WITNO6650500
WITNO6650500
Witness Name: William Paul Patterson (on behalf of Fujitsu Services Limited)
Statement No.: WITN06650500
Dated: 23 September 2024
POST OFFICE HORIZON IT INQUIRY
FIFTH CORPORATE STATEMENT OF FUJITSU SERVICES LIMITED
I, MR WILLIAM PAUL PATTERSON (known as Paul Patterson), will say as follows:
INTRODUCTION
1. I am a director of Fujitsu Services Limited (“Fujitsu”) and am duly authorised
to make this statement on its behalf. I make this statement in response to the
Inquiry’s Rule 9 Request, dated 1 August 2024, for a corporate statement
addressing issues relevant to Phase 7 of the Inquiry (the “Request”). In
particular, the Request relates to changes to Fujitsu policies, processes and
practices that have occurred as a result of concerns raised by Lord Justice
Fraser (as he is now known) in the Bates & Ors v Post Office Limited (“POL”)
Group Litigation (the “Group Litigation”), the Court of Appeal’s overturning of
criminal convictions, or arising from evidence heard by the Inquiry (the
“Concerns’).
2. This is Fujitsu’s Fifth Corporate Statement in the Inquiry. Fujitsu’s previous
corporate statements are dated 28 September 2022, 29 December 2022, 14
Page 1 of 37
WITNO6650500
WITNO6650500
September 2023 and 8 August 2024 (collectively the “Previous Corporate
Statements”, individually the ‘“First/Second/Third/Fourth Corporate
Statement’, respectively). Whilst I have oversight of the changes and
programmes described in this Fifth Corporate Statement, I do not necessarily
have detailed knowledge of all the matters set out in this statement. For this
reason, I wish to reiterate at the outset how the information in this statement
has been compiled. This Fifth Corporate Statement has been prepared using
documentary sources and discussions with relevant colleagues within Fujitsu.
For the purposes of preparing this statement, I have been assisted by a team
of individuals within Fujitsu and Morrison Foerster. This team has provided me
with the documents which are referenced in this statement and exhibited in
accordance with the index at the back of this statement.
As is made clear throughout this statement, Fujitsu’s work to change and
improve its business practices and culture is ongoing. With the development
and introduction of new technologies in both new and evolving industries,
Fujitsu continues to need to learn lessons and apply them to its future practices.
Specifically, Fujitsu recognises that its change and remediation initiatives do
not come to an end with the conclusion of this Inquiry, that current initiatives
must embed and be tested, that there will be ongoing business change with
new actions anticipated, and that there is still much work to be done.
Fujitsu notes that not all of the changes outlined in this statement have been
prompted by the Concerns described in the Request. A number of the practices
set out in this statement have occurred as Fujitsu’s business has changed and
Page 2 of 37
WITNO6650500
WITNO6650500
evolved over time. Some of these practices have been prompted by, (i) the
global strategic direction and leadership of the Fujitsu Group (as defined in
paragraph 7 below), (ii) industry change, (iii) customer demands and changing
customer expectations (such demands and expectations not being limited only
to POL), (iv) legislative or regulatory changes, (v) changing risk landscapes
resulting from advancements in technology, and (vi) the Fujitsu Group’s
ambition to be a Global Responsible business. In this statement, Fujitsu has
sought to make clear those changes and practices that have been prompted by
the Concerns.
In light of this context, this statement contains three broad sections:
5.1 Fujitsu Today: This section provides a high-level description of the
structure of Fujitsu today. This includes detail relating to Fujitsu’s (i)
global delivery and assurance framework, (ii) processes and procedures
relating to raising concerns and whistleblowing, and (iii) current reporting
lines and leadership structure. The majority of the structures and
processes described in this section of the statement have changed and
evolved over time and have not been prompted by the Concerns. The
content of this section nevertheless provides context regarding how
Fujitsu’s business operates today and, as a result, how certain of the
Concerns would be identified and mitigated should they arise again.
5.2 Fujitsu’s Response to the Concerns: This section describes the steps
that Fujitsu has taken as a result of the Concerns, including steps taken
to, (i) make targeted cultural changes across Fujitsu’s business, (ii) make
Page 3 of 37
WITNO6650500
WITNO6650500
operational changes both within the Post Office Account and across its
business, and (iii) cease supporting POL to pursue enforcement action
against postmasters and other post office workers using Horizon data
and witnesses from Fujitsu.
5.3 Fujitsu’s Ongoing Work and Next Steps: This section acknowledges that
Fujitsu’s remediation work is ongoing and provides a high-level
description of the work still being undertaken.
6. In this statement, references to “Horizon” or the “Horizon system” are to the
version of the Horizon IT System currently installed across the POL network,
unless otherwise stated.
FUJITSU TODAY — FUJITSU AS A GLOBAL BUSINESS
7. Fujitsu is part of a global business, operating in over 35 countries across Japan,
Europe, Asia Pacific and the Americas, employing more than 120,000
individuals worldwide‘ (the “Fujitsu Group”). The Fujitsu Group seeks to
operate as a global business, including in the areas of oversight and standards.
8. In order to achieve this, the Fujitsu Group uses global business standards.
These global business standards provide a common set of guidelines across
the Fujitsu Group and which are implemented regionally so that its business
operations follow national requirements, appropriate industry standards, and
reflect the common global values and behaviours of the Fujitsu Group (as
described in more detail at paragraphs 14 to 26 below).
1 As of 31 March 2024
Page 4 of 37
10.
11.
WITNO6650500
WITNO6650500
In this regard, Fujitsu Group entities operating in Europe (“Fujitsu Europe”)
have implemented the European Business Management System (“EBMS’),
which is then managed at a country level (including by Fujitsu in the UK). In
relation to the Post Office Account, the EBMS was introduced after the
implementation of Horizon. Fujitsu service lines and functions that provide or
support the delivery of services to POL do so in accordance with the EBMS.
This is complemented with local/specific standards/requirements, procedures
and work instructions relevant to the Post Office Account. Work continues to
ensure full and ongoing alignment of processes and procedures, including
where there are agreed exceptions to POL or to Fujitsu or both.
