1 Wednesday, 26 October 2022 2 (10.00 am) 3 MR BEER: Good morning, sir. Can you see and hear me? 4 SIR WYN WILLIAMS: Yes, I can, thank you very much. 5 MR BEER: And we can you. Thank you very much. 6 Can I call Anthony Oppenheim, please. 7 SIR WYN WILLIAMS: Yes. 8 ANTHONY OPPENHEIM (affirmed) 9 Questioned by MR BEER 10 MR BEER: Thank you, Mr Oppenheim. My name is Jason Beer, 11 as you know, and I ask questions on behalf of the 12 Inquiry. Can you tell us your full name, please? 13 A. Anthony Edward Peter Oppenheim. 14 Q. Thank you very much for coming to give evidence to the 15 Inquiry and thank you also for the witness statement 16 that you previously provided to us. We're very grateful 17 for the assistance that you have given and are giving in 18 the course of the investigations by this Inquiry. 19 You should have a hard copy of the witness statement 20 in the folder behind you in volume 1. Could you take it 21 out, please, and in tab A1 there should be a witness 22 statement which, excluding exhibits, is 85 pages in 23 length and dated 7 September 2022 and, on page 85, there 24 should be your signature. 25 A. There would have been but it's got "GRO" on top of it. 1 1 Q. It's been redacted. Okay, that's an error by the 2 Inquiry staff. We will correct that later. Does it 3 look like the witness statement that you did sign? 4 A. Yes, it does. 5 Q. Were the contents of it true to the best of your 6 knowledge and belief? 7 A. Yes, they were. 8 Q. A copy of that witness statement will be uploaded to the 9 Inquiry's website. I'm going to ask you questions, not 10 about every part of it, but just selected parts. Do you 11 understand? 12 A. Sure. 13 Q. Can we start with your background and experience, 14 please. I think you were employed by ICL from 1979 and 15 left Fujitsu in 2018; is that right? 16 A. That's correct. 17 Q. So you were a company man for the majority of your 18 career, just shy of 40 years? 19 A. That's right. It wasn't the first job, but the 20 majority, certainly. 21 Q. By training, you are an engineer and an economist? 22 A. Yes. 23 Q. So far as concerns this Inquiry, would this be right, 24 the most relevant part of your employment occurred 25 between 1994 and 2002? 2 1 A. That is correct. 2 Q. It began in October 1994 when you joined the Pathway bid 3 team -- 4 A. Yes. 5 Q. -- and I think you were one of the first to join. 6 A. That's correct. 7 Q. You were then Pathway's commercial and financial 8 director; is that right? 9 A. That's correct. 10 Q. You say in your statement that you became a member of 11 Pathway's board on 15 June 1995 and, by that, do you 12 mean the board of ICL Pathway Limited? 13 A. Correct. 14 Q. You left ICL Pathway in February 2001, going back to ICL 15 itself; is that right? 16 A. Yes, it is. 17 Q. But you retained some responsibilities for ICL Pathway, 18 namely the commercial and contractual arrangements 19 between ICL Pathway and its customers and its 20 subcontractors; is that right? 21 A. No, it was a higher level overarching responsibility for 22 the commercials only and not the financials, so just to 23 elaborate briefly, Pathway then was one of a number of 24 major accounts that I was responsible for commercially. 25 I think the initial title was "commercial and 3 1 finance for major projects", but it was quickly reduced 2 to commercial only, so I was brought back in later -- 3 you may go to this -- to negotiate with POCL, or POL as 4 it was then, but no, I didn't have day-to-day 5 responsibility. 6 Q. I wasn't suggesting day-to-day responsibility. Perhaps 7 you can tell us exactly the level of responsibility that 8 you had after February 2001 and before December 2002? 9 A. Virtually none. It was a sort of monthly review of high 10 level reports and that was it, so I was replaced in my 11 previous role by a guy called Colin Lenton-Smith. 12 Q. Were you involved in any negotiations after 13 February 2001 and before 31 December 2002 concerning 14 ICL Pathway? 15 A. No. 16 Q. Your involvement with the Horizon System, as it had 17 become, ended entirely, is this right, in December 2002? 18 A. That is correct. 19 Q. Can we have a look at your witness statement, please, at 20 paragraph 14, that's WITN03770100. It will come up on 21 the screen for you, Mr Oppenheim. 22 A. Mm-hm. 23 Q. Look at page 4, please, and then highlight paragraph 14. 24 You say: 25 "I was involved in setting up all of the above 4 1 arrangements ..." 2 That's the creation of ICL Pathway Limited, the 3 relationships with ICL Pathway's shareholders and the 4 engagement of the principal subcontractors, that's what 5 you have been speaking about above? 6 A. Correct. 7 Q. Then you continue: 8 "... the management of Contract Changes between 1996 9 and 1999, and then, in 1999, unwinding the ... Benefits 10 Payment Card part of the contract." 11 Is that a fair summary of the principal parts of 12 your role over time? 13 A. Yes. 14 Q. Can I turn to, in slightly more detail, positions of 15 responsibility and roles within ICL Pathway between 16 October 1994 and February 2001. I wonder whether we 17 could look, please, at FUJ00000060. This is the first 18 exhibit to your witness statement, a document that you 19 will recognise, and, for the note, I think this is part 20 of schedule A14 to the codified agreement of 21 28 July 1999. 22 Does that figure, Figure 1, the Pathway board, 23 accurately describe the five members of the Pathway 24 board and their job titles at that time, as at 25 July 1999? 5 1 A. Yes, it does. 2 Q. So Sir Michael Butler is the chairman, Mr Todd as deputy 3 chairman, you as commercial and finance director 4 Pathway, Mr Bennett as the MD of Pathway and then 5 Mr Christou -- it says "ICL legal and [commercial] 6 director", what's the significance of ICL being written 7 against his name and Mr Todd's name, rather than Pathway 8 against yours and Mr Bennett's names? 9 A. Because they were not executives of ICL Pathway, they 10 were executives of ICL and they were board members of 11 ICL Pathway. 12 Q. On the next page, if we go over the page please, there 13 is an introduction to what is called the Pathway 14 management team. Can you see under paragraph 2 in bold 15 there's the heading "Pathway Management Team" and the 16 codified agreement says: 17 "The Pathway team is in place. The management 18 structure has been agreed and the positions filled. The 19 structure of the team is as follows ..." 20 Then it says "Figure 2 -- the Pathway Management 21 Board", and we see a place where a diagram or a figure 22 is supposed to appear but is blank, at least in this 23 version. You will see that the title to the missing 24 figure is, in fact, to a Pathway management board. 25 A couple of questions arising from that. Firstly, was 6 1 the Pathway board that we saw on the previous page, as 2 it was described, the Pathway board, the same thing or 3 a different thing to the Pathway management board that 4 we see in the title to figure 2 on page 2 of the 5 document? 6 A. I would say different. It's a, I agree, slightly 7 confusing combination of management and board. This 8 would have been the operating team, as opposed to the 9 board. 10 Q. Sorry, it's a poor question from me. To start with, was 11 the Pathway management board different from the thing 12 that we saw on the previous page, which was described as 13 the "Pathway board"? 14 A. I suspect so, but it would be quite helpful to see the 15 diagram, of course. I think it is referred to somewhere 16 else but obviously not here. 17 Q. We will go to some other documents in a moment. The 18 second thing: was the Pathway management board different 19 from the Pathway management team? 20 A. Again, without seeing the diagram, I can't be sure but 21 I think this is probably meant to be the Pathway 22 management team. 23 Q. So that heading might, or might ought to have said 24 "Pathway management team", okay. 25 A. Well, the heading and then the beginning of 2.1 talk 7 1 about "Pathway team", so I would think that's just 2 an error in the figure 2 description. 