POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
Second Sight review into Horizon — briefing note on interim report
Background
1. Since June 2012 Second Sight Support Services Limited (SS) has been reviewing
allegations that the Horizon system is the source of unresolved accounting shortages in
Post Office branches.
2. SS has been undertaking its review in consultation with the Rt Hon James Arbuthnot
MP (JA), and “Justice for Subpostmasters Alliance”, an organisation “established to
raise awareness of the issues within the Post Office Horizon system”.
3. SS’s review is to:
a. review, consider and advise on whether there are any systemic issues and/or
concerns with Horizon;
consider both the old Horizon and new HNG-X (aka Horizon Online);
consider training and support processes;
d. be reasoned and evidence based.
os
Annex 1 provides more detail on SS’s review.
4. Post Office Limited, with assistance from Fujitsu, has engaged with SS, including by
providing branch files and transaction data, and detailed responses on specific issues
raised.
Annex 1 also provides more detail on Post Office Limited’s engagement in SS’s review.
5. 49 cases have been referred to SS. SS has now completed its review into 4 specific
complaints, which it will address in an interim report.
6. SS will release its interim report to:
a. Post Office Limited on Friday 5 July 2013; and
b. JAon Monday 8 July 2013.
7. Susan Crichton, Lesley Sewell, Alwen Lyons, Angela van den Bogerd and Simon Baker
met SS on Monday 1 July 2013 at 3pm and obtained a clearer picture of SS’s interim
findings and timing for delivery.
8. We believe JA may feel that any interim findings which disclose any issue with Horizon
should result in past criminal prosecutions by Post Office Limited being reopened and
overturned.
9. Paula Vennells and Alwen Lyons will be meeting JA on Wednesday 3 July 2013.
4A_27053113_1 ‘
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
10. Alwen Lyons began communicating P.
meeting with his personal assistant.
st Office Limited’s position to JA via a face to face
11. Post Office always has a right to respond to any findings. External communications
consultancy Portland has been engaged to assist Post Office Limited.
The Interim Report
12. SS’s Interim Report will focus on:
a. 4 individual cases; and
b. 2 anomalies in Horizon’s operation identified by Post Office Limited / Fujitsu.
The 4 Cases
13. SS’s Interim Report will focus on the following four cases:
Name Branch Referral — Issue
MP/JESA.
Armstrong Lepton JFSA Whether Horizon provides
adequate and timely
information during power or
communications failures
Rudkin Ibstock Andrew Access to live Horizon data
Bridgen MP
O’Dell Great Staughton Jonathan Transparency of stock
Djanogly MP adjustments
Hall Hightown Mike Wood MP I Recording scratch card stock
levels
See Annex 2 for further details on these cases.
See Annex 3 for a summary of the issues raised by subpostmasters who are constituents of
JA and Oliver Letwin MP.
14. SS has considered some of the evidence provided by Post Office Limited, but due to
resource constraints might not have considered it all (e.g. the specific branch
transaction logs).
15. SS has also asked subpostmasters to comment on this evidence and its proposed
findings for the four cases in the Interim Report.
4A_27053113_1 2
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
16. We believe SS has NOT found any evidence of systemic problems with the Horizon
computer system:
»
in any of the 4 cases in the Interim Report;
b. in any of the 6 other cases which SS has referred to Post Office Limited for
review; or
c. otherwise during its review.
The 2 Anomalies
17. We also understand SS’s Interim Report will discuss two anomalies in Horizon’s
operation.
18. These were found by Post Office Limited and voluntarily communicated to SS, i.e.
neither was identified by SS as part of its review.
19. The “62 Branch Anomaly”:
»
affected 62 branches (13 Crowns; 12 Multiples; 37 Subpostmasters)
b. concerns a Receipts and Payments mismatch in HNG-X when discrepancies were
moved into the local suspense account (i.e. the account which aggregates all
discrepancies into a single gain or loss for a branch trading period).
first appeared in March 2010.
majority of incidents occurred between August and October 2010
subpostmaster branch losses ranged from £115.60 down to 8p.
identified by Horizon’s built-in checks and balances which are designed to flag
up these types of discrepancies.
g. could have been identified if the subpostmaster had carefully scrutinised his/her
Final Balance Report.
h. 17 subpostmasters were adversely affected, i.e. had a loss attribute to their
branch.
i. subpostmasters notified in March 2011 and (where appropriate) reimbursed.
j.. subpostmasters who made a gain through the anomaly were not asked to
refund this.
k. anomaly pre-dates Separation, and therefore would have been dealt with by
Royal Mail Group Legal.
