POL00423238
POL00423238
Disclosure Line (B-257-00)
Project Initiation Document
Project Aim: To procure and implement a dedicated disclosure line for use by Post Office’ s employees, agents
and agents’ assistants, introduce internal processes where required to receive reports from the third party and
raise awareness of the line through targeted communications.
Version 0.04 Author Georgina Blair
Status Draft Classification I Internal
Date 19/02/13 Source of Planned
Funds
Role Name Title Date Agreed
Project Sponsor
Georgina Blair
Sponsoring Director
Susan Crichton
Programme/Portfolio Manager
N/A
Project Manager
Georgina Blair
Benefit Owner
Susan Cricton
DISCLOSURE LINE PID
INTERNAL USE ONLY
POL00423238
POL00423238
Section 1. Investment Business Case
Sponsor / Susan Crichton/
Project Manager Georgina Blair
Source of Funds Planned
Ultimate Authority I Director
1. Request
This paper seeks approval to draw down £45k to procure and implement a dedicated Post Office disclosure line,
introduce internal processes where required to receive reports from the third party and raise awareness of the
line through targeted communications introduce a process for receiving reports.
Approval Total CapEx OpEx VR Lease Disposal
Request (£m) Obligation Proceeds
Sunk Es = - - -
New 12/13 = -45k - - =
Total Request 0.0 -45k 0.0 0.0 0.0
NPV @ IRR Payback Pv/I Recurring I Steady
12% PBITDA State — Yr
Economics £0.0m 0.0% 0.0 Yrs 0.0 £0.0m 20xx/xx
Resource Requirement Head: Duration (Months) I Cost
Skills Group (possible internal testina - to be 1 O5 k
External Consultant (Deloittes etc) 0 = =
Contractor (outside Skills Group) 0 = =
Fixed Term (outside Skills Group) 0 = =
Total Reauest 1 os k
See section 12.5 of the Project Initiation Document for resource cost details
2. Background
This is a project that supports separation from Royal Mail Group, enabling self sufficiency for the Post Office.
A disclosure line provides employees and agents with a safe route to report concerns about serious wrongdoing
in their workplace. Encouraging disclosure of wrongdoing by providing a secure way to report it helps Post
Office to:
. detect and deter wrongdoing;
. give managers information needed to improve compliance and control risk;
. demonstrate to stakeholders and regulators that it is serious about good governance;
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 2 of 16
POL00423238
POL00423238
. reduce the chance of anonymous or malicious leaks externally (including to the media);
7 help protect the Post Office brand; and
. reduce the chance of legal claims against Post Office.
Post Office currently has the use of Royal Mail Group’ s disclosure line (the ‘Speak Up Line’ ) provided under
a Transitional Service Agreement (TSA). The TSA ends on 31 March 2013 and Post Office needs to procure and
set up a new line by this date. Over the past three years usage of the line by Post Office employees and agents
has been very low and once the new line is in place communications are planned to raise awareness of the line.
3. Options
1. Do nothing — accept the risk that there is no disclosure line — rejected.
2. Use a third party provider with specialist knowledge of the confidentiality requirements — preferred.
3. Use existing internal resource — no current resource available 24/7 and possible lack of confidentiality —
rejected.
4. Customer Journey/Marketing Consideration
Employees, agents and their assistants will need to be made aware of the new disclosure line/service and the
project will need to ensure carefully targeted communication reaches every level of the business.
The provision of a disclosure line helps to promote the Post Office values as it shows our employees and agents
that we care when things go wrong and that we are committed to finding out when they do. This encourages
trust in the Post Office brand. Although the line is not targeted at external customers, they may see it advertised
in branches or copies of Subspace. A disclosure line forms part of an organisation’ s Corporate and Social
Responsibility (CSR) and anti-bribery corruption framework, and may be asked about by customers and suppliers
as part of CSR or anti-bribery and corruption due diligence.
5. Benefits
The benefits of providing and publicising a confidential, trusted disclosure line include
e Providing employees, agents and their assistants with a mechanism to highlight wrongdoing, supporting both
their integrity and that of the business.
¢ practical embodiment of the Post Office values of care, challenge and commit
¢ ability to investigate problems before they come to public or regulatory attention
e protecting Post Office’ s reputation and brand
¢ minimising regulatory fines.
6. Key Risks And Dependencies
There will be a key dependency on procurement and external testing resources to achieve the implementation
date .
There is a risk that employees use the current shared disclosure line/service in the future, to be mitigated by a
removal of the existing number and replacing it with the new number where it is currently listed.