3 Q. Can we look at FUJ00000061, please. Again, this is 4 another exhibit to your witness statement. This is 5 an ICL Pathway organogram, a basic organogram, under the 6 heading of "ICL Pathway's directors" and can you see in 7 the bottom left it appears to date from 2000, right at 8 the foot of the page? 9 A. Yes, I can see that. 10 Q. Notwithstanding the heading to the document indicating 11 that it concerned ICL Pathway's directors, does it, in 12 fact, depict only directors or other people as well? 13 A. No, I would say this was -- this included, obviously, 14 the managing director and I was a director, but all the 15 others are part of the management team that we were 16 talking about a moment ago. 17 Q. So is this in fact a better description of the 18 management team that we saw missing from the version of 19 the codified agreement that we have just examined? 20 A. It is, except that this is a later version than that -- 21 Q. Ie 2000? 22 A. Yes. 23 Q. So, thinking back, would you say this is a fair 24 description of the Pathway management team? 25 A. Yes, as it was at 2000. It had changed slightly, but 8 1 yes, as at that date, yes. 2 Q. We see you are on this organogram, the third box down on 3 the left, and we see that you are in a reporting line 4 straight to the managing director. 5 A. Yes. 6 Q. Is that correct, that your report was straight through 7 to the MD at this time, Mike Stares? 8 A. Correct, yes, it always was, yes. 9 Q. The people on the left-hand side of the organogram 10 underneath -- ignoring his PA for the moment -- on the 11 left-hand side of the diagram, Mr Foley, Mr Muchow and 12 Martyn Bennett. Again, did they report directly to the 13 MD? 14 A. Yes, they did. 15 Q. It's only the people on the right-hand side of the 16 diagram that appear to report through Mr Coombs, the 17 deputy MD, to Mr Stares; is that right? 18 A. That is correct. 19 Q. So does it follow that people such as Mr Austin -- Terry 20 Austin on the right-hand side -- Mr Flynn, in the middle 21 of the right-hand side, people responsible for 22 development and implementation, they did not report to 23 you? 24 A. Oh, that is correct. They reported to Mike Coombs who, 25 apart from being a deputy MD, was programme director. 9 1 Q. Lastly, can we look at a further version of the codified 2 agreement to see how the Pathway board had changed. 3 This is FUJ00000062 and again this is exhibited to your 4 witness statement. This version of schedule 14 to the 5 codified agreement is dated 21 July 2000 and is version 6 1.4. I think you can see that from the bottom right. 7 A. Yes. 8 Q. Starting with the Pathway board by then, it says: 9 "The ICL Pathway board has been set up under 10 chairmanship of Richard Christou, ICL Legal and 11 Commercial Director, with board representatives from 12 ICL." 13 We can see in figure 1 the depiction, pictorially, 14 of the ICL Pathway board at this time and just looking 15 how things have changed by now, Mr Christou, who was 16 formerly the legal and commercial director, has become 17 chairman of the board, correct? 18 A. He was still ICL, legal and -- 19 Q. I'm sorry. 20 A. Yes. 21 Q. I missed what you said there, "he was still"? 22 A. He was still legal director of ICL. Previously, he had 23 been just a board member, but his overarching role was 24 still legal and commercial for ICL. 25 Q. Back in ICL parent? 10 1 A. Yes. So in addition to that role, he had taken on 2 chairmanship from Sir Michael. 3 Q. Mr Todd remains the deputy chairman of the board? 4 A. Yes. 5 Q. Mr Stares has taken over from Mr Bennett as Pathway 6 managing director. 7 A. Correct. 8 Q. Mr Bennett is described as "ICL Government Managing 9 Director", can you help us, what does that mean: ICL 10 government managing director? 11 A. I think there's a word missing. It's probably 12 "Government business unit" or some such. So he had 13 moved out of Pathway, ICL Pathway, and into -- back into 14 ICL, taking on a new senior role for a part of ICL's 15 business, which faced off to or dealt with 16 UK Government. 17 Q. So the descriptions that are given underneath each name, 18 one shouldn't be misled into thinking that's the role 19 that they are performing in ICL Pathway, that's 20 a description of their role, in this case, back in ICL, 21 the parent company? 22 A. Correct. These are their day jobs and in addition they 23 are, in a sense, non-exec directors of ICL Pathway. The 24 same applies to Tim Escudier. Likewise ICL services 25 division, whatever. 11 1 Q. Mr Escudier has been added. He is described as ICL's 2 financial services managing director. 3 A. Yes. 4 Q. Again, that's back in ICL itself rather than 5 ICL Pathway. 6 A. So John Bennett and Tim Escudier were peers running 7 different business units within ICL, correct. 8 Q. Can we go over the page please. We now see that in this 9 version of the contract figure 2 has been completed. 10 The rubric is the same, "ICL Pathway management team" is 11 the heading, the announcement that the ICL Pathway team 12 is in place, the management structure has been agreed 13 and: 14 "The structure of the team is as follows ..." 15 The cross heading still describes this as the 16 Pathway management board and just take a moment to look 17 at the organogram. 18 A. Yes. 19 Q. Does that organogram describe something called "The 20 Pathway Management Board", or does it describe something 21 called "The Pathway Management Team"? 22 A. Management team. 23 Q. We see in documents, hundreds of documents, the phrase 24 "Pathway Management Team", capital P, capital M, 25 capital T. That was a term of art, essentially. 12 1 A. Yes, and that's how this organogram should have been 2 described. 3 Q. Does that show again that those responsible for, for 4 example, implementation, customer requirements and 5 development did not report to you? 6 A. Correct. 7 Q. Does that represent the position in reality, those 8 responsible for implementation of the programme, the 9 development of the programme and customer requirements 10 didn't report to you? 11 A. Correct. 12 Q. We're going to see that later on you had -- ie later on 13 today rather than later on in the piece -- you had quite 14 some involvement in issues concerning the development of 15 the project, the implementation of the project and the 16 customers' requirements. You were present at a number 17 of meetings at which those three issues were very much 18 the hot topics? 19 A. Yes, that's true. I was involved but I wasn't 20 responsible for them. If I can just clarify, if I may. 21 There were a lot of tensions around the commercials. My 22 main responsibility here was to take care of the 23 commercials vis-à-vis BA and POCL and -- 24 Q. Just stopping you there, sorry to interrupt you, you may 25 understand what "The commercials" mean, could you 13 1 explain it to a naive audience? 2 A. By all means. 3 SIR WYN WILLIAMS: Mr Oppenheim, can I interrupt you. 4 Before you give that answer, I hope it won't take you 5 out of your stride, it would help me if the document 6 could be taken down once we have looked at it so that 7 I can see Mr Oppenheim better. I can see you, but not 8 very well. That's great. Thank you very much. 9 A. So commercials was a sort of shorthand form of 10 describing some of the things you talked about in your 11 introduction. So contracts with BA and POCL and the 12 codified agreement was the one that operated through 13 most of the piece but prior to that there were several 14 other contracts, there was the BA contract, the POCL 15 contract and the combined contract because it was 16 a tripartite set of agreements, so that was one piece. 