SUBS0000024
SUBS0000024
IN THE MATTER OF THE POST OFFICE HORIZON IT INQUIRY
‘PHASE END’ CLOSING SUBMISSIONS:
PHASE 3
On behalf of POST OFFICE LIMITED
INTRODUCTION
1. These submissions are made on behalf of Post Office Limited (“POL”)! in accordance
with the Chair’s directions of 4 April 2023. They are necessarily brief, in accordance
with those directions, and are made for the purpose of highlighting a number of key
issues and themes arising from the evidence heard in Phase 3, rather than seeking to
address each of the issues in the Completed List of Issues considered in Phase 3 in turn.*
2. These themes are:
(1) Modifications (suspense account)
(2) Resolving disputes
(3) Knowledge
(4) Training
(5) Audit data
(6) Remote access
3. Before addressing those themes, POL would reiterate that, as it made clear in its opening
statement at the start of Phase 2 in October 2022, it does not come before this Inquiry
convinced that it knows all the answers, and POL regards a key part of its role as being
to listen to, and learn from, all the evidence and representations made by other Core
Participants.
4. Some of the evidence that the Inquiry has heard over the last five months has been
extremely uncomfortable to hear, and has given rise to real concern for POL. In
particular, and as more fully set out below, there has been evidence that, in respect of at
least some POL employees:
4.1, There was a mindset that dishonesty was widespread on the part of Postmasters;
1 POL uses the same abbreviations (“POL” and “Fujitsu”) as in its phase 2 closing submissions (see
footnote 2). The term "Postmaster" is used to refer to those individuals, companies and partnerships
who/which are responsible for running branches in the Post Office network pursuant to contracts with
POL, but excluding those individuals who are directly employed by POL to work in branches that are
directly managed by POL. Depending on the context, references to "the Postmaster" should be read as
referring to or including, as appropriate, the Postmaster's staff and/or representatives.
2 References to transcripts in this document are given in the form T day/month/year [page:line —
page:line].
3 POL has also not sought to make submissions on a number of issues which were traversed during
the Phase 3 hearings but which more directly relate to Phase 4 issues.
SUBS0000024
SUBS0000024
4.2. There was a mindset, even setting aside any issue of dishonesty, that such issues
as did arise with the Horizon system were always due to user rather than system
error;
4.3, There was strong resistance to countenancing the existence of any flaws in the
Horizon system; and/or
4.4, When system issues were identified there was a mindset that there was an
advantage in ensuring that Postmasters were not kept informed of them and
equally which saw disadvantage in the more widespread dissemination of
information about them.
5. The effect of these mindsets was compounded by the fact that:
5.1. The organisation and hierarchy of POL was such that junior employees did not
feel able to escalate issues upwards which resulted in insufficient overview being
taken at appropriately senior levels;! and
5.2. Some important roles, in particular in relation to the dispute resolution
procedures, were occupied by individuals who did not have sufficient experience
of the Horizon technology and who were not sufficiently senior within the overall
organisation.
6. POL fully recognises that the Inquiry is likely to be critical of some or all of these aspects
of past behaviour and procedures. In later phases POL will seek to demonstrate that
the changes in culture and organisation in POL which have been effected since the GLO
are profound and far-reaching and are designed to ensure that mistakes like this can
never happen again. Lessons have been learnt and that is an ongoing process.
7. A further relevant factor in this context is POL’s (corporate) understanding, prior to
Fraser J’s handing down of the Horizon Issues Judgment in December 2019, that
Postmasters were contractually liable for all losses in their branch and for the actions of
all of their staff. This mindset is somewhat different to those set out above, in the sense
that it reflected POL’s understanding of the legal position, rather than a particular
attitude or frame of mind.
8. This factor is addressed in more detail below in the context of dispute resolution, but in
short POL submits that the Inquiry should be careful to avoid adversely judging past
behaviour based on (what has now been found to be) an erroneous legal understanding
which was not unreasonable at the time.
(1) MODIFICATIONS: IMPACT AND THE SUSPENSE ACCOUNT
(a) _ The Nature and Impact of the Modification
4 See for example Gary Blackburn’s evidence when asked what would have happened to him if he had
challenged those above him at T 28/2/23 [233:12 -233:19]: “[in] a highly politicised organisation, very
hierarchical, I'd have been seen stepping out of line with the message. I can’t imagine that would have been good
for my career, so I'm sure at that point in time — and this is obviously a hindsight reflection — I obviously, on
occasions, chose to unconsciously protect myself”.
SUBS0000024
SUBS0000024
9. Although a number of witnesses have simply referred to the ‘removal of the suspense
account’, the modification in relation to the suspense account was a little more nuanced
than that characterisation.
10. Under Horizon as rolled out in 1999/2000, the suspense account was intended for use
by POL as a facility to help offices balance where there was a known error that would
result in a transaction correction: see the ICL Horizon Workbook “Balancing Using the
Horizon System’”.°
11. In theory, Postmasters were only supposed to post items to the suspense account when
authorised by a Retail Network Manager (“RNM”). The default was that losses and
gains had to be cleared immediately, except in exceptional circumstances, where
permission could be sought from an RNM to carry losses in suspense for a maximum of
8 weeks. If a compensating error had not been revealed by the end of the authority
period, the amount should have been removed from the suspense account and the loss
made good. This policy was set out in various documents, including the Balancing With
Horizon Manual,’ which provided that:
“If a loss is moved to the Suspense Account, the retail network manager must be
contacted (via NBSC) the day after the balance has taken place to seek permission to
hold the amount.... If the RNM refuses authority to hold the amount, it should be
removed from the Suspense Account and made good before the end of the next balance
period.”
12. In practice, however, it appears to have been possible for staff and Postmasters to post
and keep items in the suspense account without authorisation. This was because a
branch was able to roll over to new trading periods without clearing the suspense
account. Amounts could therefore remain in the suspense account until they were
checked and identified by audit teams.
13. IMPACT introduced automation around back-end systems, which was intended to give
Postmasters and central finance a more up to date view of branch accounts. The idea
appears to have been that the more frequent and automatic balancing that would occur
within balance and trading periods would reduce the amount of unexplained
discrepancies at the end of each trading period. There are multiple balancing periods in
each trading period. As Postmasters would be given the information needed to address
variances within each trading period, there would be less of a need to post items to
suspense at the end of each trading period. As Stephen Grayston said in his evidence:
“To me, it was an appropriate action to take if you were running true end to end processing. You
didn’t need or you shouldn't need the ability to manually post into an office’s accounting
position.”
5 FUJO0119656
* POL00036884
7 T 27/02/23 [37:21-25]
SUBS0000024
SUBS0000024
14. The actual changes that were eventually made to the cash suspense account
functionality were, in summary:
14.1. The ability for branch staff to post cash discrepancies to a suspense account was
removed. Instead, each stock unit when rolling over in a balancing period would
have discrepancies (including cash discrepancies) automatically posted to an
office-wide local suspense account (the introduction of ‘local suspense’ / ‘local
adjustment’ was a new concept). The last stock unit to roll over at the end of each
trading period would have to settle the local suspense account before being
allowed to roll over.
