POL00448360
POL00448360
Compliance
Policy Monitoring Report
Postmaster Complaints Handling Policy
March 2023
1I Page Classification: Confidential
POL00448360
POL00448360
Contents
1. Scoring Table
2. Overall Rating / Residual Risk Score
3. Other Findings Overall Rating / Residual Risk Score
4. Overview
5. Objective of the review
6. Background
7. Methodology
8. Source of information/References
9, Findings
10. Recommendations
11. Policy Owner Response
12. Agreed actions to be taken
13. Review Dates/Sign Off
2I Page Classification: Confidential
POL00448360
POL00448360
1. Scoring Table
Below table sets out the Residual Risk Score and Rating that will apply upon review of the
Postmaster Complaints Handling Policy, to determine how effective the policy is, any control
weaknesses or gaps and whether the policy needs enhancements/improvements.
The framework of governance, risk management and control is adequate and effective.
Some improvements are required to enhance the adequacy and effectiveness of the
framework of governance, risk management and control.
There are significant weaknesses in the framework of governance, risk management and
control such that it could be or could become inadequate and ineffective.
There are fundamental weaknesses in the framework of governance, risk management
and control such that it is inadequate and ineffective or is likely to fail.
2. Overall Rating / Residual Risk Score of The Review
There are significant weaknesses in the framework of governance, risk management and
control such that it could be or could become inadequate and ineffective.
The overall rating for this policy is that it needs significant improvement to make it satisfactory. This
rating has predominantly been based on the lack of direct evidence to support the various risk areas
but there are specific issues that need to be addressed:
1. The risks are not articulated well and appear to be more of an impact rather than risk
which means it is challenging to set out the controls properly.
2. Most of the controls are in fact processes rather than an action which makes it difficult to
measure their effectiveness
3. There is no SLA set in the policy yet there is an expectation that complaint service levels
will be reviewed
4. Whist a number of metrics are tracked, it is not clear whether service level data is tracked
in accordance with the policy or if recurring themes/issues/root causes are identified.
What worked well:
1. Complaint handling times appear to be OK. According to the dashboard 92% of complaints
were resolved within SLA*
2. The reporting dashboard appears to track the majority of the required metrics
3. Training in the policy is good with all staff trained in it (together with the Speak Up!
training) and all have refresher training timetabled
1-The SLA is stated to be 10 days on the dashboard but this is not reflected in the policy
3I Page Classification: Confidential
POL00448360
POL00448360
Other Findings of The Review
It is concerning that key individuals with roles & responsibilities set out in the policy are
unaware of each other. This needs to be addressed
Overview
The purpose of the Policy Monitoring Report is to understand, test and gain assurance based
on some point of control assurance that the Postmaster Complaints Handling Policy is
working and fit for purpose.
Objective of the review
To assess the validity of the policy within the universe of risk framework. To review the lead
and lag indicators of the policy and to test some of the key minimum control standards in
the Postmaster Complaints Handling Policy. Finally, to assess whether the effectiveness of
the policy is being implemented across the group.
Background
The Postmaster Complaints Handling Policy is sponsored by the Group Chief Retail Officer
and owned by the Retail Engagement Director, however day-to-day implementation of the
policy is the responsibility of the Issue Resolution Manager. The purpose of the policy is to
set out the minimum control standards to be met in order to manage complaints from
Postmasters consistently, fairly and within agreed timescales.
The policy sits within a suite of postmaster support policies that have been established with
the intention to set the minimum operating standards relating to the management of our
postmaster contract risks throughout the business. The suite of policies purport to be in-line
with Post Office’s risk appetite, which is primarily averse.
The Postmaster Complaints Handling Policy was initially drafted, reviewed and approved by
the ARC in March 2021 with the current version being approved by the ARC in December
2022. This review forms part of the policy assurance review programme.
Methodology
The approach to the review was as follows:
Is risk adequately identified?
Is the risk appetite correctly identified?
Are the key personnel correctly identified?
Are reported minimum controls actually controls?
What are the key controls?
What are the key metrics?
Is the process/procedure correctly articulated?
Does the evidence show the policy is working?
Given the above, can we be sure the policy is fit for purpose?
pon anrwynp
4IPage Classification: Confidential
POL00448360
POL00448360
8. Source of Information
The review was based on information collected from interviews with key roles supported by
information provided as a result of the meetings. Access was provided to both Dynamics
and the complaints’ dashboard (via PowerBl). Evidence was sought from both the Issue
Resolution Team Manager and Retail Engagement Director but was provided too late to test
as to the effectiveness of the roles and controls set out in the policy that the evidence
referred to.