17 Then there was the piece with subcontractors and we 18 had a lot of subcontractors and so that also was 19 a commercial/contractual matter which I had overall 20 responsibility for and also you mentioned, I think, 21 funding/financing, so I had responsibility for that as 22 well, trying to get the monies lined up for this project 23 because it was a PFI project so we needed that as well. 24 So I won't go on, that is essentially what 25 "commercials" mean. 14 1 MR BEER: Thank you. 2 A. And then the ongoing operation of change control, 3 pursuing agreements to agree and such-like. 4 Q. So I interrupted your answer there and you were 5 explaining to me why we see your footprint on a number 6 of the documents, a very high number of the documents, 7 when you had no management, or directorial 8 responsibility for issues such as development, 9 implementation or customer requirements and it is simply 10 because they all impinged on commercial issues; is that 11 right? 12 A. Absolutely, spot on, correct. 13 Q. Not because you had any particular management or 14 directorial responsibility or any technical expertise? 15 A. I had to acquire sufficient technical expertise to be 16 able to deal with -- to understand the issues, to be 17 able to deal with the commercials because a lot of 18 this -- I repeat, this was a PFI. There was a lot of 19 tension between the parties as to who would be 20 responsible for what and, in some cases, there was 21 a great deal of detail that needed to be understood in 22 order to get the wording right, to get the terms and 23 conditions right, to do with risk management. So I had 24 to understand the detail at a pretty granular level. 25 Q. We will come back to examine that understanding later 15 1 today. You mention there the PFI contract and the 2 consequences of it. In your statement, you tell us that 3 there appeared to have been a conflict between the 4 Benefit Agency's and Post Office Counters Limited's 5 business objectives; is that right? 6 A. There were conflicts, yes. 7 Q. When was that conflict first appreciated or understood 8 by you? 9 A. Right at the beginning. 10 Q. The "beginning" meaning what, from 1994 onwards? 11 A. Yes. 12 Q. So it wasn't only after you entered the contract that 13 this conflict emerged? It was evident from day one? 14 A. It was implicit and visible in the terms of reference 15 for the contract. If you thought through what at 16 a second level that meant, in terms of the interactions 17 between the parties, I would say we understood that from 18 very early on and it was part of our risk register from 19 very early on. 20 Q. When you say part of your risk -- it was written down, 21 was it? 22 A. I believe it was, but I'm casting my mind back a long 23 time now. 24 Q. Was there a document called "risk register"? 25 A. There were risk registers, yes. 16 1 Q. Who was responsible for maintaining the risk register? 2 A. Martyn Bennett. 3 Q. Can you recall now the format in which they were kept? 4 A. I think over the period it evolved from probably Excel, 5 at the beginning, during the bid phase to -- I can't 6 remember the particular application that was used, but 7 there was an application which was used in ICL and we 8 used that, but I can't remember the name. 9 Q. It was Mr Bennett who had responsibility for that? 10 A. Yes. 11 Q. Was there any team underneath him that was responsible 12 for feeding into the risk register? 13 A. He had, from memory, one -- at least one person working 14 for him, Graham somebody. I can't remember his surname. 15 Q. Thank you. With responsibility specifically for the 16 risk register? 17 A. Well, in a sense, they both had responsibility for the 18 risk register. I wouldn't like to say one was 19 responsible for maintaining it and the other one for 20 inputting into it. It was a team task. 21 Q. Thank you. Was that ever escalated to the ICL Pathway 22 board for review and sign off? 23 A. Sign off -- I can't remember about sign off. Certainly 24 we talked about the major risks at the board and this 25 one would have been one of those, the inherent conflict. 17 1 The conflict -- "conflict" is a bit strong. It's 2 a conflict when there's a problem. At the outset, it's 3 a different set of priorities, perhaps. 4 Q. Putting it shortly, we've got a lot of evidence on this 5 from other witnesses and in the documents, but one of 6 the purposes of the proposed system was, from the 7 Benefits Agency perspective, to eliminate fraud? 8 A. Encashment fraud, yes. 9 Q. But Post Office Counters Limited's business goal was to 10 seek to make customer experience as frictionless as 11 possible, I think you describe it as, and therefore to 12 encourage usage; is that right? 13 A. Yes. I think that's an accurate description of the 14 difference in priorities. 15 Q. So the Benefits Agency wanted not only a different means 16 of payment but tight controls, therefore. Wasn't, 17 therefore, the Benefits Agency's withdrawal from the 18 programme always likely? 19 A. The reason we felt confident that they would go through 20 with it and we were proved wrong was that, at the time, 21 there was -- we were assured of a very strong political 22 imperative from the government and, in a sense, we 23 relied on that to push it through. 24 Q. Did that, to your recollection, enter the risk register, 25 the risk of the DSS withdrawing from the programme? 18 1 A. I don't necessarily recall -- no, I don't recall it 2 being in the risk register. I do recall discussions, 3 certainly at the board, about that. Were those 4 discussions right from the very beginning? I would say 5 no. I think, at the beginning, the discussion was much 6 more around the success -- the success of the programme 7 and the chances of problems on the programme and what 8 those problems might be, what those issues or risks 9 might be. 10 Q. Do you think that there is a possibility that the 11 questions, persisting questions, over whether the system 12 that was being developed best suited the objectives of 13 the Benefits Agency, on the one hand, and Post Office 14 Counters Limited, on the other, got in the way or 15 obstructed the delivery of a system that, in fact, best 16 suited the needs of subpostmasters? 17 A. I understand why you would ask that question. It's 18 difficult to give you a definitive response. All 19 I would say is this: we are going back, as you said at 20 the outset, 25 years and there was no internet then and, 21 in a sense, the choice was do you have an offline 22 system, so you can't do any verification of a banking 23 transaction, or do you have a totally nailed up, online 24 system which required lease lines, very, very expensive. 25 And what we were offering was a distributor system, 19 1 which is now commonplace but was very, very unusual in 2 those days, and the NAO and the PAC both acknowledged 3 that that was an advantage. It didn't show up 4 necessarily in the gradations of us versus our 5 competitors at the time, but both the NAO report and the 6 PAC review made the point that, actually, this 7 distributor system, which was kind of a halfway-house of 8 being mostly offline, but it could also go online as and 9 when verification was needed, was a good approach. 10 Q. You tell us in your witness statement, it is 11 paragraph 46 for the cross-reference, that the 12 withdrawal of the Benefits Agency from the programme 13 increased the pressure on Post Office Counters Limited 14 to move fast, move at speed. 15 A. Yes, I did say that, yes. 16 Q. You speak about an increase of pressure to move fast. 17 Firstly, was there already pressure on the Post Office 18 to move fast in the development and implementation of 19 the programme? 