UKGI00044337 - Post Office Group policy - Speak up Policy - Version 8

Evidence on official site

UKG100044337

UKGI00044337

ee)

GROUP POLICY

Speak Up Policy

Version — V8
UKG100044337
UKGI00044337

1. Overview......

1.1. Introduction by the Policy Owner

1.2. Purpose...

1.3. Core Principles

1.4. Definitions

1.5. Application

1.6. Legislation

1.7. How to Report Speak Up Concern
1.8. External Discolsures

1.9. Protecting the Speak Up Reporter (Your Legal Rights)..........

1.10. The Speak Up Champion and Management of Reports......

1.11. Responding to Speak Up Reporters
1.12. Other Contact Detai

2. Risk Appetite and Minimum Control Standards .
2.1. Risk Appetite

2.2. Policy Framework.....

2.3. Minimum Control Standards

2.4. Governance Responsibilities ....

3. Document Control
3.1. Document Control Record

3.2. Oversight Committee: Risk and Compliance Committee / Audit and Risk Committee
(delete as to the relevant policy approval forum)

3.3. Company Details......

Internal and External Page 2 of 20 Speak Up Policy v.8 May 2023
UKG100044337
UKGI00044337

1. Overview

1.1. Introduction by the Policy Owner

The Head of the Central Investigations Unit is the Policy Owner and together with the Group Legal
Director have overall accountability to the Board of Directors to oversee that a positive Speak Up culture
is proactively encouraged throughout Post Office Ltd (POL) and the current arrangements are
challenged and assessed for areas of continuous improvement. They are accountable for the
implementation of controls ensuring POL meets Speak Up obligations. Speak Up is a standing agenda
item for the Audit and Risk Committee.

1.2. Purpose

This Policy has been established to set the minimum operating standards relating to the management
of Speak Up throughout the Group. It is one of a set of policies’ which provide a clear risk and
governance framework and an effective system of internal control for the management of risk across
the Group. Compliance with these policies supports the Group in meeting its business objectives and
to balance the needs of shareholders, Staff and other stakeholders.

1.3. Core Principles

‘Speak Up’ is POL's whistleblowing service, enabling individuals to raise concerns in confidence (and
anonymously if preferred). POL encourages speaking up and raising concerns or wrongdoing. It is the
right thing to do for our colleagues and Postmasters and helps protect our reputation. We commit to
provide appropriate protections to Speak Up Reporters. The governance arrangements described in
this Policy are based upon the following core principles:

+ POL will treat Speak Up disclosures consistently, fairly, appropriately and professionally and in
compliance with the Public Interest Disclosure Act 1998;

+ To encourage the reporting of any concerns as soon as possible in the knowledge that POL will
take all concerns raised seriously and investigate them fully. Concerns will be kept confidential and
disclosed only on a ‘need to know’ basis;

+ POL will actively promote and publicise how staff can raise those concerns;

+ Reporters raising genuine concerns will be protected from reprisals, even if they turn out to be
mistaken;

+ That POL will provide a training and awareness program to ensure all employees are aware of the
Speak Up policy and procedure.

If you need further information about this Policy or wish to report an issue in relation to this Policy, please
contact the Policy Sponsor or Policy Owner.

1 The full set of policies can be found at: Key Policies

Internal and External Page 3 of 20 Speak Up Policy v.8 May 2023
UKG100044337
UKGI00044337

1.4. Definitions

“Employee” and “Staff’ means an individual who has entered into or works under (or, where the
employment has ceased, worked under) a contract of employment or any other relevant contract, as
defined in sections 230(2) and (3) of the Employment Rights Act 1996, with Post Office or the Group or
is defined as a “worker” under section 43K Employment Rights Act 1996.

“Post Office’, “POL” and “Group” mean Post Office Limited and any wholly owned subsidiary that
formally adopts this Policy.

“Speak Up” refers to the act of a person (the “Speak Up Reporter’) making a disclosure that the
Reporter reasonably believes is (a) in the public interest, and (b) regarding past, present or likely future
wrongdoing that falls into one or more of the following categories:

* criminal offences (this may include types of financial impropriety such as fraud)
+ failure to comply with an obligation set out in law (including regulatory breaches)
+ miscarriages of justice

+ endangering of someone's health and safety

+ damage to the environment

* covering up wrongdoing in the above categories

* abreach of the POL's policies and procedures

* behaviour that harms or is likely to harm the reputation or financial well-being of the POL

1.5. Application

This Policy is applicable to all Staff within the Group and outlineshow POL will encourage, receive and
investigate incidents of Speak Up and the protections provided for Staff Speak Up Reporters by law.

