POL00296943
POL00296943
Confidential and legally privileged
Post Office Limited
Internal Briefing Note to Paula Vennells:
Second Sight investigation into Horizon -
Implications of Interim Report
Date: 1 July 2013
STATUS: DRAFT
THIS PAGE TO BE DELETED BEFORE SUBMISSION
FINAL BRIEFING NOTE TO BE IN PDF FORMAT TO ENSURE ALL META-DATA ABOUT PREVIOUS
DRAFTS IS REMOVED
4A_27053113_1 1
POL00296943
POL00296943
Confidential and legally privileged
Post Office Limited — For Internal Use Only — NOT TO BE CIRCULATED
To: Paula Vennells, Chief Executive Officer
Re: Second Sight investigation into Horizon - Interim Report
Date: 1 July 2013
Background
1. Since [[DATE]] Second Sight Support Services Limited (SS) has been investigating
allegations that the Horizon system is the source of unresolved accounting shortages in
Post Office branches.
2. SS has been undertaking its investigation in consultation with the Rt Hon James
Arbuthnot MP (JA), and “Justice for Subpostmasters Alliance”, an organisation
“established to raise awareness of the issues within the Post Office Horizon system”.
3. SS’s investigation is to:
a. review, consider and advise on whether there are any systemic issues and/or
concerns with Horizon;
consider both the old Horizon and new HNG=X (aka Horizon Online);
consider training and support.processes;
d. be reasoned and evidence based.
on
Annex 1 provides more detail on SS’s investigation.
4. Post Office Limited, with assistance from Fujitsu, has engaged with SS, including by
providing branch files and transaction data, and detailed responses on specific issues
raised.
Annex 1 also provides more detail on Post Office Limited’s engagement in SS’s
investigation.
5. We understand SS has now completed its investigation into 4 specific complaints, which
it wants to address in an interim report.
6. We understand SS will release its interim report to Post Office Limited on Monday 8 July
2013, and to JA on Tuesday 9 July. [[CHECK]]
7. Weare waiting to see what precise interim findings SS has come up with.
8. Susan Crichton and [[NAMES]] are meeting SS on Monday 1 July 2013 at [[TIME]], when
we aim to get a clearer picture of SS’s interim findings and timing for delivery.
9. We believe JA may feel that any interim findings which disclose any issue with Horizon
should result in past criminal prosecutions by Post Office Limited being reopened and
overturned. This view may have been communicated to HMG.
4A_27053113_1 2
POL00296943
POL00296943
Confidential and legally privileged
10. We are contemplating meeting JA on Wednesday 3 July (See point 29 below). [[ALWEN
TO UPDATE]]
11. Post Office always has a right to respond to any findings. External communications
agency Portland [[FULL NAME]] has been engaged to assist Post Office Limited.
The Interim Report
12. We understand SS’s Interim Report will focus on:
a. 4 individual cases; and
b. 2 anomalies in Horizon’s operation identified by Post Office Limited / Fujitsu.
The 4 Cases
13. We understand SS’s Interim Report will focus on the following four cases:
Name Branch MP Issue Civil or Criminal
(Dates of Service)
Armstrong Lepton iia Whether Horizon I ****
(****) provides adequate
and timely
information
durrign apower or
communications
failures
Rudkin Ibstock ana Access to live iia
(****) Horizon data
O'Dell Great Staughton Jonathan Transparency of iia
(01.01.09 to Djanogly stock adjustments
31 .01.10)
Hall [CHECK] Hightown Mike Wood Recording scratch I ****
(****) card stock levels
See Annex 2 for more details of these cases.
14. SS considered some of the evidence provided by Post Office Limited, but maybe not all
of it due to resource constraints.
15. SS has also asked subpostmasters to comment on what they think of this evidence and
(in at least one case) its proposed findings.