I. reason for delay in notifying subpostmasters:
i. priority and distinction from other service issues that were happening at
the time of the HNG rollout;
ii. complexity of understanding the root cause; and
iii. getting agreement and clarity on how best to communicate this to
branches.
moan
20. The “14 Branch Anomaly”:
a. financially impacted 14 branches (4 Crowns; 5 Multiples; 5 Subpostmasters)
4A_27053113_1 .
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
b. concerns an error where historic accounting entries in the 2010/11 financial
year were replicated in accounts for 2011/12 and 2012/13.
c. first notified to Post Office Limited in January 2012
d. raised by 2 subpostmasters affected by the anomaly.
e. 5 subpostmasters were adversely affected, i.e. had a loss attribute to their
branch.
f. Post Office Limited suspended attempts to recover known losses from affected
subpostmasters.
Letters to subpostmasters ready to be sent on 3 July 2013.
the worst loss to a branch would have been £9,799.88. This was one of the first
cases notified, so no recovery action was progressed. Other losses ranged from
£113.14 down to a penny.
i. reason for delay in notifying subpostmasters:
i. irregular occurrence - it took over 12 months to realise that this was an
error in Horizon rather than an error by subpostmaster or Post Office
Limited;
ii. very few branches materially affected.
zo
21. Modifications have been made to rectify the 62 Branch Anomaly, and will be made to
rectify 14 Branch Anomaly.
22. One of the branches affected by the 14 Branch Anomaly is within scope of the SS
review (Bowness Road branch). That branch received a gain of £3,186.70 (i.e. there was
no loss to the branch).
23. The anomaly first manifested itself in the Bowness Road branch after the complaining
subpostmaster’s contract for services was terminated for branch mismanagement and
password sharing.
24. One other branch affected by the 14 Branch Anomaly (Merthyr Dyfan) was review by
Post Office Limited. That branch received a gain of £160.92 (i.e. there was no loss to
the branch).
25. We currently understand the branch to be operated by Costcutter, and that its
employee is the subject of a police prosecution over losses of c. £49,000 (£39,000 of
which has been repaid to Post Office Limited).
26. In line with our duties to the Courts, we are taking steps to contact the prosecuting
body so that they are aware of the anomaly and can disclose the information in any
criminal proceedings as they consider appropriate.
27. None of the subpostmasters affected by either anomaly have been prosecuted over it.
Other Anomalies - “Falkirk”
28. We are also aware of a further anomaly in Horizon which was been considered in both
criminal and civil Court proceedings — the “Falkirk Anomaly”.
4A_27053113_1 ‘
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
29. The Falkirk Anomaly occurred when cash or stock was transferred between stock units.
It was resolved in March 2006 is therefore a different anomaly to either the 14 Branch
or 62 Branch Anomaly.
30. The Falkirk Anomaly was the subject of expert evidence in the “Misra” criminal
prosecution, where:
a. the defence expert asserted that its existence demonstrated Horizon had faults
which could cause losses, and therefore that possibility could not be excluded in
Misra’s case.
b. the prosecution expert (Gareth Jenkins from Fujitsu) asserted that it could not
have been responsible for the losses because its clearly visible events had not
manifested themselves in the branch records, and that it had been fixed more
than a year earlier.
31. Misra pleaded guilty to false accounting, and was convicted by jury of theft. To reach
this verdict, the jury had to be satisfied that the charges were proved beyond all
reasonable doubt. She was sentenced to 15 months imprisonment. There has been no
appeal against the conviction.
32. The Falkirk Anomaly was also considered by the High Court in December 2006/January
2007 when a subpostmater (Lee Castleton) raised it as part of his defence to a debt
recovery action for c.£23,000.
33. The Court found “no evidence” of the Falkirk Anomaly in Mr Castleton’s branch, and
accepted the evidence of the Fujitsu witness (Anne Chambers), who was found to bea
“clear, knowledgeable and reliable witness”.
iminal Prosecutions
34. We have undertaken prosecutions which relate to the old Horizon system and the new
HNGxX Horizon Online system.
35. Since Separation we have never had a successful prosecution which has relied solely on
Horizon evidence to convict. We have always had other evidence which contributed to
the prosecution, e.g. the behaviour of SPM, failure to mention Horizon problems until
trial, other staff using Horizon without incident.
