POL00030930
POL00030930
@
POST OFFICE LIMITED
AUDIT, RISK & COMPLIANCE COMMITTEE REPORT
Title: Whistleblowing Policy Review & Meeting Date: I 30 March 2021
Report
Sally Smith, Money Laundering
Author: Reporting Officer & Head of Sponsor: Ben Foat, Group General Counsel
Financial Crime
Input Sought: Discussion & Approval
The Committee is asked to:
- review and discuss the whistleblowing review and its conclusions as part of its role in
monitoring the adequacy and effectiveness of the Group’s whistleblowing systems and
controls; and
- approve the proposed amendments to the whistleblowing policy’ and the appointment of
the Whistleblowing Champion.
Previous Governance Oversight
Annual Whistleblowing report and policy review July 2020. These proposed policy amends and
the accompanying report were approved at POL Risk & Compliance Committee on 16 March
2021.
Executive Summary
Post Office is able to demonstrate that it has good policies and procedures in place which have
been followed. Post Office's Whistleblowing Team have reviewed past whistleblowing reports
for evidence of subsequent ‘detriment! to the reporters which found no evidence of ‘detriment’.
As a result of the review of whistleblowing policy, processes and culture, there are a number of
recommended enhancements to improve and mature these areas, including the creation of a
Non-Executive Board Director Whistleblowing Champion.
The revised Whistleblowing Policy (clean and track changed) is available in the Reading Room
CONFIDENTIAL
POL-0027412
POL00030930
POL00030930
Questions addressed
1. Are the current whistleblowing arrangements adequate in light of the GLO and the Public
Inquiry?
Is there any evidence of detriment to whistleblower reporters or subjects?
What improvements are required to enable anyone who is aware of, or suspects,
wrongdoing which affects others (e.g. Postmasters, customers, members of the public,
colleagues or the Post Office) to raise their concerns and be confident that those concerns
will be acted upon
Report
4. Anumber of improvements have been implemented since 2017, these include:
e Enhancing Post Office policy and procedures, including attendance by whistleblowing
team at industry forums to learn best practice
e Raising awareness through communications and posters (which in turn has led to an
increase in reports received)
e Developing monthly MI and providing to key stakeholders
e Regular reporting to RCC and ARC, including an annual whistleblowing report which
summarises all whistleblowing reports received over the previous 12 months,
compared to the prior 12 months. This report also details any issues or outcomes,
together with key activities delivered to drive reporting
However, it was recognised that more could be done to improve the maturity of the Post
Office approach and as part of the review of this, Post Office approached Protect (the UK
whistleblowing charity) for support. This has included a self-assessment and industry
benchmarking of the regulatory requirements, current industry best practice and Protect’s
Code of Practice on effective whistleblowing arrangements, and a training workshop which
was attended by some GE members and senior managers.
5. A review of high-level summaries of the 163 whistleblowing reports and investigations
received since 2013 was undertaken by Post Office to identify if there was any evidence of
‘detriment’ to reporters and specifically Postmasters. These cases were also considered,
at a high level, for conformance to Post Office’s obligations arising from the Common Issues
Judgment (CIJ) from the GLO. The review is summarised in Appendix 1 which shows 103
cases where no detriment was suffered by the whistleblowing reporter, the subject or
anyone associated with the report, and 15 cases which show acts which could be argued
to be detriment to the subject of the report, but which were considered by Post Office to
be justified in the circumstances.
CONFIDENTIAL
POL-0027412
POL00030930
POL00030930
@
6. The monthly MI pack produced on whistleblowing has been updated to provide more
granular data on issues that are raised by or about Postmasters.
7. As part of the work reviewing Postmasters complaints and issues handling, a review has
also been undertaken to ensure that there is sufficient understanding across teams that
interact with and capture those complaints and issues, so that any that are in fact
whistleblowing reports are passed to the Whistleblowing Team and investigated and
resolved in accordance with the whistleblowing policy.
It is agreed that we should have a dedicated Whistleblowing Manager within the Compliance
Team to manage whistleblowing but also to assist in the conduct of investigations. External
recruitment for this role is nearing completion and it is hoped to have this in place for end
April/early May. In addition, an approach was made to the ARC Chair to discuss creating a
Whistleblowing Champion at Non-Executive Director level, following which Zarin Patel has
been asked to fulfil this role, and has agreed, subject to ARC approval.