20 A. There was. I mean, there was an imperative on all three 21 parties. I would say that, in rank terms, the Benefits 22 Agency wanted the fraud reductions and were instructed 23 to secure the fraud instructions (sic) by HM Government 24 and this was the -- you know, the best way to do that, 25 so there was that political imperative on them. 20 1 The Post Office wanted to automate for other 2 clients, not just the Benefits Agency, to improve their 3 competitiveness and they also recognised that the 4 Benefit Payment Card, as it was conceived, was going to 5 be their way of securing the maximum footfall, as you 6 said, of Benefits Agency business. 7 Q. Because it brings people into the branch? 8 A. It brings people into the branch and when they're there, 9 they buy other things, exactly. 10 Q. So there was already pressure on Post Office Counters 11 Limited to move fast. Where did that existing pressure 12 come from? 13 A. Well, as I said in my statement, it was there, for the 14 reasons I just said, their own business case relied on 15 attracting new business and certainly maximising the 16 amount of BA business. 17 There was a recognition that the BA business would 18 go down over time because of ACT -- sorry, that's 19 bank-to-bank transfers -- so instead of someone going 20 into the Post Office, they would get a payment through 21 the bank. 22 Q. Automated credit -- 23 A. Automated Credit Transfer. So there was that trend, in 24 any event, and that was plainly what the DSS would have 25 preferred because it's cheaper and it absolutely 21 1 eliminates encashment fraud. It's easier to administer. 2 So I would say that was always their preference. So 3 POCL wanted to head that off, that trend off, and get 4 the thing automated as soon as possible, but so long as 5 they had the Benefits Agency book business and ACT was 6 on the backburner, actually the incentive on them was 7 not as great as subsequently when BA said "Okay, we're 8 now going to go to ACT as our mainstream way of 9 delivering -- of paying benefits". 10 Q. So why did the withdrawal of the Benefits Agency from 11 the programme increase that existing pressure to move 12 fast? 13 A. Because when they did withdraw, they said, "Okay, we're 14 now going to go ACT mainstream and we're going to move 15 away from the Post Office and we're going to do that 16 from" -- from memory, 2003. So they basically gave 17 a window of opportunity to the Post Office to get 18 themselves automated and also something called Network 19 Banking, which I assume we will come on to later, or 20 Universal Bank in place before the default of moving 21 everybody to ACT kicked in in 2003. So there was 22 a window from 1999 to 2003. 23 Q. How do you know this, that the withdrawal of the 24 Benefits Agency increased the pressure -- the existing 25 pressure on Post Office Counters Limited to move fast 22 1 for the implementation and roll-out of the programme? 2 A. Because of what I just said, which was written down in 3 the exit agreement of the BA from the tripartite set up. 4 Q. Do you think there was a risk that this rush to move 5 fast was detrimental to the interests of subpostmasters? 6 A. Well, firstly, I can't -- I really can't comment on 7 that -- detrimental ... okay. Did it make them -- did 8 it induce them to go faster than they should have done 9 to deliver a safe system? There was pressure, 10 absolutely there was pressure, but then, again, we had 11 had an agreed rollout plan such -- which was not 12 accelerated, in fact it went backwards because there 13 were issues and they needed to be fixed, so from the 14 time that the BA withdrew, I would say that there was at 15 least a three-month slip from what had been contemplated 16 when they withdrew, and when we signed the heads of 17 agreement with the Post Office, which then led to the 18 codified agreement. 19 So I think POCL -- the people I dealt with were very 20 measured and careful and I don't think that they cut 21 corners. No, I don't think so. 22 Q. So there -- 23 A. (Unclear). 24 Q. -- wasn't, in the need to move quickly, the rush to roll 25 out, any detrimental effect on the quality of the system 23 1 that was delivered? 2 A. There were -- again, I find it difficult -- "any"? 3 There's always a bit of a trade-off. At one level you 4 can only do so much in a test environment. This is 5 a very complex technical system and a lot of the issues 6 that were experienced were operational, where things had 7 gone not according to plan, for some reason. I'm sure 8 you will delve into that later, but -- 9 So you can do so much in a test environment and we 10 had massive amounts of end-to-end testing. There were 11 also issues going across boundaries, between the Pathway 12 piece and POCL, TIP, and so on. So, at some point, you 13 do actually have to go into the live environment and get 14 feedback. The question for me is: what do you do when 15 you get feedback and how well do you respond to that 16 feedback? 17 Q. Can we move to a new topic and we're going to circle 18 back round a little later today to look at some of the 19 answers that you have just given by reference to what, 20 in fact, happened on the ground. 21 Can you explain to the Inquiry, in your own words, 22 what the PinICL system was? 23 A. Basically, it was an error fault logging system, so if 24 something had been reported to the helpdesk that 25 indicated an underlying fault, then it would result in 24 1 a PinICL. A PinICL would be raised and that would go 2 through the support and development team in order to get 3 either a workaround or a clarification, or a fix, a bug 4 fix. 5 Q. It's right, isn't it, that PinICL was an internal ICL 6 system? 7 A. It was an internal ICL system but POCL were aware of it 8 and had visibility of it. 9 Q. I'm going to test in a moment what "aware of it" and 10 "visibility of it" mean. 11 A. Okay. 12 Q. It was an internal system, in that it was designed by 13 ICL Pathway? 14 A. By ICL. It was a standard ICL system which ICL Pathway 15 used. 16 Q. Okay, so it was an off-the-shelf, as it were, 17 ie a pre-existing system that existed even before 18 Pathway was conceived? 19 A. My understanding -- and, again, I'm going back a long 20 way -- is that this was the standard that ICL used right 21 across its business. 22 Q. Can you recall who designed it? 23 A. No, no. I mean, it was pre-existing, is my 24 recollection. We simply adopted it as part of ICL. 25 Q. You wouldn't be able to help us with who developed it? 25 1 A. No idea, sorry. As I say, it was pre-existing. It 2 probably existed for years prior to the creation of 3 ICL Pathway. 4 Q. In terms of running or operating it, that was done by 5 ICL Pathway, is that right, in the context we're 6 speaking about? 7 A. In the context we're speaking about, yes. All the data 8 that went into it, the entries that went into it and the 9 outputs that came out of it were managed by ICL Pathway, 10 correct. 11 Q. Can I turn to whether Post Office Counters Limited staff 12 had direct access to the PinICL system. You tell us in 13 paragraph 160 of your statement -- I think we should 14 probably turn that up. 15 Page 53 of your witness statement, that's 16 WITN03770100 at page 53, and 160 at the bottom, please. 17 Thank you. If you just scroll up a little bit, please. 18 This is under the cross heading "POCL awareness of 19 issues within the Horizon System at the time of 20 rollout". You are dealing with a different issue here, 21 but, in the course of dealing with it, you say in 22 paragraph 160, second line: 23 "My understanding is that [Post Office Counters 24 Limited] had access to our PinICL system and test data 25 and that, under the aegis of the Joint [Acceptance 26 1 Incident] Workshop, they were intimately involved in the 2 [Acceptance Incident] rectification plans", et cetera. 3 It's the part of the sentence that says "My 4 understanding is that [Post Office Counters Limited] had 5 access to our PinICL system" that I want to ask about. 6 Are you there intending to refer to a contractual right 7 vested in Post Office Counters Limited to obtain access 8 to data held on PinICL, ie a theoretical right in 9 a contract that could be exercised on demand by Post 10 Office Counters Limited? 