WITNO6900200
WITN06900200
Witness Name: Anthony Nicholas Stewart
MARSH
(Tony Marsh)
Statement No.: WITN06900200
Dated: 14" October 2024
POST OFFICE HORIZON ENQUIRY
SECOND WITNESS STATEMENT OF TONY MARSH
1, TONY MARSH will say as follows.
1. This witness statement is made to assist the Post Office Horizon IT Inquiry (the
‘Inquiry’) with the matters set out in the Rule 9 Request dated 29'" August 2024
(the ‘Second Request’).
2. lama former employee of The Post Office, Post Office Ltd and Royal Mail
Group. Full details of my employment with The Post Office/Royal Mail Group
are provided in my first witness statement dated 27" April 2023
(WITN06900100), at paragraphs 2 to 4. Of particular relevance to this
statement however is the fact that I was employed from September 1999 (I
believe 27°" September) to 318 December 2006 as the Head of Security for
Post Office Network and, following the restructuring of Post Office Network and
Network Banking into Post Office Ltd, for the whole of Post Office Ltd.
Page 1 of 17
WITNO6900200
WITN06900200
However, from the beginning of July 2004 until April 2005 I was seconded from
my role as Head of Security to lead the Service Team on the Sales & Service
Improvement Programme. This was a very demanding task and during this ten-
month time period I believe that the National Internal Crime & Investigation
Team, under Tony Utting, and the Network Audit Team, under Martin Ferlinc,
were both transferred into the reporting line of Rod Ismay, Head of Compliance,
who sat within the Finance Directorate reporting line. The Audit Team did not
return under my control after this. The National Internal Crime & Investigation
Team did, but I believe that return occurred significantly after April 2005, and
may actually have happened shortly before and in preparation for my departure
in December 2006 and my handover to my successor, John Scott.
I have been asked to set out my knowledge and understanding of the
following matters when I was appointed as Head of Security in September
1999.
a. the Horizon IT system, including its integrity and remote access. I can
say that at the time that I was appointed as Head of Security, coming to Post
Office Network from the Post Office Group Centre, an entirely different
business unit, I knew nothing whatsoever about the Horizon IT system, its
integrity or remote access.
b. complaints made by SPMs as to the integrity of the Horizon IT system.
Again, I can say that I knew nothing whatsoever at that point about complaints
made by SPMs regarding any facet of the Horizon IT system.
c. that Royal Mail Group, or companies within it, had investigated,
prosecuted, and obtained convictions of SPMs for theft, fraud and false
Page 2 of 17
WITNO6900200
WITN06900200
accounting. I was wholly and entirely aware of this fact. As I note in my first
statement at paragraphs 2 and 3, I joined the Post Office Investigation
Department (POID) in September 1985. From then until my promotion to
Regional Manager in 1994, with various gaps when I was only involved in
Royal Mail inquiries, I personally investigated, interviewed and managed the
prosecutions of a number of sub-postmasters or sub-post office staff. I think it
also important to note that when I was in training as an Investigation Officer,
between September 1985 and September 1986, on a number of occasions my
training officers, who were Senior Investigators with many years’ experience in
the POID, would use as examples cases of sub-postmasters that they had
themselves investigated who had then been prosecuted, some of which dated
back as far as the late 1960s. Although I had no responsibility for Post Office
Counters Ltd cases between 1996 and September 1999 I remained aware of
the ongoing principles of investigation and prosecution of cases within that
business, which I joined as Head of Security for Post Office Network in
September 1999.
