause a subpostmaster to suffer a loss.
In summary, Horizon does not generate automatic stock adjustments. This function does not
exist within Horizon.
Each member of staff at Post Office branches should have and use their own unique ID. Each
subpostmaster, as a result, has a unique user ID. This requirement is detailed in the Standard
Subpostmaster's Contract for Services. Section 1, clauses 5, 14 and 15 of this Contract for
Services and the Horizon Online Help operational manual provide that passwords and login
details for Horizon are personal and are not to be shared between branch staff. This is
important to enable traceability of transactions for audit and review purposes.
On review of the Horizon transaction logs, every stock adjustment transaction inputted on 4
November 2009 at the Great Staughton branch (being the date and branch under consideration
in this Spot Review) was a manual transaction logged against the subpostmaster user ID
(JOD001).
4A_27053113_1 "
POL00115919
POL00115919
Confidential and legally privileged
Even if there were erroneous stock adjustments, these adjustments could not cause a
subpostmaster to suffer a loss due to the "double entry" balancing process inherent in Horizon.
Each manual instruction inputted by a subpostmaster creates a double entry (i.e. if the
subpostmaster adjusts the stock level down, the cash level on Horizon will be increased by the
same value as the stock). This has a balancing effect on the overall cash and stock position
even if an error is made by the subpostmaster. For example, if the branch position begins in
balance, an inaccurate increase to the stock level of stamps will create a shortage of stamps
but it will also cause a reciprocal decrease in the cash position thereby creating a balancing
surplus of cash. This shortage of stamps and surplus of cash balance out meaning the
subpostmaster will not have an overall shortfall.
This double entry system is designed to mitigate the risk of user errors by automatically
balancing out those errors to the Subpostmaster's benefit.
CASE 4 - Spot Review 22 — Recording scratch card stock levels
This Spot Review principally asks whether Horizon accurately records REMMED-in scratch
cards,
In summary, Post Office cannot find any evidence that there is a problem with the Horizon
system with regard to REMMED-in scratch cards.
National Lottery scratch cards are provided and)controlled by Camelot, the National Lottery
provider. In order to sell scratch cards, a Subpostmaster must (1) activate a pack of scratch
cards on the in-branch Lottery terminal and (2) REM-in the scratch card stock on Horizon.
"REMMING-in" a scratch cardhis the process whereby new packs of scratch cards are recorded
on Horizon as in branch stock.
During the period being examined in this Spot Review, if subpostmasters correctly REM-in
scratch cards to the Horizon system the final figures recorded in the Horizon system at the end
of each day will match the final figures in the Camelot system at the end of each day for the
activation of scratch cards.
On 17 February 2010 at the Hightown branch (being the date and branch under consideration
in this Spot Review) there were two remittance sessions relating to scratch cards in regard to
which two receipts would have been automatically produced by Horizon.
The Spot Review suggests that the Subpostmaster's printed records on this day do not match
Post Office's records. However, the alleged discrepancy in the figures resulted from the
subpostmaster presenting for the purposes of this Spot Review only one of the two receipts
produced on this day.
The transaction history in Horizon reflects the figures advanced by Post Office. [[This
transaction history has been provided to Second Sight. CHECK]]
4A_27053113_1 2
POL00115919
POL00115919
Confidential and legally privileged
In any event, the manual REMMING-in of scratch cards by Subpostmasters has now been
replaced with an automated process so the risk of a discrepancy occurring (such as the one in
the Hightown branch on 17 February 2010) has been largely mitigated.
4A_27053113_1