36. Both before and after Separation, every time a defendant has raised a criticism of the
Horizon computer system it has been successfully defended by Post Office and Fujitsu.
Forward Strategy
37. Plan A: Meet JA and try to persuade him to postpone his meeting with Second Sight on
Monday 8 July 2013. This is unlikely to be successful.
4A_27053113_1 .
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
38. If not successful, Plan B: We are preparing a full communications strategy and will
consider rebuttal and tactics in line with an approach aimed to minimise reputational
impact to Post Office Limited.
39. Do we attend the meeting with Second Sight and JA on Monday 8 July 2013?
a.
b.
as an observer? (attending may open us up to a cross examination); OR
not attend and pursue the communications strategy (Plan B above)?
40. Consider replacing or introducing a new Independent reviewer (such as one of the
Consulting / Accountancy firms)?
Key Messages
41. Horizon’s size and user base —
a.
b.
6 million transactions processed daily
over the past ten years, many millions of branch reconciliations have been
carried out;
Horizon used out by 25,000 subpostmasters and their staff in Post Office
branches with transactions and balances accurately recorded.
42. Horizon designed to maintain the integrity of transaction data. SS has not as yet
identified anything which challenges this core principle.
43. With respect to the 62 Branch and 14 Branch Anomalies:
4 27083113.1
We found the anomalies and, so as to be completely open, told SS (i.e. SS didn't
find them).
the anomalies were detected, resolved, and we communicated the problem to
sub postmasters
no Post Office prosecutions relate to these bugs
say we have addressed the problem (but acknowledge it has taken time)
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
ANNEX 1 - An overview of the Second Sight Inquiry process and how Post Office has
interacted with it
Overview of the Inquiry process
As part of the Inquiry process, Second Sight has submitted 10 scenarios relating to Horizon to
Post Office for its comments (the Spot Reviews). In light of its review to date and Post Office's
responses to these Spot Reviews, Second Sight is now preparing an Interim Report.
In accordance with the Inquiry process set out under the "Raising Concerns with Horizon"
agreement:
- Second Sight will prepare its report bearing in mind the primary need to ensure that
the report is reasoned and evidence based.
- The report and any recommendations will be the expert and reasoned opinion of
Second Sight in light of the evidence seen during the Inquiry.
- Second Sight will consult with JFSA, Post Office and/or any other party as it considers
necessary before producing any report.
- Post Office may provide Second Sight with its own comments on any or all concerns,
and on Horizon generally.
- Second Sight will consider and take into account any comments received from JFSA,
Post Office and/or any other consulted party.
Post Office's activity
Post Office has provided continuous support to Second Sight and has responded to all 10 Spot
Reviews.
In supporting Second Sight, Post Office has:
- Worked with Second Sight to ensure that it is addressing all issues raised.
- Thoroughly reviewed each Spot Review through the leadership of senior
management.
- Consulted senior personnel inside Post Office on the issues raised in each Spot
Review.
- Liaised closely with Fujitsu so that its expertise on Horizon supports every response.
- Collated and interrogated Horizon transaction records where Second Sight has
referenced particular identifiable transactions.
4A_27053113_1 r
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
- Addressed any follow-up questions raised by Second Sight or Subpostmasters.
- Promptly submitted all responses to Second Sight in accordance with agreed
timeframes.
Overview of Post Office's responses
Post Office remains confident that Horizon is a robust system that accurately records the
activities of Subpostmasters, and maintains the integrity of transaction data.
All 10 Spot Reviews have been fully addressed by Post Office and none of them have identified
any error in Horizon.
In fact, the Spot Reviews have demonstrated that Post Office's organisational processes and
the Horizon system are designed to:
- Consistently track user and transaction activity in a transparent manner.
- Provide complete audit trails that allow Subpostmasters to fully review their
transaction histories.
- Strictly control access to Horizon data.
- Mitigate the risk of user generated errors resulting in financial losses.
- Prevent fraud against Subpostmasters and Post Office.
- Withstand problems outside Post Office's and Subpostmasters' control such as
power outages.
- Constantly monitor Horizon use and user experience for possible improvement.
It is expected that Second Sight's Interim Report will address Spot Reviews 1, 5, 21 and 22 in
detail. Below is a summary of Post Office's position on each of those Spot Reviews.
4A_27053113_1 .