d. who within the Royal Mail Group or POL was responsible for (a) the
investigation of those alleged offences (b) the decision on whether to
prosecute those matters, and (c) the conduct of those prosecutions. From
1999 onwards the investigation and prosecution of sub-postmasters would all
have been dealt with within Post Office Network/Post Office Ltd. In terms of (a),
the person directly responsible for the investigation of any alleged offence
would be the PON/POL investigator to whom the case was allocated, after
initial review by an independent casework manager within the relevant
Page 3 of 17
WITNO6900200
WITN06900200
Regional Security & Investigation team, and after the initial restructuring of the
Security Team at some point in 2000/01, by an independent casework manager
within the POL National Internal Crime & Investigation Team. Above the
investigator there would be a line of responsible supervisors leading ultimately
to myself as Head of Security (& Investigations) for PON/POL. The policy of
investigating and, where appropriate, prosecuting those suspected of offending
against Post Office Group/Royal Mail Group and its constituent companies was
detailed in various iterations of the Royal Mail Group Ltd Criminal Investigation
and Prosecution Policy, some of which I have referred to and addressed in my
first witness statement at paragraphs 14 and 15. At a Royal Mail Group level
these policy documents would have been owned by the RMG Group Security
Director as a devolved power from the Board. I am unable to say, after 2006,
how mirror policies would have been owned within POL. In terms of (b), once
an investigator believed that sufficient evidence had been identified and
gathered and that the threshold for prosecution for one or more offences had
been passed, the case would be submitted with a suitable suspect offender
report. The case would be reviewed by an independent casework manager
and, provided that person concurred that there was sufficient evidence to
warrant submitting the case for an opinion from Royal Mail Group’s prosecuting
lawyers, the case would be submitted to specialist prosecution lawyers who
would have applied the Code for Crown Prosecutors Full Code Test. If the case
was considered to have passed the Full Code Test then it would be sent, with
appropriate advice, either directly by the lawyer or via the casework
management team to the relevant PON/POL decision maker, who would
usually be either in the suspect offender's management line or in the business
Page 4 of 17
WITNO6900200
WITN06900200
unit Human Resources team, where the actual decision to authorise
prosecution would be made. The conduct of prosecutions (c) would be guided
by the prosecuting lawyer with any necessary actions usually delivered by the
investigator. No significant action would have been taken by the investigator
without instruction and authority from the RMG prosecuting lawyer or, in crown
court cases, the instructed barrister.
I have been asked to describe if and when my knowledge of those matters
materially changed or developed at the appropriate point in the witness
statement, maintaining chronological order. Although I will do so I will note
at this point that my knowledge of the Horizon IT system, its integrity and
remote access did not change or increase significantly during my time as Head
of Security for POL. I learned how to use the system at a basic user level to
enable me to provide counter support at Christmas, as all senior managers
were expected to do, but I did not need to develop a deeper technical
understanding of the system to perform my role and therefore did not do so.
I have been asked to set out to what extent I was involved in responding to
concerns or allegations made by SPMs that the Horizon IT system was
defective. I can say that I was not involved in responding to concerns or
allegations made by SPMs that the Horizon System was defective. The issue of
the reference to the Horizon System Helpdesk in various iterations of the
Liability for Losses Policy, which I owned during the period of time that the
Network Audit Team reported to me, and the findings by both the Court of
Appeal and the Horizon IT Inquiry that Horizon was afflicted by bugs, was
Page 5 of 17
WITNO6900200
WITN06900200
raised during my oral evidence to the inquiry on 5" July 2023. Details can be
seen of the questions that I was asked and answers that I gave on this matter
at pages 129 to 150 of the transcript of my evidence INQ00001068. I have
nothing further or new to add.
I have then been asked to what extent, if at all, I was concerned by the
nature or frequency of allegations made by SPMs that the Horizon IT
System was defective, and who, if anyone, I shared my concerns with? I
can say that I had no awareness at any time whilst employed within Post Office
Ltd of a concerning or high level of complaints or allegations of issues or
defects made by anybody, including sub-postmasters, against the Horizon IT
System. Consequently I had no such concerns to share.
I have been asked to consider document POL00439186, which was sent to
me by email on 02/02/2002. I have been asked to summarise my
understanding of the meaning of the statement at point (iv) that “there
were gaps in the approach to risk management during the implementation
of the Horizon system, and to explain what risks I was aware of
concerning the Horizon system and its implementation. I can say that I
have no recollection of this document and that it is not clear to me from the
question whether I was sent this short extract from the Post Implementation
Review or the whole review, which would have been a much larger document.
Without the accompanying email I cannot see on what basis I may have been
sent the document. I was not aware of any particular or specific risks in the
implementation of Horizon, in the main because I had absolutely no
Page 6 of 17
WITNO6900200
WITN06900200
responsibility for any part of the implementation of Horizon. In terms of the
statement that “there were gaps in the approach to risk management... etc.” as
I was not at all involved in the Horizon Programme I really cannot provide any
clarification of this statement without access to the Horizon Programme Risk
Management process and the risk list, analysis and mitigations that would have
been maintained under the process.
