POL00448320
POL00448320
POST OFFICE LIMITED
BOARD REPORT
Title: oe Investigations: Next Meeting Date: I 27 September 2022
Sarah Gray, Group Legal
Autor Director Benen Ben Foat, Group General
. John Bartlett, Head of Central Ps . Counsel
Investigations Unit
Input Sought: Noting
The Board is asked to note:
e POL, POL Staff, Postmasters, and Postmasters’ staff all being within the remit of the Post
Office Investigation Branch.
e —CIU to conduct criminal investigations
e Mobilizing a new partnership model with the relevant bodies across the UK to facilitate the
investigation and referral of suspected criminal misconduct.
Previous Governance Oversight
ARC approval of Law Enforcement Policy
Group Executive Tactical Meeting of 5 May 2021
Group Executive Tactical Meeting of 15 September 2021
Group Executive Tactical Meeting of 20 April 2022
Group Executive Tactical Meeting of 06 July 2022 - Approval for onward submission to
Board
Executive Summary
« CIU will be staffed! from September 2022 and fully operational by January 2023.
e CIU is working with other departments to identify the types of cases likely to be escalated
to CIU, identify potential sources of digital evidence, and to test the reliability of that
evidence.
e A virtual Post Office Investigations Branch develops a one-team approach to Post Office
investigations, ensuring the application of best practice across the organisation.
¢ CIU provides investigative training, mentoring, and coaching to the de-centralised teams;
will introduce and carry out quality assurance of the lower risk investigations; and conduct
the higher risk or more complex investigations.
e It is proposed that the Investigations Branch’s remit includes POL and POL staff,
Postmasters, and Postmaster’s staff for a range of matters based on employment,
ownership of property, and practical factors.
e Post Office has no appetite to pursue private prosecutions. However, it is proposed that
Post Office investigators conduct investigations into suspected criminality and to report
what has been evidenced to law enforcement and prosecutors in all four nations of the
UK. The rationale being to act as a deterrent and to seek financial restitution through the
independent and external criminal justice system.
11x Head of CIU, 2x Senior Investigations Managers
Confidential
POL00448320
POL00448320
e At present, Post Office is at risk of not discharging our duty as an organisation in receipt
of public funds to investigate and then refer suspected criminal conduct. The Cooperation
with Law Enforcement Policy permits reporting to law enforcement, but criminal
investigations are not currently actual practice which is preventing pro-active reports
being made to law enforcement. The solution to the broader context within which Post
Office operates is to discontinue the practice of not performing criminal investigations, but
rather to ensure they are carried out correctly by appropriately qualified and experienced
individuals, working closely with the relevant external bodies and to report matters to the
appropriate authorities if and when evidence has been established.
e BEIS assistance is to be sought to establish strategic relationships with law enforcement
and public prosecutors in the three UK jurisdictions.
Questions addressed
e How has the establishment of the investigation model progressed?
e How should Post Office manage criminal investigations?
Report
1. Operating Model - Current Status Up-date
1.1. Post Office is committed to undertake ethically executed, evidence-led, and
transparent investigations which can withstand internal and external scrutiny. We
will apply best practice, applicable laws, and guidance so that we instil confidence in
those who would consider themselves as being investigated that they are being
treated fairly, and to external agencies that we have applied the highest possible
standards in the conduct of our investigations.
1.2. As part of this commitment, GE agreed on 20 April 2022 to the forming of the virtual
Post Office investigations Branch (IB?). This will consist, starting in September 2022,
of two levels of investigative capability within Post Office?. The first level is a small
group of experienced and trained professional investigators who set standards for
investigations across POL, provide a quality assurance role, and conduct
investigations into matters presenting the greatest risk to Post Office or which are
the most complex to carry out (e.g. failings of critical processes or allegations of
senior staff misconduct). The CIU forms this group of investigators.
1.3. The other strata of investigators are based in the business and will continue to either
conduct volume investigations as part of their BAU (e.g. in to shortfalls), or conduct
2 2The Post Office Investigations Branch was the first recognised investigation unit in the world dating back to near the foundation of the Post
Office itself. It has an unblemished reputation. It’s motto was Suaviter in Modo, Fortiter in Re meaning Gentle in Manner, Resolute in Deed
which is very much in keeping with the intended approach of the new investigation function. The IB underwent many changes over the years
and the name fell out of use in the mid 20th century.
