POL00448723
POL00448723
POST OFFICE LIMITED
Review of the effectiveness of the Board and Committees
March 2021
Confidential
INDEPENDENT AUDIT
BOARD REVIEW
POL00448723
POL00448723
INDEPENDENT AUDIT dX.
we ITs
BOARD REVIEW
CONTENTS
Page
Context... seseeeeaee seeeeeeeeeee seseeeeeeeeeseeeeeeaee seseseeeeeee
Summary: “Moving along the strategic-operational spectrum” . 2
Focus and balance...............+ arecees 5
Composition, succession and dynamics. 7
Maintaining an effective management team... ree
Cultural transformation...........
Risk, controls and “grounded trust”...
Quick wins .........
Appendix 1: What we did
Appendix 2: Strengthening risk governance
The small print...
This report is based on the work we have performed in accordance with our engagement letter dated 22 December
2020. Our terms of engagement provide for a limit to our liability, and also restrict release of our report to third
parties. Should we agree to a third party being given access to our report we have no responsibility for any judgements
or decisions made by that party based on our report. Where our work is referred to externally, the wording and context
should be agreed with us in advance.
Draft for discussion Confidential
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
AUDITS,
BOARD REVIEW
Context
] We were commissioned to undertake a review of the Board of Post Office Limited (POL). This
involved:
e interviews with all non-executive directors (NEDs), executive directors, some further
executives and representatives of stakeholders at the Department for Business, Energy
and Industrial Strategy (BEIS)
e observation of meetings of the Board and three of its committees
¢ —areview of board information.
2 POL came into existence in its present format in 2012 when it was split from Royal Mail,
inheriting functions and services relating to the management of post office branches and the
provision of financial, information and other services through this network.
3 The CEO and around 50% of the senior management have been recruited in the last two
years. With the strong support of the Board, the executive team has embarked on a new
strategy, focused on mails and cash, with the aim of becoming financially self-sustaining.
Underpinning this strategy is a far-reaching culture shift to become much more postmaster-
friendly while significantly reducing employee numbers and transforming both the
organisation and its IT infrastructure.
4 This would be a lot for any organisation to handle. At POL, however, both the Board and the
Executive also have to contend with a complex historical legacy and a challenging external
environment:
e COVID-19 has had a major impact on the operation of post offices, and itis a major
achievement that they stayed open throughout, providing essential services.
¢ — Historic IT issues with the Horizon system led to a number of postmasters being wrongly
prosecuted for fraud. A large number of appeals and compensation claims connected to
this are in the process of being resolved.
e As well as the new strategy and culture shift, POL is undergoing changes to its processes
and organisation, migrating IT systems and reducing employee numbers and costs.
¢ Pressure on public finances has meant that only one-year funding has been agreed with
Government, which complicates longer-term planning.
e The NEDs have been closely involved in both the litigation and the business
transformation — over 60 ad hoc and scheduled board and committee meetings took
place in 2020 to handle the heavy workload.
5 We have taken these circumstances into account while looking at how the POL Board
undertakes its responsibilities, and we have drawn on our experience of reviewing the boards
of many different public and private sector organisations. This board review — like all our
reviews — is a forward-looking one. Our aim is to provide suggestions for how the POL Board
can develop in future, to maintain effective oversight and support the Executive as it sees the
POL transformation through to completion.
Confidential Page I of 17
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
AUDITS,
BOARD REVIEW
6 Appendix I describes our scope of work in more detail. Please note that we did not attend
discussions or review papers specifically relating to the ongoing litigation or compensation for
postmasters. We did not evaluate the effectiveness of the Board’s work in assessing the
ongoing litigation or in formulating a response to these historical matters.
Summary: Moving along the “strategic-operational spectrum”
7 The POL Board has been in an unenviable position. It has been having to spend considerable
time looking in detail at the legal challenges faced by POL and the organisational root
causes, at the same time as looking to lead the organisation through a transformation around
its people, platforms and business model. This all needs to happen alongside “business as
usual” governance oversight with a complex strategic, stakeholder, compliance and risk
environments. At the same time, it needs to move forward as a unitary board with a
persistent focus on the future and the strategic interests of the company, whilst looking to
ease away from more detailed oversight.
8 Boards typically need actively to shift on a “board governance spectrum”: at times of crisis
being close to the operational detail, and then moving back to a more normal position of
strategic oversight. As the POL Board starts to emerge from a time of intense work on the
historical litigation and looks ahead to shaping a positive future for the business, it will want to
move back to a position where its focus is less operational and more on strategic oversight.
This move needs to be underpinned by grounded trust — an evidence-based confidence that
the organisation is fully under control. The main theme of this report could, therefore, be
called “moving along the strategic-operational spectrum”, considering how the Board can
plan and best equip itself to make this move when it becomes possible.
9 Inevitably, given the context, there are areas where the Board has had to become more
operational than we would expect, and some aspects of board governance have not been
addressed as fully as we would expect. But the Board has many strengths which set it up well
for the challenges ahead:
* The NEDs and Executive share a common goal of creating a sustainable and competitive
Post Office for all stakeholders, while maintaining a strong social mission, with a
particular focus on postmasters.
¢ The Board has agreed and articulated a future strategic direction for POL
e The Board is made up of committed and hard-working NEDs and executive directors,
who bring a range of relevant and complementary skills, including industry expertise of
mails and financial services, IT transformation and turnaround skills, and experience of
liaising with Government.
* The Chairman is held in high regard by all his colleagues for his engagement and
business acumen. He has fostered collegiate and constructive boardroom dynamics.
© The relatively new CEO is rated highly by all for his drive, communication skills and
strategic vision. The refreshed senior team is unanimously commended for their
openness, transparency and readiness to consider challenge and input. This underpins
the work of the Board and gives a good basis for strengthening of governance more
generally.
Confidential Page 2 of 17
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
ow
BOARD REVIEW
e¢ ~The Chairman and CEO are felt by all to work well together, andrelationships between
NEDs and executives more generally are constructive.
e The Company Secretary is appreciated by all interviewees for the efficient support she
and her team provide to the Board.
e The four meetings we observed were all well chaired (by the Chairman and both
Committee Chairs), with a range of executives and nor-executives contributing to
inclusive and wide-ranging debates on major topics.
e The Board has adapted well to not being able to meet in person and exhibits good virtual
meeting practices.