The EBMS consists of policies, processes and guidance, which are designed
to ensure that Fujitsu Europe’s business complies with relevant legislation,
regulations and international and industry standards. Demonstrating adherence
to the EBMS is necessary for Fujitsu Europe to hold and maintain certifications
and registrations to the standards required by Fujitsu Europe’s customers. The
EBMS is managed by Fujitsu Europe’s governance and assurance teams, with
internal and external audits conducted to ensure the EBMS maintains
compliance and upholds Fujitsu Europe’s certifications and registrations.
Key documents within the EBMS include ‘master policies’, which are
statements of principles by Fujitsu Europe’s management that set the intention
and direction of the organisation cross regionally and in-country. By way of
example, these master policies cover compliance, procurement, project and
program management, account management, security, design and quality.
Page 5 of 37
WITNO6650500
WITNO6650500
12. Adherence to all master policies is compulsory and knowledge of them is driven
by online training courses undertaken by employees as part of their induction
and available annually thereafter. Adherence is tested by a system of internal
quality management, operated by the internal audit teams, based in the UK and
Europe. Where non-conformities are identified (either by internal audit or
through external audits undertaken), corrective action plans are formulated and
deployed with the assistance of the policy and process owner.
13. The EBMS also aligns with the Customer Solution Lifecycle (“CSLC”). The
CSLC is a framework used in Fujitsu Europe that defines and controls the
attainment and delivery of business in a standardised way.”
CULTURE AND THE FUJITSU WAY
14. As a result of the Concerns, Fujitsu accepts that there have been failures to
meet the standards expected. It is for this reason that Fujitsu is committed on
an ongoing basis to revisit, test and strengthen its culture, and continue to
implement business-wide cultural changes.
15. — In this section, Fujitsu provides some background as to, (i) the Fujitsu Way, (ii)
processes and procedures relating to raising concerns and whistleblowing, and
(iii) its Current reporting and governance structure. The changes that have
resulted in the processes and structures outlined in this section were not
prompted by the Concerns and are instead changes that have been made over
time.
2 FUJ00243269
Page 6 of 37
WITNO6650500
WITNO6650500
16. The actions that Fujitsu has taken in response to the Concerns are set out in
paragraphs 27 to 71 below.
The Fujitsu Way
17. The ‘Fujitsu Way’ was first introduced in 2002 as a basic set of principles for
anyone working in the Fujitsu Group globally to work towards. Most recently in
2020, the Fujitsu Way was updated to define the Fujitsu Group's global
purpose, values and code of conduct.
18. The Fujitsu Way now in place comprises three parts:
18.1 Purpose: “Our purpose is to make the world more sustainable by building
trust in society through innovation.”>
18.2 Values: In order to realise the purpose outlined above, Fujitsu applies a
critical action cycle consisting of three core values, ‘Aspiration’, ‘Trust’,
and ‘Empathy’.4
18.3 Code of Conduct: This provides rules and guidelines to be followed by
everyone globally in the Fujitsu Group and adhered to in any business
and societal dealings or actions. The Code of Conduct is further
developed in the global business standards described above. ®
19. The leaders of business within the regions and countries of the Fujitsu Group
are responsible for promoting the Fujitsu Way and ensuring the business and
RLIT0000350
RLITO000350
RLITO000351
RLITO000352
Page 7 of 37
WITNO6650500
WITNO6650500
its strategies aligns with the Fujitsu Way. Managers are then responsible for
ensuring that their teams work in line with Fujitsu’s values and behaviours in
accordance with the Code of Conduct, and addressing colleagues who do not
comply.
Raising concerns and whistleblowing
20. Fujitsu is committed to ensuring that anyone raising concerns can do so in good
faith and without fear of retaliation. There are multiple routes employees can
take to raise concerns about behaviours or actions. These include:
20.1 Using an informal route to speak up, such as talking to a colleague or
line manager or directly to members of Fujitsu’s leadership team;
20.2 Raising a formal grievance;
20.3 Raising appropriate issues directly with members of the Legal and
Commercial, HR or Internal Audit departments, as relevant;
20.4 Raising issues through the mailboxes introduced in response to the
Concerns and described in more detail at paragraph 43 below; and
20.5 Using Fujitsu Alert, the Fujitsu Group’s confidential and globally
consistent whistleblowing route. Fujitsu Alert is an external online portal
where whistleblower reports can be raised and _ followed-up
anonymously by the Fujitsu Group in writing. Fujitsu Alert is also
available via a phoneline which can be used 24 hours a day, 7 days a
week.
Page 8 of 37
WITNO6650500
WITNO6650500
21. — This information is available to all Fujitsu Group employees through the Fujitsu
Group's intranet site, Compass. Details are also set out in Fujitsu Europe’s
‘Europe Compliance Sub-Master Policy on Whistleblowing’ and the Fujitsu HR
Handbook.”
Reporting Lines and Leadership
22. Fujitsu has undergone a process of reviewing the Fujitsu leadership's oversight
of delivery to customers, with a focus on quality assurance. By way of context,
Fujitsu’s customer accounts generally sit within one of three sectors or business
units, (i) Private Sector, (ii) Public Sector, and (iii) Defence and National
Security. Within each of those sectors are then a number of industry-based sub-
sectors, for example Retail and Hospitality are sub-sectors of the Private
Sector.®
23. Fujitsu conducts business reviews for each of the sectors on a monthly basis.°
These monthly business reviews report on, (i) financial performance and
forecast, (ii) sales performance and sales pipeline, (iii) delivery performance,
(iv) customer satisfaction, (v) human resources, and (vi) risk management, and
consist of the following stages:
23.1 each customer account leader reports to the relevant sub-sector leader;
23.2 the sub-sector leader then reports to the sector leaders;
7 FUJ00243273; FUJ00243272
8 FUJ00243274
® FUJ00243270
Page 9 of 37
WITNO6650500
WITNO6650500
23.3 the sector leaders and their team then present to the Fujitsu leadership
team (including Fujitsu’s Head of UK, Anwen Owen, and Head of
Delivery for the UK, Carla Hall) on behalf of their sector; and
23.4 Fujitsu’s Head of UK and leadership team then reports to the Head of
Fujitsu Europe and its leadership team.