Procedures for the Speak Up team who handle the reports are set out in an internal document called
the Investigators Manual.

In order to encourage reporting of possible wrongdoing, POL will, where appropriate, and to the extent
possible, follow equivalent principles to encourage, receive and investigate incidents of Speak Up by
Postmasters (whether limited companies, partnerships, limited liability partnerships or individuals),
Agent Assistants, and members of the public.

Although covered by the principles of this policy, Postmasters and Agent Assistants are not protected
under law to the same extent as POL staff. POL can extend confidentiality protection, but employment
protection can only extend to employees.

1.6. Legislation

The Group seeks to comply with all relevant UK legal and regulatory requirements including (but not
limited to) the following legislation as amended or supplemented from time to time:

+ Employment Rights Act 1996.
+ Public Interest Disclosure Act 1998

Internal and External Page 4 of 20 Speak Up Policy v.8 May 2023
UKG100044337
UKGI00044337

1.7. How to ‘Speak Up’
POL supports and promotes a number of reporting mechanisms:

+ The Speak Up Reporter's line manager
+ Contacting the “Speak Up” line, a confidential reporting service which is operated by an independent
company, Convercent, on behalf of POL
+ Direct to the Speak Up Manager speakup!
+ To a front-line team, e.g. Area Managers, customer complaints, Branch Support Centre and
Grapevine.

“

These may be verbal or written communications.
Information and contact details

Speak Up line:
+ Telephone Number:

Any POL Staff who suspects that there is a breach of this Policy should report this without any undue
delay through any of the reporting mechanisms set out above.

What information needs to be provided?

There is no definitive list of what should be reported to Speak Up. Although the Speak Up Reporter is
not required to provide evidence, they should be able to explain their concern, why they are making the
disclosure and any relevant background information they have. Reports can be made:

+ openly,

* confidentially -when the individual (or entity in the case of a limited company, partnershipor limited
liability partnership) making the report gives their or its name and the person handling the report will
try to respect confidentiality where possible (subject to exceptions described in paragraph 19, or

* anonymously — reports made anonymously are taken seriously, however, POL encourages open
reporting as without certain details, it may not be possible to investigate a report as thoroughly as
would otherwise be the case and/or provide feedback on the progress or outcome of the
investigation.

Difference between Speak Up and other complaints

This Policy should not be used by Staff wishing to raise complaints relating to their own personal
circumstances, such as the way they have been treated at work. Speak Up reporting is a matter of
public interest that meets the definition of a Public Interest Disclosure set out in this Policy and statute.
Grievances and matters such as bullying and harassment or dissatisfaction with a performance rating
should be raised in accordance with the procedures set out in the appropriate HR policy.

Internal and External Page 5 of 20 Speak Up Policy v.8 May 2023
UKGI00044337

UKGI00044337

The following table sets out examples of events that might prompt the making ofa Speak Up disclosure.

Speak Up

Not Speak Up

Actions that put colleagues or customers health
and safety in danger - A branch manager refuses
to follow security procedures when admitting
visitors into the secure area of a branch, putting
staff at risk

A member of staff tells you they are being
constantly criticised by one particular manager.
The manager seems to pick on their work and
does so in front of others - — this is covered by
the Grievance Policy

Disclosure of a personal grievance may count as
a legitimate complaint if it is in the public interest,
for example on the grounds of racial, sexual or
disability discrimination A. staff member
complains that the branch manager has made
racist/discriminatory remarks to other members
of staff and members of the public.

You believe that you are not provided with
training and development opportunities because
of your age or sex — this is covered by the Dignity
at Work Policy

An individual identifies that an invoice from a
company has a company address that is the
home address of a company director or senior
manager, and they do not believe this is being
handled within Post Office Policy.

A manager believes they have been given an
unfair PDR assessment, and they are not happy
with the outcome of discussions with their line
Manager — this is covered by the Grievance
Policy

It is suspected that Post Office is breaching legal
or regulatory requirements and that this is being
covered up - A staff member reported to their
manager that the dates on the fire extinguishers
within the building have expired but still no action
has been taken.