All directors have committed considerable time to ensuring a strong focus on the litigation,
including reviewing appeals and compensation claims in detail.
Despite this inevitable and fully appropriate focus on the fallout of these historical cases, the
Board has managed to keep looking forward. As well as setting the strategic direction, it has
been:
e Starting to foster a postmaster-centric culture, taking into account their views and needs.
An important first step has been the decision to appoint two postmasters as NEDs, due to
join the Board in April.
e Developing a more robust framework for risk management and assurance.
e Overseeing a widescale business transformation including a reengineering of the IT
infrastructure.
¢ Working with government stakeholders at UKGI and BEIS to keep them informed and to
take into account their perspectives
* Providing support to the executive team, acting as a sounding board, constructively
challenging and giving advice, including interacting outside the board meetings.
As part of the theme of “moving along the spectrum”, we have identified the areas outlined
below for the Board to continue to work on. There is a good deal of awareness at POL of the
need to move forward in these areas, and our intention is to reinforce the efforts you are
already making, with particular emphasis on:
e — Striking the right balance in agendas, discussions and pre-papers across three
interrelated workstreams: managing the ongoing stresses affecting the organisation,
strengthening oversight of business as usual, and planning for the future.
e — Putting in place a timely plan to manage the succession of some long-standing board
members and to integrate new members, including the two new postmaster NEDs.
e Supporting the development of a strong management team to deliver the new strategy
and culture. This involves maintaining a competitive remuneration structure to attract
and retain skilled people.
Confidential Page 3 of 17
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
ow
BOARD REVIEW
e Getting a good picture of how the culture is changing with indicators brought together in
a culture dashboard. The new postmaster NEDs can play an important part in ensuring
the “postmaster voice” is heard in the boardroom, but more will be needed. This will
include the Secretariat developing a more systematic programme for all NEDs to “go out
and about” once this becomes possible; the Board constantly looking for opportunities to
discuss the cultural drivers and implications; and working out how to get a picture of the
progress being made in embedding the target culture.
¢ Working with executives to further develop the risk management approach, building on
the progress already made, ensuring that the framework is adding value by making a
practical difference to the way the business works. As part of this, the ARC could
concentrate more on impact and behaviours, with a greater focus on the strategic
principal risks.
Our report is in five main sections covering these areas. A final section contains some
additional suggestions, which fall under the category of “housekeeping” or “quick wins”.
We would like to thank all those we interviewed for engaging in open and insightful
conversations with us.
Confidential Page 4 of 17
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
ow
BOARD REVIEW
Focus and balance
1S
20
21
22
It is much to your credit that the Board has succeeded in agreeing a clear strategic direction
for POL with well-defined business priorities. A clear consensus has been reached that Mail &
Parcels and Cash & Banking will sit at the heart of the strategy, underpinned by cultural
transformation that puts the postmasters at its centre.
Supporting these overarching aims is an agreed plan covering a series of initiatives which seek
to deliver the required change. The challenge is now to put these core components of the
strategy at the centre of the way the Board is working, while at the same time continuing to
give sufficient focus to ongoing legal challenges and the upcoming public inquiry. In practice,
this will involve the Board giving sufficient weight in its agendas, discussions and pre-read
papers to three parallel workstreams: the “stress scenario”, business as usual and the future.
The first of these encompasses the perfect storm of conditions facing POL Any board, when
faced with such a conjunction of challenges, might struggle to keep in sight the overall picture
of how these tensions are affecting the organisation and those working within it. Given the
extent to which the Board has been immersed in each component, it is not surprising that it
has struggled to find time to stand back regularly to discuss with the Executive the wider stress
scenario, the possible breaking points and mitigants. The Board should set aside time for
discussions specifically on this risk, to make sure that the overall situation is sustainable.
When an organisation is under stress, the likelihood of problems arising in day-to-day
operations increases, for example through control weaknesses, absenteeism and unethical
short cuts. Whilst these may be partially captured through the work on the risk register, their
true impact may not be clear when discussions about risk management are heavily focused
on processes, structure or defining risk appetite. You should check periodically whether the
continuing strains are stretching operations — and possibly key individuals — to an extent that
the risk is unacceptable.
At the same time as dealing with the immediate challenges and business as usual, the Board
will need to continue to push to ensure the way forward has clear visibility and is given the
right airtime in meetings. So far this has been happening, despite the immediate pressures
on the Board’s time and energy. This now needs to be maintained, in part throughmaking
sure that board agendas and information support this emphasis.
The current agendas cover the ground well but tend to beunstructured lists of items, all of
which are necessary, but which are missing some strategic coherence. This includes grouping
some potentially difficult issues under “for consideration” at the end.
As an alternative, we suggest you start with the pillars of the strategy and risks to strategic
success, structuring agendas around these. Items could then be grouped thematically This
would enable many of the items the Board has to cover to be slotted under strategic
headings, thus helping to make the agenda coherent and linked to the KPIs and milestones.
To help in establishing the priorities and the balance, you could consider developing a
“strategic governance map”. This would plot out on one page the myriad issues the Board
has to cover over the year. Especially fora board dealing with a particularly diverse set of
responsibilities, this is a useful way to maintain a view of how far oversight activity is covering
the full spectrum of responsibilities. Once agreed, it can then be used to shape the Forward
Confidential Page 5 of 17
23
24
25
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
ow
BOARD REVIEW
Agenda so that this becomes a detailed map for the year of all the areas that need to be
covered.
The current forward agenda only covers the next two meetings and should be extended to
cover the key topics to be considered at board and committee meetings in the course of the
next year. Later in this report, we will suggest you spend more time on vital areas such as the
cultural shift and the development of the management team. It will be a challenge
considering the historical workload, but a better balance is needed.
Overall, the papers provided to the Board and committees have improved as a result of effort
over the past year. Positive features include:
e The use of opening templates, whilst still requiring development, is reasonably consistent
and provides some clarity over the purpose and content of the papers.
e¢ The CEO Report works well as a concise and readable run through of the state of play
and the issues management have been dealing with.
e The Finance Report covers the ground in a welkstructured, clear way with a reasonable
amount of analytical commentary to guide the reader.