I have been asked to consider POL00021483, minutes of a POL Board
Meeting held on 20 August 2003, during which I reported to the Board on
matters of security. I am asked a. how often I reported to the Board on
issues of security, b. how often a member of my team reported to the
Board on issues of security and, c. the nature of the relationship between
the Security team and the Board. I can say (a) that I reported extremely
infrequently to the Board of POL in person on issues of security. I believe that
both of my first two supervisors in PON/POL, Alan Barrie, Operations Director
and David Miller, Chief Operating Officer, were members of the Board, and
consequently I would tend to report to them formally on progress, which was
generally positive, or occasionally on a specific issue, more often to do with
security of people and cash or stock than investigations and prosecutions. I
believe that they would then brief the Board as required. I’m not sure whether
my subsequent supervisor, Byron Roberts, was a Board member, I believe he
may have reported up via David Miller himself. I do not believe (b) that a
member of my team ever reported to the Board in my place, on the rare
occasions that a report to the Board was called for I am sure that I would have
delivered it. The nature of the relationship (c) between the Security team and
Page 7 of 17
10.
11.
WITNO6900200
WITN06900200
the Board was, I believe, positive. I would have expected to have been called in
far more frequently had it not been. It is worth noting that I believe that I
attended on 20" August 2003 to present this paper because I was asking for
significant up-front funding to enable two changes in physical security strategy,
partly to change the nature and manner in which we installed and managed
alarm systems to ensure more effective police call-outs to robberies and
burglaries, and partly to support a radical change in security equipment, away
from screens and towards open-plan environments with technical protection of
staff, cash and assets. This was a very specialised proposition to which David
Miller did not feel he could do justice, so I attended both to present the proposal
and to deal with the inevitable questions.
I have been asked to what extent, if at all, the Board discussed the
prosecution of SPMs for theft or false accounting arising from alleged
shortfalls in branch accounts at this or other meetings that I attended. As
I have said above, I attended very few Board meetings within POL, but I cannot
ever recollect the issue of the prosecution of SPMs coming up at any meeting
at which I was present. Consequently, at no point did I ever witness the Board
considering the reliability of Horizon IT data for the use in prosecutions,
of SPMs or anyone else.
I have been asked to consider the following documents:
(a) WITN09020115 “The Expert Report of Jason Coyne”.
(b) POL00142503 “Email from R Ismay to D Parker, M Talbot and others;
‘Legal case — Cleveleys PO 153 405 Mrs J Wolstenholme”.
Page 8 of 17
12.
13.
WITNO6900200
WITN06900200
(c) POL00142504 “Advice on Evidence and Quantum by S A Brochwicz-
Lewinski in POCL v Julie Wolstenholme, Case No. CR101947”, and
(d) POL00118219 “Trial Bundle B: Witnes Statement and Joint Expert’s
Report Blackpool County Court POL v Julie Wolstenholme CR101947”.
I have been asked to describe the nature and extent of my knowledge and
involvement in the Cleveleys case (POL v Wolstenholme). I can say that I
believe that I had absolutely no knowledge of nor involvement in this case
whatsoever. The case appears to be a civil action that resulted from a dispute
over losses and disciplinary matters relating to the manner of operating a sub-
post office. None of these issues had any security relevance and the matter
does not appear to have had any criminal investigator involvement, so I do not
believe any member of my team would have been involved in the early stages
of the case either.
I have been asked to consider Mr Coyne’s report WITN09020115. In
particular I have been asked when I first read the report, what my view is on
the report, and to provide details of any discussions that I have had about
the report with any other individuals at the Post Office. I believe that this is
the first time that I have seen or read this report, although I have seen
references to it in earlier Inquiry evidence that I have seen. To the best of my
knowledge I had no involvement in the Cleveleys case at the time that I worked
in Post Office Ltd and I do not recollect seeing the report then or since. I have
never discussed the report with any other individual at the Post Office and I
hold no particular views on the report now, at 20 years remove from its drafting.
Page 9 of 17
14.
15.
WITNO6900200
WITN06900200
I have been asked to consider POL00142503 “Email from R Ismay to D
Parker, M Talbot and others; ‘Legal case — Cleveleys PO 153 405 Mrs J
Wolstenholme”. I have been asked to provide a context for the email chain.
I'm afraid I can provide no further context for the email than the context evident
from reading it from bottom to top, in particular the detailed context provided by
Jim Cruise on 17/03/2004. I have been asked to describe my knowledge of
the IT risk register. I have no particular knowledge of the IT risk register for
POL for 2004, and I have difficulty understanding its relevance in the context of
this email. I have been asked what my understanding was of the reason(s)
why Mrs Wolstenholme’s case was on the IT risk register. I have no
information that would enable me to answer that question. I have also been
asked who had access to the IT risk register. Again, I do not know but would
expect that it was predominantly senior members of the IT Directorate.