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
ANNEX 2 — DETAIL ON THE 4 CASES SECOND SIGHT ARE PROVIDING AN INTERIM REPORT ON
CASE 1 - Spot Review 1 ~ Risks associated with power or communications failures
This Spot Review principally asks whether Horizon robustly manages the risks created when it
is unable to connect to Post Office's central servers due to a power or communications failure
which is beyond a Subpostmasters' or Post Office's control.
Post Office's response to this Spot Review shows that the in-branch Horizon terminal has a
robust back-up and recovery system that prevents there being any discrepancies or errors in
the event of a communications or power failure.
In the particular case raised in the Spot Review, the root cause of the difficulties suffered by
the Subpostmaster was his failure to follow the on-screen and printed instructions given by
Horizon.
A comprehensive, line-by-line review of all the Horizon transactions for the period covered by
this Spot Review was undertaken by Horizon experts at Fujitsu. In light of this analysis, Post
Office Limited is confident that the SPMR knew that the back-up and recovery process had
actively managed the communications failure at the branch in question because:
- When the transactions in question first failed to be processed, Horizon asked the
SPMR whether he wished to cancel or retry the transactions. The SPMR opted to
retry the transactions.
- When the transactions failed again, the SPMR opted to cancel the transactions.
- Horizon then automatically disconnected and printed a "disconnect" receipt that
showed the transactions that had been automatically reversed.
- A standard customer receipt was not produced — this would tell the SPMR that the
full transaction had not proceeded.
- Following the disconnect, the SPMR was required to log back on to Horizon and duly
did so.
- Following the log on, and as part of the standard recovery process, Horizon printed a
"recovery" receipt which again showed the transactions that had been reversed and
those that had been recovered.
The transaction logs evidencing the above conclusions have been provided to Second Sight.
CASE 2 - Spot Review 5 — Access to live Horizon data
This Spot Review principally focusses on an assertion by Mr Michael Rudkin that during a visit
to Fujitsu's site at Bracknell on Tuesday 19th August 2008, he observed an individual based in
4A_27053113_1 °
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
the basement of the building who demonstrated the ability to access ‘live’ branch data and
directly adjust transactions on the Horizon system.
Given the amount of time that has passed, neither POL nor Fujitsu have any record of Mr
Rudkin attending the Bracknell site.
Post Office and Fujitsu have attempted to establish the Bracknell visitor logs for the day in
question to verify Mr Rudkin’s attendance and his contact on the day, however these records
are not retained for as far back as 2008.
Fujitsu have additionally made the effort to go through all email, documents and archived
information to hand but do not have any information for Tuesday 19th August 2008 that would
suggest they had visitors to the site.
Further review into Post Office work logs indicates that there were just three POL test
managers present on site in Bracknell on the 19 August 2008. None of them have any calendar
records relating to a visit by Mr Rudkin.
It has however been determined that in August 2008 the basement of Fujistu's building
contained a Horizon test environment that would look very similar to a live Horizon
environment. This environment was not physically or technologically connected to the live
Horizon environment. It was therefore impossible for anyone in this room to have adjusted
any live transaction records, though Mr Rudkin may have witnessed some form of adjustment
to the test environment.
This separation of test and live environments is designed to guarantee the integrity of Horizon
data.
CASE 3 - Spot Review 21 - transparency of stock adjustments
This Spot Review principally asks whether Horizon automatically makes stock adjustments and,
if so, whether this could cause a subpostmaster to suffer a loss.
In summary, Horizon does not generate automatic stock adjustments. This function does not
exist within Horizon.
Each member of staff at Post Office branches should have and use their own unique ID. Each
subpostmaster, as a result, has a unique user ID. This requirement is detailed in the Standard
Subpostmaster's Contract for Services. Section 1, clauses 5, 14 and 15 of this Contract for
Services and the Horizon Online Help operational manual provide that passwords and login
details for Horizon are personal and are not to be shared between branch staff. This is
important to enable traceability of transactions for audit and review purposes.
On review of the Horizon transaction logs, every stock adjustment transaction inputted on 4
November 2009 at the Great Staughton branch (being the date and branch under
4 27083113.1 10
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
consideration in this Spot Review) was a manual transaction logged against the subpostmaster
user ID (JODO01).
Even if there were erroneous stock adjustments, these adjustments could not cause a
subpostmaster to suffer a loss due to the "double entry" balancing process inherent in Horizon.