14.2. The ways to settle the discrepancies in the local suspense at the end of each trading
period were to: (i) make good cash (physically add or remove the amount of cash
to achieve a nil balance); (ii) settle centrally or (iii) settle centrally and dispute the
discrepancy. The only way to dispute a transaction was therefore to use the “settle
centrally” option and then have the discrepancy ‘suspended’ to allow time for
further investigations and / or a transaction correction to be issued (see
PowerPoint titled “Training guide for managers”®).
15. The facilities for posting certain other products to the suspense account would remain
available to be used, but only following prior authorisation via POL’s central processes
and were to be restricted to use by branch staff with Horizon manager / supervisor roles.
(b) The Rationale for the Modification
16. Around January to February 2004, discussions took place as to whether to keep the
manual authorisation process for branch staff to post cash discrepancies in suspense, or
whether to remove the cash suspense account facility altogether, although it is unclear
which individuals or group actually took this decision:
16.1. David Smith, in response to a question from CTI as to who made the decision to
remove the suspense account function, said “I don’t recall making that decision.
That's not to say I wasn’t involved in it but I don’t recall it... I think the process ownership
would have been whoever was running transaction processing at the time. They would be
the process owner here. As — in charge of project management, we didn't make up the
requirements. The requirements came from the sponsor. So in this case, with IMPACT,
the sponsoring unit would have been Transaction Processing”.°
16.2. Susan Harding said “I honestly can’t remember. If I was in a meeting with those senior
stakeholders, it would not have been my decision” and “at the end of the day they may
have been — it may have been the programme board which would have been people like...
Peter Corbett. And then there would be somebody absolutely from Network, and that might
have included POID”.””
°'T 24/02/23 [28:18 - 29:5]
10 T 22/02/23 [83:17 — 84:14]
SUBS0000024
SUBS0000024
17. Based on the contemporaneous documents, and bearing in mind the fact that at the time
POL was acting in the mistaken belief that the Postmasters’ contractual obligation to
make good discrepancies was absolute, the reasons for the decision to remove the cash
suspense products appear to be that: (i) there was a concern that the facilities were being
used (or could be used) without authorisation from RNMs, sometimes to conceal fraud;
and (ii) it was anticipated that the back-end automation introduced by IMPACT would
reduce the need for a cash suspense facility. See in particular:
17.1. The document titled “Branch Trading Reporting, Management and Control and
Transaction Management Conceptual Design”, dated 3 March 2004, which
recorded that “the analysis has also identified requirements to more tightly control and
police the use of the suspense account within the branch accounts, only a limited subset of
the existing suspense account products will be retained. The contractual requirement for
agents to make good unknown errors in branch accounts will be used instead.” (Section
6.7)"
17.2. A Q&A document on “Branch Suspense Accounts and Trading Statements”,
undated, which suggests that the suspense facility was sometimes being used by
Postmasters without being authorised by their RNM (contrary to the proper
procedure):
Q: Please advise why suspense accounts were removed from branches / postmasters in
2005, and at that time what alternative processes were put into place to manage
shortfalls / discrepancies at branches?
A: “The original processes to be followed when dealing with losses and gains on
Horizon are described on pages 65-79 of the “Balancing with Horizon” document
(POL-0171229.pdf)
Prior to 2005, accounting was done on a weekly basis. With approval from their Retail
Network Manager, a Postmaster was able to carry shortfalls (and gains) into the next
accounting period through placing them into the Local Suspense Account.
However, this facility was sometimes used by Postmasters without being authorised by
their Retails Network Manager...”
17.3. A document from the Risk and Compliance Committee meeting dated 8
November 2005 confirms this view, where it states that in relation to branch audit
findings and investigation activity “positive action has been taken through Branch
Control since last year. This has reduced the incidence of ‘suspense accounts’ being abused
to conceal fraud.”
18. The evidence for the rationale behind the modification referred to by CTI in opening
was the witness statement of Susan Harding (§31), whose role was Business Process
Architect during the design of the IMPACT programme. When giving evidence she
agreed that by "hide" she meant ‘dishonestly place’, based on "the record of people who had
™ POL00038878
2 POL00037835
13 POL00021419
SUBS0000024
SUBS0000024
been prosecuted successfully in the past” and she accepted that she seemed to be operating
on the basis that it must be “nefarious”,'> a belief she held throughout her time at Post
Office.16
19. Rather more nuanced evidence was given by Stephen Grayston, who was the Change
Management Lead for the IMPACT programme, and Ms Harding’s Business Change
Manager. Having accepted that there was a perception that Postmasters were using the
suspense account to hide money that they could not account for or had stolen, he
‘unpacked’ that answer:
“In my experience... there were instances where SPMs wished to use an amount of money
for other purposes, not with the intention of theft or permanently deprive, but wanted to
or needed to use it for other purposes. So it was a facility or an opportunity should someone
so wish to, undertake something short-term using Post Office cash. There were instances,
I believe, where it involved theft, and you know, I’m sure there's a lot of analysis within
Post Office on the types of cases, the numbers of cases, the amounts involved that, you
know, were regularly discussed at post office management level.”"”
CTI’s Characterisation of the modification
20. In his opening statement CTI characterised the removal of the suspense account as “the
most noteworthy modification provided by policy”, '* and there was evidence that the reason
for it was “because of a sense that the suspense account was being used to hide disparities”.!°
He asserted that “It was obvious that, as a result of this modification, subpostmasters were put
in a position where it was more difficult to dispute shortfalls or discrepancies. Indeed, that was
the very point of the change being made ...:’°°
21. POL agrees with some, but not all, aspects of this characterisation. For the reasons set
out above, its position is that: (i) the modification in relation to the suspense account
was the most noteworthy modification for the purposes of the issues under
consideration by the Inquiry; (ii) a (not the sole or predominant) factor taken into
account in deciding to make that modification was a sense that the suspense account
was being used to hide disparities; (iii) following the modification it was more difficult
in practice for Postmasters to dispute shortfalls or discrepancies but this difference was
due, not to the modification itself, but to an apparent failure to ensure that the previous
policy (of requiring authorisation from a RNM before monies could be retained in the
suspense account) was adhered to; and (iv) the increased difficulty was not the sole
point of the change being made.
14 T 22/02/2023 [18:24 - 19:12]
18 T 22/02/2023 [32:2-16]
16 T 22/02/2023 [29:25 — 30:16] Ms Harding left POL in 2017.
” T 27/02/2023 [27:3-16]
18 T 12/11/22 [43:16]
1 T 12/11/22 [45:22-24]
20 T 12/11/22 [45:23-46:4]
SUBS0000024
SUBS0000024
22. As set out above, POL submits that the change was made for understandable and
legitimate reasons. POL submits that it was not unreasonable to have regard to potential
criminality when considering appropriate modifications to be made to Horizon (not
least given POL’s obligations to protect the public purse); but accepts that where that
factor was treated as a presumption that all Postmasters suffering shortfalls were
criminal (or otherwise at fault) in the context of investigations, civil recoveries and/or
prosecutions, that mindset had the potential to result in serious injustice to Postmasters.