11 A. I don't recall ever having discussed that. My 12 understanding was that, certainly with respect to the 13 AIs, all of the relevant PinICLs were shared with POCL, 14 so we had a lead on both sides and they shared 15 information between them. 16 Q. Putting the AIs to one side for the moment, I'm looking 17 at the PinICL system. 18 A. Right. 19 Q. Are you referring there to what I have described as 20 a theoretical right, a contractual right on demand, "Can 21 we please see what is on a PinICL", or are you referring 22 to an understanding that, as a matter of fact, the Post 23 Office had direct physical access to PinICLs, just as 24 a matter of course? 25 A. I think not, as a matter of course. So, in hindsight, 27 1 I probably would have worded this slightly differently. 2 The point here was specific to the AIs and those PinICLs 3 that related to the AIs, I believe, were shared. 4 That's different, I can see that, from having 5 a contractual right to just go through any and all 6 PinICLs. I don't know, to be honest, whether they did 7 have access, or some members of their team had access. 8 I genuinely don't know that. 9 Q. Are you aware of any policy or procedure, or protocol 10 concerning the issue of access by the Post Office to 11 PinICLs and test data? 12 A. I don't, no. 13 Q. So, although this is written in an unqualified way, 14 ie it isn't restricted to those PinICLs that were 15 associated with AIs, albeit you are discussing AIs at 16 the time, you don't have any evidential basis for saying 17 that Post Office had, as a matter of course, direct 18 access to all and any PinICLs; is that right? 19 A. That is correct, yes. I mean, this was written in the 20 context of the AIs and I can see that what I said there 21 is probably too broad a sweep. I was thinking 22 specifically of those PinICLs that related to the AIs. 23 Q. In relation to the AIs, what is your understanding of 24 how Post Office Counters Limited secured access to those 25 PinICLs that were associated with a AI? 28 1 A. To be honest, I don't know. You would have to ask my 2 technical colleagues, but -- 3 Q. We will get to those, in due course. 4 A. Okay, right. 5 Q. Can we look at the documents to see whether Post Office 6 Counters Limited did have a contractual right to look at 7 records in PinICLs, so data that happened to be in 8 PinICLs, and could we look, please, at FUJ00000071, the 9 codified agreement. Can we turn to page 49, please, and 10 can we look at paragraph 801.2. I will read it out: 11 "The Contractor shall grant or procure the grant to 12 POCL, any statutory or regulatory auditors of POCL and 13 their respective authorised agents the right of 14 reasonable access to the records and shall provide all 15 reasonable assistance at all times for six (6) years 16 after the creation of the relevant Records for the 17 purposes of carrying out an audit of the Contractor's 18 compliance with this Codified Agreement including all 19 activities, Charges, performance, security and integrity 20 in connection therewith. Each party shall bear its own 21 expenses incurred pursuant to this clause. On 22 termination, the Contractor shall within a reasonable 23 time to be agreed by the parties, transfer the Records 24 to POCL or a replacement contractor, as instructed by 25 POCL. The Contractor shall thereafter be released from 29 1 any further liabilities under this Clause in relation to 2 such Records." 3 You will see that "Records" in the third line has 4 a capital R, it's a defined term. 5 Can we look at page 89, please, of the document. 6 I think it might, in fact, be the previous page. 7 (Pause) 8 If you just keep going, thank you. "Records" 9 defined as: 10 "Full and accurate records relating to the 11 performance of the POCL Services." 12 I'm not going to turn it up now and chase down what 13 "POCL Services" meant, but it is defined in this 14 codified agreement as: 15 "The core systems services and all other obligations 16 of the contractor under the Codified Agreement." 17 Can we go back to page 49 and paragraph 801.2, 18 please. Thank you. This tends to suggest that POCL had 19 a right of reasonable access to the records as we have 20 defined them but, for the purposes of an audit -- if we 21 just scroll up on the page, it's under the heading 22 "Audit" -- would you agree, reading those now, that the 23 primary purpose of the provision appears to be to allow 24 access to the records for the purposes of a financial 25 audit? 30 1 A. Well, that would be the normal implication of statutory, 2 regulatory auditors and keeping records for six or 3 seven years would be the norm. 4 Q. So you've got the heading, you've got the time period 5 and then you've got the reference to statutory or 6 regulatory auditors, pointing in the direction that the 7 purpose of this clause was to give POCL a right of 8 reasonable access for that purpose. 9 A. Well, that's how I would have read it. You have just 10 pointed me to the definition of "Records" which has 11 broadened that. 12 What I can say with confidence is that certainly at 13 the time of the AI exercise, which I was very much 14 involved in as joint chair with Keith Baines, I was 15 confident that any and all PinICLs that were relevant 16 were being shared. 17 Now, what I don't know is whether our POCL 18 colleagues were given direct access into the PinICL 19 system, that's what I don't know. So there's the point 20 about "reasonable access" and what is "reasonable 21 access"? I genuinely don't know the answer to that. 22 You would have to ask a technical support person. 23 Q. That's what I'm seeking to explore with you at the 24 moment. 25 A. Yes. 31 1 Q. Would you have -- would you read these clauses as 2 permitting Post Office Counters Limited access because 3 they are sufficiently broad to allow access to records 4 and give a right of access to records held within the 5 PinICL system as a matter of course? 6 A. From the definition of "records" that you reminded me 7 of, I think it's a reasonable interpretation, but what 8 I would say is that I have no recollection of it being 9 brought up as a contractual matter by Keith Baines or 10 anybody else, ie it was never an issue to my 11 recollection. So either they had the access and that 12 would explain why there was no issue, or alternatively 13 POCL thought they had sufficient sharing of information 14 without direct access, such that it wasn't an issue for 15 them. 16 Q. In terms of physical access, was the -- that can be 17 taken down, thank you. 18 In terms of the situation on the ground rather than 19 the contractual right, on what system was PinICL run, or 20 was the system itself called PinICL? 21 A. My recollection -- and this was not really my bailiwick, 22 is that this was a part of their support suite of 23 applications that we, if you like, adopted from the 24 mothership. I really don't know the answer to your 25 question. 32 1 Q. Were clients habitually given access to suites of 2 applications provided by the mothership? 3 A. No, no, I mean you would need to consider security and 4 I would say almost certainly not. They were intended as 5 internal systems and normally if we're carrying out 6 a project for a client, on an outsourced basis or 7 project basis, I would have thought that there would be 8 an agreement about what information would be shared but 9 it wouldn't extend to direct access into internal 10 systems. That would be my guess. 11 Q. You looked, in the course of your joint chairmanship of 12 the resolution of some particularly complex and 13 problematic AIs, at PinICLs, back in the day, on 14 a relatively regular basis. 15 A. Yes. 16 Q. Did you ever see an entry on a PinICL made by 17 an employee of Post Office Counters Limited? 