9. Following migration of the external speak up line and website to the new Navex Global
EthicsPoint platform, call enhancements have been implemented to include an IVM that is
specific to Post Office and provides reassurance to callers as below:
e Thank you for calling the Post Office Whistleblowing Speak Up line. Post Office is
committed to ethical behaviour in all our business dealings and your call and any related
reports will be treated confidentially and respectfully to the extent legally permissible.
Protecting our colleagues, Postmasters and customers is the number one priority for
Post Office, and this includes protecting those that raise concerns. To maximize
confidentiality, this Speak Up line is operated by NAVEX Global, an unaffiliated, third-
party service provider.
10. To address the lack of formal training, a new module has been developed in Success Factors
and is currently being undertaken by all employees for completion by 1* April 2020,
together with a number of planned communications for employees and Postmasters to raise
awareness.
Self-assessment and benchmarking
11. The outcome of the Protect self-assessment and industry benchmarking was in line with
expectations given that the benchmark is modelled around best practice and the bar is
deliberately set very high.
12. Post Office achieved a score of 86% for its written policy and procedures and there were
no specific recommendations, indicating that the basic foundations put Post Office in a good
place to improve.
13. It was in the areas of training, engagement and communications that further work was
identified.
14. The need for formal training and awareness in Post Office had already been recognised,
with budget to develop a training module included in 2020/21.
15. The table below shows the overall performance of Post Office v. organisations with a
comparable number of employees and also within the financial services sector which has a
3
CONFIDENTIAL
POL-0027412
POL00030930
POL00030930
@
more mature approach to whistleblowing, given the additional regulatory obligations for
this sector (see Appendix 2 for scores within these overall areas):
Total Your Score Group
Gavernance 12% 67%
Engagement 24% 39%
Operations 36% 55%
Total 46% 60%
e It should be noted that nearly all organisations come out very poorly for Engagement
the first time they do self-assessment — this is because the main resolution for this area
is training which is generally costly, and most often not seen as a priority. Usually
selected people and teams have some form of training, but not enough and not company-
wide. Also, there is a heavy score weighting for Line Manager training, and this is an
area that Post Office was unable to demonstrate.
e Organisations also tend to score poorly in the area of Operations and there are a number
of factors here:
fe
Whistleblowing process maturity tends to reflect the cases organisations have had to
deal with — if an organisation has not had any cases that are material/significant, or
had whistleblowing reporter claims of detriment, then they are less likely to have
matured their processes.
o Included in this area are questions about seeking feedback from whistleblowers about
their experiences or doing ‘tests’ or ‘stress tests’ of the whistleblowing processes -
most organisations do not do this, but it is best practice.
e A number of organisations re-run the self-assessment and benchmarking exercise
annually to help them demonstrate continuous improvement as part of their Board
reporting which means the benchmark is continually rising as organisations improve. We
will re-run the self-assessment in June 2020 (and annually thereafter) following the
implementation of planned enhancements to show how Post Office is building on its
improvements.
Whistleblowing Policy Review
16]
17. The policy has been amended to reflect the following new roles and governance oversight:
e The creation of a Non-Executive Director Whistleblowing Champion to oversee that:
co A ‘whistleblowing culture' is promoted across Post Office, ensuring employees are
genuinely encouraged to speak openly and honestly about their concerns and
misgivings
o The current arrangements are always challenged and assessed for areas of
continuous improvement
CONFIDENTIAL
POL-0027412
POL00030930
POL00030930
@
o Employees are always supported in raising a concern
co Barriers to speaking up are uncovered and addressed
o The whistleblowing team, senior managers and leaders receive training on the
importance of whistleblower support
co Root cause analysis is undertaken for all cases and issues, so that continual
improvements can be made in the relevant areas
e The creation of a new dedicated Whistleblowing Manager to manage whistleblowing
processes and investigations, triaging reports and assigning to investigating managers,
completing root cause analysis and ensuring any corrective controls are implemented,
designing and delivering a programme of training and awareness
18. A number of amendments and additions have been made to reflect best practice, enhance
the policy and help encourage reporting. These include:
e Removal of some duplication and clarifying the definition of whistleblowing, the
investigations process and the treatment of reporters
e Providing more information to reporters (e.g. other external advice available)
e Clarification of some of the definitions used in the policy
e Clarification that reporters do not need to provide evidence and the different reporting
types along with the benefits and disadvantages of open/confidential/anonymous
reporting
e Anew minimum control standard for line managers.