A clerk complains that they feel they are being
bullied by their line manager - this is covered by
the Dignity at Work Policy

A staff member has noticed their line manager
changing the teams SLA results to show better
figures when reporting — This is potential fraud as
this could lead to the Post Office declaring false
figures

You are suspicious of a customer coming in to
purchase substantial amounts of foreign
currency on a regular basis — this is covered in
the Anti Money Laundering and Counter Terrorist
Financing Policy.

If an individual (or entity in the case of a limited company, partnership, or limited liability partnership) is
uncertain about whether something is within the scope of this Policy they or it should seek advice from
the Speak Up team, whose contact details are set out in this Policy. Where reports are made to the
Speak Up team that are not disclosures falling under the team's remit, the reports will be sent to an
appropriate team in POL for consideration or the Reporter will be sign-posted by the Speak Up team to
the appropriate team e.g. a complaint about an end of year performance review will be directed to the
Grievance Policy unless there are PIDA-qualifying characteristics to the report.

1.8. External Disclosures

The aim of this Policy is to provide an internal mechanism for reporting, investigating, and remedying
possible wrongdoing in the workplace and to demonstrate POL’s commitment to listen to the concerns
of Staff. In most cases Speak Up Reporters should not find it necessary to alert anyone externally.

Internal and External

Page 6 of 20

Speak Up Policy v.8 May 2023
UKG100044337
UKGI00044337

However, the law recognises that in some circumstances it may be appropriate for individuals to report
their concerns to an external body such as a regulator. It will rarely, if ever, be appropriate to alert the
media at least without informing POL or an external agency first and usually in that order.

Advice

We strongly encourage Speak Up Reporters to seek advice before reporting a concern to anyone
externally. The independent whistleblowing charity, Protect (formerly Public Concern at Work) have a
list of prescribed regulators for reporting certain types of concerns. Ther contact details are as follows:

Helplint
Website: www.protect-advice.org.uk

Protect operates free, confidential advice to people concerned about crime, danger or wrongdoing in
the workplace. All Protect advisors are legally trained and supervised by qualified lawyers and their
advice is fully confidential and subject to legal privilege. All information, including emails, or records of
telephone calls, letters, or any other form of communication with Protect advisors is stored in a fully
encrypted format.

Advice may also be sought from:

+ the Government (general guidance is available on www.gov.uk/whistleblowing);
+ Trade Unions; and/or
+ Advisory, Conciliation and Arbitration Service (ACAS) (www.acas.org.uk)

+ Advice may be sought which would, among things, assst Speak Up Reporters to verify the position
that a personal grievance is not generally regarded as a protected disclosure.

Disclosures to the FCA or PRA

Post Office Management Services (POMS) is directly regulated by the Financial Conduct Authority
(FCA), and Post Office Limited is an appointed representative of Bank of Ireland (UK) Limited which is
authorised by the Prudential Regulation Authority (PRA). As such individuals may decide to report
concerns directly to the FCA or PRA, and can do so by using one of the following channels.

Body Contact details

FCA's Whistleblowing
Service

Address: Intelligence Department (Ref PIDA), Financial Conduct Authority,
12 Endeavour Square, London, E20 1JN

PRA’s Whistleblowing I Helpline: inne
Service E-mail: whistleblowing!
Website: www.bankofengland.
regulation/whistleblowingand-the-pra

Address: Confidential reporting (whistleblowing) IAWB team, Legal
Directorate, Bank of England, Threadneedle Street, London, EC2R 8AH

Contacting the FCA or the PRA is not conditional on a Speak Up reportfirst being made using POL's
internal arrangements (nor is it necessary for a disclosure to be made to POL in the first instance), and
it is possible to utilise POL’s internal arrangements and contact the FCA or PRA simultaneously or
consecutively.

Speak Up concerns usually relate to the conduct of our staff, but they may sometimes relate to the
actions of a third party, such as a customer, supplier, agent, Postmaster or service provider. In some

Internal and External Page 7 of 20 Speak Up Policy v.8 May 2023
UKG100044337
UKGI00044337

circumstances the law will protect those who Speak Up if they raise the matter with the third party
directly. However, we encourage individuals to report such concerns internally in the first instance.

1.9. Protecting the Speak Up Reporter (Your Legal Rights)

POL has a statutory obligation to protect Speak Up Reporters and will endeavour to support anyone
who raises genuine concerns under this Policy from detrimental treatment, even if the concern raised
is unsubstantiated (not proven) after investigation. In respect of a certain class of person (“Staff as
defined under this policy) POL has a statutory obligation not to subject such persons to detriment or to
dismiss them for reporting any wrongdoing via the Speak Up function.