4A_27053113_1 3
POL00296943
POL00296943
Confidential and legally privileged
16. We believe SS has NOT found any evidence of systemic problems with the Horizon
computer system:
»
in any of the 4 cases in the Interim Report;
b. in any of the 6 other cases which SS has referred to Post Office Limited for
review; or
c. otherwise during its investigation
The 2 Anomalies
17. We also understand SS’s Interim Report will discuss two anomalies in Horizon’s
operation.
18. Neither of these anomalies was identified by SS, but were found by Post Office Limited
and communicated to SS.
19. The “62 Branch Anomaly”: [[SIMON BAKER TO REVIEW AND AMEND AS NECESSARY]
a. affected 62 branches 13 Crowns; 37 subpostmasters, 12 multiples)
b. concerns a Receipts and Payments mismatch in HNG-X where discrepancies
were moved into the local suspense account
first appeared in March 2010
majority of incidents occurred between August and October 2010
e. identified by Horizon’s built-in checks and balances which are designed to flag up
these type of discrepancies
f. could have.been identified if the’subpostmaster had carefully scrutinised his/her
Final Balance Report [[SIMON — IS THIS FAIR?]]
g. 17 subpostmasters were adversely affected, i.e. had money improperly
deducted.
subpostmasters notified in March 2011 and (where appropriate) reimbursed
in the worst case, the subpostmaster was reimbursed c.£115
[[WHERE SPMss HAD A GAIN, DID WE RECOVER THIS, e.g. THROUGH P&BA?]]
reason for delay in notifying subpostmasters:
i. priority and distinction from other service issues that were happening at
the time of the HNG rollout;
ii.complexity of understanding the root cause; and
iii. getting agreement and clarity on how best to communicate this
to branches.
ao
arrsos
20. The “14 Branch Anomaly”:
a. affected 14 branches (4 Crowns, 10 subpostmasters)
b. concerns an error where historic accounting entries in the 2010/11 financial year
were reproduced in accounts for 2011/12 and 2012/13.
c. first notified to Post Office Limited in January 2012
d. raised by 2 subpostmasters affected by the anomaly.
e. [[X]] subpostmasters were adversely affected, i.e. had money improperly
deducted.
4A_27053113_1 4
POL00296943
POL00296943
Confidential and legally privileged
f. In response, Post Office Limited suspended attempts to recover known losses
from affected subpostmasters.
subpostmasters notified on [[1 July 2013]].
the worst loss to a branch would have been £9,799.88. This was one of the first
cases notified, so recovery action was not progressed. Other losses ranged from
£113.14 down to a penny.
i. reason for delay in notifying subpostmasters:
i. irregular occurrence - it took over 12 months to realise that this was an
error in Horizon rather than an error by subpostmaster or Post Office
Limited;
ii.very few branches materially affected.
za
21. [[We have implemented new processes having learnt lessons from these two bugs:
[SIMON BAKER TO PROVIDE DETAILS IF APPLICABLLE]]
22. One of the branches affected by the 14 Branch Anomaly.is within scope of the SS
investigation (Wall, Bowness Road branch). That branch received a gain of £3,186.70
(i.e. there was no loss to the branch).
23. The anomaly first manifested itself in this branch occurred after the complaining
subpostmaster’s contract for services was terminated for branch mismanagement and
password sharing.
Criminal Prosecutions [[JARNAIL SINGH TO REVIEW AND AMEND AS NECESSARY]]
Generally
24. [We have undertaken prosecutions which relate to the old Horizon system and the new
HNGX Horizon Online system.] [[CHECK WITH LESLEY IF/WHY THIS IS NECESSARY]
25. [Since Separation we have never had a successful prosecution which has relied solely on
Horizon computer system evidence to convict. We have always had other evidence
which has also contributed to the guilty verdicts (such as confessions, paper trail
evidence, or lies being exposed). [CHECK what the position is on pre separation cases
with Jarnail and rob Wilson if we can]
26. [Both before and after Separation, every time a defendant has raised a criticism of the
Horizon computer system it has been successfully defended by Post Office and Fujitsu].