I have been asked to consider the advice of Stefan Brochwicz-Lewinski,
forwarded to me on 26 July 2004 POL00142504. I have been asked who
instructed counsel to provide this advice, I do not know and have no details
to add. I have been asked to comment on Mr Brochwicz-Lewinski’s
statement that “[he was] asked to take into particular account that the
Post Office is anxious for the negative computer expert’s report to be
given as little publicity as possible”, and whether I shared that anxiety. To
the best of my knowledge I had not seen POL00142504 Advice of Mr
Brochwicz-Lewinski until I received it with the Rule 9 request to which I am
responding. I did not therefore share any anxiety regarding the potential impact
Page 10 of 17
16.
WITNO6900200
WITN06900200
of publicity around the computer expert’s report. I am asked what my view
was of the advice when I received it. I do not believe that I opened, looked at
or read the advice at the time that it was sent in 2004 and do not feel that there
is any relevance to my views at 20 years remove. I have been asked whether I
discussed the advice with anyone. To the best of my knowledge I did not at
the time that it was sent nor have I since.
I have been asked “Following receipt of the advice, please provide details
of any discussions you had with David Miller regarding (a) the issues in
the Wolstenholme case and (b) POL’s next steps in relation to the same.
Please provide a detailed account of (a) what you told Mr Miller and (b)
whether you showed him any documentation relevant to the
Wolstenholme case.” The email that appears to have prompted all the
questions relating to the Cleveleys civil action is dated 26/07/2004. As I note in
my introduction to this statement at paragraph 2, from the beginning of July
2004 I was seconded from my regular duties to lead the Service Team on the
Sales and Service Improvement Programme. I believe that as part of “clearing
the decks” for this commitment, line management of the Network Audit Team
under Martin Ferlinc and line management of the Internal Crime and
Investigations Team under Tony Utting were both transferred to Rod Ismay,
Head of Compliance. If this did not occur right at the beginning of the
Programme I firmly believe that it took place very soon after it started. I retained
arms-length responsibility for security matters, having ensured that all critical
issues were on target and that experienced staff were aware of requirements
for the following six to nine months. The Programme involved a very
Page 11 of 17
17.
WITNO6900200
WITN06900200
demanding round of interviews with senior and junior staff, analysis of data and
development of structural options. Consequently, from the start of the
Programme I paid no further attention to day-to-day issues, unless they were
specifically raised with me by one of my remaining direct reports or a director. I
cannot say exactly how I would have responded to this email, but I consider it
highly unlikely that I would have read through it in detail. I believe that I would
either have responded briefly to Rod Ismay, pointing out that my team were not
likely to be involved, or I might have forwarded it to Tony Utting, whether he
was reporting to me or to Rod Ismay at that point in time, asking him to deal
with it. Clearly if any further documentation is available that might counter these
assumptions I will not challenge it, but I asked in writing on 7" September 2024
if any additional documents exist and was informed in writing on 11°
September by a member of the Inquiry legal team that “We believe we have
provided you with sufficient documents to prepare your draft statement.”
lam aware, from watching both the YouTube recording and then reading the
transcript INQ00001130, that on 16" April 2024 during his oral evidence to the
Inquiry David Miller was asked about the Cleveleys civil proceedings. Pages 51
to 74 of the transcript refer. On pages 36, 37 and 38 of the transcript however,
prior to discussions about the Cleveleys case, Mr Miller had acknowledged that
there was some confusion in his mind between Tony Utting and myself, he
noted that he recollected that Tony had a reporting line through the Finance
function, which he did whilst reporting to Rod Ismay, but not whilst reporting to
me. At page 52 of the transcript of Mr Miller’s evidence a portion of his
Page 12 of 17
18.
WITNO6900200
WITN06900200
statement is read to him, together with a further question that provides details
of the relevant document.
“My first formal involvement with the case was that I was asked to sign
off the compensation payment to Ms Wolstenholme in 2004, in the
absence of Peter Corbett, who was on holiday. Rod Ismay's note to Donna
Parker (my PA at the time) secured a slot in my diary for Tony Marsh"?