9. Findings
Issue Finding Rating
Is risk adequately identified? I The risk areas are not described well to
the extent that it is difficult to determine
whether the identified risk is a risk at all.
Is the risk appetite correctly The risk appetite is consistent with the
identified? approach taken across all Postmaster
Policies with the specific risk for this area
being Averse
Are the key personnel Key personnel are broadly identified.
correctly identified?
Are reported minimum The controls appear to be better
controls actually controls? described as policy or procedures rather
than steps that would eliminate or
mitigate risks. This may be as a result of
the risks not being well identified.
What are the key controls? As controls have not been described
properly, no confidence can be had that
these would work. Rewording the
controls may help but only where risk
areas are improved. A specific control
states that common and recurring issues
will be escalated to the Voice of the
Postmaster meeting, however these
meetings have been suspended with no
replacement indicated.
What are the key metrics? The key metrics are:
Number of Complaints received over
a variety of timescales
* Complaints via channel
* Service Level data against target —
minimum, maximum, average and
outliers
* Resolution types
* General themes of Complaint types
* Identification of recurring themes and
issues
* Repeat Complaints from the same
Postmaster
5IPage Classification: Confidential
POL00448360
POL00448360
A PowerBI dashboard is available that is
updated daily. This is managed by the
Service and Support Manager and some
of the metrics are tracked.
It is not clear whether service level data is
tracked in accordance with the policy or if
recurring themes/issues/root causes are
identified
Is the process/procedure Leaving aside the issues relating to risk
correctly articulated? identification, the general intention of the
policy is clear and the handling process is
understandable
Does the evidence show the Reviews of cases in Dynamics together
policy is working? with the dashboard indicate that the
policy is working despite the control
issues
Given the above, can we be Although complaints appear to be
sure the policy is fit for handled appropriately, the lack of
purpose? properly articulated controls and
evidence to support certain areas, the
policy needs significant improvement to
give full assurance that it is fit for purpose
6IPage Classification: Confidential
Postmaster
ease of raising
Complaints
If Postmasters are
discouraged to raise and
pursue Complaints, their
issues will be unknown
to Post Office and
remain unresolved.
* Communication
with Postmasters at
Adopt an Area
dashboard gives
some evidence
of
No direct evidence
that this happens
has been seen.
The level of
all levels should Postmaster I At every encouragement; I complaints would
encourage the facing teams I interaction Postmaster indicate there is
reporting of issues Support Guide some
and Complaints. published on encouragement,
onepostoffice but improvement is
site needed
Branch Hub I Branch Hub
offers ability to I appears to be the
make aI central location for
complaint. feedback.
Entries on Adopt I Postmasters can
. an AreaI use email and
‘ eet Office wil dashboard anecdotal evidence
8 ¥ Retail indicate other I suggests WhatsApp
channels available to 7
Engagement I Quarterly channels is also used.
Postmasters for the I -. .
raisin of Director available for
- feedback. No
Complaints.
direct evidence
has been
provided that
indicates regular
reviews are
carried out
7I Page
Classification:
Confidential
POL00448360
POL00448360
POL00448360
POL00448360
If Post Office do not
provide suitable
channels for Complaint
raising, Postmasters will
not be encouraged to
share their Complaints.
* Postmaster facing
teams will take
reasonable steps to
identify Postmaster
dissatisfaction which
. . Postmaster
is expressed during facing team
their contact with 8
managers
Postmasters and
offer the Postmaster
the opportunity to
raise a formal
Complaint.
At every
interaction
No direct
evidence has
been seen to
support this
measure:
The Adopt and
Area dashboard
tracks feedback
issues and there
is the capability
to identify key
areas of concern
No supporting
evidence was
provided by the
business area in
connection —_ with
this review.
Indirect evidence of
compliance was
provided by way of
a published
response to an FOIA
request. In the
absence of
evidence managed
by the relevant
teams, compliance
does not form part
of the — formal
control structure
and significant
improvement is
needed.
Tr is tracked
Table showing ing
completion of I with all team
training in I members _ receiving
* Training to cover the policy at I training. Annual re-
principles and 100%; training scheduled
If Post Office Employees are I minimum standards Storyboards for later in year;
Training of this I not aware of the guidelines I relating to Postmaster of current I Training —_ materials
Policy and I and principles set out to deal I Complaints will be training in I are developed by a
procedures for I with Postmaster Complaints, I rolled out across all I Retail complaint contractor with no
handling Postmasters may suffer anI teams that could I Engagement handling; permanent/FTC role
Complaints inconsistent service. receive one. Director Annually appearing to have
8] Page Classification: Confidential
POL00448360
POL00448360
overall
responsibility. There
is a risk that this may
lapse once the
contract period is
complete if no
permanent role has
responsibility for
BAU activity
9] Page Classification: Confidential
Receipt
of Speak
reports
and
identification
Up
If Speak Up incidents are not
recognised and reported to
the Speak Up investigation
team, there is a risk that the
most serious Complaints
may not be investigated and
resolved as a priority.