[CHECK what the case is pre Separation]
With respect to the 62 Branch and 14 Branch Anomalies
27. [None of the subpostmasters affected by either bug have been prosecuted over it]
UJARNAIL TO CONFIRM]
28. [[ADD THE “MISRA” ANOMLAY AND ANY FURTHER ANOMALIES RAISED IN COURT
PROCEEDINGS HERE?]]
Forward Strategy
4A_27053113_1 5
POL00296943
POL00296943
Confidential and legally privileged
29. Plan A: Meet JA and try to persuade him to postpone his meeting with Second Sight on
Tuesday 9 July.
30. If not successful, Plan B: prepare a counter-comms statement to be issued on [[WHEN?
Mon 8th or Tues 9" July] to try to minimise the chances of any misleading stories
developing.
31. Do we attend the meeting with Second Sight and JA on Tuesday 9°"?
a. asan observer? (attending may open us up to a cross examination); OR
b. not attend and issue a counter-comms?
32. Consider replacing or introducing a new Independent reviewer (such as one of the
Consulting / Accountancy firms)?
Key Messages [[MARK DAVIES TO REVIEW AND AMEND AS NECESSARY]]
33. Horizon’s size and user base —
a. 6 million transactions processed daily,
b. over the past ten years, many millions of branch reconciliations have been
carried out;
c. Horizon used out by 25,000,subpostmasters and their staff in Post Office
branches with transactions and balances accurately recorded.
34. Horizon designed to maintain the integrity of transaction data. SS has not as yet
identified anything which challenges this core principle. [[SIMON BAKER TO CONFIRM]]
35. With respect to the 62,Branch and 14 Branch Anomalies:
a. We found the anomalies and, so as to be completely open, told SS (i.e. SS didn't
find them).
b, the anomalies were detected, resolved, and we communicated the problem to
sub postmasters
c. confirm the anomlaies did not affect the integrity of the transaction data
[[FUJITSU / GARETH JENKINS TO CONFIRM]]
d. no Post Office prosecutions relate to these bugs [[JARNAIL SINGH TO
CONFIRM]]
e. say we have addressed the problem (but acknowledge it has taken time)
4A_27053113_1 6
POL00296943
POL00296943
Confidential and legally privileged
ANNEX 1 — An overview of the Second Sight Inquiry process and how Post Office has
interacted with it
Overview of the Inquiry process
As part of the Inquiry process, Second Sight has submitted 10 scenarios relating to Horizon to
Post Office for its comments (the Spot Reviews). In light of its investigations to date and Post
Office's responses to these Spot Reviews, Second Sight is now preparing an Interim Report.
In accordance with the Inquiry process set out under the "Raising Concerns with Horizon"
agreement:
- Second Sight will prepare its report bearing in mind the primary need to ensure that
the report is reasoned and evidence based.
- The report and any recommendations will be the expert:and reasoned opinion of
Second Sight in light of the evidence seen during the Inquiry.
- Second Sight will consult with JFSA, Post Office and/or any other party as it considers
necessary before producing any report.
- Post Office may provide Second Sight with its own comments on any or all concerns,
and on Horizon generally.
- Second Sight will consider.and take into account any comments received from JFSA,
Post Office and/or any other consulted party.
Post Office's activity
Post Office has provided continuous support to Second Sight and has responded to all 10 Spot
Reviews.
In supporting Second Sight, Post Office has:
- Worked with Second Sight to ensure that it is addressing all issues raised.
- Thoroughly investigated each Spot Review through the leadership of senior
management.
- Consulted senior personnel inside Post Office on the issues raised in each Spot
Review.
- Liaised closely with Fujitsu so that its expertise on Horizon supports every response.
- Collated and interrogated Horizon transaction records where Second Sight has
referenced particular identifiable transactions.
4A_27053113_1 7
POL00296943
POL00296943
Confidential and legally privileged
- Addressed any follow-up questions raised by Second Sight or Subpostmasters.
- Promptly submitted all responses to Second Sight in accordance with agreed
timeframes.
Overview of Post Office's responses
Post Office remains confident that Horizon is a robust system that accurately records the
activities of Subpostmasters, and maintains the integrity of transaction data.