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 3 of 16
POL00423238
POL00423238
7. Summary Financials
Incremental Profit & Loss (£m)
WW/12
12/13
13/14
14/15
15/16
16/17
+
Recurring Income [Describe]
Recurring Cost Savings — Staff [Describe] - - - - = -
Recurring Cost Savings — Non Staff
[Describe]
Recurring Costs - Staff [Describe] - - - 2 « 2
Recurring Costs — Non Staff [cost of service] - -30k -30k -30k - -
One-off costs (Opex) - Operating - -15k - 7 - z
Depreciation - - - 7 = .
Gains/(losses) on disposal - - - 7 - -
One-off costs (Opex) - Exceptional - - - = = -
Total Incremental PBIT 0.0 -45k -30k -30k 0.0 0.0
Incremental Cashflow (£m) = S = = = $ .
One-off Costs (Opex): - -45k -30k -30k - 7
Other Non-VR - - - - - -
Capital Expenditure (Capex) - - - - - -
Cash Proceeds from Assets Disposed - - - - - -
Total Incremental Cashflow 0.0 -45k 0.0 0.0 0.0 0.0
Variance from Plan [OCIS Go} 000000
8. Key Performance Indicators
KPI Current End-State Achieving the End-state
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 4 of 16
POL00423238
POL00423238
KPI Current End-State Achieving the End-state
RMG
Service to be in place POL own service
shared . Delivery of this Project
for 31.03.13 . provider in place
service
. Comprehensive
Communication plan to
knowledge of the
cover every aspect of N/A Delivery of this Project
new provider
the Business .
service
Immature
(less than I Mature (Number
of calls per 1000
20 POL P Number of calls per 1000 users similar to
Usage related users similar to
comparable retailers
calls in last. I Comparable
year) retailers)
Widespread
awareness of line
Measure of perception I Not
throughout Employee surveys
by employees & agents I measured
business (90%
awareness)
Perceived as
Measure of value to the I Not . Employee surveys which would need to be
value adding to
. scheduled to inform PIR
the business
individual and company I measured
9. Sensitivities/Tolerances
Sensitivity rate I Sensitivity NPV (£m) IRR (%) Payback (yrs)
10. Investment Appraisal (IA) Commentary
POL does not have a dedicated disclosure line (whistle blowing) in place and currently makes use of the RMG
disclosure line ‘Speak Up Line’ .
The £45k request in 12/13 FY includes an annual fee of £30k for the 13/14 FY.
The disclosure line fulfils part of POL’ s CSR objectives and also forms part of the separation of dependencies
on RMG.
Approval recommended
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 5 of 16
POL00423238
POL00423238
Head of Commercial Finance: Colin Stuart
Arthur Church
[Feb 2013]
DISCLOSURE LINE PID - INTERNAL USE ONLY
Page 6 of 16
POL00423238
POL00423238
11. Business Case Annexes
ANNEX 1. Alternative Options Considered
Option 1
Do Nothing If we do nothing Post Office will not have a
disclosure line once the current TSA ends.
Rejected.
Option 2 - Preferred Option
A specialist supplier who could fulfil our
requirements (e.g. In Touch MCS Ltd who currently
supply the Disclosure Line under the TSA) -
Use a specialist supplier and introduce internal
processes where required to manage the new
supplier
i Preferred
Option 3
There is no internal resource available 24/7 which is
Use existing internal resource . .
suitable for receiving calls of this type. — Rejected.
Option 4
Existing helplines and reporting lines are:
. HELP (employee assistance line) which is
supplied by Atos Healthcare.
. Bullying & Harassment Helpline which is
supplied by Atos Healthcare.
. Grapevine (security threat reporting line)
which is supplied by King’ s Security.
. Manager’ s HR Help (specialist HR advice
for managers) which is supplied by Adviser
Use a current supplier Plus.
. Speak Up Line (employee disclosure line)
which is supplied by In Touch MCS Limited
under a TSA from RMG.
Any current supplier would need to fulfil our
requirements for a disclosure line. It is unlikely that
any current supplier other than In Touch MCS
Limited would be able to fulfil these requirements. -
Rejected
ANNEX 2. Key Risks and Mitigations
Risk Factor Impact Mitigation Mitigated Financial Impact
Impact
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 7 of 16
POL00423238
POL00423238
Basing vendor selection High Rigorous selection process Low This impact would
on cost over quality / or use existing provider be qualitative, not
service provision with revisions and /or quantitative.
modifications to existing
Service agreements.