3 As well as proposing a central investigative function, the KPMG review examined the investigative activity conducted by the following teams:
Network Monitoring, PM Dispute Resolution, PM Complaints, Contracts, Customer Complaints, Financial Crime, Conduct Compliance,
Whistleblowing, Data Protection, and Cyber, as well as those under HR’s remit eg Grievances, Code of Conduct, and Dignity at Work
complaints.
Confidential
POL00448320
POL00448320
investigations less frequently and/or carry lower risk. These investigators will be
trained where appropriate to the best standards as set by CIU.
1.4. Moreover, the CIU will be the escalation point for the other teams.
1.5. The de-centralised investigative activity continues under their existing reporting lines
but for investigative activity they have a dotted line to the centralised team. The IB
as a whole will perform to the same standards and methodologies adjusted for the
complexity of the cases in-hand. By using the IB brand the aim is to foster a one
team approach in the conduct of investigations.
1.6. The CIU will set standards, provide coaching, and conduct quality assurance of lower-
risk and/or volume investigations conducted by the de-centralised staff. Within
appropriate parameters and with suitable support, those not in the central team can
conduct quality investigations that meet the requirements of Post Office best
practice.
1.7. Once the additional CIU staff start in September 2022 there will be sufficient capacity
and capability to start increasing the volume of investigations suited to the CIU but
currently carried out by a Speak Up investigator and the Head of CIU. At the same
time, CIU and Triage will develop processes, procedures, systems, thresholds, and
internal and external stakeholder relationships to operate the model. The aim is to
be fully operating the model from January 2023.
1.8. The Disputes Resolution Team have provided some scenarios for CIU to sand box in
order to understand how these cases would flow between the teams and what QA
framework would be appropriate. A group of events from the last 18 months is being
identified by the Disputes team which may have been suitable for escalation to CIU
for discussion.
1.9. CIU is also working with the Horizon and GLO IT team, IT Security (Retail & Controls),
and Legal colleagues to identify sources of evidence, how digital evidence can be
accessed, and the level of reliability for use in case work.
2. Operating Model - Extent of Investigative Remit
2.1. For an internal investigation function, the Post office is not a straightforward
organisation. Normally, the full extent of a corporate’s activities and all “staff” would
fall within the function’s remit. However, the Post Office is a more complex
environment for an investigation function to engage with.
2.2. Given this complexity, it is proposed that GE selects one of the below options (or
another variation) as the remit for the investigation function for the first 12 months
that it is in place and that this decision is reviewed at the one-year marker*.
4 The Whistleblowing team sits outside this decision as those types of investigations are determined by the Public Interest Disclosure Act 1998
and laid out in the Whistleblowing Policy.
3
Confidential
POL00448320
POL00448320
2.3. This appetite would then help define the purpose of the IB e.g.: The investigation
function conducts structured, transparent, objective, fair, and evidence-based
collection and assessment of information with the intent to prove or disprove the
suspicion of wrong-doing, or assertion of a particular chain of events, that has or
could affect (insert applicable categories from the table below)
a see I a I
a v v v v v v
c ~ lv tv iviev
: we ee Lee
4 v v vv
s l° v all
LJ v
* Denotes current investigative activity. However, investigations which consider
Postmaster conduct or activities, such as that governed by the Dispute Resolution
Committee, are limited in scope.
2.4. It is our recommendation that the minimum remit of the investigation function is
Option 45. This would allow POL to act in determining facts relating to situations
ranging from allegations of theft or fraud by Postmasters and/or their staff
using/misusing POL systems or functions where either or both POL and the
Postmaster are victims, through to misconduct or process failings in POL and the
subsidiaries. The Horizon issue identified a failure to investigate beyond the
Postmaster in determining culpability. Best practice (and in some situations, law)
requires all reasonable lines of enquiry to be followed, whether they point away or
towards the considered investigative hypothesis as it is the truth that is sought, not
that a case is to be made against a selected individual. By investigating wider than
the Postmasters, for example their staff when relevant, we demonstrate that POL
has learned from the past and would seek to determine actual culpability, if any,
which is treating the Postmasters fairly. Allegations of misconduct by Postmasters
would be explicitly included in the proposed remit.
2.5. There may be situations where it is suitable for the investigation function to conduct
an evidential investigation building on intelligence work conducted by Financial
Intelligence Officers in Compliance e.g. when a post office is the venue of a serious
and/or series of frauds or money laundering which uses Post Office infrastructure to
facilitate the offence. Cooperation and liaison with other organisations and agencies
would be essential in these circumstances.