18 A. Not a direct entry. What I have seen is a reference to 19 an individual in POCL support team who had "authorised 20 closure" of a particular PinICL and there were at least 21 two, possibly three of those that I have seen and 22 I refer to in my witness statement. 23 Q. We're going to come to those in a moment. You're not 24 referring there to something that a Post Office Counters 25 Limited employee typed in, this is something that an ICL 33 1 Pathway employee typed in saying -- 2 A. Yes. 3 Q. -- "I have spoken to Mr X or Ms X, they authorise 4 closure", for example? 5 A. Correct. To repeat, this was an internal system and we 6 gave, I believe, reasonable access to it or extracts 7 from it, but beyond that we didn't allow POCL people to 8 make direct entries and take control over it, no. 9 Q. You said "In my view we gave them reasonable access to 10 it", did that mean -- coming back to some of the answers 11 you gave earlier -- you still believed that they had 12 viewing rights of it? 13 A. I don't know. 14 Q. -- that they exercised? 15 A. I don't know whether they had direct viewing rights. 16 I will be honest, I'm not sure I ever knew and 17 I certainly can't remember. What I would say is they 18 had extracts at least which appeared to satisfy them at 19 the time, but again you would need to talk to my 20 technical colleagues who had the direct interaction 21 between themselves and their opposite numbers. 22 Q. Can we look at some of the documents that you were just 23 referring to and a convenient way of doing that will be 24 through your witness statement because you actually cut 25 into your witness statement the relevant PinICLs. 34 1 A. Okay. 2 Q. It is WITN03770100 and it's at page 41. Just to 3 introduce some context, at paragraph 122 you say: 4 "To understand better what had been going on in the 5 run-up to the joint decision to start volume Rollout 6 in January 2000, in preparing this witness statement 7 I went through [the] PinICLs raised in late 1999 that 8 related to AI376. I do not recall having seen any of 9 these PinICLs at the time although (as explained above) 10 I had been briefed on the issue." 11 Then you set out in paragraph 123 three PinICLs, 12 those ending 552, 884 and 363. You say that they are: 13 "... examples of PinICLs that identified Reference 14 Data as the cause of issues. The records show that in 15 each case [Post Office Counters Limited] were aware of 16 what had happened and approved closure of the PinICL, as 17 demonstrated by the quotations below ..." 18 You deal firstly with 552 and I think we've got the 19 whole of the relevant bits of the PinICL there. It 20 reads: 21 "This is clearly the result of the missing Primary 22 Mappings on the local travel ticket products in the 23 Southend area. The error in the reference data was 24 corrected on Friday 24th September and therefore 25 [transferred] transactions recorded up to that time 35 1 [cash accounting periods 26 and 27] will fail to report 2 to the cash account, causing a receipts [and] payments 3 condition." 4 Then this: 5 "Ok to close as per Martin Box of POCL 16/2/00." 6 Is it that last entry, under your last bullet point 7 there, that you are referring to in your present answers 8 when you say that it is clear that Post Office Counters 9 Limited had knowledge of what was on some of the PinICLs 10 because they authorised closure of them and this is 11 a record of an authorisation to close? 12 A. That's part of what I was trying to describe. This is 13 clearly a little bit later than the actual AI workshops 14 which took place in August/September 1999, so this being 15 dated closure in February 2000, so this would have been 16 an operational PinICL that occurred. At the time there 17 were different PinICLs. There had been reference data 18 related PinICLs that we -- as I recall, the first known 19 one was in June 1999. So earlier, I was referring to 20 the approach during the AI workshops where we had a very 21 strong focus on identifying the problems, understanding 22 the root cause and fixing them. 23 Q. If we look at the next one please at paragraph 123.2, if 24 we just scroll down. Thank you, yes, that has all of it 25 on there. Again, the first three bullet points don't 36 1 matter, but it's the fourth for present purposes: 2 "Okay to close as per Martin Box of POCL ..." 3 He was a Post Office Counters Limited employee, 4 Martin Box, and so this is a record made by 5 an ICL Pathway employee of their claim that Mr Box had 6 authorised closure of the PinICL, yes? 7 A. That's my understanding, yes. 8 Q. Now, of course, that wouldn't be necessary to make 9 a record like that if Post Office Counters Limited did 10 have direct access to the PinICL because they could type 11 in "We agree closure"? 12 A. They didn't have -- can I just challenge you a little 13 bit on that. They might have had view access, they 14 might have had, but not write access. They definitely 15 did not have write access. 16 Q. By "write access" you mean writing access? 17 A. Writing access, yes. I'm very confident with that but 18 I don't know whether they -- some individuals may have 19 been given a viewing access, I just don't know. 20 Q. So is your final position on this then, you don't know 21 one way or the other and we can -- 22 A. In terms of viewing, that's correct. I do know that 23 they wouldn't have had write access. 24 Q. Thank you. Can we look at -- that can come down, thank 25 you -- something which is the reverse of -- to some 37 1 extent the reverse or the obverse of what we have just 2 been looking at, namely remote access by ICL Pathway to 3 systems to make changes to them at a counter level, 4 without the relevant subpostmasters' knowledge and 5 without the relevant subpostmasters' permission. 6 To your knowledge, did Pathway have the ability to 7 obtain such remote access without the relevant 8 subpostmasters' knowledge or permission? 9 A. No. Let me give you a little bit of -- perhaps a longer 10 explanation than you want. The way the architecture 11 worked was that all transactions, all messages, 12 so-called, were exchanged between counters within 13 a branch and then from the branch to so-called 14 correspondence servers. So they were all supposed to be 15 in sync. Now, there was no ability to get access into 16 a branch PC, but what there was was a possibility to get 17 into the correspondence server, make an entry in the 18 correspondence server, which would then propagate back 19 to the branch, so the effect would be the same. 20 The point though is that it would be clear -- should 21 have been clear, I had understood -- that any entries 22 made in the correspondence server would show up as 23 entries made on the correspondence server, in other 24 words they would appear as a different counter or some 25 such. There would be a marker in the audit trail that 38 1 showed that those entries had been made centrally as 2 opposed to within the branch, so if there's an argument 3 later, the audit trail would have shown where 4 an additional message would have been inserted. And 5 that, for me, was absolutely fundamental, that there 6 would be an audit trail. 7 The other point I quickly make is that no message 8 that had been created in a branch could be amended, as 9 that message was unique and discrete, a bit like block 10 chain. Riposte was a forerunner to block chain. 11 Q. When did you acquire the knowledge that you have just 12 summarised? 13 A. At the time. I dealt with Riposte technology to the 14 level, as I was saying earlier, that I needed to in 15 order to understand what could happen, what the risks 16 were, and I also managed the contract with Escher, who 17 were the supplier of Riposte, and it was Riposte that 18 was at the heart of what I just described. 