Rod Ismay's note, to which you refer here, is at POL00142503. Could we
have that on screen, please. This is the email from Rod Ismay, dated 26
July 2004.
Subsequent to this exchange there is then considerable discussion between Mr
Miller and Counsel to the Inquiry Ms Price regarding a meeting and discussions
alleged to have taken place between Mr Miller and myself.
Since seeing the YouTube recording, reading the transcript and again since
receipt of the Rule 9 request I have racked my brain for any recollection of this
meeting, the details referred to by Mr Miller, or indeed the documents referred
to, in particular the “Expert Report of Jason Coyne”. I have none. As I note, if I
am presented with evidence that the meeting took place with me present then I
would not challenge it, but I have absolutely no recollection of it, its subject
matter or documentation. I believe it is much more likely, and logical given the
date and circumstances, that the meeting actually took place between Mr Miller
and Tony Utting, particularly given that I believe that Tony Utting was at that
point of time in Mr Ismay’s reporting line rather than my own.
Page 13 of 17
19.
20.
21.
WITNO6900200
WITN06900200
Further to this, I have been asked to please describe my recollection of the
settlement offered to and accepted by Mrs Wolstenholme? I have no
recollection of, nor of any involvement with, the settlement offered to Mrs
Wolstenholme.
I have been asked to describe the impact of the Cleveleys case on future
POL proceedings (including civil/contract claims and criminal
prosecutions), including but not limited to the case of Lee Castleton? I
have no knowledge of any impact of this, or other cases relevant to the Horizon
IT inquiry, on future POL proceedings, whether civil, contract or criminal.
Finally, I have been asked to what extent, if at all, did you reflect on POL’s
conduct in pursuing shortfalls and/or prosecuting SPMs following the
Cleveleys litigation at the time? With the benefit of hindsight, what are
your reflections? As I have explained above, I do not believe that I had the
level of knowledge that the Inquiry considers that I did of the Cleveleys case, or
indeed any knowledge of it at all at the time that it was taking place. In addition,
at this time I do not believe that I held responsibility for investigations or
prosecutions taking place within POL, due to the transfer of Tony Utting and the
Investigation team to Rod Ismay, nor for policy on losses (shortfalls) due to the
transfer of Martin Ferlinc and the audit team the same way. As I have also
explained earlier in this statement, from July 2004 onward I was leading ona
very stretching structural review within POL Operations, which also led to me
subsequently taking on considerable additional responsibilities for branch
equipment and special projects — the programme of conversion of Crown
Page 14 of 17
WITNO6900200
WITN06900200
Offices to Modified Sub-Post Offices. I do not believe therefore that I had any
reflections on POL’s approach to losses, investigations or prosecutions at that
time. I do not feel it would assist the Inquiry for me to express views now with
the use of hindsight.
22. There are no other matters that I wish to bring to the attention of the Chair of
the Inquiry at this time.
Statement of Truth
I believe the content of this statement to be true
Signed
Dated 14" October 2024
Page 15 of 17
WITNO6900200
WITN06900200
Index to Second Witness Statement of Tony Marsh
No.
URN
Document Description
Control Number
POLO0439186
Post Implementation Review Board -
Horizon Implementation - Extract -
Note
POL-BSFF-096-0001113
POLO0021483
Post Office Limited Board Minutes of
20/08/03
POLO000016
WITNO9020115
Jason Coyne Expert Opinion 21.04.04
and associated documents
WITNO9020115
POLO0142503
Email from R Ismay to D Parker, M
Talbot and others; 'Legal case -
Cleveleys PO 153 405 Mrs J
Wolstenholm'
POL-BSFF-0001779
POLO0142504
Advice on Evidence and Quantum by
S.A Brochwicz-Lewinski in POCL v Julie
Wolstenholme, Case No. CR101947
POL-BSFF-0001780
POLO0118219
Trial Bundle B: Witness Statement and
Joint Expert's Report Blackpool
County Court POL v Julie
Wolstenholme CR101947
POL-0120139
INQ00001068
Transcript (05/07/2023): Post Office
Horizon IT Inquiry - Tony Marsh
[WITNO690]
INQ00001068
Page 16 of 17
WITNO6900200
WITN06900200
No.
URN
Document Description
Control Number
INQ00001130
Transcript (16/04/2024): Post Office
Horizon IT Inquiry - David Miller
[WITNO347] and David Mills
[WITN1095]
INQ00001130
Page 17 of 17