¢ The style adopted in many papers of raising questions and then providing explanatory
answers works well.
NEDs are appreciative of the efforts put in on the papers but wouldstill like to see
improvements. We agree that further improvements would improve discussion and help
maintain strategic focus:
e The CEO Report could be complemented with clear KPIs and milestones as the strategy
is operationalised. A “stress map” could also provide an up-to-date picture of each of
the main elements, the interdependencies and the trends.
e¢ The volume of information needs to be significantly reduced. If NEDs still feel a need for
more detail, or simply more background, this should go into an online reading room.
¢ To reduce paper length and improve focus, the paper owners should be persistently
asking the question “do non-executives in a strategic oversight role really need to know
this?”
e The summary templates provide some structure, but in places they can become boxes to
be filled in rather than providing a well-thought-through overview. They should highlight
what NEDs need to know: a recap of past discussions, the main angles and risks to be
discussed, what the Executive is looking for in terms of a steer or a decision.
e Discussions should be closely tied into the strategy and strategic drivers. In the summary,
or in the headlines throughout the paper, thestrategic relevance should be highlighted.
For example, as “putting postmasters at the heart of what we do” is a key objective, each
paper could highlight how it helps to promote this aim.
Confidential Page 6 of 17
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
AUDITS,
BOARD REVIEW
Composition, succession and dynamics
26 The Board currently benefits from the insights of experienced directors who have a good
range of knowledge and skills, covering all the key aspects of POL’s business model, including
Retail, IT/Digital, Mails/Parcels and Financial Services. All the NEDs work hard, putting in
much more time than they would in a typical non-executive role, and executives value their
contributions. The Board has a shareholder representative NED from UKGI who is felt by
colleagues to be engaged and constructive, and to provide good input into debates.
Postmaster NEDs
27 Two new “postmaster NEDs” are due to join the Board in April following a thorough and welt
planned process to source and select candidates. In this way, the Board will hear first-hand
from active postmasters about the challenges they are facing, their experience of interacting
with various functions within the Post Office and the impact board decisions might have. It is
also hoped that they will network among postmasters to bring a perspective wider than just
their own. They will bring the postmaster perspective but will not “represent” them; like all
directors, they will have to take all stakeholders into consideration as they participate in board
discussions and decisions.
28 The Board is clearly very committed to integrating the new members effectively. This should
be helped by the noteworthy decision to include two postmaster NEDs rather than just one.
This should make it easier for them as they will be able to share experiences and provide each
other with support.
29 — All recognise that induction will be especially important for the new postmaster NEDs and a
programme is being developed. It is also good that the new NEDs will be assigned a
“buddy”, pairing up with one of the experienced NEDs for support.
30 We suggest the postmaster NEDs be invited to attend all committees for their first six months
before determining, in consultation with them, which committees they will join as members.
This will give them the opportunity to understand the time commitment of their board
responsibilities — both in formal meetings and in networking with postmasters — and also give
them a sense of where they can make the best contribution.
31 The proportion of time spent or the focus of the new NEDs might be open to adifferent
emphasis, and they will be relying on the work done in the committees (in line with their
board-approved terms of reference) as are all directors. But the Board fully understands the
importance of ensuring they are in the same position as any other director in terms of
receiving information, being aware of discussions and being involved in making decisions. At
the same time, there might be scope for the new NEDs to be less involved in any separate
meetings covering the historical litigation, giving them the space to concentrate on the
forward-looking agenda of building a postmaster-centric culture.
Succession
32. The Board faces a significant challenge over the next 18 monthsas the three most
experienced NEDs are all due to finish their terms (the SID and ACC followed by the
Confidential Page 7 of 17
33
34
35
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
ow
BOARD REVIEW
Chairman). Along with the addition of the postmaster NEDs, thiswill create a lot of change,
which needs to be managed carefully.
We observed a good discussion about succession at the Nominations Committee we
attended, but not all directors were able to contribute and some points would have benefitted
from being raised at an earlier stage. Sounding out existing NEDs to take on new roles and
to potentially extend their term by a year (which can be acceptableto Government in some
circumstances) could have been considered at an earlier stage.
In our interviews and at the Committee, various profiles of experience and expertise were
suggested for future NEDs including retail, mails/logistics, financial services, social policy,
accounting, digital/start up, CEO experience and operating franchises. Several executives feel
that relevant industry experience should be increased. It is understandable that succession
planning has not been a priority amidst the pressures of recent years, but it will be important
to make time for it as the Board evolves. Given lengthy HMG approval times, succession
planning for the Chairman should begin soon.
Succession planning in future should include:
¢ ~The Chairman and SID sounding out NEDs as regards their willingness to be considered
for extension/new roles such as committee chairs / SID / designated NED for employee
voice.
¢ Adiscussion of the target experience profiles at the full Board and a discussion led by the
SID on the future Chairman profile.
e Adiscussion at the Nominations Committee to work further on the profiles and process
reporting back to the Board regularly on progress.
Dynamics and relations
36
37
38
The board and committee meetings we observed were well chaired, both by the Chairman
and the Committee Chairs. We heard consistently how the NEDs come well prepared to
meetings. Discussions appear inclusive, NEDs offer robust and constructive challenge, and
the executives respond without defensiveness. At times, it may be difficult for all NEDs to
have their say on all topics given the large number of topics in the agenda and the many
historical legal issues to be dealt with. This will only become more acute with the increase in
size of the Board. Board members will need to exercise self-discipline to give everyone an
opportunity to contribute and the Chairman will need to ensure that, despite the number of
NEDs, everyone is getting an opportunity to do so - particularly but not only in their areas of
expertise.
At times, in the face of considerable external pressure, some challenge has been interpreted
as less constructive. This should lessen as the stresses on the organisation subside and it
moves to a more “business as usual” state, allowing the Board to start to become more
strategic.