24. In addition to this monthly business review process, Fujitsu’s Head of Delivery
for the UK also conducts a monthly review of the delivery elements of the UK
business, reporting separately to the Fujitsu Head of UK on a monthly basis.
The combination of these reporting processes is intended to give improved
independent scrutiny and reduce the risk of internal silos.
25. Separate to the monthly business review process, Fujitsu's leadership team
also conducts bi-annual reviews of strategic customer accounts. '°
26. Fujitsu notes that, from approximately 2019, the Post Office Account has
reported directly into Fujitsu leadership. Accordingly, the Post Office Account is
currently reviewed by the Fujitsu UK leadership team, including the Head of
Delivery for the UK, on a monthly basis as part of the business review process
described above.
FUJITSU’S RESPONSE TO THE CONCERNS ~ CULTURAL CHANGES
27. Within this context, Fujitsu committed fully to the Inquiry process in order to
understand what went wrong and to learn from it. Fujitsu has not wanted to pre-
empt the Inquiry’s findings but in any case has taken a number of steps in
10 FUJ00243271
Page 10 of 37
28.
29.
30.
WITNO6650500
WITNO6650500
specific areas of focus. Fujitsu acknowledges that more should and could have
been done sooner.
In this regard, and in addition to the expectations of the Fujitsu Way, Fujitsu
understands the importance of continually reviewing its ethical compliance
processes in the UK. In 2023, Fujitsu partnered with Ethisphere LLC
(‘Ethisphere”) to help it better understand how its ethical culture could be
improved. Ethisphere is a business ethics consultancy that assists global
businesses to achieve best in class corporate ethical standards, promote best
practices in corporate ethics, and provide a globally recognised standard for
companies that excel. Ethisphere benchmarks leading corporates to provide
extensive data on market practice and is providing Fujitsu with consultancy
services over a period of 3 years on ethical culture and compliance.
Ethisphere’s Business Ethics Leadership Alliance (“BELA”) is a global
community of over 380 leading organisations interested in improving business
integrity practices in governance, risk management, compliance and ethics.
This global group of BELA members, which now includes Fujitsu, recognises
the inherent value of promoting ethical leadership and compliance cultures. It
collaborates on best practices in order to shape the ethics, compliance, and
ESG landscape with tools, data and resources. BELA is a platform for employee
discussions and benchmarking regarding key topics such as
remuneration/incentive systems and speak up programs.
Through Fujitsu’s collaboration with Ethisphere, the following have been
introduced:
Page 11 of 37
WITNO6650500
WITNO6650500
30.1 UK-wide workforce research conducted through interviews and surveys
to help Fujitsu assess its internal ethical culture and identify gaps or
areas for improvement.
30.2 In-person targeted workshops with Fujitsu leadership and Fujitsu’s Legal
and Commercial team and senior management.
30.3 Newly designed mandatory values and ethics training for all Fujitsu
employees.
30.4 Measures to encourage a speak-up, ethical culture.
31. More detail in respect of each of these measures is provided below.
The Ethisphere Research
32. During October 2023, Ethisphere undertook research, launched by Fujitsu's
Head of UK to examine more deeply its ethical culture, feelings about decision
making, and the ability of employees to speak-up. This included interviews and
an ethical culture survey over approximately 7,000 Fujitsu employees in the UK,
receiving approximately 1,000 responses (the “Ethisphere Research”). The
Ethisphere Research was commissioned to help Fujitsu understand its
business today and how all colleagues feel about working at Fujitsu in the UK.
33. The questions posed to employees focussed on the following eight key pillars
of ethical culture to provide quantitative measurements as to employees’
awareness of where to go with concerns, the level of comfort in speaking up,
Page 12 of 37
WITNO6650500
WITNO6650500
and to what extent employees felt supported throughout the organisation.
These eight key pillars were as follows:
33.1. Awareness of program and resources: Familiarity with the assets and
efforts of the compliance and ethics function;
33.2 Perceptions of the function: Perceptions of the assets and efforts of the
compliance and ethics function;
33.3. Observing and reporting misconduct: Comfort in reporting misconduct,
the reason for doing so, and potential reporting barriers;
33.4 Pressure: Strength and source of pressure experienced where
standards may be compromised to hit goals;
33.5 Organisational justice: Whether the company holds wrongdoers
accountable and the awareness of discipline;
33.6 Perceptions of supervisors: For example, the comfort of employees to
approach supervisors with concerns;
33.7 Perceptions of leadership: Perceptions of the conduct, values, and
communications of senior leadership; and
33.8 Perceptions of peers and environment: Whether employees felt
personally responsible for Fujitsu’s ethics.
Page 13 of 37
WITNO6650500
WITNO6650500
34. The findings of the Ethisphere Research were shared with the Fujitsu
leadership team on 14 November 2023"' and shared with employees in local
briefings from January 2024 onwards.‘? In summary, the results were sobering
and show that Fujitsu has more work to do. Approximately 25% of the Fujitsu
employees who partook in the Ethisphere Research were not aware of the
routes to speak up about any concerns they may have, and 15% were not
comfortable in speaking up if they witnessed activity that was not in accordance
with the Fujitsu Way. ‘>
35. To ensure that Fujitsu employees feel able to speak up about concerns, ideas,
questions and suggestions, and be taken seriously, Fujitsu has implemented a
programme of activity detailed below, which includes the all-employee training
as detailed at paragraphs 38 to 40 below. Additional resources, support and
time to engage have also been made available to managers and leaders to
support a speak-up culture.
Workshops
36. Between 28 and 30 November 2023, leaders from across the Fujitsu business,
including members of the Legal team, attended workshops conducted by
Ethisphere designed to highlight and learn from failings in the governance and
oversight of the Post Office Account over time.
1 FUJ00243277
12 FUJ00243289
13 FUJ00243277
Page 14 of 37
WITNO6650500
WITNO6650500
37. I The workshops included sessions on (i) ethical business, (ii) stakeholder impact
activity, (iii) professional standards training, (iv) Inquiry case studies, (v) lessons
learned, and (vi) ethical principles. Copies of the materials used to conduct
these workshops are exhibited to this statement.