The provided service is High Design a service superior Low This impact would
underused due to poor to that already in use. The be qualitative, not
perceptions of service provided can only quantitative.
confidentiality and be equal to, or better than
anonymity that already provided.
Poor data handling and High Design a scheme that Low Repuational
investigation procedures builds in compliance with damage and
lead to data protection the “Article 29 Working possible
breaches. Party Opinion 1/2006 on regulatory fines
the application of EU data (currently up to
protection rules to internal £300k)
whistleblowing schemes"
ANNEX 3. Project Milestones
Milestone Date
Gating Forum 27.02.13
Financial Authorisation 14.02.13
Procurement of service activities commence 19.02.13
Design of Business Processes 15.03.13
Draft Comms Plan 15.03.13
Stakeholder sign-off achieved tbc
Go-live 31.03.13
PIR 30.09.13
ANNEX 4. Benefits Management Plan
Benefit / Trigger I Owner Position Budget Conditions /
Precedents /
Interdependencies
ANNEX 5. Concurrences
Directorate/Area of Name, Title Version Date
Ne mal
DISCLOSURE LINE PID - INTERNAL USE ONLY
Page 8 of 16
POL00423238
POL00423238
Responsibility Reviewed Agreed
Project Sponsor Georgina Blair
Sponsoring Director Susan Crichton
Programme/Portfolio N/A
Manager
Benefit Owner
Role — Concurrence
Project Manager Georgina Blair
Test Manager Salman Bukhari
Finance Colin Stuart 14/02/2013
P&BA
Marketing Steve Crowhurst
Network Julia Marwood
Legal Piero D' Agostino
Compliance Georgina Blair
Data Protection Compliance
Jacqueline Gazey
HR
Hector Campbell
Strategy
Information Security Dave M King
Commercial Security Sue Hanson
Security Andy Hayward
DISCLOSURE LINE PID - INTERNAL USE ONLY
Page 9 of 16
POL00423238
POL00423238
ANNEX 6. Financial Detail
Summary of one-off costs — OpEx
Costs ee
P8 P9 PIO I PI I Pi2 I 73
(Ek) total
Set-up 1
Costs
External 6
testing
Annual
Fee 30
13/14
Comms
and 1
Training
Internal 7
testing
Total 45
Summary of one-off costs — CapEx
201 I 2012
Costs
i. pr Ip2 Ip3 Ip4 Ips Ipe Ip7 Ipa fpo fPio jen fri fe f73
eh) total I total
Total
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 10 of 16
POL00423238
POL00423238
Section 2: Project Description
12. Change Description
12.1. Scope and Exclusions
The scope of this project is to procure a new disclosure line to replace the line currently provided by Royal Mail
Group, to implement internal processes to receive reports and forward them for investigation, and to define and
deliver necessary training and communications.
There are already many existing processes in the business for dealing with instances of wrong doing and
misconduct, and they do not fall within the scope of this project.
The supplier will be available to take calls and web reports from employees, agents and agents’ assistants at
any time of day throughout the year. Calls and web reports will be securely forwarded to Post Office in an
agreed format and under agreed timescales to be agreed as part of the contract.
A team in Post Office, within the HR Service Centre will receive the reports and forward them to the appropriate
business area for investigation.
12.2. Constraints
Time — service needs to be in place 31 March 2013. Go-live is Easter Monday, typically there is reduced resource
around this period.
12.3. Acceptance Criteria
The project must ensure the provision of a dedicated Post Office disclosure line on 31 March 2013.
The service line and inter-related supplier and business processes to be tested prior to Go-live.
The supplier must maintain the quality and caller experience of the current line as a minimum.
The supplier must comply with data protection and information security requirements as stated in the service
specifications.
12.4. Impact Analysis
Business areas impacted to deliver this project are: Procurement, HRSC and Comms.
HRSC will need to The fleet service has historically been fully provided by RMG. POL will need to adopt some of
the processes currently carried out by RMG in relation to receipt of reports.