Where a member of Staff is subject to a Post Office settlement agreement, any clauses whin it will not
prevent the member of Staff from Speaking Up. This should in any event be made clear by the terms of
the settlement agreement itself and staff should receive independent advice in relation to those terms
when entering into a settlement agreement.

All concerns raised via the Speak Up channels are treated confidentially. The Speak Up Reporters
details, or any other information where their identity could be deduced, will not be shared outside the
Speak Up process without their permission, unless required for legal purposes.

There is no requirement for the Speak Up Reporter to provide contact information, however, not
providing this information may reduce POL’s ability to undertake a thorough investigation into the
concerns raised. Please note that making a disclosure anonymously means it can be more difficult for
an Employee or Staff member to be provided with protections under the PIDA legislation, as there would
be no link between the individual and the disclosure.

POL will take all reasonable steps to ensure that Speak up Reporters who are Employees or Staff do
not suffer any detrimental treatment as a result of raising a genuine concern in an appropriate manner.
The mistreatment of anyone having raised a concern will be viewed as a disciplinary matter. The
detriment could be a direct or indirect act oran act of omission or disciplinary action, dismissal, threats,
or other unfavourable treatment connected with raising a concern.

If anyone who is an Employee or member of Staff believes that they have suffered any such treatment,
they should inform the Speak Up Manager immediately, so that support can be provided, which may
include working with the People Team to put appropriate remedial measures in place and the matter
investigated.

1.10. The Speak Up Champion and Management of Reports

POL has appointed an independent Non-Executive Director as Speak Up Champion (the NED).

The Speak Up Champion acts as a point of assurance for the integrity, objectivity, independence,
effectiveness, and evolution of the Speak Up function in adherence with the Group Speak Up Policy and
associated procedures.

The Speak Up Champion oversees that:

+ A positive speak up culture is proactively encouraged throughout POL

+ The current arrangements are challenged and assessed for areas of continuous improvement
and best practice

+ Reporters are always supported and protected when raising a concern

+ Barriers to speaking up are uncovered and addressed

+ The Speak Up team, senior managers and leaders receive training on the importance of Speak
Up Reporter support

+ Root cause analysis is undertaken for all cases and issues, so that continual improvements can
be made in the relevant areas

Internal and External Page 8 of 20 Speak Up Policy v.8 May 2023
UKG100044337
UKGI00044337

The Speak Up Champion will also be an additional point of escalation for feedback or concerns raised
about the Speak Up function from other parts of the organisation.

The Head of the Central Investigations Unit has oversight of the Speak Up Team.

The Speak Up Manager oversees the day-to-day management of Speak Up reports and Speak Up
Team. The Speak Up Manager is also responsible for ensuring that reports are investigated and
responded to in a timely manner. They determine the appropriate parties who should investigate the
allegations raised, considering the sensitivities and seriousness of the report.

The Speak Up Manager is also responsible for identifying key trends orissues and providing assurance
to the Board that the Policy is complied with.

1.11. Responding to Speak Up Reports

In all instances any Speak Up reports, regardless of reporting method, will be responded to within 5
working days.

All reports will be fully reviewed and investigated and any information, including emails, or records of
telephone calls, letters, or any other form of communication will be stored securely and confidentially.

Any investigations will be carried out in accordance with the Group Investigations Policy and
Investigators Manual, which set out the operating standards, guidance and conduct of internal
investigations throughout POL.

The time frame for investigating the reports raised is dependent on the nature of the report and the
investigation required. The Speak Up Reporter will be given feedback via the reporting channel they
have used or have given the Speak Up Manager permission to use (Speak Up line, e-mail or phone
call) during the course of the investigation and once it has been concluded. The frequency of up-dates
will be agreed with the Reporter at the start of the investigation.

Where an anonymous report is received, Speak Up Reporters will not ordinarily be able to receive
feedback and details of action taken by POL may be limited. However, feedback in this instance could
be sought through a telephone appointment or by using an anonymised email address.

1.12. Other Contact Details

Other contact details

Grapevine:

24/7 Security Support Centre provided by Kings Ltd. Grapevine provide security advice and record all
security incidents across the business, this includes burglaries, robberies and the reporting of
suspicious activity.