All 10 Spot Reviews have been fully addressed by Post Office and none of them have identified
any error in Horizon.
In fact, the Spot Reviews have demonstrated that Post Office's organisational processes and
the Horizon system are designed to:
- Consistently track user and transaction activity in atransparent manner.
- Provide complete audit trails that allow Subpostmasters to fully investigate their
transaction histories.
- Strictly control access to Horizon data.
- Mitigate the risk of user generated errors resulting in financial losses.
- Prevent fraud against Subpostmasters. and Post Office.
- Withstand problems outside Post Office's and Subpostmasters' control such as power
outages.
- Constantly monitor Horizon use and user experience for possible improvement.
It is expected that Second Sight's Interim Report will address Spot Reviews 1, 5, 21 and 22 in
detail. Below is a summary of Post Office's position on each of those Spot Reviews.
4A_27053113_1 8
POL00296943
POL00296943
Confidential and legally privileged
ANNEX 2 — DETAIL ON THE 4 CASES SECOND SIGHT ARE PROVIDING AN INTERIM REPORT ON
CASE 1 - Spot Review 1 — Risks associated with power or communications failures
This Spot Review principally asks whether Horizon robustly manages the risks created when it is
unable to connect to Post Office's central servers due to a power or communications failure
which is beyond a Subpostmasters' or Post Office's control.
Post Office's response to this Spot Review shows that the in-branch Horizon terminal has a
robust back-up and recovery system that prevents there being any discrepancies or errors in
the event of a communications or power failure.
In the particular case raised in the Spot Review, the root cause of the difficulties suffered by the
Subpostmaster was his failure to follow the on-screen and printed instructions given by
Horizon.
A comprehensive, line-by-line review of all the Horizon transactions for the period covered by
this Spot Review was undertaken by Horizon experts at Fujitsu. In light of this analysis, Post
Office Limited is confident that the SPMR knew that the back-up and recovery process had
actively managed the communications failure at the, branch in question because:
- When the transactions in question first failed to beyprocessed, Horizon asked the
SPMR whether he wished to cancebor retry the transactions. The SPMR opted to
retry the transactions.
- When the transactions failed again, the SPMR opted to cancel the transactions.
- Horizon then automatically disconnected and printed a "disconnect" receipt that
showed the transactions that had been automatically reversed.
- A standard customer receipt was not produced — this would tell the SPMR that the
full transaction had not proceeded.
- Following the disconnect, the SPMR was required to log back on to Horizon and duly
did so.
- Following the log on, and as part of the standard recovery process, Horizon printed a
"recovery" receipt which again showed the transactions that had been reversed and
those that had been recovered.
The transaction logs evidencing the above conclusions have been provided to Second Sight.
CASE 2 - Spot Review 5 — Access to live Horizon data
This Spot Review principally focusses on an assertion by Mr Michael Rudkin that during a visit
to Fujitsu's site at Bracknell on Tuesday 19th August 2008, he observed an individual based in
4A_27053113_1 ®
POL00296943
POL00296943
Confidential and legally privileged
the basement of the building who demonstrated the ability to access ‘live’ branch data and
directly adjust transactions on the Horizon system.
Given the amount of time that has passed, neither POL nor Fujitsu have any record of Mr
Rudkin attending the Bracknell site.
Post Office and Fujitsu have attempted to establish the Bracknell visitor logs for the day in
question to verify Mr Rudkin’s attendance and his contact on the day, however these records
are not retained for as far back as 2008.
Fujitsu have additionally made the effort to go through all email, documents and archived
information to hand but do not have any information for Tuesday 19th August 2008 that would
suggest they had visitors to the site.
Further investigation into Post Office work logs indicates that there were just three POL test
managers present on site in Bracknell on the 19 August 2008. None of them have any calendar
records relating to a visit by Mr Rudkin.