2.6. POL investigators do not have the power of detention, seizure or arrest and so will
not over-reach and seize personal property, will enter and remain on property only
in in accordance with the law, and will not seek to compel attendance to under-
caution interviews but will inform interviewees that they are free to leave at any time
if they do consent to a voluntary interview. The IB is not a constabulary and will not
act as one.
° Peters & Peters have been advised of this paper and the proposed approach to criminal matters.
Confidential
POL00448320
POL00448320
@
2.7. It is our view that more exploratory work is required to better understand the
investigation needs of Post Office’s on-line presence before proposing an
investigative remit in this space.
3. Operating Model - Criminal Investigations
3.1. Speak Up / CIU already conduct non-criminal investigations that touch Postmasters
as well as POL itself. These include significant process and policy failures, root-cause
analysis of significant events, allegations of discrimination, allegations of bullying and
harassment, and activity which could cause reputational damage to POL. These case
types will continue to be investigated once CIU is established and are assumed to
continue to fall within CIU’s investigative remit.
3.2. However, data from Speak Up reporting shows that c50% of reported matters relate
to potential criminal offences. Analysis of Dispute Resolution information shows a
regular and continuous identification of sometimes sizable shortfalls which may result
from criminal activity conducted by Postmasters and/or their staff. Recent events
around stamps shows other criminally-exploited vulnerabilities, and working with the
Contracts team we are aware of multiple other potential criminal activities such as
theft of cash pouches, compensation frauds against RMG, and manipulation of inputs
into terminals to facilitate thefts or frauds. Resolution of these event types are
currently viewed from a contractual perspective. We are proposing that these are
instead viewed through a criminal investigation and referral lens. Without a criminal
investigation and referral capability, POL cannot effectively provide a counter to these
potential losses of public funds. Project Oberon is a clear example of where a lack of
a criminal investigation and referral capability was detrimental to POL and to the
interests of justice.
3.3. A policy decision was taken that Post Office would cease to act as a private prosecutor
of alleged criminal offences in England & Wales. This paper does not seek to change
that decision. The Cooperation with Law Enforcement Policy® (CLEP) sets out POL’s
intent to report suspected criminality to law enforcement, how we support police
investigations with evidence when requested by the police, and sets minimum control
standards for doing so. It is silent on whether POL investigators may conduct criminal
investigations in advance of applying the policy. The Group Investigations Policy is
not explicit on this matter and is primarily concerned, in respect of criminal matters,
with disclosure of information, referencing the CLEP.
3.4. As a wholly government-owned corporation in receipt of government funds, it may
be viewed that we have a duty to investigate as well as report suspected criminal
events to the relevant authority. We may be criticised for not doing so, particularly
where POL funds have been misappropriated (and so by inference public funds are
lost) and where we seek only a commercial outcome to these events. For example,
where evidence obtained via an investigation supports a suspicion of someone having
defrauded POL, they should be reported to the police irrespective as to whether or
not the loss has been made good so that a credible deterrence may be established.
® A brief summary of the CLEP forms Appendix A
Confidential
POL00448320
POL00448320
@
Existing policies facilitates the reporting to police but not the preceding internal
investigation. This paper asks Board to note that CIU staff are to conduct criminal
investigations within the IB’s remit and report these matters to police when
appropriate and in accordance with the CLEP.
4. Operating Model - Criminal Referrals & Strategic Partnerships
4.1. As a government organisation, Post Office is viewed by law enforcement (LEA)
differently from a privately owned company. It is unfortunately fact that LEAs de-
prioritise most reports of crime made by government-linked organisations if made in
the traditional way. There is an expectation that a degree of self-sufficiency exists.
Without recourse to private prosecutions an alternative is required if the interests of
Post Office, Postmasters, our staff, our shareholder, and the public are to be
protected.
4.2. Suspected offences with an element of criminal dishonesty would form the vast
majority, if not all, of our criminal investigations and potential referrals. This would
include theft, fraud of all types, and money laundering. These types of offences are
those which most LEAs do not have sufficient, nor sufficiently skilled, resource
allocated, and which are lengthy to investigate, often resulting in them not being
prioritised. If we do not investigate these matters prior to referral then the likelihood
of preventing the loss of public money significantly diminishes, as does any
deterrence factor.