23. As for whether the modification made it more difficult for Postmasters to dispute
shortfalls or discrepancies, this issue falls into two parts. First, the change to the process
to be followed in order to raise a dispute was marginal. Had the pre-IMPACT policies
been followed properly, a Postmaster would have had to contact the RNM to obtain
authorisation to put shortfalls into the suspense account; the post-IMPACT policy
required that a Postmaster instead had to contact the Network Business Support Centre
(“NBSC”) to raise a dispute: a difference but not a material one. Equally, there was no
difference between the nature of the investigation that would have been followed for a
disputed shortfall as between the pre- and post-IMPACT policies: in both cases the
starting point would have been that the onus fell on the Postmaster to disprove liability
for the shortfall, based on POL’s (then) understanding of the contractual position (as to
which, see section 2 below).
24. The main difference between the position pre- and post-IMPACT was the effect of
clicking ‘settle centrally’. Andy Winn accepted that this "force[d] the subpostmaster to
accept the validity of the transaction correction before a proper exploration of the dispute"?! and
that “everybody's understanding" of doing so was that it meant the Postmaster had
accepted the debt.”
25. To that extent the modification in respect of the suspense account could properly be said
to have made it more difficult to dispute shortfalls, POL recognises that Postmasters
should not have been required to accept the validity of a transaction correction before a
proper investigation of the dispute.
26. The changes which have been made to the dispute resolution process following the
settlement of the GLO proceedings, which include a modification to the Horizon screen
to enable Postmasters to register a dispute via that screen rather than separately, are
summarised at section 2 below.
(2) RESOLVING DISPUTES
(i) _ POL’s contemporaneous understanding of Postmasters’ contractual obligations
27. POL submits that in considering the processes and procedures in place for the resolution
of disputes over shortfalls, it is critical to have due regard to POL’s contemporaneous
understanding of Postmasters’ contractual obligations towards it.
21 T 03/03/23 38:10-39:1
22 T 03/03/23 50:22-51:10, 51:17-51:20
SUBS0000024
SUBS0000024
28. POL accepts the findings of Fraser J in the Common Issues Judgment and has worked
hard in the years since the GLO was settled to ensure that significant changes are
implemented to contracts, policies and working practices.
29. However, it needs to be recognised that Fraser J’s interpretation of the respective
obligations of POL and the Postmaster is significantly different from POL’s genuinely
held beliefs at the time as to what those obligations were. In particular POL held
genuine beliefs that:
29.1. Postmasters were contractually liable for all losses in their branch and for the
actions of all of their staff;
29.2. The burden was on the Postmasters to provide evidence that they should not be
so liable (which in a sense flowed from the belief as to the Postmasters’ contractual
liability); and
29.3. There were no widespread problems with Horizon - and if and when problems
were encountered they were promptly addressed and appropriate corrective
action taken. In respect of this belief, POL was largely reliant on what Fujitsu was
(and was not) telling POL.
30. The belief as to the contractual liability of Postmasters is key. It was clearly spelt out in
all relevant contracts with Postmasters and was repeated in the various policy
documents which POL prepared (and which, in reality, were more likely to inform the
attitudes of POL employees than the formal contracts).
31. Fraser J found that the true meaning of the obligations in the contracts were more
complex and nuanced than is provided for in the words of the contracts (or the various
policy documents which were produced in light of POL’s then understanding of the
position) — and POL now accepts that. But throughout the relevant period, POL’s belief
was that that was not the case. The reasonableness of that belief is supported by e.g. the
legal advice given to POL by Linklaters in 2014, which was to the effect that under their
contracts Postmasters were automatically responsible for all losses if it could be shown
that they were at least in error.?>
32. It follows that while POL now accepts that, in light of the CIJ, it was mistaken as to the
true nature of the relationship between POL and the Postmasters, and must accept the
legal consequences of that mistake, it would be wrong to treat each and every past action
on the part of POL and its employees as though that action were taken in the knowledge
that it was mistaken and not in accordance with POL’s contractual obligations. That is
not the case. The Inquiry is invited to bear this carefully in mind and to resist the
temptation to judge POL and its employees as though the matters set out in the CIJ were
plain and obvious to everyone in the preceding two decades: they were not. At the time,
» POL00006354 at §5.44. Linklaters also advised that the “sound contractual basis for the recovery of losses
...is supported or in any event, supplemented, by the general law governing an agent’s duties to his principal.”
($5.48)
SUBS0000024
SUBS0000024
POL believed that it was administering the contracts in the way it was obliged and
entitled to.
ii) _ Processes and Procedures
From roll-out to IMPACT (2005)
33. As set out above, until 2005 POL’s policy was that the purpose of the suspense account
was to provide sufficient time for a compensating error to be revealed within the period
for which an RNM had given authority to hold the loss; and if no such error became
apparent, the amount was required to be removed from the suspense account and the
loss made good.
34, Responsibility for matching/reconciling third party data received by POL and data
recorded by the branch in its Horizon account lay with the Product and Branch
Accounting Team (‘P&BA’) within POL. Where data could not be matched and a
discrepancy/shortfall arose as a result, one of the teams within the P&BA would
investigate the issue and issue an error notice/transaction correction if the data could
not be matched in order to correct a branch's accounting position.
35. The P&BA Team consisted of different teams led by different Team Leaders, including
product-specialist teams. The product-specialist teams could become involved in
investigating a discrepancy or shortfall that related to a transaction correction issued in
respect of a product in which that particular P&BA team specialised. Over the years,
changes occurred in relation to the structure and size of the FSC and the teams which
sat within it. The P&BA fell under the responsibility of Rod Ismay from 2003 until 2016.74
36. If a Postmaster disputed an error notice/transaction correction (or absence of one) then,
generally, the Postmaster could call the NBSC as a first point of contact for help, to raise
their issue or query. If the NBSC was unable to resolve the issue this might then have
been directed to the P&BA Team which issued it (and therefore specialised in that
particular product).
37. If a Postmaster received a transaction correction which they did not understand or
wished to challenge, they could contact the phone number provided on the disputed
transaction correction. This phone number would be the number of the P&BA team who
issued it or that of the NBSC. 7°
2005 to 2016
38. A guide issued by the P&BA dated October 2005” provided for the following
procedures:
> From 2003-2005, Mr Ismay's title was "Head of Risk Management & Control", from 2005-2011 it was
"Head of P&BA" and then from 2012-2016 it was "Head of FSC".
25 See for example POL00032960 and POL-0173142
% See page 3 of the Guide referred to in the paragraph below - POL00085794
27 POL00085794
SUBS0000024
SUBS0000024
38.1. If a Postmaster received a transaction correction for over £150 which they wished
to query or dispute, then they could choose an option to "accept and settle centrally"
the amount of the discrepancy/shortfall. This was an alternative to the option to
“accept and make good" the amount of the transaction correction (either by cash or
cheque). The option to “accept and settle centrally" was only available for amounts
over £150.
38.2. Following a decision to "accept and settle centrally", the amount would be moved
into the Postmaster's central account. If it was a shortfall and the Postmaster did
not dispute it, a team within the P&BA would initiate the debt recovery process.
If, however, the Postmaster chose to dispute the transaction correction, they
would be given a reference number to acknowledge further investigation was due
by the P&BA team and the debt recovery process would be put on hold pending
investigation. This guide also states that if the Postmaster had a discrepancy for
over £150 and "[they] can provide evidence" that this was an error which would be
rectified by a compensating transaction correction, then they could report this by
contacting the NBSC helpline who would advise the P&BA team to contact the
branch.