Storyboards Training is tracked in
. All — Complaint for Speak Up! I accordance with
Handlers will I Learning and training POL’s requirement
undertake a training I Development Records from I for all staff to
and awareness I with — input Annual L&D showing I complete Speak Up!
programme, so that I from the ¥ 100% Training
they are aware of the I Speak Up completion of
Whistleblowing Policy I Manager Speak Up!
and procedure.
Met with I The lack of
Speak Up! I awareness of the IRT
Manager. Manager’s identity is
Doesn’t have I concerning and
Regular case reviews regular oy, I ueeests @ gap in
‘ meetings with I connections.
of Complaints that I Speak Up .
toatl Issue Evidence re the
have/have not been I Investigation . .
i i Resolution attestations was only
identified as Speak Up I Team and .
Team Manager I received on the
reports to ensure I Issue Monthly
consistenc and I Resolution and had never I report completion
id heard of Mat I date but it shows
continued Team
7 Thorley. that these are
understanding of the I Manager :
fa dali IRT Manager I carried out monthly
triage guidelines. .
completes as required.
monthly However it was not
attestation of
whistleblowing
cases
possible to test this
in the time available
10I Page
Classification: Confidential
POL00448360
POL00448360
Investigation
and resolution
of Complaints
Feedback
from IRT
Manager.
Current process
involves 2 individuals
auditing 5 KB articles
Process flow I and
* Knowledge based * sees
. Issue for audit. classifications/month
articles and processes 2 ; a“ am ‘
- Resolution Dynamics Dip-testing articles,
will be rolled out Quarterly ; nae
an Team contains indicates that they
through training and a
is Manager knowledge are up to date which
reviewed regularly. a es i
. base articles I does not give rise for
If Postmaster Complaints aumadin uae
are not fully understood and 7 8
. . multiple
investigated, the root cause :
subjects
may not be addressed and m
7 Feedback The evidence was
the same Complaints could .
iy from IRT I provided after the
recur, leading to Postmaster . , «
and branch dissatisfaction. * Quality checks and Manager. deadline but there is
“I training will take place Anattestation I an indication that
with Complaint I Issue Monthly as I is completed I checks are done. The
Handlers to ensure I Resolution standard and I monthly evidence, however, is
that all information is I Team weekly by I confirming insufficient to enable
gathered, and the I Manager exception quality checks I a proper assessment
correct process is undertaken to be carried out.
followed. Example of
quality check
provided.
* Complaint Service Statement The evidence was
If Post Office do not take Levels will be regularly from IRT provided after the
a reviewed by the Manager that I deadline. The
reasonable steps to achieve Issue . a r
7 ap; I Complaint Handler . process exists I evidence consisted of
resolution within Resolution
yeacoriable timescales and spot checked by Team to update I a workflow plus a
1 . ’ I the Issue Resolution Daily PM/branch WOW based guide
there is a risk that Manager and .
Team Manager. Any . when but no evidence of
Postmasters and branches I . Complaint a .
risk to Service Level complaint actual reviews.
may not be able to operate i i Handlers
effectivel will be notified to the exceeds
Y Postmaster in advance 10WD SLA.
and flagged to the
No evidence
11IPage
Classification: Confidential
POL00448360
POL00448360
Issue Resolution Team
Manager.
seen of actual
monitoring
taking place
* Any Complaints that
are unable to be
resolved will be
escalated for review.
Issue
Resolution
Team
Manager
At each
occurrence
IRT Manager
claims no
complaint has
ever been
unresolved
A better
understanding is
needed of the
concept of resolution
to determine whether
this measure _is
effective. The WOW
guidance contains
information on how
to escalate a
complaint after 10
working days and the
dashboard indicates a
number of cases
exceeding the SLA but
there is no direct
evidence of that
occurring.
Any complaints
referred to Speak Up!
are managed in
accordance with
whistleblowing
policy. Check of cases
inI Dynamics show
cases being referred
but no audit trail to
confirm cases handed
over. Knowledge
articles indicate
referrals to be carried
out from personal
mailboxes not central
12I Page
Classification: Confidential
POL00448360
POL00448360
POL00448360
POL00448360
which is an
unnecessary data risk.