As the Board changes, investing in relationships will be key, and the arrival of two new NEDs
in April is a good opportunity to reflect on how best to do that. However, the focus should not
only be on the newest NEDs. Others who have recently joined the Board have only met their
Confidential Page 8 of 17
39
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
AUDITS,
BOARD REVIEW
colleagues a few times in person and all NEDs would value more informal contact. While
relationships have held up reasonably well, meeting virtually has presented significant
challenges (as it has for all boards) and these may continue for some time yet.
The dinners that the Board held when it met in person were valued, and these should be
resumed when possible. Other informal meetings between individual NEDs and executives
will help to cement relationships. All NEDs are appreciative of their monthly catchups with
the CEO which he recently instigated. NEDs are keen to continue to receive updates on
business matters that go beyond the litigation and to understand how the strategy is being
embedded.
Maintaining an effective management team
40
41
42
43
44
The new CEO, who was appointed 18 months ago, has a strong track record in retail and
turnaround situations. The NEDs, his executive colleagues and government stakeholders all
hold him in high regard, feeling he has made a strong start to the major task of transforming
the Post Office. He has substantially refreshed the team, including critical roles such asthe
Chief Operating Officer and Group Chief Information Officer. His clear communications and
results orientation are particularly commended, and this was evident at the board meeting we
attended. He gave engaging and informative updates to the NEDs, responding well to their
questions and challenges.
The CFO is also a good communicator who provides the Board with a clear perspective and
insight on many historical matters, as well as a thorough presentation of the finances. The
POL Board compares favourably with some other boards in the way many members of the
executive team and senior managers participate in board and committee meetings. The CEO
does not dominate, and, in this way, NEDs are able to get good insight into the wider team
and their capabilities.
The CEO and CFO have beenendeavouring to keep the board informed between formal
reports. When executives make this a priority it can be helpful for them to receive feedback —
whether positive or negative, or simply an acknowledgement. This helps them gauge whether
they are hitting the right points and level of detail, and to judge howto juggle other demands
on their time with keeping the Board weltinformed.
The importance of getting and keeping the right senior team in place is universally recognised
as a top priority. If POL is to resolve its legacy issues and successfully deliver on its strategy
and transformation, it needs a strong and experienced group of executives with competitive
remuneration packages that will reward them for success and help to retain them. As a
public-sector body which competes with commercial organisations, attracting and
remunerating high-calibre people can be a challenge for POL. However, the Remuneration
Committee works hard at this, and takes a thoughtful approach to KPIs, incentives and
remuneration more generally. It must operate within public-sector constraints, albeit with
fewer limitations than central government or many other public bodies.
The POL Board could focus more on the development of the team, bench strength and
critical skills. A lack of diversity among POL’s management was also raised during interviews.
The Board can influence this by holding the Executive to account on recruitment processes (at
a minimum by setting an expectation of diverse shortlists and selection panels), and hearing
Confidential Page 9 of 17
45
46
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
ow
BOARD REVIEW
from management about how they are encouraging women and BAME employees to develop
their careers at POL.
Discussion of the team has been squeezed over the last year due to the large number of other
priorities. However, a discussion is planned at the next meeting, and we suggest that time is
devoted to this every six months. Rather than making this an item along with many others at
a board meeting, an alternative approach is for the NEDs to hold a regular session with the
CEO on his own to discuss his views on the team and succession challenges. As part of these
sessions, the CEO could provide an overview of the roles, skills and attributes that are needed
in the team to deliver on POL goals. He could set out the extent to which these needs are
currently being met in the existing team and his future plans for retention, management
development and attracting new team members.
Many boards find it ideal to hold this discussion over dinner to ensure that it is a freeranging
and thorough one. However, you should not wait until this becomes possible again. A video
discussion, while not as satisfying, can also be valuable. Questions were raised during our
interviews as to the strength and depth of the team in critical areas such as transformation,
finance, parcels and HR. While it is the role of the CEO rather than the Board to form and
stabilise the team, these sessions could be a good forum for the CEO to use the NEDs as
sounding boards, getting their guidance while at the same time keeping them informed as to
how the team is settling and his plans for the future.
NED-only sessions
47
48
The NEDs should have more frequent private sessions without the executives present. NED.
only sessions are a good practice for any board. They offer the opportunity for the non-
executive directors to highlight areas of concern or simply where more discussion is needed.
These are particularly important at POL given thescale of the change programme. The
NEDs need to consider if the pace of delivery is sufficient and decide how much to challenge,
recognising the strain the executives — and the organisation — are under.
One option would be to start each meeting with a brief NED-only session. Holding them at
the start of meetings allows discussion on the upcoming meeting agenda and helps the
Chairman to steer the meeting to cover areas of particular interest and concern to NEDs. It is
also best if they take place routinely to avoid creating a sense of division between NEDs and
managers. In any case, they should be kept short and the topics of discussion restricted to
those that really need the private time. And they should not become a substitute discussion;
often points should also be raised in the full forum, albeit possibly in a different way. It is
good practice for the Chairman to provide a verbal summary to the CEO after each meeting,
so that he/she is aware — as far as possible — of what was discussed.
Remuneration
49
The Remuneration Committee we observed was thorough in its consideration of a range of
remuneration questions. Balanced KPls are being developed, including postmaster metrics,
which will impact bonuses. The Committee has a heavy workload and discussions can take
some time given the complex and conflicting requirements to be taken into consideration
including:
Confidential Page 10 of 17
50
51
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
ow
BOARD REVIEW
e Navigating the different remuneration philosophies underpinning privatesector vs public-
sector pay levels, incentives and benefits.
e Balancing incentives for profitability and self-sustainability with cultural objectives and the
social purpose.
e Balancing current performance with external pressures: POL’s current executive team
were not in post when the Horizon issues took place, butthe public prominence of the
cases has an inevitable impact on remuneration decisions.
¢ — Paying for real results: the RemCo has the role of ensuring that targets are stretching but
achievable, and that pay-outs are linked to genuine results in terms of delivery of
strategic goals.
The Committee is focusing well on these different aspects, none of which have easy answers.
A “mid-term” incentive plan has recently been agreed to take the place of the shortterm
incentive programme. It takes a pragmatic approach and has been successful in agreeing
with HMG elements of remuneration that are commercial ones.
The Committee has recently changed external remuneration advisor, following a thorough
tender process. The best advisors are able to do more than provide data and benchmarking.