38.3. It appears that Postmasters were able to ask for a discrepancy/shortfall to be
investigated in this way before a transaction correction was issued, or the P&BA
team might have contacted the Postmaster to either clarify a transaction under
investigation, or discuss what appears to be a discrepancy to ensure that the
transaction correction could be understood when it was received. However, if the
discrepancy had already led to a transaction correction being issued, the
Postmaster would only have the option to "accept and settle centrally" as above.
39. If the P&BA Team was unable to resolve a dispute which related to a
discrepancy/shortfall or error notice/transaction correction, then it could escalate the
issue further. From 2008 until 2016, the person to whom discrepancy/shortfall disputes
or issues could be ultimately escalated for investigation or resolution was the
"Relationship Manager" who sat within the P&BA Team (renamed the Finance Service
Centre in 2012).
40. The Relationship Manager's role was to investigate and resolve issues/disputes,
including where (i) a Postmaster did not agree with the outcome of an investigation of
another team (such as the NBSC or P&BA/FSC), and/or (ii) if an issue was considered
particularly complex. Such queries could arise from multiple avenues, including
P&BA/the FSC, those raising concerns on behalf of a Postmaster (such as an Area
Manager, NFSP or senior management) and a Postmaster contacting the Relationship
Manager directly. The Relationship Manager's role was to act as an independent and
final point of escalation for investigations into any discrepancy/shortfall.?* This role was
performed by Mr Winn during this period. In his oral evidence to the Inquiry, Mr Winn
agreed that prior to his start in his role, there was no recognised dispute process.””
28 POL00088897
29 T 03/03/23 [165:7-165:17]
10
41.
SUBS0000024
SUBS0000024
In addition to changes in relation to the P&BA, in or around 2006, a “Branch Support
Team” was created who the Tier 2 NBSC team could contact if a discrepancy/shortfall
issue could not be resolved. The Branch Support Team could be involved in gathering
data from the branch in relation to the issue and would decide if further training or face-
to-face support was required for the Postmaster. The Branch Support Team was an
administration team who provided a further tier of support to arrange training or
intervention to assist Postmasters outside of NBSC’s remit.
2016 to 2020!
42.
43.
44,
45.
In 2016, following the Initial Complaints & Mediation Scheme, the Support Services
Resolution Team (‘SSRT’) was created. This team’s remit was to act as a final point of
escalation in relation to any complex discrepancies/shortfalls issues and to
independently investigate the source of issues and to try and resolve disputes.
This team’s function was similar to that which had been performed by the Relationship
Manager, but it did not sit within the FSC. A discrepancy/shortfall issue or dispute could
be escalated to the SSRT from any part of the organisation where it was deemed that an
issue was complex enough to merit the SSRT’s involvement. The SSRT’s role was to act
as an independent and final point of escalation for investigation into any
discrepancy/shortfall.
The SSRT was renamed the Contract Investigations Resolution Team (the “CIRT”) in
September 2019. This team is now called the Tier 3 team and serves a similar function;
it is the escalation point for the most complex cases from the current Tier 2 team. If the
Postmaster or their representative is not satisfied with the result of the investigation, the
Tier 2 team can escalate the issue for review to the Tier 3 team. Together, the Tier 2 and
Tier 3 teams are called the "Investigations Teams".
In April 2019, functions in relation to transaction corrections were split into two separate
and independent teams: (i) a team was created with the remit of issuing transaction
corrections only (and not in the investigation of any disputes that may arise
subsequently); and (ii) a team with a more investigative role relating to transaction
corrections called the "Transaction Corrections Disputes Team".
From November 2020
46.
The current policies are markedly different from the previous policies in a number of
regards:
30 See for example POL-0024119
» The period post-2016 was not addressed by any witness during the Phase 3 hearings, but given that
the ‘relevant period’ for the purpose of the Completed List of Issues extends to 1 June 2021, and it
does not appear that this period will be covered in any subsequent phase, this summary is included
here for completeness.
11
SUBS0000024
SUBS0000024
46.1. Losses have to be “established”;
46.2. Settling centrally does not convey acceptance;
46.3. Issues with Horizon are acknowledged; and
46.4. Recovery is only possible following a fair investigation.
47. There are also two important responsibilities on POL which did not appear in earlier
documents. First, POL must monitor potential discrepancies and must actively engage
with Postmasters to deal with them at source. Secondly, POL must bring known faults
to the attention of Postmasters rather than merely accepting payment for losses.
48. There is now a three-tiered system for investigating and resolving disputes, sitting
under Network Support & Resolution. The Tier 1 Team is the initial point of contact
within what is now called the Branch Support Centre (“BSC”). Any issues which cannot
be resolved are escalated to the “triage” team within the Tier 2 team which determines
whether or not a discrepancy/shortfall issue should be escalated to the Tier 2 team,
which performs an investigative function in relation to discrepancies (both generally
and in relation to transaction corrections)
Criticisms of the dispute resolution process
49. It is clear from the various policy documents that from the outset, and until significant
changes in November 2020, the approach taken by POL was that:
49.1. Postmasters were treated as being automatically contractually liable for all losses;
49.2. Postmasters were treated as having an evidential burden to disprove any losses
arising on Horizon;
49.3. Postmasters were held liable for all actions of their staff;
49.4, Immediate cash payment was the preferred and default means of ‘making good’;
and
49.5. Clicking ‘settle centrally’ was effectively accepted as conclusive proof of
acceptance of liability if the Postmaster did not also raise a dispute in relation to a
discrepancy as well as selecting this option.
50. POL accepts that these policies could, and in many cases did, operate harshly and
unfairly.
51. It also accepts that, despite the importance of the role of Relationship Manager, the
appointment of Mr Winn in that role was inappropriate in circumstances when he was
relatively junior,” had little technological understanding and no training to be a team
leader in the problem management team. The fact those in competition for that role
would all have had similar backgrounds® is obviously no answer to criticism in this
context. POL accepts that given the significance of the role, it ought to have been filled
by someone with greater and more relevant experience.
2 Grade 3B.
3 T 3/3/23 [10:3-10:8]
12
SUBS0000024
SUBS0000024
52. That decision nevertheless should be considered against the background that these
policies reflected POL’s then understanding of the nature of the contractual relationship
between POL and Postmasters (which Fraser J rejected in the Common Issues Trial in
the GLO). It also reflected a belief in the reliability of the Horizon system and its data,
which POL also accepts was ultimately misplaced.
53. Finally, it is noted that in the course of oral closings, Mr Stein KC, on behalf of the Howe
& Co CPs, made a complaint about the failure to provide disclosure of the Helpdesk
scripts. As the Inquiry is already aware, the position here is that from the inception
of the NBSC until 2014, it was run by the Royal Mail Group (or its predecessors)
(“RMG”) and any guidance for the NBSC was accessed through an RMG system called
“Remedy”. RMG has stated that it has not retained any data from Remedy. In 2014 the
Knowledge Based Articles (“KBAs”), which would include any scripts provided to
NBSC staff, that were on Remedy at that date were transferred to POL’s NBSC KBA
SharePoint site and accessed through a platform called “Microsoft Dynamics”
(“Dynamics”). Since 2018, any new KBAs that were created were created and managed
directly in Dynamics while KBAs stored on the NBSC KBA SharePoint site were
transferred to Dynamics in December 2021. Both for the purposes of the GLO and the
Inquiry, POL has carried out reasonable searches of the NBSC KBA SharePoint site and
has explained the nature of such searches to the Inquiry in some detail. In addition POL
has searched some custodian mailboxes, email distribution lists, a shared drive and
other SharePoint sites. POL has provided the Inquiry with relevant material responsive
to all of these searches.