19 Q. So to be clear, there was remote access by ICL to the 20 correspondence server, which such access would have the 21 effect, or could have the effect, of changing 22 transactions conducted at branch level, but your 23 understanding was that should be identifiable for audit 24 purposes. 25 A. If I may slightly modify what you stated, the 39 1 correspondence server sat in Wigan and Bootle, so they 2 were central servers. 3 Secondly, they would show up with a time stamp as 4 subsequent messages, well after the original -- let's 5 say there was an erroneous message, some kind of 6 doubling up or whatever, there were -- I dare say you 7 will go into that later -- opportunities for error, 8 let's put it that way, inadvertently, to occur and this 9 would have been a way to fix those after a -- I would 10 have expected a helpdesk call from the postmaster to say 11 he had a problem. 12 There was also this notion of repaired cash 13 accounts, and so on, and so on, strict rules about that. 14 But they would have all been made in the central service 15 and there would have been, as I say, a separate, 16 completely separate, set of messages associated with 17 those changes, so that if there was an argument later 18 the audit trail would have shown. 19 Q. You said that that separation and the separate set of 20 messages was fundamental. Why was it fundamental? 21 A. Well, for actually the reasons that we're having to 22 discuss, so that there would be no argument later. 23 Q. No argument about what? 24 A. Well, who had made what changes, who had made what 25 errors. The idea was -- 40 1 Q. Ie whether they were the responsibility of 2 a subpostmaster, or as a consequence of action taken by 3 an ICL employee at or in the correspondence layer? 4 A. Precisely. 5 Q. What controls and safeguards were that system, the use 6 of remote access to the correspondence layer, subject 7 to? 8 A. Well, you would have -- I'm sorry to defer on this. You 9 would have to talk to my support colleagues. My 10 understanding from, if you like, my commercial role was 11 that there would be very stringent security controls, 12 access controls for -- I think I was expecting third 13 line only, third line support. 14 Q. Yes. When you say "stringent access controls", you mean 15 the barriers or gateways that would have to be passed 16 through in order to obtain access? 17 A. Yes, correct, and the other thing I say on top of that 18 is that -- I'm sure you will come on to it this later -- 19 the third supplemental agreement and related service 20 control documents stipulated very clearly that, whenever 21 anybody in ICL made a change, they were to inform POCL, 22 or POL as it became, of whatever those changes were and 23 the reasons for those changes. 24 Q. How widely known at board level, ICL Pathway board 25 level, was it known that such remote access existed? 41 1 A. I don't know, to be honest -- 2 Q. Was it the kind of thing -- sorry. 3 A. Let me carry on and try and answer that. Did we ever 4 talk about it? I don't remember a minute of it at any 5 of the board meetings, but what I can say is that any 6 system you have to have some kind of third line ability 7 to get into systems to make changes. Now, you want 8 those to be as limited as possible but there is that 9 need. If there's a corruption, sometimes you just have 10 to go in and fix it. Now, this is beyond my knowledge. 11 You would need to talk to support people on just what 12 they knew and how they actually did it in practice, 13 that's the other point. 14 Q. In terms of the breadth of knowledge at board level, 15 which is what I'm interested in at the moment, was this 16 facility so obvious that it need not be discussed? 17 A. Yes, because, as I said, any system and all systems, 18 I would contend, have very tightly controlled -- they 19 should be very tightly controlled, very limited number 20 of key personnel -- sorry, not key personnel in the 21 sense of this contract, but trusted people with 22 particular levels of expertise who could go in, do 23 a very limited number of amendments, which would then be 24 documented, and I stress that they should always be 25 documented. 42 1 Q. When you say "documented", do you mean separately 2 written up and catalogued or do you mean, by the very 3 operation of the system, there is an audit trail 4 available of the messages? 5 A. There would be an audit trail of the messages. One 6 would obviously need to go and look for them and to know 7 to go and look for them, which may have been a problem 8 here, I don't know. But also the process around the 9 third supplemental agreement was that, whenever such 10 a change was made, POCL were to be informed. 11 Q. Would have been, how? 12 A. There was -- again, if you were to refer to -- I think 13 it was called the TIP incident process, TIP -- TIP 14 reconciliation and incident process. 15 Q. We're going to go on to that in detail later. 16 A. That's the place -- 17 Q. Hold on a moment. That's a very specific issue arising 18 out of a specific problem, AI376. 19 A. Yes, but this is all to do with, as far as I'm 20 concerned, 376 and -- 21 Q. The answers that you have been giving are only framed by 22 reference to AI376; is that right? 23 A. Well, did you say you wanted to get back to it in detail 24 later? 25 Q. Yes. 43 1 A. My answer is in response to 376 broadly. Maybe when we 2 get to it you will see if it needs to be expanded on but 3 that's the context I'm referring to, yes. 4 Q. To your knowledge, did anyone within Post Office 5 Counters Limited know about ICL's remote access to the 6 correspondence layer? 7 A. It was a requirement in the supplemental agreement, so 8 yes. I mean, you say remote access to the 9 correspondence server. This was the support people who, 10 in a sense, are logically sat right on top of the 11 correspondence server, so the remote point I don't quite 12 fathom. They are logically sitting in the data centre 13 managing these correspondence servers. 14 Q. We could knock off the word "remote" and just say 15 "access"? 16 A. Yes. 17 MR BEER: Can I turn -- in fact, before we turn to the next 18 topic I wonder whether that's a convenient moment, sir, 19 for the morning break. 20 SIR WYN WILLIAMS: Yes, by all means. 21 MR BEER: Sir, could we say half past please? 22 SIR WYN WILLIAMS: Yes, fine. Thank you very much. 23 (11.14 am) 24 (Short Break) 25 (11.29 am) 44 1 MR BEER: Sir, good morning. Can you see and hear me? 2 SIR WYN WILLIAMS: Yes, I can, thank you. 3 MR BEER: Thank you, and likewise. 4 Mr Oppenheim, can I turn to consider disclosure 5 obligations for the purposes of criminal proceedings. 6 A. Mm-hm. 7 Q. After the Benefits Agency withdrew from the tripartite 8 arrangement, you know, we know, that ICL Pathway and 9 Post Office Counters Limited entered a bilateral 10 agreement. 11 A. Yes. 12 Q. I just want to look, please, at paragraph 277 of your 13 witness statement, that's page 85, please. It is, in 14 fact, the last paragraph of your statement. I hope by 15 now, if we go down, the page has been replaced and you 16 can now see your signature in there. 17 A. Yes. 18 Q. That is your signature? 19 A. That is my signature. 20 Q. The "GRO", the general restriction order redaction has 21 been removed. 22 A. Yes. 23 Q. But, anyway, more substantively, at paragraph 277, you 24 say: 25 "I was aware of [Post Office Counters Limited's] 45 1 facility to mount private prosecutions against 2 subpostmasters determined to be acting fraudulently and 3 that the Codified Agreement ..." 4 Just interposing there, the codified agreement is 5 the agreement that I just mentioned: 6 "... required Pathway to provide audit trails when 7 requested to do so to support such prosecutions. My 8 expectation was that each case would be properly 9 investigated before concluding that the cause of a cash 10 shortfall was indeed fraud rather than some kind of 11 mismatch in the system. To the best of my recollection, 12 I was never asked to look into any of these cases -- 13 indeed, I was completely unaware at the time that the 14 prosecutions were going on." 15 It's the first sentence that I'm interested in 16 particularly. You were aware, that's aware at the time, 17 of Post Office's facility to mount private prosecutions 18 against subpostmasters? 