« Anew minimum control standard for checking that whistleblowers feel supported
Conclusions and Recommendations
19. Post Office has a good policy and reports received have been managed in accordance with
that policy, although clearly further work on engagement including training together with
operational improvements are needed and are being quickly remediated Whilst the policy
and process were intended to cover employees and the protections afforded them under
the law, reports have historically been received from postmasters, their teams, customers
and the general public, and these reports have always been investigated and managed
under the whistleblowing policy. Improvements to communications and awareness have
been made in recent years, but the lack of training for all employees and, in particular, line
managers needs addressing.
20. The work with Protect has highlighted that whistleblowing process maturity tends to reflect
the cases organisations have had to deal with. To date, Post Office has not had any material
reports, or found evidence of significant or material (or disclosable) wrongdoing through
the whistleblowing channel. By quickly implementing the recommendations within this
report, management believes that it would put Post Office in a good place.
21. Prior to the Protect self-assessment, it had been recognised that a training and
communications programme was required in 2020/21 and this was budgeted for, although
this was hampered by Covid, and the loss of the role supporting this work in November
2020.
22. The following lists key recommended activities to be delivered in 2021/22 (see Appendix 3
for full actions and timescales):
CONFIDENTIAL
POL-0027412
POL00030930
POL00030930
@
e Continue to work with Protect to identify improvements and enhancements
e Provide the monthly whistleblowing MI pack to all GE members to ensure visibility
¢ Quarterly meetings with the Whistleblowing Champion to review cases and activities,
together with monthly meetings with the postmaster and customer complaints teams to
ensure that complaints or issues they receive that are in fact whistleblowing, are
appropriately identified and investigated.
e Work with the People Function and L&D to enhance on-boarding and line manager
training relating to whistleblowing
e Review and update the Whistleblowing Team’s procedures, including those relating to
the whistleblower and mechanisms to obtain feedback from whistleblowers
e A programme of continual communication and awareness, including refreshing posters
for office locations as staff return to work locations following Covid
« Update Settlement Agreements to remove potential ambiguity
e The Protect self-assessment benchmarking should be undertaken again in June 2021 and
annually thereafter to test and demonstrate improvements achieved from planned
activities
CONFIDENTIAL
POL-0027412
@
Appendix 1 —- Whistleblowing Report Review
POL00030930
POL00030930
Number of Whistleblowing Records Reviewed (From 25/04/2013 to 25/01/2021)
REVIEW FOR DETRIMENT
Number of cases ongoing (no apparent detriment and no CIJ breaches identified in investigation of complaint to date).
163
Number of historic cases where information is insufficient for assessment
These predate whistleblowing falling under the remit of the Financial Crime Team. The most recent record is 23.09.2017
Number of Whistleblowing Reports NOT within Scope of the Whistleblowing Policy
« Employment matters between Postmaster and the Postmaster’s employees: 5
Properly dealt with outside of Whistleblowing channels e.g. dignity at work: 11
Properly referred to external organisations such as RMG: 5
Other cases which did not meet WB criteria (These cases are quite varied but include for example, PMs are calling for advice from the
Security team; a report raised by a known individual harassing branch staff, and errors/mistakes relating to applications for hardship
grants): 9
.
.
30
Number of Whistleblowing Reports WITHIN scope of the Whistleblowing Policy
« No detriment suffered by the Reporter, the Subject or anyone associated with the Report: 103, including
o 6 cases where inadequacies with POL’s policies and procedures alleged but where no specific detriment to an individual identified
(for example, two complaints related to the same alleged incident of sexual harassment which took place outside of POL
premises. The reporters were not the victim of the alleged incident; one of the POL managers was present at the time and the
reporters were concerned that the manager didn't take any action/ provide support when the alleged victim returned to work. HR
could not investigate any further due to lack of information).
1 case where reporter withdrew complaint due to slow response time. The Reporter was subject to a grievance which was raised
by the Subject of the WB report. Legal advised the WB disclosure should be investigated subsequent to the grievance being
heard. The POL employee who was due to investigate the WB disclosure left the business without informing the WB team which
caused delays. The WB team did contact the Reporter to encourage them to pursue the case, but did not receive any response.