(3) KNOWLEDGE
54. Two consistent themes emerged from the Fujitsu evidence:
54.1. First, that Fujitsu’s own procedures were poorly documented, inconsistently
applied, were heavily reliant on the discipline and integrity of individuals, and
that important procedures, such as when remote access was effected, were not
audited and may not have been recorded;
54.2. Secondly, that Fujitsu’s communication of important information to POL
(including information relating to the fact and extent of bugs, whether such bugs
had been resolved, and whether any change had been made to branch accounts)
was similarly inconsistent, incomplete and not governed by procedures which
were consistently applied or audited; and that despite Fujitsu witnesses
continuing to assert that relevant information was conveyed to POL, there is
little evidence of any such communication, still less of any such communication
taking place in a structured and auditable manner; moreover, no evidence has
been heard from any witness who is able to give first-hand evidence of any such
communication.
55. On the first of these points see for example:
55.1. The evidence of Anne Chambers that:
34 T 17/5/23 [89:23 — 92:7]
13
SUBS0000024
SUBS0000024
55.1.1. Event logs that were investigated whilst dealing with a ticket (i.e. a
PEAK ora KEL) were not always preserved with the ticket, and if they
were not it was up to the discretion of the individual within the SSC
team to decide whether to keep the event log, and if so, for how long.
55.1.2. Whether or not an update was copied to a PEAK after being added to
Powerhelp depended on the helpdesk using the right category for the
update, which could have “lead to left hand not knowing what the right
hand is doing” or “information just not being passed through to the people
who are probably being expected to give an answer”.
55.2. The evidence of Steve Parker that:
55.2.1. No-one undertook any ongoing monitoring of how the KEL system
was working in practice; *”
55.2.2. There was no system in place to ensure that SSC staff in fact only
accessed the live estate to correct data in response to an authorised
Operational Correction Requests (“OCR”), no audit of whether it had
occurred took place in the 22 years that he was at Fujitsu and Fujitsu
had “got to trust that they follow the process”;*
55.2.3. There was “no approved and auditable tool that was operationally good
enough for them to use”, and as the system did not record individual
user access, no audit was possible;
55.2.4. Other than locks and keys on the building and what was said to be
frequent or more frequent security checks, the people in third line
support had unrestricted and unaudited access to post office counter
PCs;*°
55.2.5. There was no system-wide retrospective audit done to ensure that
changes made using the Operation Change Proposals (“OCP”) system
or otherwise were monitored for errors, regression or unintended
consequences.*!
56. On the second of these points, see for example:
56.1. Anne Chambers’ evidence that she did not know whether there was a process
in place to ensure that certain types of information were always reported to
POL* (and the absence of any other evidence from Fujitsu, whether from the
Management Support Unit ("MSU") or otherwise, that there was).
56.2. Steve Parker’s evidence that:
38 T 2/5/23 [62:4-63:7]
96 T 2/5/23 [142:14-143:12]
7 T 10/5/23 [49:20-50:9]
38 T 10/5/23 [79:23-82:16]
% T 10/5/23 [91:10-92:19]
+9 T 10/5/23 [98:18-99:4]
41 T 10/5/23 [106:23-107:13]
© T 2/5/23 [150:7-10]
14
SUBS0000024
SUBS0000024
56.2.1. KELs were not accessible to POL;#
56.2.2. Whilst he expected that a problem with serious consequences for
Postmasters would have been communicated to POL in order to be
passed out to all Postmasters who were using Horizon, he was
unaware of any system being in place to ensure that that occurred, and
did not know how the service managers who would have been
responsible for passing that on to POL recorded that sort of
information. “
57. POL was to a large extent dependent on the information provided to it by Fujitsu.
Fujitsu for its part was, at best, lax and, at worst, seriously remiss in ensuring that POL
was kept fully and properly informed. The result is that, to a significant extent, POL
did not have a full and clear view of the performance of the Horizon system and of the
true nature of the difficulties being faced by Postmasters, and had nothing like the
overview which was available to Fujitsu.
58. The extent to which POL relied on information provided to it by Fujitsu, and the
dangers of failing to challenge it or seek further information, were most clearly
demonstrated in Mr Ismay’s evidence, in particular in relation to his testimony
concerning what has come to be known as the Ismay Report dated 2 August 2010.‘
Mr Ismay accepted, amongst other things, that:
58.1. He was only asked (by Dave Smith, then Managing Director of POL) to include
reasons that gave reassurance i.e. “to present one side of the coin” and that he was
not given the task of establishing what allegations had been made about Horizon
and investigating them;**
58.2. He relied on what others had told him — including Gareth Jenkins — and that he
should have made it clear that the report included assertions which he had not
tested during the course of collating the report;”
58.3. Similarly, he accepted that the evidence in his witness statement (para 39), to the
effect that the report was “a summary of existing conclusions” was not recorded in
the report itself and that the report’s own description of it being an “objective,
internal review” was inaccurate.”
59. This is obviously highly unsatisfactory and Mr Ismay’s own candid acceptance that
he ought to have gone about things differently is a conclusion which the Inquiry will
undoubtedly share. POL does not seek to excuse the many errors of judgment that
were made in the commissioning and preparation of the Ismay Report.
8 T 10/5/23 [50:10-11]
4 T 10/5/23 [141:5-142:2]
* POL00026572
46 T 11/5/23 [104:4 — 104:23]
# T 11/5/23 [107:8 — 108:13]
48 T 11/5/23 [109:2 — 109:20]
“© T 11/5/23 [110:18 - 110:24]
15
SUBS0000024
SUBS0000024
60. That said, it is submitted that the Inquiry should not conclude that, when Mr Ismay
was preparing the Ismay Report, he (or POL) believed that he was presenting a report
which was either materially inaccurate or incomplete. There is no evidence that POL
generally, or Mr Ismay specifically, were trying to cover up what was known, or even
suspected, about genuine problems with Horizon. POL’s view, largely based on
Fujitsu’s assurances, was that the allegations made about Horizon were misconceived
and that there were no legitimate criticisms to be made of Horizon.
61. POL accepts that, for its part, it could and should have been stricter about insisting
that Fujitsu established clear procedures concerning communication and provided
full, accurate and regular reporting to POL. Equally, it could be said that POL ought
to have pressed Fujitsu harder when issues arose. However, that does not alter the
fact that during the relevant period POL did not have a full awareness of the fact or
extent of the problems being experienced; and nor does it detract from the fact that
such matters were the primary responsibility of Fujitsu.