As an independent party, they can help reconcile various positions and assist the Committee
to find a sensible way forward, taking into account all stakeholders. The new advisor could
usefully be invited to attend the entirety of committee meetings. This would help them to
develop a good understanding of the unique circumstances and history of POLand to provide
strong support for the RemCo in future.
Cultural transformation
52
53
The POL Board and Executive are highly attuned to the need totransform the culture and
everyone is determined to make this happen. The postmasters are very much in focus now
with the objective to put them at the heart of the new strategy and with postmaster-friendly
behaviours being targeted. What will be important in coming months is to build momentum
around this, ensuring that the Board is able to give it enough focus in helping the Executive to
drive the necessary changes. Culture change is a complex and long-term project, and the
Board will need to constantly challenge itself on whether it is making enough time— both in
formal meetings and outside the boardroom — to make sure that the management team are
pushing the pace.
The Board has a number of sources of information to support it in overseeing how the culture
is developing and in holding the Executive to account in this area
* Asalready mentioned, NEDs have good exposure to a range of managers at meetings
and they are given the opportunity to voice their opinions. Hearing from the wider team
and seeing how they interact with the CEO is an important source of insight.
* Aconsultation among postmasters is taking place with independent consultants involved.
The Board plans to debate the results when they are complete.
Confidential Page 11 of 17
54
55
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
ow
BOARD REVIEW
e Various NEDs are in touch with staff according to their own specialisms and interests.
The Chair and the shareholder NED are a visible presence in the officeand the Audit
Committee Chair takes part in a Women in Leadership forum and interacts often with key
audit/compliance staff. Other NEDs interact regularly with various teams including IT
and mails.
This can be supplemented in future by:
e Hearing regularly from the postmaster NEDs. Once they have settled in, we suggest that
you include an update from them on the postmaster perspective as a standing item, at
least initially.
e Periodically allocating time on the agenda to consider the target values and behaviours
that are currently under development, and to hearing from executives on how they are
encouraging these behaviours through training, communications, performance
management, promotions etc. The culture shift is currently permeating many discussions
and it is important that the Board continues to make these links, especially in terms of
how the culture is underpinning the strategy. But the importance of the topic for POL
means that it also merits its own agenda item on a regular basis.
e Agreeing indicators to give the Board and Executive an objective way to measure how the
culture is changing. A NED suggested a “postmaster dashboard” and this could be
extended to include employees too, becoming a “culture dashboard” for the business
more generally. We see organisations getting value from this approach, including, for
example, response levels from employee and postmaster surveys, customer NPS scores,
customer complaints, internal audit findings, absenteeism, turnover and data on relevant
training.
e Speak-up lines can also provide an important source of information about behaviour from
the “coalface”. We understand the whistleblowing policy is currently under review for
consideration in March. This will be a good opportunity to look at the effectiveness of
whistleblowing and other speak-up procedures: whether employees and postmasters have
effective and safe channels to escalate concerns and whether the concerns are being
dealt with appropriately. NEDs should have timely reporting on cases as well as hearing
from the Executive on the trends.
In addition to the reporting to the Board, NEDs need to ensure they are going out and about
and “sniffing” the culture for themselves— meeting people at different levels in different parts
of the organisation. Pre-pandemic, this was happening to some extent, but we see some
other boards being more systematic. The Secretariat could develop a comprehensive post-
pandemic programme for all NEDs to get out and about in order to meet employees and
postmasters. You should not rely only on the postmaster NEDs for this. Some ideas you
could explore, which we see other boards using, include:
* Holding one or two meetings a year at a site outside head office and combiring it with
interaction with employees and branches.
e — Visiting individually or in pairs, which allows for more informal conversations than if the
Board descends en masse for a “royal visit”. New NEDs are likely to be visiting sites and
teams as part of their induction, and all NEDs might try to do this once a year, perhaps
accompanying new NEDs on their induction visits to get to know them.
Confidential Page 12 of 17
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
ow
BOARD REVIEW
e NEDs spending an afternoon listening in at a call centre or listening to recorded calls.
e —NEDs dropping in when they are in the vicinity of branch. Some NEDs do this but a more
extensive “mystery shopper” approach could be developed as well as planned visits.
¢ — Extending a wider invitation for groups of employees to join the Board for an informal
breakfast before board meetings or for a “speed-dating” session, in which NEDs meet a
number of lower-level managers in succession for brief discussions over the course of a
couple of hours.
¢ Individual NEDs hosting focus groups of employees to hear their views first-hand on a
range of topical questions. Many designated “workforce NEDs” are undertaking such
focus groups with the support of executives, although not all reliance should be placed on
one NED. With the major shift towards hearing the postmaster perspective, several
interviewees perceive a risk of the employee voice not being sufficiently heard, and the
Board needs to ensure it is balancing all of the various stakeholders.
56 This may seem a long list of things for NEDs to do, but the emphasis here should be onnot
overdoing it. You should use a systematic approach to spread the NEDs over a representative
sample of managers, employees and branches, without overburdening them ordistracting
teams with a stream of visitors. The aim should be to ensure that NEDs’ time interacting
outside the boardroom is well spent on keeping in touch with a wide selection of people and
viewpoints.
57 The large burden on NEDs’ time of the litigation is a limiting factor and the pandemic is
another, as visits are not possible. However, virtual interaction also has its place and could be
useful even after the pandemic. Some practices we have seen elsewhere include NEDs
holding virtual meetings with small groups of employees to find out about their experiences,
virtual site visits (either live or pre-prepared video clips to show during board meetings) and
special employee pulse surveys.
Risk, controls and “grounded trust”
58 At present, the Board is heavily involved in supporting managersto transform POL and put it
on the path to a more financially sustainable future. As you put the remaining legacy issues
behind you, you should aim to move to a position where you can step away from involvement
in operational matters and concentrate on providing strategic oversight and leadership. For
this to happen, NEDs must be confident that the organisation is well run and under control.
In other words, the Board needs to have “grounded trust”: confidence based on both
quantitative and qualitative evidence that things are working well.