Training
38. On 30 January 2024, following discussion and refinement at the workshops
described in paragraphs 36 and 37 above, a mandatory online training session
on the Fujitsu Way was launched for all Fujitsu employees.'® The training was
developed by Fujitsu with assistance from Ethisphere and Ethena, Inc
(‘Ethena’”) and was titled ‘Living the Fujitsu Way’. Ethena is an agile training
provider that develops and deploys customised training aimed at helping
companies create more inclusive work cultures. This training was created
following results in the Ethisphere Research that demonstrated only 73% of
those who participated noted ‘yes’ when asked whether they believe Fujitsu
visibly lives the Fujitsu Way in the UK.®
39. The training was launched by Fujitsu's Head of UK. It builds on the feedback
shared in the Ethisphere Research and aims to ensure everyone in Fujitsu:
39.1 understands the Fujitsu Way as a framework of practice to guide ethical
decision making and their responsibility for upholding it;
‘4 FUJ00243285; FUJ00243286; FUJ00243282; FUJ00243281; FUJ00243283; FUJ00243284;
FUJ00243278; FUJ00243279; FUJ00243280; FUJ00243287; FUJ00243275; FUJ00243276
18 FUJ00243291
16 FUJ00243291
Page 15 of 37
40.
39.2
39.3
39.4
39.5
39.6
39.7
WITNO6650500
WITNO6650500
knows what is required to put Fujitsu Way principles into practice;
is able to identify unacceptable behaviours and practices;
knows the steps to take if unacceptable behaviour is encountered (either
directly or as an active bystander);
knows how to speak up and the speak-up routes available, and feels
willing to speak up;
understands what retaliation is and what to do if retaliation is
encountered (either directly or as active bystander); and
knows that Fujitsu has a zero-tolerance approach to retaliation and other
unacceptable behaviours.
This training has now been rolled out globally. Further phases of work are being
identified and will be undertaken. This includes the development and release of
a practical ethics handbook and a repeat of the Ethisphere Research described
above.
“Speak Up, Listen Up, Follow Up”
41.
Following the results of the Ethisphere Research it was clear that more needed
to be done to ensure that Fujitsu employees (i) understood the routes available
for them to report concerns, (ii) felt supported when reporting concerns, and (iii)
understood the Fujitsu leadership’s commitment to promoting a speak-up
culture. This commitment was first communicated by Fujitsu’s Head of UK, in
December 2023 in the following terms: (when you) Speak Up; (we will) Listen
Page 16 of 37
42.
43.
44,
WITNO6650500
WITNO6650500
Up; (and we will) Follow Up. This is now described as the “Speak Up > Listen
Up > Follow Up” promise.'”
Fujitsu’s Head of UK and the Fujitsu leadership team host regular calls open to
all Fujitsu employees, where employees can raise concerns, ideas and
questions. All calls are recorded and made available to all Fujitsu employees
on Compass. All questions raised in calls and written responses provided are
also stored on Compass.
This was supported by the introduction of a “Fujitsu Way” mailbox in December
2023, allowing Fujitsu employees to raise questions or concerns about the
company’s compliance with the Fujitsu Way. The mailbox is managed by the
Rebuilding Trust Programme, as described at paragraphs 45 to 55 below,
monitored by a team who coordinate responses to resolve these queries and
ensure where appropriate their direct visibility to Fujitsu's leadership.
In order to further encourage employees to speak up and ensure that those
who do are appropriately supported, in May 2024, the Fujitsu HR team
introduced speak-up feedback, whereby colleagues who have been through a
grievance process are invited to, (i) share their experience, (ii) discuss whether
this mirrored the “Speak Up > Listen Up > Follow Up” promise, and (iii) suggest
changes and improvements.
17 FUJ00243290
Page 17 of 37
WITNO6650500
WITNO6650500
FUJITSU’S RESPONSE TO THE CONCERNS -— THE REBUILDING TRUST
PROGRAMME
45. Fujitsu has established a remediation programme known as the Rebuilding
Trust Programme (“Rebuilding Trust Programme’). The Rebuilding Trust
Programme, which commenced in earnest in April 2024, brought together
existing projects, improvement activities and initiatives, as well as defining new
ones, and seeks to direct change in three broad areas: (i) people, (ii) process
and governance, and (iii) technology.
46. The Rebuilding Trust Programme was established as a result of the (i)
Concerns, (ii) results of the Ethisphere Research, and (iii) technical standards
and guidance review commenced in 2023, which identified the need for a
review of defect management policies, the amendment of release management
policies and a review of privileged access management, to strengthen the
delivery of Fujitsu's services.
47. The Rebuilding Trust Programme consists of three phases: (i) Discovery, (ii)
Implementation, and (iii) Monitoring and Improvement. Within each of these
phases, there are three workstreams, (i) people, culture and ethics, (ii)
governance and oversight, and (iii) technology remediation.
48. The Discovery Phase is not yet complete but brings together various remedial
activities, including the following:
48.1 People, culture and ethics: consisting primarily of, (i) the Ethisphere
Research and resulting activities described at paragraphs 32 to 34
Page 18 of 37
WITNO6650500
WITNO6650500
above, and (ii) the Ethena training provided to all employees described
at paragraphs 38 to 40 above;
48.2 Process and governance: consisting of the process and governance
reviews described at paragraph 55 below; and
48.3 Technology remediation: consisting of (i) the Systems Audit described
at paragraphs 53 to 54 below, and (ii) with the assistance of
PricewaterhouseCoopers (“PwC”), an assessment of the remediation
activity undertaken on the Post Office Account to date to address the
Concerns, and to identify areas of further improvement to address the
Concerns. This work is ongoing.
49. Work to determine the scope, structure and format of the second phase of the
Rebuilding Trust Programme, the Implementation Phase, is currently
underway. This phase will focus on the implementation of recommendations
from the Discovery Phase across all three workstreams.