62. On the particular issue of knowledge in the context of OCPs and OCRs knowledge,
POL notes:
62.1. Mr Roll’s oral evidence to the Inquiry that whilst at the time of giving evidence
in the GLO he believed that formal consent from POL was required, he
subsequently saw some documentation that indicated that there were times
when POL was not informed, namely, a statement from Mr Peach that SSC were
not to inform POL of a particular item;* as against
62.2. the Customer Service Operational Change Procedure (written by Mr Peach)
which provided that all OCRs where the data to be changed had a financial
impact on POL had to be approved by a senior POL manager;*! and
62.3. Mr Peach’s evidence that OCPs could only be done with the agreement of the
Postmaster, POL and (Fujitsu) Customer Service.
63. The Inquiry will obviously reach its own view on the extent to which Mr Roll’s
evidence should be accepted generally, having regard to the other evidence it has
heard, but in this context POL notes that Mr Roll’s specific allegation against Mr Peach
was not put to him in questioning by the Inquiry.
64. A separate, but related issue, concerns the position where POL was aware of the
alteration of a branch’s accounts by Fujitsu. Anne Chambers’ evidence was that she
was aware that on some occasions personnel in POL had known that accounts in a
branch had been altered and that someone in POL took the deliberate decision not to
inform the relevant Postmaster of this fact.* This is obviously a matter of potentially
serious concern.
50 T 9/3.23 [86 :25 - 88:5]
51 POL00029282, internal p.23.
3 T 15/5/23 [43 :12 - 44 :7]
53 T 2/5/23 [207:20 - 207:24] & T 3/5/23 [28:9 - 31:8]
16
SUBS0000024
SUBS0000024
65. POL does suggest, however, that some care needs to be taken with that evidence since:
65.1. Mrs Chambers did not provide any details of who was responsible for this, or
when;
65.2. No such allegation has, at least as yet, been put to any past or present POL
employee;
65.3. While Mrs Chambers alleged secretiveness on POL’s part (which, if accurate,
was plainly inappropriate), there is no suggestion that the change to the branch
accounts was anything other than corrective i.e. Fujitsu and POL were doing
what needed to be done albeit not being as open about that as they should have
been; and
65.4. There plainly was no orchestrated campaign of secrecy since Postmasters were
frequently told of the fact of system errors (e.g. by Mrs Chambers herself if she
had cause to speak to them).
(5) TRAINING
(i) Phase 1 evidence
66. POL is conscious that during Phase 1 a number of Postmasters told the Inquiry that the
initial training on Horizon provided to them was inadequate.
67. POLis sympathetic to the position of any Postmaster who genuinely felt that they were
not given sufficient training. The Inquiry will understand that POL faced a considerable
challenge in ensuring that the varied requirements of each Postmaster were met: some
individuals were immediately comfortable with the requirements of computerisation
and others found the move more difficult. The challenges in designing training courses
which met this range of needs were significant. That is why follow-up training was
available to those who sought it.
68. However, for the avoidance of any doubt, POL does not accept the characterisation of
that evidence (as put forward by Howe & Co™) that the evidence as to training which
was heard during Phase 1 was “unchallenged” by POL, and therefore accepted in every
case. It would not have been appropriate (or indeed possible) to challenge that evidence
during the Phase 1 hearings. POL's approach to the human impact hearings was that it
was an opportunity for the witnesses to have their say, and for POL to listen to their
grievances, and it would not have been feasible to submit Rule 10 questions in
circumstances where a large proportion of the human impact statements were provided
very shortly before or even on the day of the hearings, such that POL would not have
had the opportunity to review any records held for that Postmaster. Ultimately, it is for
the Inquiry to decide what weight to ascribe to any particular piece of evidence based
on the whole body of evidence it has received. In this context POL would respectfully
remind the Inquiry of the principles in Gestmin as set out in its Phase 2 closing
submissions.
54 T 20/01/23 [55:22 - 57:5]
17
(ii)
69.
70.
71.
72,
73.
74.
75.
SUBS0000024
SUBS0000024
Development of the training programme
Three principal entities were involved in developing training for end-users of Legacy
Horizon and delivering that training during the national roll out:
69.1. Fujitsu;
69.2. Knowledgepool;* and
69.3. POL.
Fujitsu were responsible for, among other things, the design of training events, the
development of training materials (day to day and maintenance), the delivery of
training to delegates and trainers, the communication of training activity and the
management of training processes.
Knowledgepool was a sub-contractor selected by Fujitsu to design, develop, deliver and
manage the Training and User Awareness Programme.
POL’s role was to consider and approve Fujitsu’s training proposals and processes,
monitor and review performance, attend regular training meetings and identify
improvements to training services as part of the Contractor's quality review.
In relation to the roll-out of HNG-X, Fujitsu was to supply training systems and
documents for the purpose of training POL employees. POL's responsibilities included
the provision of all training for its employees, agents, contractors and sub-contractors
as well as the production of all training material required in connection with any new
services and applications.
The Inquiry has now heard from many of the individuals who were responsible for
delivering this training and it was clear in the main that they were conscientious
individuals who were doing their best to provide thorough training and that any
inadequacies were by no means universal.
The witness evidence sets out the training that was provided for the roll-out of Legacy
Horizon:
75.1. All users were given the opportunity to attend a local awareness event in the
weeks before their migration to Horizon, which typically lasted two hours and
were held after offices closed and in suitable locations.
75.2. A few days before the "go-live" date for each office, staff attended a basic
classroom course using off-line Horizon terminals for one day, which
concentrated on the point-of-sale functions. Training was delivered by
Knowledge Pool. Branch managers and Postmasters attended a second day to
learn about stock control and financial accounting.”
55 Which formerly traded as Peritas Limited from 1992 to 1998 and ICL Training Services Limited
from 1998 to 1998.
5 Witness statement of Donald Grey, para 8a.
57 Witness statement of Donald Grey, para 8a-8b.
18
SUBS0000024
SUBS0000024
75.3. Remedial events were arranged for those who, in the opinion of the trainer, did
not meet the required standard during the initial training.*
75.4. On the resignation of a Postmaster, training of the incoming Postmaster on
Horizon was incorporated into the initial on-site training given to all newly
appointed Postmasters. This was normally for one week.*®
75.5. The training system was built around the needs of potential users as identified in
the initial Training Needs Analysis. Feedback was collected at each training
session and, where appropriate, incorporated into future events. Training had to
encompass a wide range of ages, abilities and backgrounds.”
76. POL accepts that there were some early concerns expressed about the sufficiency of the
training provided. This was taken seriously by POL and led to Acceptance Incidence
218 being raised on 19 May 1999.%
77. Mr Grayston gave evidence® that a rectification plan was introduced to address A1218,
which focused on improving training for office staff and support staff. The rectification
plan® included:
77.1. changes to ensure training was provided to POL Retail Network Managers;
77.2. the introduction of pre-assessment training (that focused on improving office
manager training success rates);
77.3. improved processes for monitoring and reporting training delivery;
77.4. ways of encouraging the use of the Horizon training mode facility; and
77.5. a process for managing office managers who did not demonstrate the required
level of competency.