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 11 of 16
POL00423238
POL00423238
12.5. Resource Profile
Skills Group Resource
mt I M2 I M3 I M4 I M5 I M6 I M7 I M8 I M9 I M10 I M11) M12 I Full Year
Business Analyst 470 0.00
Business Change 425 0.00
Programme Manager 552 0.00
Project Manager 479 0.00
PMO 462 0.00
Project Architect 715 0.00
Tester 461 15] 6,915.00
Total -._L-L_L-._-I.-[. - [.-[_-I-[ -[ -[ 50] 695
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 12 of 16
POL00423238
POL00423238
13. High Level Plan
This activity is in three parts
1) Procurement of a third party service to replace the one currently provided by Royal Mail. The initial
analysis for this service has already commenced with informal meetings with potential suppliers. The
target date for issuing the request for proposals is 19 February 2013. Specialist advice has been taken to
include information security and data protection requirements and members of the Info Sec and Data
Protection teams will be involved in reviewing suppliers’ responses. External testing resource will be
utilised for any vulnerability testing required. The service must be in place by 31 March 2013.
2) Development of an internal process in the HR Service Centre for receiving reports from the selected third
party provider and distributing them to the appropriate areas for investigation. Reports will need to be
recorded and investigations tracked, Investigations will be carried out through existing investigation
routes, and these are currently being mapped. Data protection training will be given as required. 15
days of internal testing resource has been budgeted for in case there are any internal systems affected
by the new process. Quarterly summary reports will be submitted to the Audit and Risk Committee, and
there will be an escalation route to a nominated non-executive for the most serious cases. This process
must be in place by 31 March 2013.
3) Internal promotion of the line. An approach has been agreed with Internal Comms to promote the line
with carefully targeted messages through the appropriate channels, which present the line as part of a
suite of help and reporting lines (to also include Grapevine, NBSC, HR Help) in order to minimise the
number of misdirected calls. This activity is planned to start after 1 April 2013 in order to ensure internal
processes are working before call numbers increase.
13.1. Planning Assumptions
Gating and financial authority will be obtained at first request.
The service will need to undergo a procurement exercise to remain compliant with procurement legislation.
POL business resource will be available to support the procurement activity in the timeframes required.
13.2. Test Requirements
Process walkthrough with business owners prior to Go-live
Accessibility points for user access to be tested (Telephone/Web)
Penetration test conducted of any aspects of supplier’ s network used by POL, or sight of the supplier’ s last
test and action plan (and subsequent scan of any web presence for vulnerabilities). £6000 for external testing
has been included above.
There may be internal testing requirement depending on the internal process which are yet to be determined.
A provision has been made for 15 days of internal test resource.
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 13 of 16
POL00423238
POL00423238
13.3. Implementation Requirements
The new line needs to be in place by 31 March 2013.
13.4. Lessons Learned
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 14 of 16
POL00423238
POL00423238
14. Project Management Strategy
14.1 Project Organisation
14.1.1. Project Management Team Structure
Georgina Blair — Risk & Compliance Team (Project manager)
Gavin Pugh — Procurement
Hector Campbell — HRSC
Jonathan Knox - Comms
14.1.2. Role Descriptions
Per existing job descriptions for each specific role as stated above
14.2. Quality Management Strategy
Quality reviews to be conducted, prior to each Gating Forum.
14.3. Configuration Management Strategy
Project documentation will be versioned and held in the project filing structure.
14.4. Risk Management Strategy
Risk log to be held and monitored.
145. Communication Strategy
The project will undertake all necessary communications using various communications vehicles such as Branch
Focus, Online Focus, intranet, Subspace, Subspace Online, and stakeholder engagement
14.6. Project Controls
15. Document Control
15.1. Version History
Version Date Change Details Author
0.1 01.02.13 Draft PID Georgina Blair
02 14.02.13 Financials added Arthur Church
03 14.02.13 Amended for DP and Info Sec requirements Georgina Blair
04 18.02.13 QA Review Tina Davis
DISCLOSURE LINE PID - INTERNAL USE ONLY Page 15 of 16
POL00423238
POL00423238
Version Date
Change Details
Author
0.5 19.02.13
Amended according to QA comments
Georgina Blair
15.2. Change
Control
Changes to this Project Initiation Document shall be requested in writing to the Project Sponsor. Any significant
change will require this document to be modified by the Project Sponsor, re-reviewed/concurred, and if the
change causes the project to exceed the approved tolerances, re-approved by the appropriate financial
authority.
15.3. Referenced Documents
Nr. Title Version Date Document Ref. Location
1 Your text here
2
16. Appendix A — Add as Needed
Your Text Here
17. Appendix B — Add as Needed
Your Text Here
18. Appendix C — Terms & Abbreviations
Term Meaning
HRSC Human Resources Service Centre
NBSC Network Business Support Centre
POL Post Office Limited
RMG Royal Mail Group
TSA Transitional Service Agreeement
DISCLOSURE LINE PID - INTERNAL USE ONLY
Page 16 of 16