Detriment suffered by the Subject, with Detriment justified based upon evidence and rationale: 15
o 12 cases where PMs have been suspended and/or terminated due to ongoing operation issues.
o 2 cases where the agent assistant/clerk was dismissed by the PM for suspected/admitted theft.
o i case there were formal consequences for the Branch Manager, which were justified upon investigation. In addition, in this case,
the Subject was said to have obtained copies of witness statements which, had the WB disclosure not been made anonymously,
could have compromised the Reporter's identity. Enquiries were made but these were not able to determine how or if the witness
statements had been shared with the Subject.
.
CIJ CONFORMANCE REVIEW
118
CIJ Issues NOT relevant
I 142
CONFIDENTIAL
POL-0027412
POL00030930
POL00030930
CJ Issues ARE relevant: 21 (including 1 case still ongoing) 21
o Dealt with in a GLO conformant Manner: 12 (including 1 case still ongoing)
o Not dealt with in a GLO Conformant Manner: 9 - While suspensions appear to be justified by the circumstances, the PMs were
suspended without pay (predates the CIJ). This is being separately considered by the Historical Matters Unit and will be
remediated as appropriate.
8
CONFIDENTIAL
POL-0027412
POL00030930
POL00030930
@
Appendix 2 - Protect Review Recommendations
Section
Written Policy and Procedures BB%
Total 72%
Accountability - 61% Considers the roles different individuals have and their engagement
with the whistleblowing arrangements. Clear accountability structures will help staff better
understand their roles in relation to the whistleblowing arrangements. Active engagement from
senior leaders may improve staff trust and confidence in your whistleblowing arrangements.
Recommendation - You have a good score in this area. In order to improve on this score in line
with best practice, you need to show how senior leaders within your organisation engage with
the whistleblowing arrangements and actively demonstrate a commitment to workers raising
concerns without fear of reprisal. You also need to ensure that designated personnel (for
example the whistleblowing champion and team) clearly understand their roles and
responsibilities.
Written Policy & Procedures - 86% A well drafted whistleblowing policy helps to provide
staff with a clear understanding of what whistleblowing is and the processes by which an
individual can raise and/or escalate a concern. It will also provide staff with assurances about
victimisation and confidentiality
Recommendation - You have achieved a good score in this area and there are no specific
recommendations at this stage
Review & Reporting — 59% Considers the processes by which you review and report on
whistleblowing arrangements. Conducting reviews enables organisations to practically see
whether whistleblowing arrangements are effective in practice and action learning points.
Recommendation - You have achieved a good score in this area, but additional work should be
considered to strengthen governance. When reviewing the arrangements, recommendations
should be assigned ownership with a timeline for completion. Serious concerns raised and
positive outcomes from whistleblowing cases should be reported to the Board. These should be
redacted in order to protect the identity of the whistleblower. You could consider incorporating
an overview of management information on whistleblowing in published data e.g. annual
reports.
CONFIDENTIAL
POL-0027412
POL00030930
POL00030930
Training B%
Communications - 30% Engaging regularly with staff is essential to building a strong speak
up culture. Staff will not have confidence in whistleblowing arrangements if they are not aware
of them.
Recommendation - This section requires improvement. We recommend that you review your
communications materials to ensure that you engage with different staff groups and cultures.
Messages encouraging staff to raise concerns might be included in various media such as
posters and staff training. Finally, think about how you test staff awareness and confidence in
the whistleblowing arrangements (for example by using staff surveys, focus groups and exit
interviews)
Training -— 8% Clear and detailed training on whistleblowing provides your workforce with a
good understanding of arrangements. Training can help embed the importance of
whistleblowing and key policy messages.
Recommendation - This section requires improvement. We recommend that staff, designated
managers and line managers receive in-depth training on whistleblowing. In most
circumstances line managers or named designated contacts are the first people to receive a
whistleblowing concern. Accordingly, line managers should receive appropriate training in order
to accurately identify concerns and effectively handle the individual raising the concern. This
minimises the likelihood that concerns will be escalated further and helps make best use of
your resources. You may wish to review how you provide training to your workforce (e.g.
instructor led by e-learning).