Governance of the Rebuilding Trust Programme
50. The Rebuilding Trust Programme is run on a day-to-day basis by Christian
Benson (Head of Growth, UK leadership team) and the Nerve Centre. The
Nerve Centre was developed with assistance from McKinsey and is the
operational hub of the Rebuilding Trust Programme responsible for, (i) defining
the Rebuilding Trust Programme's approach, objectives, KPIs, and status, (ii)
management of the Rebuilding Trust Programme workstreams, (iii) co-
ordination of communications with external experts and the wider Fujitsu Group,
Page 19 of 37
WITNO6650500
WITNO6650500
(iv) tracking events, (v) handling internal and external enquiries, and (vi)
reporting on KPIs.
51. The Rebuilding Trust Programme in turn reports to a Steering Committee,
comprising members of the Fujitsu leadership team and chaired by Fujitsu’s
Head of UK. The Steering Committee meets with the Rebuilding Trust
Programme fortnightly to:
51.1 review all delivery performance across the Rebuilding Trust Programme;
51.2 manage escalation within the Rebuilding Trust Programme; and
51.3 approve progress throughout the Rebuilding Trust Programme on
completion of deliverables.
52. In order to measure the progress and success of changes made pursuant to
the Rebuilding Trust Programme, KPIs have been developed for each
workstream. These KPIs in turn determine how frequently the relevant teams
need to report to Fujitsu’s Head of Growth on changes. Progress is
subsequently monitored by the Nerve Centre.
Systems Audit
53. The Rebuilding Trust Programme has also comprised an exercise of auditing
its UK service systems (the “Systems Audit”) against the Concerns. 115
systems were identified in this regard. The Systems Audit seeks to query the
systems’ teams on the risks and risk management processes of the relevant
Page 20 of 37
WITNO6650500
WITNO6650500
systems. The audit process is undertaken through a series of interviews, where
responses are sought to around 270 questions. '®
54. As of the date of this Fifth Corporate Statement, audits of all 115 in-scope
systems have been completed. The Systems Audit has identified a number of
both serious and minor issues that are currently in the process of being
reviewed with relevant stakeholders. In some instances, remediation is already
underway. In others, further triaging and analysis is required. The Rebuilding
Trust Programme will monitor this process.
Process and governance reviews
55. The technical standards and guidance review described above in paragraph 46
has been incorporated into the Discovery Phase of the Rebuilding Trust
Programme. Such reviews are being conducted with the assistance of Fujitsu's
delivery organisation and the Fujitsu Group's global quality team, who are in
any event responsible for overseeing general changes and improvements to
process, standards and guidance. Work is being done to define how Fujitsu's
solution design, development and delivery processes can be strengthened. For
example, Fujitsu is looking at how it can improve Release Management,
Integrated Risk Management, Testing and Validation processes.
FUJITSU’S RESPONSE TO THE CONCERNS —- TECHNICAL CHANGES
56. A number of the Concerns relate to technical matters surrounding Horizon,
including (i) the identification, rectification and communication of bugs, errors
18 FUJ00243293
Page 21 of 37
57.
58.
59.
WITNO6650500
WITNO6650500
and defects (“BEDs”), and (ii) the use and communication of access by Fujitsu
employees to remedy errors in transaction data and branch accounts
(‘Privileged Access’).
The changes made by the Post Office Account team in relation to (i) how it
manages BEDs in Horizon, other network or system failures, and the impact of
these on branch accounts (“Incident Management’), '9 (ii) Privileged Access,7°
and (iii) internal and external measures to monitor its compliance with
contractual obligations relating to Incident Management and Privileged Access
are set out in the Fourth Corporate Statement.
The status of technical remediation, and specifically, changes undertaken by
Fujitsu in relation to Incident Management and Privileged Access in the Post
Office Account, are also considered in the following contexts:
58.1 When audited against international industry standards, in particular ISAE
3402, which is assessed annually by external auditors;
58.2 In relation to the work being undertaken with PwC; and
58.3 Through audits and reports where Fujitsu’s input has been requested by
POL.?!
Fujitsu continues to seek to address issues identified through the work
described in paragraph 58 above.
‘9 WITN06650400, Fourth Corporate Statement, §§156 to 170
20 WITN06650400, Fourth Corporate Statement, §§199 to 207
21 See for example, the documents referenced at §222 of the Fourth Corporate Statement, and
FUJ00243292
Page 22 of 37
FUJITSU’S RESPONSE TO THE CONCERNS — PROSECUTION SUPPORT
WITNO6650500
WITNO6650500
60.
61.
62.
Throughout the life of the Horizon IT System, the Horizon Contract has
contained provisions requiring the delivery of a “prosecution support” service
by Fujitsu (defined in the Horizon Contract since 2014 as ‘Court Case Support
Services’). Whilst the scope and formulation of this service has changed over
time, it has generally included the provision of Horizon IT System data and / or
witness evidence by Fujitsu to POL in support of proceedings brought by POL
against postmasters.
In a letter to the Business, Energy and Industrial Strategy Committee dated 16
June 2020 (the “BEIS Letter”), Fujitsu explained:
61.1 “Fujitsu has not provided any new witness evidence since the [Horizon
Issues Judgment]”;
61.2 “Fujitsu will not provide any witness evidence in the future to support
Post Office led prosecutions of sub-postmasters”; and
61.3 “We will provide information if requested by the Police or an appropriate
judicial authority but only after such request has been fully considered,
and with the approval of a UK board director’.??
While it remains the case that Fujitsu has not issued any new witness
statements for prosecutions relating to Horizon shortfalls or discrepancies, a
corrective witness statement was issued by Andrew Dunks on 11 June 2020.
This was in response to a request from Greater Manchester Police regarding
22 POLO0112955
Page 23 of 37
WITNO6650500
WITNO6650500
an ongoing case which pre-dated December 2019.?° Mr Dunks’ corrective
statement amended a typographical error in a date contained in his original
statement.
63. Although the positions set out in the BEIS Letter have not been formalised into
amended policies and procedures, they have created a heightened awareness
within Fujitsu surrounding these issues and they have since guided the
approach taken by, (i) individuals working on the Post Office Account, and (ii)
Fujitsu’s legal team, to requests from POL for witness statements and/or data.