78. Evidence was also heard in Phase 3 on the extent to which feedback on training was
considered and implemented in the training course during the roll-out of Horizon. The
Inquiry heard evidence on this issue as follows:
78.1. Mr Rollason worked on the training course with Fujitsu and helped to develop
the user awareness events. His view was that the Inquiry is "barking up the wrong
tree" by trying to blame the initial training for errors in Horizon. Mr Rollason's
evidence was that the training was tested and tested and "worked perfectly" from
1997. He said the problem was that Horizon was glitchy.
78.2. Mr McNiven gave oral evidence that feedback from Postmasters on the training
course was considered by POL in the context of AI 218. He said that Postmasters
were involved and that there were two open sessions with end-users of Horizon
who participated in the "live trial" to gather feedback. He noted that there were
two sessions in Bristol, which he personally attended, and two sessions in the
58 Witness statement of Donald Grey, para 8d.
5° Witness statement of Donald Grey, para 8e.
60 Witness statement of Donald Grey, para 8h.
* POL00028357, p.4.
© Witness statement of Stephen Grayston, para 42.
© Referenced at page 1 of FUJ00079176.
6 Paragraph 77
19
SUBS0000024
SUBS0000024
north-east, one of which he personally attended and the other of which was
attended by Mr David Miller (whom he reported to). Mr McNiven acknowledged
that Postmasters "had a hard time" because, at that stage of live trial, they were
unhappy with their experience — notably the length of time dedicated to training
and the training on balancing — and this was relayed to POL.*
78.3. Mr Fletcher gave evidence in his witness statement that feedback from the training
course suggested that there was not enough time set aside for training and that
there was insufficient information on balancing (though he noted that he thought
there was sufficient time for most delegates).
79. There was also evidence that POL made changes to training after the rollout of Legacy
Horizon as a result of Postmaster feedback:
79.1. Mr McNiven gave oral evidence that feedback from Postmasters on the training
course was considered by POL in the context of addressing AI 218 (which had
raised concerns with the time being made available by the training schedule
proposed by Fujitsu). His evidence was that:
79.1.1. Feedback received from Postmasters during the open sessions referred to
above informed POL's negotiations with Fujitsu. regarding
improvements to the training course. POL noted that they were not
happy with the training product; and it had to be modified and
improved. Those debates were "going on a very regular basis with [Fujitsu]
from [April 1999] up to the revised training package that they produced".”
79.2. Mr Grey gave evidence that POL took steps to address the criticisms on training
set out in the Christmas Horizon Research Report (in particular, criticisms of there
being insufficient time provided for training and inadequate training on
balancing). He gave evidence that the following measures were taken to address
this feedback:
79.2.1. moving to provide a user awareness event two-to-four weeks before
training itself;
79.2.2. diverting more staff to support offices during the rollout period; and
79.2.3. introducing a "balancing guide" to support Postmasters on balancing.
79.3. Furthermore, Mr Grey noted that POL took the score on the ease of balancing
during the live trial from 19% to 90% within 12 months. He also stated that POL
took on board the recommendation in the Christmas Horizon Report that time
should be set aside to consider feedback from Postmasters.”
80. In addition, evidence was heard on changes and improvements made to training
unrelated to feedback from Postmasters. For example, Mr Bansal gave evidence that:
6 T 10/01/23 68:15-81:24
% T 10/01/23 105:3-113:3
& T 10/01/23 73:9-75:4
6 T 19/01/23 13:1-13:15
6 T 19/01/23 13:1-13:15
20
SUBS0000024
SUBS0000024
80.1. The rollout of Legacy Horizon was put on hold for around a year and the initial
training materials drafted by Knowledgepool were replaced as the old materials
possibly became obsolete or enhanced following developments from the system
that came a year later.”
80.2. Over time, POL introduced their own test teams and within those POL teams have
been Postmasters.7!
81. Having regard to the above evidence, POL submits that the training provided was
reasonable and adequate in all the circumstances, and, in particular, that it took on
board, and responded to, Postmaster feedback during the roll-out, such that
improvements were made in the provision of training during the relevant period.
(5) AUDIT DATA
82. There has been considerable confusion and conflicting accounts (both during the
Horizon Issues Trial (“HIT”) and evidence before the Inquiry) as to what data was
available to both POL and Fujitsu which could be referred to when an investigation was
necessary.
83. The point is important since one of Fraser J's criticisms of POL was that it had access to
keystroke data but chose not to make use of that access: the implication is that in every
case where a discrepancy arose POL or Fujitsu could, had they chosen to, ascertained
precisely what had happened in the branch and thereby conclusively determined
whether Horizon, or the Postmaster, was responsible for a discrepancy. As set out
below, that does not seem to have been the case.
84. “Transactions” are defined in Schedule A01 of the Codified Agreement as “a recorded
and auditable instance of a business activity, involving service provision or Stock movement
across organisational or service boundaries”. “Events” were defined as “a recorded and
auditable instance of business administration activity, such as the registration of a new User, or
the production of a report.”
Transfer and storage of audit data
85. The way in which audit data was transferred and stored differs between Legacy
Horizon and Horizon Online. The position was summarised by Jason Coyne, expert for
the claimant-Postmasters in the GLO in his first report (“Coyne1”) §§4.23-4.47:75
85.1. From 1996-2010, Horizon was designed to store all data locally on the branch
counter’s hard disk. That data would then be replicated to the hard disks of other
counters in the branch and then passed on to the Horizon data centre where it was
stored in the “CS Messagestore”. Once the data reached the Horizon data centre,
7 Witness statement of Steve Bansal, para 9.
71 Witness statement of Steve Bansal, para 20.
POLO0028215
73 POL00000410
21
SUBS0000024
SUBS0000024
a further copy was taken by the Audit Agent, who wrote that data to an audit file
where it was available for retrieval for up to 7 years.
85.2. After the migration to Horizon Online, transactional data was stored in the data
centre rather than on branch counters. Data reaches the data centre as follows:
85.2.1. When transactions are carried out locally on the Horizon Online
counters, a “Basket” is built up during a customer session, whose
monetary sum must be zero (i.e. the services and money paid for them in
settlement by the customer should balance). Each transaction should
result in a Basket entry consisting of one or more accounting lines.
85.2.2. At the end of a customer session, when the Basket has been completed,
the Basket is sent to the online branch database (the “BRDB”) as a Branch
Access Layer (“BAL”) message where the BAL processes the message
and all the accounting lines are recorded and committed to the BRDB.
85.2.3. The BRDB contains a record of all branch transactions and event data
captured in the branch. Each day the contents of the database table in the
BRDB is copied from the BRDB to a number of serial files. The files are
then copied to the audit system nightly where they are sealed digitally
and held for 7 years,” during which time they may be retrieved and
filtered to produce the relevant audit data for a particular branch.
86. Audit data therefore records “transaction data” entered at the branch. However, there
appears to be some confusion as to the extent to which audit data records all activity
which can affect branch accounts.
Integrity of audit data
87. Itis uncontroversial that there were a series of measures in place to ensure the integrity
of the audit data — i.e. that the data, once transferred from the counter and stored in the
audit store, could not be altered.
88. However, as set out in §5.57 of Coyne2,” the audit data reflects branch counter data, so
it is possible that audit data could reflect erroneous information. For example, if a
counter error caused a transaction item to be duplicated prior to its submission to the
database, then the audit log would itself contain this error. In other words, the data is
not itself audited prior to being saved in the audit store.