59 This will be a complex mix of ingredients. Core components include risk management,
internal control, compliance and assurance. Decision-making processes, operational systems
and processes, executive level governance, accountability and values, and culture as already
discussed above are also important. For the POL Board and committees, maintaining
grounded trust in these areas will be crucial, with the work of the Audit & Risk Committee
(ARC) being central to achieving this over the core components.
Confidential Page 13 of 17
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
ow
BOARD REVIEW
The risk management framework
60
61
62
63
64
65
We understand that good progress has been made over the last two years on overhauling the
risk management framework and processes and on embedding risk management more fully
at all levels. Although this remains a work in progress, active oversight and guidance by the
ARC has being important in maintaining momentum and direction Considerable time is
regularly given to risk management in the ARC agendg, and the Committee is continuously
pushing for the organisation to move into the next stage of maturity. The Committee Chair
makes a direct contribution in terms of the encouragement and advice she gives to the Chief
Risk Officer (CRO).
Changes so far include better reporting to the ARC around the risk register as well as pushing
risk identification and monitoring processes further into the business. This is giving the ARC
increased confidence that a “risk-aware culture” is beginning to take hold across the
organisation and that it is supported by sound processes.
The detailed Risk Register report provided by the CRO is well structured and informative. It is
complemented by deeper dives into specific areas of the business at given points throughout
the year. Such register-based reports have a tendency towards being very detailed, which is
appreciated by the ARC members as they look to satisfy themselves that risks are being
identified and mitigated. Nonetheless, the report would benefit from a more effective
overview giving the CRO’s opinion on the main gross and net exposures, emerging risks and
his subjective concerns. This would help ensure that the ARC's discussions are focused on the
areas needing particular attention.
Now would be a good time for the ARC to work with the Exeautive to map out the future
development of risk management, building on the progress already made. This mapping
should consider what POL needs to achieve from its risk management and how it will get
there. Without clear objectives and benefits, there is a danger that the next stages of
development may suffer from an overemphasis on structure and process. The risk
management framework is more likely to implemented effectively and become embedded if
the strategic and operational value to gained is evident.
We observed a tendency for the discussions to be focused on method, categorisation and
definition, with less consideration of strategic issues around whether controls are working or
the implementation of GLO initiatives. As the risk framework continues to develop, ARC time
would be better spent on gaining a greater understanding of how management are
responding to the critical risks, both current and emerging. If these can be surfaced more
effectively in a short narrative paper, the ARC can focus more quickly on what matters most,
as well as allowing time for the NEDs to raise their concerns and input their thinking.
Furthermore, the ARC is currently encouraging management to develop a structured
approach to defining risk appetite across its operations so that risk exposures can be
monitored against the defined appetites. While this is a valuable approach in financial
services firms, it may not be suitable for a business-like POL. As we saw happening to a
degree in the meeting we observed, there is a danger that the focus will be overly on
definitions and categorisation. Instead, it needs to be on how the concept can be used to
strengthen management and operational decision-making.
Confidential Page 14 of 17
POL00448723
POL00448723
INDEPENDENT AUDIT dX.
NT AUDIT ES,
BOARD REVIEW
66 We suggest the ARC develop a more comprehensive approach in conjunction with the
Executive and the full Board. We see five main elements to the way a board needs to
approach risk, and the POL Board can work further on these over the next few years. In
Appendix 3 we provide fuller guidance on each element but, in summary, the oversight
approach could be developed around a structure with five elements:
¢ — Strategic Risk Management: setting out the principal risks and confirming the acceptance
of risks (individual or the risk profile).
* — Risk Monitoring: bringing together a risk picture through the risk register, risk assessment,
emerging risk evaluation, response tracking.
e — Risk Management Effectiveness: assessing the impact of risk management on the way
the business is run including looking at the risk culture/behaviours.
e — Risk Communication: the reporting that has to underpin the other three aspects
¢ — Risk Discussion: the focus and style of oversight discussion at board and executive levels.
67 Across these five elements, we feel that the POL Board would benefit from a clear and
integrated view of what it wants to achieve, and of how it will get there in a way that is helpful
to management.
Compliance
68 The ARC gives good focus to the compliance agenda, with regular reports giving confidence
that this is managed well. These include providing detailed process mapping and
explanations as to how self-assessment and tracking processes are helping to drive a stronger
compliance mindset into the First Line.
69 As with risk management, the ARC now needs to identify the point at which it has sufficient
“grounded trust” in the processes to allow itself more space to discuss points such as
behaviours, the postmaster experience and ownership/accountability which are fundamental
to achieving the necessary shift in the culture of the business. Although there were some
short-lived attempts to raise this sort of point during the meeting we observed, they gained
little traction, in part because of a tendency to focus ondefinition and process.
Assurance
70 Good progress appears to have been made in building solid internal audit processes into the
way POL works. We heard how the ARC has played ahelpful role in getting to this point,
including valuable guidance and attention provided by the Committee Chair. The reporting to
the ARC is well structured and helps the committee members to focus on the main issues. In
addition, oversight of the co-sourcing partner seems to work well through the Head of Internal
Audit. For their part, committee members are felt to prepare thoroughly, through attentive
review of the internal audit reports, with the result that questions around root causes and
thematic issues are surfaced.
71 To take work in this area to the next level, one possibility is for the ARC to oversee the
development of a risk controls assurance map. This would help to give management and
directors confidence that the risks are comprehensively covered both in terms of the response
Confidential Page 15 of 17
72
73
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
AUDITS,
BOARD REVIEW
to new and existing risks and by giving assurance over the quality of the controls and
mitigators. It will be important, however, to ensure that this is not over-engineered and does
not become unwieldy. Also, it should be drawn together across risk, compliance and audit to
ensure an integrated picture. But, used effectively, it can become a very useful oversight tool.
In addition, the Head of Internal Audit could be invited to play an expanded role in ARC
meetings. An experienced Head of IA should be well placed to comment on numerous
aspects of the activity overseen by the ARC, but we did not see him being involved in this way
which seems like a missed opportunity.