It has however been determined that in August 2008 the basement of Fujistu's building
contained a Horizon test environment that would lookwery similar to a live Horizon
environment. This environment was not physically or technologically connected to the live
Horizon environment. It was therefore impossible foranyone in this room to have adjusted any
live transaction records, though Mr Rudkin'may have witnessed some form of adjustment to
the test environment.
This separation of test and live environments is\designed to guarantee the integrity of Horizon
data.
CASE 3 - Spot Review 21 — transparency of stock adjustments
This Spot Review principally asks whether Horizon automatically makes stock adjustments and,
if so, whether this could cause a subpostmaster to suffer a loss.
In summary, Horizon does not generate automatic stock adjustments. This function does not
exist within Horizon.
Each member of staff at Post Office branches should have and use their own unique ID. Each
subpostmaster, as a result, has a unique user ID. This requirement is detailed in the Standard
Subpostmaster's Contract for Services. Section 1, clauses 5, 14 and 15 of this Contract for
Services and the Horizon Online Help operational manual provide that passwords and login
details for Horizon are personal and are not to be shared between branch staff. This is
important to enable traceability of transactions for audit and investigation purposes.
On review of the Horizon transaction logs, every stock adjustment transaction inputted on 4
November 2009 at the Great Staughton branch (being the date and branch under consideration
in this Spot Review) was a manual transaction logged against the subpostmaster user ID
(JOD001).
4A_27053113_1 10
POL00296943
POL00296943
Confidential and legally privileged
Even if there were erroneous stock adjustments, these adjustments could not cause a
subpostmaster to suffer a loss due to the "double entry" balancing process inherent in Horizon.
Each manual instruction inputted by a subpostmaster creates a double entry (i.e. if the
subpostmaster adjusts the stock level down, the cash level on Horizon will be increased by the
same value as the stock). This has a balancing effect on the overall cash and stock position
even if an error is made by the subpostmaster. For example, if the branch position begins in
balance, an inaccurate increase to the stock level of stamps will create a shortage of stamps
but it will also cause a reciprocal decrease in the cash position thereby creating a balancing
surplus of cash. This shortage of stamps and surplus of cash balance out meaning the
subpostmaster will not have an overall shortfall.
This double entry system is designed to mitigate the risk of user errors by automatically
balancing out those errors to the Subpostmaster's benefit.
CASE 4 - Spot Review 22 — Recording scratch card stock levels
This Spot Review principally asks whether Horizon accurately records REMMED-in scratch
cards,
In summary, Post Office cannot find any evidence that there is a problem with the Horizon
system with regard to REMMED-in scratch cards.
National Lottery scratch cards are provided andcontrolled by Camelot, the National Lottery
provider. In order to sell scratch cards, a Subpostmaster must (1) activate a pack of scratch
cards on the in-branch Lottery terminal and (2) REM-in the scratch card stock on Horizon.
"REMMING-in" a scratch cardhis the process whereby new packs of scratch cards are recorded
‘on Horizon as in branch stock.
During the period being examined in this Spot Review, if subpostmasters correctly REM-in
scratch cards to the Horizon system the final figures recorded in the Horizon system at the end
of each day will match the final figures in the Camelot system at the end of each day for the
activation of scratch cards.
On 17 February 2010 at the Hightown branch (being the date and branch under consideration
in this Spot Review) there were two remittance sessions relating to scratch cards in regard to
which two receipts would have been automatically produced by Horizon.
The Spot Review suggests that the Subpostmaster's printed records on this day do not match
Post Office's records. However, the alleged discrepancy in the figures resulted from the
subpostmaster presenting for the purposes of this Spot Review only one of the two receipts
produced on this day.
The transaction history in Horizon reflects the figures advanced by Post Office. [[This
transaction history has been provided to Second Sight. CHECK]]
4A_27053113_1 "
POL00296943
POL00296943
Confidential and legally privileged
In any event, the manual REMMING-in of scratch cards by Subpostmasters has now been
replaced with an automated process so the risk of a discrepancy occurring (such as the one in
the Hightown branch on 17 February 2010) has been largely mitigated.
4A_27053113_1