Reporting and
Insights
If Post Office are unable or
unwilling to recognise
consistent thematic issues
Postmasters and branches
will suffer recurring issues
and Post Office will forfeit
opportunities to address
common Complaint issues.
Access given
The PowerBI
Dashboard is
maintained over and
to PowerBl above the minimum
dashboard. requirement and
© Complaint handling Figures appears to contain
; exported metrics on the
reporting dashboards 7 -
f ess daily from elements set out in
will be maintained and - '
Service and Dynamics and I the control. The SSI
updated to show . ‘i '
Support inputted into I Manager is new in
volumes, channels, " Weekly 9
. Insights dashboard. post and couldn’t
Service Levels, . .
+ Manager No evidence I confirm whether the
subjects and ;
resolution of available to content of the
Complaints show that dashboard had been
P dashboard agreed by the
meets business so it’s
requirements I possible that the
of business metrics are not as
effective as they
could be.
No evidence
provided showing
* Interrogation of any thematic
7 F assessment. SSI
Complaints data will Issue Manager considered
be undertaken to Resolution Dashboard is i
i. . Weekly a that to be
identify themes that Team checked daily psa
responsibility of IRT
could surface common I Manager
Complaint issues.
but IRT Manager
referred to SSI
Manager for details.
This suggests no real
13I Page
Classification:
Confidential
Policy
adherence
non-
assessment is being
carried out
Voice of
recurring issues will be renatiinns Without Voice of
escalated to the Voice have heen Postmaster
of the Postmaster Voice of the meetings, escalation
. suspended +
meeting for Postmaster Monthly pare of issues cannot
If Post Office are not awareness and meeting indication of happen and
. discussion with the solutions may not be
transparent with aim of establishin, when they rovided.
performance against Service anew solutions would be p .
Levels applied to the i 7 restarted
Complaint handling process, Updates
Postmasters and branches * Postmasters will be provided Lack of awareness of
and stakeholders may lose rovided with regular Service and internally but I what information is
faith in Post Office’s ability ° dates on the 8 Support no updates provided to
to effectively manage Pi . Insights provided to Postmasters is
; number of Complaints a j
Complaints. . Manager and Postmasters concerning. This
raised by Postmasters, Monthly
+ . Issue by SSI measure does not
key issues raised and .
. Resolution Manager. No I appear to be
what Post Office are 4 7
doing if they haven’t Team knowledge if I working and
niepiniltielh Manager this is done therefore the risk
. by IRT has crystallised
Non adherence to the Policy
could result in financial loss,
legal and regulatory risk,
detriment to Postmasters
and branches and
reputational damage to Post
Office.
*¢ The Policy will be
rolled out in training to
Issue Resolution
Support Advisors and
wider Complaint
Handler teams, with
regular refresher
sessions.
Issue
Resolution
Team
Manager
Once
approved
and annually
thereafter
(or sooner in
the event of
material
changes to
the policy)
Manager
Training
records
L&D training records
indicate all handlers
have received
training and annual
refreshers are
scheduled.
14IPage
Classification
Confidential
POL00448360
POL00448360
annually)
Feedback There appears to be
* The Issue Resolution from IRT I regular assessments
f Manager — I of cases
Team Manager _ is I Issue .
‘ checks carried
accountable for I Resolution ,
4 Daily out via
ensuring they and I Team Dynamics to
their team adhere to I Manager a
the Policy. determine
° trigger points
for cases
Document Current policy
As veauired control record I version is 3.0. A
* The Policy should be I Issue (but a in policy significant number of
reviewed, and _ if I Resolution ‘ revisions took place
reviewed at A
necessary updated I Team for both versions 1 &
least "
regularly. Manager 2 suggesting regular
updates are carried
out
15IPage
Classification: Confidential
POL00448360
POL00448360
POL00448360
POL00448360
10. Recommendations
The following recommendations are made
1. The controls must be revisited and changed from being procedural steps to actual
controls
2. Regular meetings between Speak Up! and the Issue Resolution Manager need to be
put in place to ensure the relevant risk is managed properly
3. The business needs to review the dashboard and determine whether it is fit for
purpose and document the decision
4. The Voice of Postmaster meetings must be reinstated and communications with
Postmasters improved so that thematic issues can be addressed properly
11. Policy Owner Response
12. Agreed actions to be taken
Action Owner Date to be completed by
13. Review Date/Sign Off
Policy Review Date I Next Policy Review I Review Conducted I Review Signed Off
Date By By
March 2023 David Sinclair, Senior
Data Protection Manager
16IPage Classification: Confidential