* Telephone Numbe:
+ E-mail: grapevine.admit

BSC:
Branch Support Centre (BSC) is a helpline and the first port of call for Post Office branches if they have
any operational query or require assistance.

* Telephone Numbe:
+ E-mail:nbscenquiries GRO. i

Internal and External Page 9 of 20 Speak Up Policy v.8 May 2023
UKG100044337
UKGI00044337

Customer Support Team:

Complaints handling team based in Chesterfield. The team address complaints reported into Post Office
via various channels, including post and telephone.

i: ustomercare; ‘GRO. ~ ~

Executive Correspondence Team:

This team handles all complaints addressed directly to the Group Executives. The team liaise with
various stakeholders within the business in order to resolve complaints.

+ E-mail: flagcaseadvisof# GRO

Internal and External Page 10 of 20 Speak Up Policy v.8 May 2023
UKG100044337
UKGI00044337

2. Risk Appetite and Minimum Control Standards

2.1. Risk Appetite

Risk Appetite is the extent to which the POL will accept that a risk might happen in pursuit ofday-to-day
businesses transactions. It therefore defines the boundaries of activity and levels of exposure that the
Group are willing and able to tolerate.

POL has a five-scale approach to risk appetite, Averse, Cautious, Neutral, Flexible and Open.

The Group takes its legal and regulatory responsibilities seriously and consequently has":

+  Anaverse appetite to being non-compliant with our Statutory & Regulatory requirements.
The Group acknowledges however that in certain scenarios even after extensive controls have been

implemented an action may still sit outside the agreed Risk Appetite.

2.2. Policy Framework

POL has established a suite of policies and procedures, on a risk sensitive approach which are subject
to an annual review. The policy suite is designed to comply with applicable legislation and regulation.
The Speak Up Policy should be considered and read in conjunction with other policies where relevant.
These may include the Group Investigations Policy, the Financial Crime Policy, the AntiBribery &
Corruption Policy, Health & Safety Policies and HR Policies where relevant.

‘ The Risk appetite was agreed by the ARC Ma y 2023

Internal and External Page 11 of 20 Speak Up Policy v.8 May 2023
2.3. Minimum Control Standards

UKGI00044337
UKG100044337

A minimum control standard is an activity which must be in place in order to manage the risks, so they remain within the defined Risk Appetite statements.
There must be mechanisms in place within each impacted business unit to demonstrate compliance. The minimum control standards can cover a range of
control types, i.e. directive, detective, corrective and preventive which are required to ensure risks are managed to an acceptable level and within the defined

Risk Appetite.

The table below sets out the relationships between identified risk and the required minimum control standards in consideration of the stated risk appetite. The

subsequent pages define the terms used in greater detail:

Risk Area Description of Risk Minimum Control Standards Who is responsible When
Receipt and investigation I Failure to meet legal and Directive Control:
of Speak Up reports regulatory requirements Post Office must nominate a Post Office CEO and Board Ongoing
Speak Up Champion to provide must nominate the
governance and oversight, ensuring I Speak Up Champion.
that all reports are fully investigated
and that any appropriate corrective
action is undertaken.
The Speak Up Manager must provide I Head of the Central Annually

a Speak Up report to the RCC and
ARC annually.

Any Speak Up concerns must be
promptly escalated to the GLD, GGC
and the Speak Up Champion.

Preventative Control:
All Employees and Staff are trained,
and the Policy is available to them

Investigations Unit is
responsible for providing
report.

Head of Central Investigations
Unit

Training must be
provided at least
annually and
within 30 days of
joining Post Office

Internal and External

Page 12 of 20

Speak Up Policy v.8 May 2023
UKGI00044337
UKG100044337

Risk Area

Description of Risk

Minimum Control Standards

Who is responsible

When

The Speak Up Manager must ensure
that appropriate arrangements are in
place to ensure that Speak Up
reports are addressed promptly
including during absences.

Communications and awareness
provided to all Employees and Staff.

Corrective Control

The Speak Up Manager must
escalate Speak Up reports to the
appropriate Integrity Investigator for
investigation to take place.

The nominated Integrity Investigator
is responsible for conducting the
investigation must report the findings
back to the Speak Up Manager.