As one final point, the ARC should satisfy itself that IT and data protection-related risks are
getting sufficient discussion on a regular basis. The IT controls assessment discussion at the
meeting we observed was short, even though it had not appeared on the agenda “for some
time”. Given the severity of the risks in this area and the speed at which they can change, the
ARC should make sure it is giving enough attention to this area. The discussion needs to take
a wide-ranging view, for example including discussion of the supplier risk (as was raised in the
meeting but not discussed). We also suggest that the ARC consider whether it has enough
technical knowledge to be able to ask the right questions, and how it might draw in the IT
experience that is on the Board but is not on the ARC itself.
Quick wins
74 Listed below are a number of other smaller suggestions forthe Board and committees, set out
in no particular order.
Meetings
75 POL board meetings are long and intense given the number of important topics to be
discussed. Breaks should be planned if a meeting is due to last for two hours or more, to
maintain energy. These should be included in the agenda with the Chair of meetings
ensuring that they are actually taken. At the five-hour board meeting we attended, there was
only one 15-minute break.
76 Additionally, the ARC and Board meetings could be scheduled on different days, at least while
you are meeting virtually, in order for exhaustion not to set in later in the day.
77 _ It is worth planning proactively for how you will use virtual meetings in future. Short updates.
and committee meetings when the agenda is light might continue to be virtual.
78 Aclearer section of the board agenda could be allocated to committee reports to ensure that
those not attending get a view of what has been discussed and have an opportunity to input.
Additionally, the NED with specialist IT skills could be invited to attend some parts of ARC
meetings, particularly when areas requiring specialist knowledge are being discussed.
Executives attending the Remuneration Committee
79
There could be more procedural clarity around executives attending the Remco. At the
Remco meeting we attended, the CEO and CFO were present throughout. It is useful for the
CEO, and sometimes the CFO, to attend for part of the meeting so that their perspectives can
be gained, and we understand they are not present when their own pay is being discussed.
Confidential Page 16 of 17
80
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
AUDITS,
BOARD REVIEW
But it would be good for each Remco meeting to allocate some time for the NEDs on their
own with the Remuneration Advisor to deliberate on targets, for example, and reach decisions
on these without the executives being in the room. If agreed in advance, there should be no
awkwardness about asking executives to leave the meeting.
The POL Board will want to set clear expectations of the CEO as the transformation
progresses, giving him regular feedback. We observed a good discussion on the CEO’s
objectives at the Remco, but this could also usefully be discussed by the NEDs alone, without
the CEO present. The Chairman could also use this discussion to solicit the views of the NEDs
on the CEO’s performance and their future expectations, which he can then feed back to the
CEO.
Feedback to NEDs
81
Chairman feedback to NEDs could be given annually in a more structured way, with a brief
record kept of the conversations that have taken place. These conversations are a useful
opportunity to discuss with each individual their future expectations in terms of tenure, how
they can contribute effectively in and outside the boardroom, as well asidentifying any
development needs.
And finally...
82
83
84
The Post Office is an instantly recognisable brand fulfilling an essential service in the UK.
The current Board and Executive have worked hard to address legacy problemsand to put the
organisation on a firmer footing. This review comes at a pivotal time as the intense work on
historical litigation reaches its final stages, and the Board can begin to move to a more
typical, strategic oversight role.
Everyone we interviewed wants to ensure that the POL Board continues to develop its
effectiveness. With this in mind, after you have debated the suggestions in this report,the
Secretariat should create an action plan and assign responsibility for each action. Progress
against the plan can then be reviewed in a year’s time using a questionnaire. Looking further
ahead, POL would benefit from an external board review every three years with questionnaire
based self-evaluations in the interim.
The areas for development outlined in this report should not detract from the strengths of the
POL Board which we have identified. They include a committed, hard-working group of
NEDs and executives with a good mix of skills, positive meeting dynamics, a strong alignment
of purpose and an effective Chairman. The suggestions in this report are designed to help
you to build on these strengths as you oversee the continued transition of POL to a
competitive and self-sustaining organisation.
Confidential Page 17 of 17
POL00448723
POL00448723
at
INDEPENDENT AUDIT dX.
AUDITS,
BOARD REVIEW
Appendix 1: What we did
We reviewed the effectiveness of the Board of Post Office Limited and its Committees.
This report is based on five main strands of work:
e — areview of board and committee papers
© interviews with all members of the Board, executives who interact with the Board and the
Company Secretary (listed below)
* — observation of an Audit and Risk Committee meeting and Board meeting on 26 January 2021
and the Nomination and Remuneration Committees on 9 February 2021
© quality assurance review of the report by an IAL director who was not otherwise involved in the
review
analysis of what we learnt, drafting the report and discussing it with the Chairman This did not
result in any significant revisions.
Johann Appel
Veronica Branton
Alisdair Cameron
Lisa Cherry
Tom Cooper
Carl Cresswell
Ben Foat
Lisa Harrington
Tracey Marshall
Ken McCall
Tim Parker
Zarin Patel
Andrew Paynter
Nick Read
Declan Salter
Carla Stent
Owen Woodley
Head of Internal Audit
Company Secretary
Group Chief Financial Officer
Group Chief People Officer
Non-Executive Director
Director, Professional & Business Services, Retail and Post, BEIS
Group General Counsel
Non-Executive Director
Postmaster Effectiveness Director
Senior Independent Director
Chairman
Non-Executive Director
PwC External Audit Partner
Group Chief Executive Officer
Director — Historical Matters
Non-Executive Director
Group Chief Commercial Officer
Confidential
POL00448723
POL00448723
INDEPENDENT AUDIT dX.
sue ITS
BOARD REVIEW
Appendix 2: Strengthening risk governance
“Risk” and “risk management” are used widely and readily across all types of organisations and at
many different levels. To strengthen risk oversight at the governance level, a board needs to tackle:
1. Strategic Risk Management: the principal risks, risk appetite or tolerance, and risk acceptance
2. Risk Monitoring: the risk register, risk assessment, emerging risk evaluation, response tracking
3. Risk Management Effectiveness: a review framework; impact review; risk culture/behaviours
4. Risk Communication: the reporting that has to underpin the other three aspects
5. Risk Discussion: the focus and style of oversight discussions.
Post Office Limited: our detailed suggestions
The ARC could use this five-point framework to develop a view of how its oversight needs to look.