Jurisdiction is also relevant. Typically, authorities in Scotland are less inclined to
adopt evidence collected by non-LEA investigators. England & Wales LEAs expect an
almost complete case in an admissible format and Northern Ireland is likely to be
somewhere between the two.
It is proposed that ahead of any specific case referrals (other than in extremis):
4.3. England & Wales:
e A CEO letter to BEIS, and then on with a Minister’s endorsement, requests
assistance from the Commissioner of the City of London Police’s (CoLP)
Economic Crime Directorate (ECD) (the national lead force for fraud and other
economic crime) to work in partnership with CIU to investigate and then refer
to the Crown Prosecution Service all strong cases of dishonesty-based offences
above a certain level of complexity or monetary loss;
e A dedicated team to be formed within CoLP ECD to work closely with CIU under
a MoU would be the best-case scenario - its size would be dependent upon
volumes and budget;
¢ Post Office or BEIS may be asked to contribute to the cost of this team
Confidential
POL00448320
POL00448320
@
4.4, Scotland:
e ACEO letter to BEIS and then on, with a Minister’s endorsement, to the Crown
Office and Procurator Fiscal Service and the Chief Constable of Police Scotland
seeking a similar arrangement to England & Wales; OR
e the HCIU and CIU Senior Investigator for Scotland engage Police Scotland and
seek a solution at a more operational level with their ECD;
4.5. Northern Ireland
e ACEO letter to BEIS and then on, with a Minister’s endorsement, to the Public
Prosecution Service Northern Ireland (PPSNI) and the Chief Constable of the
Police Service of Northern Ireland (PSNI) seeking a similar arrangement to
England & Wales; OR
e the HCIU and CIU Senior Investigator for Northern Ireland engage PSNI and
seek a solution at a more operational level with their ECD
4.6. The purpose, as ever with criminal case work, is to act as a deterrent to prevent or
limit future loss, seek punishment, and to seek compensation for the victim(s)
(including Postmasters where they are the victims). By working with and through
LEAs we could achieve all three, but this outcome is less predictable if we take an ad
hoc approach to LEA referrals.
4.7. By seeking partnership working in this way, POL demonstrates that we do not operate
as victim, investigator, and prosecutor. Conceptually, the police and the prosecutors
will decide on the strength of evidence what they will (or will not) progress through
the criminal justice system, not POL. To get to that point, POL will need to collect
admissible evidence to assist over-stretched LEAs and that requires competent,
evidence-led, ethical investigators.
5. Next Steps
5.1. If the approach is agreed, CEO letters to be drafted and sent to BEIS for the relevant
authorities in all three jurisdictions.
5.2. Based on approvals given and decisions made as a result of this paper, The Group
Investigations Policy and The Cooperation with Law Enforcement Policy will require
significant up-dating.
Confidential
POL00448320
POL00448320
Appendix A
The Co-operation with Law Enforcement Policy’s Post Office’s approach to cooperating with Law
Enforcement Agencies is based upon the following core principles:
e Post Office is committed to supporting Law Enforcement Agencies in the prevention,
detection, investigation and potential prosecution of alleged offences;
« Post Office will as far as possible cooperate with Law Enforcement Agencies and
voluntarily provide information and evidence on request;
e Post Office is committed to ensuring that prosecutions are fair and that Prosecution
Teams are made aware of, and provided with, Disclosable Material in Post Office's
possession;
e Post Office will manage the risks associated with providing such cooperation, by
ensuring that appropriate controls are in place in relation to the provision of information.
In accordance with these principles, and subject to the controls described in the policy, Post
Office:
e will make a Victim Crime Report to the police where suspected criminal misconduct is
identified in its business operations;
¢ will not conduct private prosecutions (Post Office’s shareholder must be consulted and
approval obtained from the Post Office Board if any deviation from this is contemplated);
e will provide information to Law Enforcement Agencies to assist the prevention,
detection, investigation and potential prosecution of crime:
o voluntarily for intelligence purposes, accompanied by an Advisory Note if
required to describe any known issue/s which might affect the reliability of the
information;
o voluntarily for use as evidence, where it is classified by Legal and Compliance
as ‘low risk data’ for the purpose of this policy (see Appendix 1);
o voluntarily for use as evidence, if approved by Post Office Legal or any
Nominated Criminal Law Advisors acting for Post Office; or
© as required by a Mandatory Order or otherwise approved by the Post Office
Board.
Confidential