“Keystroke” data
89. Fraser J defined “audit data” in the Horizon Issues Judgment (“HIJ”) at §906 as:
“a complete and accurate record of everything that has occurred, which in the context
of Horizon means including a full record of keystrokes used by a SPM (or assistant) in
the branch. This accurate record is kept in what is called the audit store. This is a secure
place for the keeping of such data.”
™ POL sent data retention instructions to Fujitsu in late 2014 as a result of which Fujitsu currently holds
transaction and event data from October 2007 onwards.
75 POL00028988.
22
SUBS0000024
SUBS0000024
90. Fraser J concluded that the audit data includes “a full record of keystrokes used by a SPM
or assistant in the branch”. However, this appears to confuse audit data (which contains
a record of transactions entered at the counter) with an idea of “keystroke data”,
seemingly used by Fraser J to mean a record of each key pressed by a Postmaster in
completing a transaction.
91. The phrase “keystroke activity”, in the context of data available to POL, appears to have
originated from Mrs Mather’s witness statement, prepared for the purposes of the GLO,
where she stated that Credence records all keystroke activity. This was incorrect:
a. Her statement was corrected under cross-examination during the HIT, where
she said in response to a question from Fraser J (transcript day 6, pg. 172)”° that
“I didn’t realise that keystroke activity actually refers to these ARQ reports where we
do the transactional data on Credence; that’s what we're looking at, the sales and non-
sales so I meant transactional data.”
b. She also clarified that her understanding of “keystroke activity” at the time she
made her statement was “transactional data, sales and non-sales. So for every
transaction that a postmaster — for example somebody paid their bill, we would see that
level of detail and how the transaction was finished, either to cash, cheque, debit card.
So it’s the transactional data over the Horizon counter.”
c. Her evidence was ultimately therefore that Credence records transactional
data performed in a branch, but not “keystroke activity”.
d. It may be that Fraser J understood (mistakenly) from Mrs Mather’s statement
that “keystroke activity actually refers to these ARQ reports” that audit data
contained a record of all keystrokes pressed by a postmaster at a counter.
92. The same point was confirmed by Anne Chambers in her evidence to the Inquiry, in the
following exchange:
“Q: It’s been suggested by some witnesses that the ARQ data equated to data that
recorded every keystroke made by a subpostmaster in branch?
A: that was never captured.
Q: simplifying matters, was it therefore the data when a subpostmaster committed what
they had done to the stack, essentially?
A: Yes, because the messages got written to the message store, the transaction messages
were written to the message store when the basket was settled.”””
93. Instead, “keystroke data” may refer to records downloaded “from the counter” (the
“POC log”), which do seem to contain a record of “buttons” pressed by Postmasters, but
not every individual key pressed.
94. Inher evidence to the Inquiry on 3 May, Anne Chambers clarified that the logs did not
contain a record of every single keystroke pressed by a Postmaster, but that, at least for
Horizon Online, they did allow Fujitsu to see the button that was pressed by a
Postmaster in order to move between screens (i.e. the tile on the touchpad or the
6 POL00004071
77 T 2/5/23 [160:14 — 160:20]
23
SUBS0000024
SUBS0000024
associated key on the keyboard), such that “the button presses or the virtual button presses
are recorded but not every single keystroke”. She further explained that “we can’t see here that
a name has been typed in or... then deleted or anything like that.”
94.1. She was then asked whether it would be possible to tell whether a Postmaster had
keyed in £250 or £2,500, if the screen was showing that £2,500 of cash had come
in, but the Postmaster claimed that he only keyed in £250. She said this would not
be possible and that level of detail of precisely what the Postmaster had keyed
was not recorded.
94.2. According to Anne Chambers’ evidence, the “keystrokes” which appeared on the
counter logs would be “any of the buttons that controlled the navigation around the
system or where the postmaster was given a choice and had to choose “yes” or “no””, and
that “you could see the order of events” and the pathway that a Postmaster took.”*
95. If Mrs Chambers’ evidence is correct (and it is submitted that she gave the most
confident account of these matters that the Inquiry has heard)” it would seem to follow
that some witnesses have been talking at cross purposes about the nature of keystroke
data.
96. The point is of some significance since it means that, contrary to the view expressed by
Fraser J in the HIJ, it would never have been possible for an investigation to have
ascertained each and every keystroke which a postmaster had pressed: the criticism
against POL for failing to do just that is therefore unfounded. The true position, as Mrs
Chambers explained it, is that those investigating discrepancies could not be absolutely
confident of what had happened in the branch. They were, at least in some
circumstances, reliant on being told what had happened and could then try to make
sense of that based on the information that was available. But it has never been the case
that the complete history of every keystroke pressed could be reproduced.
Miscellaneous
97. The end of Phase 3 effectively concludes the Inquiry’s consideration of the Horizon
system itself (as distinct from how evidence in relation to it was treated in criminal
and/or civil proceedings etc.).*” The evidence to date has concerned its development,
its operation and the various procedures which were implemented by both POL and
Fujitsu to deal with, amongst other things, training and dispute resolution.
79 T 3/5/23 [1:9 -8:3]
” POL notes in this context the evidence of Mr Parker, who suggested that for a period keystroke
logging did take place, it having been put in about the time of network banking (c.2006) and probably
came out again at HNG-X (2010), although he was not positive about that. He was unable to recall why
it came out. T10/5/23 [133:16-134:16]
% Subject, of course, to the Inquiry deciding to revisit any of the issues covered in Phases 2 and 3 in
later phases.
24
SUBS0000024
SUBS0000024
98. No evidence has been put before the Inquiry on the issue of whether, as a matter of
fact, any particular bug caused identifiable loss to a specific Postmaster. Nor does that
issue form any part of the Inquiry’s Completed List of Issues. POL assumes that this
is because the Inquiry does not consider it necessary to reach any independent
conclusion on this issue in order to fulfil its Terms of Reference.
99. Having regard to the Chair’s statement that he would consider the findings of fact by
Fraser J in his Common Issues and Horizon Issues judgments and the conclusions
which he reached based upon those findings as “established and incontrovertible”, it
follows that the following findings by Fraser J in the HIJ on this issue are established:
99.1. It was possible for bugs, errors or defects to cause apparent or alleged
discrepancies in branch accounts [HIJ/968];
99.2. Not only was there this potential but it actually had happened and on numerous
occasions [HIJ/969] (although it should be noted that this is not a finding that
any particular and identified loss was non-transient i.e. loss that was not made
good by POL through the Transaction Correction process: for the purposes of
the HIJ Fraser J made no findings at that level of detail);
99.3. There was a material risk that a shortfall in a branch’s accounts was caused by
the Horizon system from 2000 to 2017 [HIJ/978].
100. Against this background POL notes that it was suggested to Mr Ismay that it is now
known that Horizon was significantly compromised by a series of bugs which had the
effect of causing accounting discrepancies which were wrongly attributed to the
criminal actions of Postmasters.*! In the absence of any evidence before the Inquiry
going to causation, still less any finding by the Inquiry to that effect, it is respectfully
submitted that care must be taken to ensure that findings of Fraser J are accurately
reflected, both during the course of the hearings and in the Inquiry’s findings in due
course.
81 T 11/5/23 [177:23 - 178:12]
25