Speak Up Manager

Speak Up Manager

Speak Up Manager

Integrity Investigator

Ongoing

Ongoing

Ongoing

Ongoing

Internal and External

Page 13 of 20

Speak Up Policy v.8 May 2023
UKGI00044337
UKG100044337

Breach of confidentiality

Failure to ensure confidentiality

Preventative Control:

for the Speak up Reporter Speak Up Policy is robust and up to Speak Up Manager Ongoing
date.
Confidential Speak Up line reports / Speak up Manager is Ongoing
are shared only with the Speak Up responsible for ensuring that
Manager and nominated deputies reports are shared with the

appropriate persons.
Speak Up email inbox access is Speak Up Manager
restricted to the Speak Up Ongoing
Manager and nominated deputies
Risk Area Description of Risk Minimum Control Standards Who is responsible When

Speak Up Manager must put Speak Up Manager Ongoing
arrangement in place to protect the
confidentiality of the Speak Up
Report during investigations
Corrective Control:
All incidents of breaches are Speak Up Manager to escalate I Ongoing

escalated to the Head of the Central
Investigations Unit to review and take
necessary actions.

to the Head of the
Central Investigations Unit.

Internal and External

Page 14 of 20

Speak Up Policy v.8 May 2023
UKGI00044337
UKG100044337

Incorrect handling of An individual may raise a Preventative Control:

Speak Up report Speak Up report with other Training provided to contact teams to I Speak Up Manager Ongoing and
individuals in the Group. Details I identify potential Speak Up reports within 30 days of
may then be shared with various I and ensure these are correctly joining POL
stakeholders before being handled, e.g.:
passed onto the Speak Up + Grapevine,

Manager. + BSC,
+ Customer Support, and
+ Executive Correspondence
Team.
Ongoing
Communications and awareness Speak Up Manager
provided to all Employees and Staff.
Corrective Control: Speak Up Manager to Ongoing
All incidents of breaches are escalate to the Head of the
escalated to the Head of the Central I Central Investigations Unit.
Investigations Unit to investigate and
take appropriate actions.

Insufficient Information Failure to capture/report Directive Control:
sufficient information about the Employees and Staff are encouraged I Speak Up Champion and Ongoing
issue may mean that the to report issues and provide full Speak Up Manager to
underlying issue cannot be information and their contact details, I encourage Employees and
properly investigated and where they feel able to do so. Staff to do so.
resolved

Risk Area Description of Risk Minimum Control Standards Who is responsible When

Corrective Control:

All reports, including those where Speak Up Manager Ongoing
insufficient information has been

provided and no further action was

taken are recorded on the

Speak Up database, which is

reviewed for trends and issues.

Internal and External

Page 15 of 20

Speak Up Policy v.8 May 2023
UKGI00044337
UKG100044337

The ‘Speak Up’ Service

Failure to effectively record
Speak Up reports and pass onto
the Speak Up Manager, due to
factors such as resource or IT
failure.

Preventative Control:

The Speak Up Manager must review
the effectiveness of the service
provided by Convercent at least
annually.

The Speak Up Manager must review
the effectiveness of the processes
operated by Grapevine, BSC,
Customer Support, and The
Executive Complaints Team at least
annually to ensure that Speak Up.
reports are identified and
communicated promptly.

Head of the Central
Investigations Unit to ensure
review takes place.

Head of the Central
Investigations Unit to ensure
review takes place.

Annually

Annually

Treatment of
Speak Up Reporters

Breach of Speak Up guidelines
such that a

Speak up Reporter suffers
prejudice, detriment or dismissal
as a result of making a Speak
Up report

Preventative Control

Training must be provided to all
people managers as part of their
induction process as a manager and
on appointment to POL.

Annual training must be provided to
all POL Employees and Staff to
remind them of the protections
available to Speak Up and the
importance of identifying and
reporting wrongdoing

The Code of Business Standards
must refer to the Speak Up

Speak Up Manager

Speak Up Manager

Speak Up Manager and
People Training Manager

Ongoing

Ongoing

Ongoing

Risk Area

Description of Risk

Minimum Control Standards

Who is responsible

When

policy and must be provided to all
new joiners as part of their induction
programme.