Recent requests for witness statements for use in relation to legal proceedings
64. Between February and July 2024, Fujitsu received requests from four separate
police forces for witness statements regarding the reliability of the Horizon
system currently in place. The statements were for use in ongoing
investigations into four unconnected cases which Fujitsu understands were
reported to the relevant police forces by POL (together, the “Police Requests”).
65. In relation to the Police Requests:
65.1 Fujitsu has informed the relevant police forces and POL that, whilst
Fujitsu is willing to cooperate with the investigations through the
provision of documentary records, Fujitsu is not in a position to provide
the witness statements requested. Fujitsu is of the view that such
witness statements would amount to expert opinion evidence, which
23 FUJO0243259
24 FUJ00243260
Page 24 of 37
WITNO6650500
WITNO6650500
Fujitsu cannot provide on the basis that Fujitsu is not independent
(amongst other reasons). 7° Fujitsu has made clear to POL that
discussions regarding these investigations are confidential as between
Fujitsu and relevant police forces.
65.2 It became apparent to Fujitsu through the Police Requests that the views
of POL and Fujitsu with respect to the use of Horizon data in
enforcement action against postmasters and branch staff are
fundamentally different. Accordingly, between 17 May 2024 and 26 July
2024, I exchanged correspondence with the CEO (Nick Read) and
subsequently the acting CEO (Owen Woodley) of POL. 2” This
correspondence set out Fujitsu’s concerns surrounding POL’s continued
pursuit of enforcement action against postmasters”® and culminated in a
meeting on 18 July 2024 (the “18 July Meeting”).2° My last letter to Mr
Woodley was sent on 26 July 2024. Copies of these letters*° and my
notes of the meeting are exhibited to this statement.*"
Provision of Horizon data for use in relation to legal proceedings
66. Fujitsu continues to provide POL with Horizon data, including ARQ data, when
requested as part of its provision of services related to the Horizon system.
25 See, for example, FUJ00243303
26 FUJ00243157
27 FUJ00243199; FUJ00243201; FUJ00243204; FUJ00243205; FUJ00243209; FUJ00243211;
FUJ00243206; FUJ00243211
28 FUJ00243199
28 FUJ00243201; FUJ00243204
3° FUJ00243199; FUJ00243201; FUJ00243204; FUJ00243205; FUJ00243209; FUJ00243211;
FUJ00243206; FUJ00243211
31 FUJ00243206
Page 25 of 37
WITNO6650500
WITNO6650500
While Fujitsu has informed POL that it will not provide support for enforcement
actions taken against postmasters, whether civil or criminal, Fujitsu has
struggled to verify the purpose to which POL intends to put this data, or what
the data is in fact used for.°?
67. Fujitsu has sought to put in place processes to ensure that any ARQ data it
provides to POL is not to be used in enforcement action against postmasters.
In particular:
67.1 Fujitsu has removed from the ARQ request form options to request
services which are no longer provided, such as witness statements.°>
“Audit Extraction — Local Work Instruction” dated 10 April 2024
(SVM/SEC/WKI/4517, version 1.0) states that Fujitsu does not provide
witness statements with ARQ data.
67.2 Fujitsu sought to require POL to confirm whether, using a change to the
ARQ request form, an ARQ request relates to (i) redress, or (ii) an
investigation into or action against a postmaster or member of branch
staff.
68. At the date of this statement, POL has not accepted the proposed changes.°*
32 FUJ00243199
33 FUJ00243213
%4 FUJ00243297
35 FUJ00243233; FUJ00243295; FUJ00243296; FUJ00243227; FUJ00243199
36 FUJ00243237; FUJ00243236; FUJ00243317
Page 26 of 37
WITNO6650500
WITNO6650500
69. In the meantime, Fujitsu continues to provide ARQ data to POL using the
existing process on the understanding that failure to do so would delay the
provision of data required by postmasters for the purposes of redress.°”
70. Fujitsu is currently making arrangements for the Horizon audit archive, from
which ARQ data is extracted, to be transferred to POL. Fujitsu’s involvement in
the provision of ARQ data will cease when this transfer is complete. This is
currently anticipated to occur in early 2025.
71. Fujitsu also provides call logs and other contemporaneous documents to POL
and its legal advisors, when requested, on the understanding that this
information is to be made available to postmasters who are seeking to overtum
their convictions or achieve appropriate redress. As a matter of course, Fujitsu
seeks confirmation from POL of the purpose to which this data is intended to
be put before it is provided. However, as noted above, Fujitsu is not able to
verify the accuracy of the information provided by POL in response.
FUJITSU’S ONGOING WORK AND NEXT STEPS
72. Fujitsu recognises that realising change in a large international organisation
takes time, and many of the change and remediation initiatives described in this
statement are only in their infancy. Fujitsu also recognises that the need for
change and improvement does not come to an end with the conclusion of this
Inquiry. There is still substantial work to be done.
37 FUJ00243233
Page 27 of 37
WITNO6650500
WITNO6650500
73. In this regard, Fujitsu notes that there are a number of contexts in which
recommendations for further change will likely be made in the foreseeable
future. These include:
73.1
73.2
73.3
73.4
73.5
74. Upon
as a result of the activities currently being pursued with PwC;
as part of Fujitsu’s Rebuilding Trust Programme;
through Fujitsu’s routine audit and assurance programmes;
as part of Sir Wyn’s final report in this Inquiry; and
Through the existing supplier governance structure and measures with
the Cabinet Office in relation to scrutiny of Fujitsu’s status as a strategic
supplier to the UK Government.
receipt of these further recommendations, Fujitsu will need to take
appropriate actions to address the matters raised.
The continuance of the Horizon Contract
75. The Horizon Contract is currently due to end on 31 March 2025. Fujitsu
understands that POL’s programme to introduce a replacement system to
Horizon is substantially delayed.