Recording and Investigations 56%
Total 36%
Support & Protection - 41% Considers internal processes in place for supporting and
protecting staff who raise whistleblowing concerns. Implementing effective processes for
managing confidentiality and victimisation will help to ensure staff are appropriately supported
and protected when they raise concerns. Implementing clear policy messaging and protocols
for supporting and protecting staff who raise concerns is essential.
Recommendation - This section requires improvement. We recommend that you operate
multiple support networks within your organisation to enable whistleblowers to seek support
when raising concerns (such as whistleblowing advocates trade unions and Employee
10
CONFIDENTIAL
POL-0027412
POL00030930
POL00030930
@
Assistance Programs). Consider how you ensure that confidentiality is maintained throughout
the whistleblowing process. You should ensure the risk of victimisation is considered in each
whistleblowing case and that appropriate safeguards are put in place to prevent this. Finally,
you should ensure that any settlement agreement that you have with staff clearly states that
nothing in the agreement prevents staff from making a whistleblowing disclosure.
Recording & Investigations — 56% This section considers the processes by which you record
and investigate concerns. Having clear processes and principles for recording and investigating
concerns will help to ensure consistency in handling a whistleblower.
Recommendation - You have achieved a good score in this area. We recommend that you
periodically review management information to ensure consistency of processes in recording
concerns. You should ensure that investigation guidance is clear on the key principles that are
to be followed when whistleblowing concerns are investigated (such as confidentiality,
competence and independence). You should ensure that an independent internal function
conducts periodic reviews of your investigations, to ensure that the principles have been
followed.
Resolution & Feedback — 18% This looks at your processes for resolving concerns and how
you provide feed receiving feedback from whistleblowers. Clear processes on feedback after
the investigation will help give your staff confidence that their concerns have been addressed.
Recommendation - This section requires improvement. We recommend that you implement
standard processes for resolving any substantiated concerns. Where possible ensure that you
provide feedback to whistleblowers on the outcome of concerns that are raised (subject to
limitations imposed by confidentiality). Consider how you seek feedback from whistleblowers
at the end of the process and use this information to improve your arrangements.
11
CONFIDENTIAL
POL-0027412
@
POL00030930
POL00030930
Appendix 3 - Whistleblowing Action Timetable
to whistleblowing
Action By when Status
Protect training workshop January Complete
Review how complaints are captured by various back February Complete
office teams and enhance procedures to correctly
triage potential whistleblowing complaints and pass to
whistleblowing team
Design and deliver employee survey via One Comm February Complete
(440 responses fed into Protect self-assessment)
Enhanced Whistleblowing monthly MI to provide more I February Complete
granular detail about Postmaster/agent assistant
reports
Protect self-assessment and benchmarking February Complete
Review all historic whistleblowing reports February Complete
Whistleblowing Manager role designed, approved and February Complete
advertised
Whistleblowing Champion role approved in principle February Complete
Navex Global Speak Up Line - call enhancements to February Complete
include IVM that is specific to Post Office and provides
reassurance to callers
Review and update Whistleblowing Policy March Complete
Determine whether there is any evidence of detriment I March In progress
to whistleblower reporters or subjects
RCC and ARC whistleblowing approach and policy March Pending
approval
Interviews for new Whistleblowing Manager role and End April In Progress
recruitment
Design and deliver new employee Success Factors 1% April In progress
whistleblowing training module
Design and deliver new Team Talk whistleblowing 1* April Complete
training module for DMB staff and Supply Chain (non-
Success Factor users)
Design and deliver postmaster whistleblowing April In progress
awareness communications
Establish monthly meetings with the postmaster and April
customer complaints teams to review complaints or
issues
Training and induction for Whistleblowing Manger May
Design a programme of continual communication and May
awareness
Establish quarterly meetings with Whistleblowing May
Champion
Design and deliver employee survey via One Comm May
Review and update all whistleblowing processes and May
guidelines
Re-run Protect self-assessment benchmarking June
Annual whistleblowing report to RCC and ARC July
Enhance on-boarding and line manager training relating I July
CONFIDENTIAL
12
POL-0027412
POL00030930
POL00030930
Refresh and deliver new whistleblowing posters to all I July
Post Office back office locations and DMBs (dependent on
Covid)
13
CONFIDENTIAL
POL-0027412