Internal and External

Page 16 of 20

Speak Up Policy v.8 May 2023
UKGI00044337

UKGI00044337

Line managers An Employee or member of Staff I Preventative Control
may not want to make a report Employees and Staff should be made I Speak Up Manager Ongoing
to their line manager in case it aware of the multiple ways to
affects their relationship or disclose a report and also that
where the disclosure involves reports can be anonymous.
the line manager.
Training must be provided to line Speak Up Manager Ongoing
managers as part of their induction
process as a manager and on
appointment to POL regarding the
handling of reports and the
importance of encouraging
Employees and Staff to make reports.
Support available to Speak Up Reporters are not Preventative Control
Speak up Reporters supported throughout the Feedback should be taken from Speak Up Manager Ongoing
process of an investigation Speak Up throughout an investigation
to monitor that they feel supported
and protected by the POL

Internal and External

Page 17 of 20

Speak Up Policy v.8 May 2023
UKG100044337
UKGI00044337

2.4. Governance Responsibilities

As at the date of approval of this Policy, the Group General Counsel is the Policy Sponsor and the
Head of the Central Investigations Unit is the Policy Owner, responsible for oversight of the Policy.

The Audit and Risk Committee are responsible for approving the Policy and overseeing compliance.

The Board is responsible for setting the Group’s risk appetite.

Internal and External Page 18 of 20 Speak Up Policy v.8 May 2023
UKGI00044337
UKG100044337

3. I Document Control

3.1. Document Control Record

SUMMARY
Policy Spor Policy Owner Pe implementer I Policy Approver
Group General Head of the Central Speak Up Manager RCC & ARC

Counsel Investigations Unit

] I I
Document Review I policy — effective date I Policy location
Period

Version I

Policy Hub Intranet

Annually May 2023 Key policies
(sharepoint.com)

REVISION HISTORY

Version Date Changes I Updated by
14 April 2016 Sponsors review and sign-off Jane MacLeod
15 I August2017 Annual Review and update : Vitor Camara
16 September 2017 POL R&CC approval I Thomas Richmond
2.0 September 2017 Final Version Approved "Thomas Richmond
24 June 2018 Annual Review and update Vitor Camara
22 July 2018 POL R&CC approval Sally Smith
23 July 2018 POL ARC approval I Sally Smith
24 September 2018 POMS ARC approval Sally Smith
3.0 September 2018 Final version approved I Vitor Camara
34 June 2019 Annual review and update Sally Smith
32 June 2019 Incorporating legal review comments Sally Smith
33 I July 2019 POL R&CC approval Sally Smith
34 September 2019 I POL ARC approval Sally Smith
4.0 September 2019 Final version approved Sally Smith
44 April 2020 Updated with new Speak Up service Sally Smith

contact details -
42 June 2020 Annual review and update Sally Smith
43 July 2020 POL R&CC approval Sally Smith
5.0 July 2020 Final approval by ARC's Sally Smith
54 March 2021 Amendments following Protect self Sally Smith

assessment and external review by
Herbert Smith Freehills

5.2 March 2021 Amends after Group Director of Sally Smith
Compliance review
53 March 2021 POL R&CC approval Sally Smith

Internal and External Page 19 of 20 Speak Up Policy v.8 May 2023
UKGI00044337
UKGI00044337

54 March 2021 POL ARC approval Sally Smith
6.0 May 2024 POI ARC approval Sally Smith
6.1 July 2021 Amended Speak Up contact details Jenny Brady
6.2 March 2022 Changed responsible people from MRLO Sally Smith

to Head of Central Investigations Unit and
added paragraph following internal audit
recommendations.

6.3 March 2022 Annual approval by RCC Sally Smith
7.0 April 2022 Annual approval by ARC Sally Smith
8.0 April 2023 Annual approval. Updates with new Speak John Bartlett

Up function following External Review by EY

3.2. Oversight Committee: Risk and Compliance Committee / Audit and
Risk Committee

Committee Date Approved
POL R&CC 09/05/23

POL ARC 16/05/23
POMS ARC TBC

Next Policy Annual Review Date:
April 2024

3.3. Company Details
Post Office Limited and Post Office Management Services Limited are registered in England and Wales. Registered numbers 2154540 and
084597 18 respectively. Registered Office: 100 Wood Street, London, EC2V 7AN.

Post Office Management Services Limited is authorised and regulated by the Financial Conduct Authority (FCA), FRN 630318. Its Information
‘Commissioners Office registration number is ZA090585.

Post Office Limited is authorised and regulated by Her Majesty's Revenue and Customs (HMRC), REF 12137104. Its information Commissioners
Office registration number is 24866081

Payzone Bill Payment Limited is a limited company registered in England and Wales under company number: 11310918
VAT registration number GB 172 6705 02. Registered office: 100 Wood Street, London, EC2V 7AN.

Internal and External Page 20 of 20 Speak Up Policy v.8 May 2023