76. In around November 2023, POL requested discussions with Fujitsu concerning
a potential extension of the Horizon Contract to March 2030. However, there
are several challenges to the feasibility of the continued delivery of the Horizon
Page 28 of 37
WITNO6650500
WITNO6650500
system and its associated services. These challenges are outlined in a letter
from Fujitsu to POL dated 15 December 2023,*° and include the following:
76.1 The risks associated with the continued provision of Horizon (including
the audit archive) on an ‘End-of-Service-Life’ (“EOSL”) IT infrastructure.
POL’s focus has historically been on implementing alternative solutions
to Horizon, rather than investing in the existing infrastructure. Due to the
age and EOSL status of the existing Horizon infrastructure, there is an
increasing risk of the infrastructure failing, which could adversely impact
the delivery of services to the public.
76.2 The technical complexity and risk associated with (i) updating the
existing infrastructure, which is now at varying states of obsolescence
and compatibility, and (ii) delivering new system requirements. The risks
and technical challenges associated with these two activities are also
increasing with the continued provision of Horizon on an EOSL IT
infrastructure.
76.3 The need to (i) extend the leases for, and (ii) upgrade the facilities for
the Datacentre that hosts Horizon.
76.4 The need to retain highly specialised staff who, in some cases, have
been working on Horizon for many years and have a deep knowledge of
the underpinning business logic, bespoke application and aged
infrastructure environment.
38 FUJ00243299
Page 29 of 37
WITNO6650500
WITNO6650500
76.5 The challenges of recruiting staff to work on Horizon with the requisite
knowledge in aged infrastructure and bespoke applications, and in light
of public scrutiny concerning the system itself.
77. As noted above, the Horizon Contract is due to end on 31 March 2025.°9
However, in the event that this is not possible, Fujitsu is currently discussing
with POL (at its request) the potential for a short-term extension (which POL
envisages to be approximately two years) to facilitate an orderly exit and
transition to occur. In light of the evidence that has emerged in the Inquiry in
relation to POL’s conduct and culture, and the challenges that Fujitsu has faced
with regards to visibility over POL’s use of Horizon data and/or records, Fujitsu's
position will be that any extension to the Horizon Contract should necessarily
see the removal of the Court Case Support Services provisions.
The January 2024 Statement
78. The Inquiry has referred Fujitsu to a BBC News article dated 11 February 2024
(the “BBC News Article”) 4° and the following statement set out at the end of
the article:
“Based on the findings of the Inquiry, we will also be working with the UK
government on the appropriate actions, including contribution to compensation.
The Fujitsu Group hopes for a swift resolution that ensures a just outcome for
the victims.”
38 FUJ00243301; FUJ00243300
40 RLITOO00276
Page 30 of 37
WITNO6650500
WITNO6650500
79. As I explained to, (i) the Business and Trade Committee when I gave oral
evidence on 16 January 2024 and, (ii) the Inquiry when I gave oral evidence on
19 January 2024, Fujitsu will engage with Government on appropriate
contribution to redress at the conclusion of the Inquiry. This view was reiterated
in a statement by Fujitsu Limited in Japan on behalf of the Fujitsu Group on 18
January 2024 (the “January 2024 Statement”), which stated:*"
“The Fujitsu Group regards this matter with the utmost seriousness and offers
its deepest apologies to the sub-postmasters and their families.
The UK statutory public Inquiry, to which our UK subsidiary is providing full
cooperation, is examining complex events that have unfolded over many years,
and we remain steadfast in our commitment to this cooperation. Based on the
findings of the Inquiry, we will also be working with the UK government on the
appropriate actions, including contribution to compensation.
The Fujitsu Group hopes for a swift resolution that ensures a just outcome for
the victims.”
80. The BBC News Article reflects exactly the words used in the January 2024
Statement, the contents of which remain unchanged today.
81. Fujitsu takes Lord Justice Fraser's criticisms in the Horizon Issues Judgment
very seriously. In its letter to Darren Jones MP, then Chair of the Business,
Energy and Industrial Strategy Committee dated 12 June 2020, Fujitsu
committed to helping with all inquiries, including the Government Review
41 RLITO000353
Page 31 of 37
WITNO6650500
WITNO6650500
announced on 10 June 2020 (which later became a Statutory Inquiry on 1 June
2021).
82. During a virtual meeting with Sir Wyn Williams on 19 November 2020, I
conveyed that Fujitsu welcomed the opportunity to be heard and would
cooperate fully with his Inquiry. Fujitsu believes that providing the Inquiry with
its full support presents the best possibility of ensuring a just outcome for the
victims.
83. Fujitsu believes that POL continues to have significant cultural issues. Fujitsu
considers that direct engagement with government, if conducted in a
constructive manner and in light of the findings of this Inquiry, is the most
appropriate way of resolving this matter to the satisfaction of all relevant
stakeholders.
84. In the meantime, Fujitsu remains committed to providing every possible
assistance to the Inquiry.
Statement of Truth
I believe the content of this statement to be true.
Dated: 23 September 2024
Page 32 of 37
WITNO6650500
WITN06650500
INDEX TO THE FIFTH CORPORATE STATEMENT OF
FUJITSU SERVICES LIMITED
Exhibit I Document description Control No. URN
No.
1. European Services Assurance POINQ0249310F I FUJ00243269
Handbook dated 18 July 2024
2. Copy of “Fujitsu Way” webpage on RLIT0000350 RLIT0000350
Fujitsu website
3. Copy of “Code of Conduct” webpage I RLIT0000351 RLITO000351
on Fujitsu website
4. Fujitsu Global Business Standards RLIT0000352 RLIT0000352
dated December 2012
5. Europe Compliance Sub-Master POINQ0249314F I FUJ00243273
Policy on Whistleblowing dated 12
December 2023
6. Fujitsu UK HR handbook dated 15 POINQ0249313F I FUJ00243272
July 2024
7. Organisation chart for Fujitsu UK & POINQ0249315F I FUJ00243274
Ireland Leadership Team dated
September 2024
8. Management Business Review POINQ0249311F I FUJ00243270
Terms of Reference dated 15
October 2021
9. Strategic Account Review Terms of POINQ0249312F I FUJ00243271
Reference dated 8 February 2023
10. Ethisphere Ethical Culture POINQ0249318F I FUJ00243277
Assessment dated 14 November
2023
11. Briefing shared with Fujitsu POINQ0249330F I FUJ00243289
employees following findings of
Ethisphere survey dated December
2023
Page 33 of 37
WITNO6650500
WITN06650500
Exhibit I Document description Control No. URN
No.