Each manual instruction inputted by a subpostmaster creates a double entry (i.e. if the
subpostmaster adjusts the stock level down, the cash level on Horizon will be increased by the
same value as the stock). This has a balancing effect on the overall cash and stock position
even if an error is made by the subpostmaster. For example, if the branch position begins in
balance, an inaccurate increase to the stock level of stamps will create a shortage of stamps
but it will also cause a reciprocal decrease in the cash position thereby creating a balancing
surplus of cash. This shortage of stamps and surplus of cash balance out meaning the
subpostmaster will not have an overall shortfall.
This double entry system is designed to mitigate the risk of user errors by automatically
balancing out those errors to the Subpostmaster's benefit.
CASE 4 - Spot Review 22 — Recording scratch card stock levels
This Spot Review principally asks whether Horizon accurately records REMMED-in scratch
cards.
In summary, Post Office cannot find any evidence that there is a problem with the Horizon
system with regard to REMMED-in scratch cards.
National Lottery scratch cards are provided and controlled by Camelot, the National Lottery
provider. In order to sell scratch cards, a Subpostmaster must (1) activate a pack of scratch
cards on the in-branch Lottery terminal and (2) REM-in the scratch card stock on Horizon.
"REMMING-in" a scratch card is the process whereby new packs of scratch cards are recorded
on Horizon as in branch stock.
During the period being examined in this Spot Review, if subpostmasters correctly REM-in
scratch cards to the Horizon system the final figures recorded in the Horizon system at the end
of each day will match the final figures in the Camelot system at the end of each day for the
activation of scratch cards.
On 17 February 2010 at the Hightown branch (being the date and branch under consideration
in this Spot Review) there were two remittance sessions relating to scratch cards in regard to
which two receipts would have been automatically produced by Horizon.
The Spot Review suggests that the Subpostmaster's printed records on this day do not match
Post Office's records. However, the alleged discrepancy in the figures resulted from the
subpostmaster presenting for the purposes of this Spot Review only one of the two receipts
produced on this day.
4 27083113.1 "
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
The transaction history in Horizon reflects the figures advanced by Post Office.
In any event, the manual REMMING-in of scratch cards by Subpostmasters has now been
replaced with an automated process so the risk of a discrepancy occurring (such as the one in
the Hightown branch on 17 February 2010) has been largely mitigated.
4 27083113.1
POL00297104
POL00297104
Confidential and legally privileged. For internal PO use only — not to be circulated.
ANNEX 3 — SUMMARY OF ISSUES RAISED BY SUBPOSMASTERS WHO ARE CONSTITUENTS OF
JAMES ARBUTHNOT MP AND OLIVER LETWIN MP
James Arbuthnot MP —Jo Hamilton (South Warnborough)
- Spot Review 12: SPMRs are liable for lost cheques even though the root cause of the
loss is never explained.
- Response: POL absorbs the cost of all lost cheques that cannot be explained. The cost
of a lost cheque is only passed to an SPMR where (1) there is clear evidence that the
SPMR has failed to follow proper remittance processes and (2) POL has exhausted all
other possibilities of recovering the missing cheque. This SR did not raise any issue with
Horizon per se.
- Spot Review 13: SPMR was charged for a TV licence due to the loss of a cheque.
- Response: Due to the incident occurring in 2005, POL no longer has records to
investigate this matter. However, from the information provided by the SPMR it does
not appear that the SPMR has suffered a loss. This SR did not raise any issue with
Horizon per se.
Oliver Letwin MP - Tracey Ann Merritt (Yetminster and Chetnole)
- Spot Review 6: Can transactions be logged against an SPMR's user ID after they are
suspended?
- Response: On suspension a SPMR's user ID is automatically revoked preventing any
further transactions against that ID. The Horizon records show that the user ID of the
SPMR submitting this SR was revoked in accordance with this standard practice.
- Spot Review 10: Could a power failure cause Horizon to print duplicate postage labels?
- Response: The Horizon logs for the particular events raised in this SR do not show any
additional labels being printed. Further, those logs show that there was no power
failure at this particular branch during the period under review.
- Spot Review 11: SPMRs cannot follow an audit trail for Giro transactions.
- Response: SPMRs will have a complete audit trail of all Giro transactions if they retain
the automatically printed receipts and reports produced by Horizon. Standard
operating procedures clearly require SPMRs to retain these documents.
4 27083113.1 3