This will allow it to start “moving along the strategic-operational spectrum” and adding more value
to the business through its oversight.
e Strategic risk management. As well as clarifying what it wants to achieve through the risk
appetite approach and how this will strengthen governance and control, the ARC and Board
can make better use of the principal risk concept as part of its strategic decisionmaking, risk
monitoring and mitigation.
e Risk monitoring. The ARC has, as noted above, made good progress in overseeing the
development of the risk register into a tool for risk assessment, emerging risk evaluation and
response tracking. Now it can focus more on how the risk register process and outputs are
changing behaviours and decision making. It can also consider how the report can best be
used to focus ARC oversight on a more limited number of the more fundamental risks.
e Assessing risk management effectiveness. The ARC has, largely by necessity, been focused
on checking that the development of the processes and structures has made good progress.
The next step is for it to concentrate on the wider question of how far the risk management
framework is actually having an impact on the way POL is working. An important part of this is
to consider how far the target risk culture is reflected in day-to-day behaviours. ARC papers
and meetings could give more prominence to this. If done with an eye on actioncdle
suggestions, this leads to a practical development plan across the risk management framework.
¢ — Risk communication. Once there is confidence that the risk management processes can be
relied on to tackle risk exposures to the required level, the reporting can move to a more
strategic level, with the ARC receiving risk-related information which is structured for board level
oversight discussion. This should largely come from analytical narrative and opinion, rather
than being dependent on risk categorisation, impact/probability assessments and attempts to
quantify non-financial risks through Key Risk Indicators.
e — Risk discussion. We saw a tendency for the discussions to be focused on method,
categorisation and definition, with less consideration of strategic issues around whether controls
are working or the implementation of GLO initiatives. As the risk framework continues to
develop, ARC time would be better spent on gaining a greater understanding of how
management are responding to the critical risks, both current and emerging. If these can be
Confidential
POL00448723
POL00448723
INDEPENDENT AUDIT dX.
TAUPIT SS,
BOARD REVIEW
surfaced more effectively in a short narrative paper, the ARC can focus more quickly on what
matters most, as well as allowing time for the NEDs to input their thinking.
Guidance on developing the risk oversight approach
A board (and its committees) needs to determine what it needs to do across these aspects: What
are we trying to achieve? What do we have to get right? What do “effective risk management” and
effective risk oversight look like? All adding up to addressing the core question:
How far is our risk management having an impact on the way we run the organisation?
The questions to be answered are extensive but here we set out some of the main questions you
should think through to arrive at practical solutions that are of value to management as well as to
board-level oversight.
Strategic Risk Management
« — Is the Board clear on its target risk profile? What do management need from this?
e If the concept of “risk appetite” is being used, is the pupose understood? Is it useful?
¢ — What is the purpose of defining the “principal risks”? What is it they are putting at risk?
e — How far do risk discussions align with, and form part of, our strategy?
¢ How are the risks tied into reporting on strategic performance/milestones?
e How is the uncertainty of achieving financial and nonfinancial targets considered?
e How are risks/response set out in papers provided to support board decision-making?
e How far is the board explicitly accepting risks in its strategic decisions?
e How is the risk/reward balance presented and considered?
Risk Monitoring
¢ How does the board audit/risk committee (A/RC) get line of sight on how the risk register is
put together and used across the three lines of defence?
¢ How far is the way the risk register brought to the A/RC useful for oversight of risk exposures
(scale, change, emerging?) Does the probability/impact and RAG classification work in
focusing attention on the right areas? Is the gross versus net distinction clear?
¢ — How is director/committee thinking and challenge reflected in assessment and tracking?
e How is risk-control-assurance mapping used to highlight gaps in the response?
¢ How is the register/heat map/mapping integrated across the second and third lines to
support an integrated picture for oversight purposes?
e¢ How are (1) management and (2) the board standing back and asking how far the identified
principal and high-level risks are reflecting the big things that could go wrong?
Confidential
POL00448723
POL00448723
INDEPENDENT AUDIT dX.
=e
BOARD REVIEW
Risk Management Effectiveness
Is the A/RC assessing effectiveness in terms of the impact on the organisation— or just
checking that structures and processes are in line with what's expected?
Are the different aspects of what makes up effectiveness being considered? These are set
out in the Independent Audit model of Risk Management Effectiveness:
expectations being made clear
.. looking at what needs to be achieved
factoring in the strategic context
working out who needs what
Effectiveness depends on...
applying hindsight
evaluating the impact
learning from events/incidents
drawing on assurance insight
following through on actions
structures and resources
linkage to strategy and appetite
looking ahead at scenarios
helping line management
tie-in to strategic reporting
how managers take ownership
making it part of daily activity Mm 3
factoring into decision-making and cult
monitoring exposures
watching for weaknesses
attitudes to risk-taking and control
how people respond to process
Jinking values and risk-taking
how we communicate with each other
Risk Communication
How is risk reporting to the board and committee tied into strategic goals and plans, the
business model, the primary levers of success, changes in the external environment..?
Is the uncertainty of reaching goals/targets reflected in management reporting?
ls reporting driven by the process and risk classifications — or is narrative surfacing the
exposures and response weaknesses that really matter?
Are management - and the 2” and 3” lines — giving their opinions?
Are the First Line risk owners being put under the spotlight?
Is an integrated picture across Assurance, Risk & Compliance provided?
How are project management risks communicated? Are accountabilities clear?
How is the picture of soft controls and the behavioural/cultural influences presented?
Do external communications align with strategic and operational assessments?
Risk Discussion
How far does discussion ask about the impact on the organisation and the strategy— rather
than the process, the definitions and the classifications?
How is siloing of the discussions across audit/risk/compliance avoided?
ls the behavioural angle consistently considered as part of a root cause debate?
How does the discussion lead to clear leadership around risks and the risk environment?
Confidential
POL00448723
POL00448723
CONTACT:
Richard Sheath
Catherine Stalke:
Ireland: 20 Harcourt Street I Dublin 2
IAL Europe: Avenue Louise 367 I Brussels I Belgium 1050
www.independentaudit.com
Registered in England number 4373559 Registered Office One Glass Wharf Bristol BS2 0OZX
INDEPENDENT AUDIT ase
© Independent Audit Limited 2021 BOARD REVIEW \