12. Fujitsu UK and Ireland Leadership POINQ0249326F I FUJ00243285
Workshop agenda and materials
dated 28-29 November 2023
13. Fujitsu Legal Workshop agenda and POINQ0249327F I FUJ00243286
materials dated 30 November 2023
14. Fujitsu UK and Ireland Leadership POINQ0249323F I FUJ00243282
Workshop agenda dated 28-29
November 2023
15. Fujitsu Legal Workshop agenda POINQ0249322F I FUJ00243281
dated 30 November 2023
16. Fujitsu UK and Ireland Leadership POINQ0249324F I FUJ00243283
Workshop presentation dated 28-29
November 2023
17. Fujitsu Legal Workshop presentation I POINQ0249325F I FUJ00243284
dated 30 November 2023
18. Fujitsu Ethics and Values workshop POINQ0249319F I FUJ00243278
case study 1
19. Fujitsu Ethics and Values workshop POINQ0249320F I FUJ00243279
case study 2
20. Fujitsu Ethics and Values workshop POINQ0249321F I FUJ00243280
case study 3
21. Fujitsu Ethics and Values workshop POINQ0249328F I FUJ00243287
case study 1
22. Fujitsu Ethics and Values workshop POINQ0249316F I FUJ00243275
case study 2
23. Fujitsu Ethics and Values workshop POINQ0249317F I FUJ00243276
case study 3
24. Living the Fujitsu Way training POINQ0249332F I FUJ00243291
presentation talking notes
Page 34 of 37
WITNO6650500
WITN06650500
Exhibit I Document description Control No. URN
No.
25. I Communication from Anwen Owen to I POINQ0249331F I FUJ00243290
all Fujitsu UK and Ireland dated 12
December 2023
26. Rebuilding Trust Tech Survey POINQ0249334F I FUJ00243293
Interview Questions Master
27. Fourth Corporate Statement of Fujitsu I WITN06650400 WITNO06650400
Services Limited dated 8 August
2024
28. I PAM RAM Assurance Report dated POINQ0249333F I FUJ00243292
20 April 2023
29. I Letter from Rob Putland to Darren POL-0110351 POL00112955
Jones MP dated 16 June 2020
30. I Email chain between FSL and POINQ0249284F I FUJ00243259
Greater Manchester Police last dated
11 June 2020
31. I Amended witness statement of Andy I POINQ0249285F I FUJ00243260
Dunks dated 8 August 2020
32. I Letter from Paul Patterson to Nick POINQ0249224F I FUJ00243199
Read dated 17 May 2024
33. I Letter from Chris Breen to City of POINQ0249295F I FUJ00243303
London Police dated 23 August 2024
34. I Letter from Paul Patterson to Nick POINQ0249229F I FUJ00243204
Read dated 8 July 2024
35. Email chain between Chris Breen and I POINQ0249182F I FUJ00243157
John Bartlett last dated 1 May 2024
36. Letter from Nick Read to Paul POINQ0249226F I FUJ00243201
Patterson dated 30 May 2024
37. I Email from Paul Patterson to Nick POINQ0249230F I FUJ00243205
Read dated 16 July 2024
38. I Letter from Owen Woodley to Paul POINQ0249234F I FUJ00243209
Patterson dated 23 July 2024
Page 35 of 37
WITNO6650500
WITNO6650500
Exhibit
No.
Document description
Control No.
URN
39.
Letter from Paul Patterson to Owen
Woodley dated 26 July 2024
POINQ0249236F
FUJ00243211
40.
Email from Paul Patterson to Chris
Breen, Daniel Walton, Rob Putland,
Rachel Roberts and Carla Hall dated
19 July 2024
POINQ0249231F
FUJ00243206
41.
Letter from Paul Patterson to Owen
Woodley dated 26 July 2024
POINQ0249236F
FUJ00243211
42.
Audit Record Query Request form
dated 4 March 2024
POINQ0249238F
FUJ00243213
43.
Audit Extraction — Local Work
Instruction SVM/SEC/WK1/4517
version 1.0 dated 10 April 2024
POINQ0249338F
FUJ00243297
44.
Email chain between POL
Remediation Team and FSL CSPOA
last dated 21 June 2024
POINQ0249258F
FUJ00243233
45.
Email from Daniel Walton to Rajivsinh
Rathod and Neeraj Mittra dated 9
July 2024
POINQ0249336F
FUJ00243295
46.
Credit note memo from FSL to POL
dated 28 June 2024
POINQ0249337F
FUJ00243296
47.
Audit Record Query Request form
dated 22 May 2024
POINQ0249252F
FUJ00243227
48.
Email chain between Simon Oldnall
and Daniel Walton last dated 21 June
2024
POINQ0249262F
FUJ00243237
49.
Email chain between Rajivsinh
Rathod and Daniel Walton last dated
19 July 2024
POINQ0249261F
FUJ00243236
50.
Email chain between Simon Oldnall
and Daniel Walton last dated 4
September 2024
POINQ0249309F
FUJ00243317
Page 36 of 37
WITNO6650500
WITN06650500
Exhibit I Document description Control No. URN
No.
51. Email from Daniel Walton to Chris POINQ0249339F I FUJ00243298
Brocklesby and Dionne Harvey dated
15 December 2023
52. Copy of “A Fujitsu statement of Post RLITO0000353 RLIT0000353
Office Horizon IT” webpage on Fujitsu
website dated 18 January 2024
53. I Letter from FSL to POL dated 15 POINQ0249340F I FUJ00243299
December 2023
54. I Letter from Daniel Walton to Simon POINQ0249342F I FUJ00243301
Oldnall dated 3 July 2024
55. I Email from Daneil Walton to Simon POINQ0249341F I FUJ00243300
Oldnall dated 3 July 2024
56. I BBC article dated 11 February 2024 I RLIT0000276 RLIT0000276
Page 37 of 37