19 A. I was. There's a provision in the contract and there 20 was in the original POCL contract, which was the 21 forerunner to the codified agreement, which was carried 22 forward, that we would support the Post Office in -- 23 when requested to do so -- in mounting such 24 prosecutions, with the provision of information. 25 Q. You have referred to the codified agreement, which we're 46 1 going to come to in a second, and the fact that it was 2 carried forward from the original agreement to 3 a provision. Is it by that means that you knew about 4 the facility of the Post Office to bring private 5 prosecutions? 6 A. That was the original trigger for that awareness and 7 I remember asking Liam Foley, one of the colleagues you 8 will remember, sorry, from the organogram, about it and 9 he explained that that did exist. I was very surprised 10 at the time. 11 Q. Surprised about what? 12 A. That the Post Office had that jurisdiction. 13 Q. And why were you surprised? 14 A. Previously I was just unaware that anybody had that 15 jurisdiction, other than Crown Prosecution. 16 Q. So the awareness that you had existed in the period 17 from, would this be right, about 1996 to 2002? 18 A. That sounds right, yes. 19 Q. So you knew that it was the Post Office, unusually, who 20 would be a prosecutor rather than, as you said, the 21 police or the Crown Prosecution Service? 22 A. As I say, I was aware of it. It never really came up in 23 my working experience over that time. 24 Q. Can we look at the second part of the sentence there 25 where you are, is this right, drawing a link between 47 1 your knowledge of the facility of Post Office to 2 prosecute in the criminal courts its subpostmasters for 3 fraud and a part of the codified agreement that requires 4 the provision of data to support such prosecutions? 5 A. Yes, I'm trying to make the case that -- the point that 6 I was aware of the provision to provide such information 7 and I assumed that it would be a rare thing when it 8 happened and that we would provide the audit trail kind 9 of information that I was referring to earlier. 10 Q. Why did you assume that it would be a rare thing? 11 A. Because I had assumed that inspection of the kind of 12 information that, again, I referred to earlier, whereby 13 we -- where there was a mismatch in the system, as 14 referred to here, and in the third supplemental 15 agreement, in particular, and the subsequent operational 16 processes, that there was an acknowledgement that there 17 would be occasional mismatches. I mean, everybody knew 18 that and the scale of the system was such any remote 19 system will have mismatches occasionally. 20 So the question then was, well, what happens when 21 there is such an event? And my presumption was, 22 wrongly, that the Post Office would look into those and, 23 certainly at the outset, as I say somewhere else, give 24 the postmaster the benefit of the doubt. We needed 25 feedback when these things occurred, in order to find 48 1 the errors in the system and then fix them. 2 Q. Why would you assume that the Post Office would give, in 3 prosecutorial decisions, subpostmasters the benefit of 4 the doubt? 5 A. Well, I had assumed that, before getting to prosecution, 6 the people that were on, as it were, the other side of 7 the fence from me would look into the evidence, the 8 audit trails that we were talking about earlier, so 9 start with the support people and they would look at it 10 and they would put questions to ICL Pathway and we would 11 respond and we would dig into these things, in the same 12 way as we did with PinICLs. That was the whole point 13 about PinICLs and incidents and also problems, which 14 were combinations of similar incidents. 15 Q. You said that you assumed. Is that something that you 16 remember assuming from 25/27 years ago, or is it 17 something that you have looked at now and is an ex post 18 facto rationalisation of what you think you would have 19 thought, had you thought about it at the time? 20 A. It didn't occur to me that POCL would rush to 21 prosecution without checking the facts and the fact that 22 we had all of these very, very detailed provisions as to 23 what to do under certain error conditions, operational 24 error conditions, for me was an indication that my 25 opposite numbers understood that these things would 49 1 occur and that there was a process for dealing with 2 them. 3 And, on occasion, I write somewhere, there's 4 a specific statement in the third supplemental 5 agreement, that it would not always be possible to 6 determine what exactly had gone wrong in a particular 7 case and, therefore, if we had to make an assumption 8 about putting something right we would absolutely inform 9 the Post Office of what that was and then it was up to 10 them to determine whether that was a correct assumption 11 or not. 12 I was very uncomfortable with the pressure that we 13 were under to actually make corrections. We were 14 invited to make all the corrections. We pushed back on 15 that and, in the case of TIP errors, Post Office then 16 made the errors -- the error corrections. But, I mean, 17 there was just a general understanding between all the 18 technical and commercial people that there would be 19 occasional errors. There's something like 10 million 20 transactions a day going through this system: there will 21 be errors. 22 Q. You either think now that you would have thought, had 23 you addressed your mind to it, or thought then, that the 24 Post Office in making prosecutorial decisions would, 25 against that context of the likelihood of errors 50 1 generated by the system itself, have given 2 subpostmasters the benefit of the doubt? 3 A. Benefit of the doubt, certainly in the early stages when 4 they always have teething problems with any new system. 5 So you asked earlier about did they rush to rollout, did 6 we rush to rollout. There was a judgement call made as 7 to the quality, we passed the tests, but the word of 8 caution was always be on the look out for new things 9 that we didn't know about, and that's the same with the 10 introduction of any new, large complex system. 11 So in the early days, certainly, I would have said, 12 "Let's listen to the feedback, pay attention, work out 13 what's going on here", and, in that circumstance, yes, 14 give the benefit of the doubt. 15 I'm not sure what -- that would necessarily be what 16 I would have said, say, five years in, when the thing 17 should have been completely bedded in, but, even then, 18 there needed to be an inspection of the audit trails and 19 the facts. 20 Q. We can take that document down but, in its place, 21 please, put FUJ00000071. Back to the codified agreement 22 and can we look, please, at page 97. If we can 23 highlight/blow up, "Prosecution Support", 4.1.8 and 24 4.1.9, please. These provisions in the codified 25 agreement provide that: 51 1 "The contractor shall ensure that all relevant 2 information produced by the POCL service infrastructure 3 at the request of POCL shall be evidentially admissible 4 and capable of certification in accordance with Police 5 and Criminal Evidence Act (PACE) 1984, the Police and 6 Criminal Evidence (Northern Ireland) Order 1989 and 7 equivalent legislation covering Scotland. 8 "At the direction of POCL, audit trail and other 9 information necessary to support live investigations and 10 prosecutions shall be retained for the duration of the 11 investigation and prosecution irrespective of the normal 12 retention period of that information." 13 Would you agree that, in order for ICL Pathway to 14 comply with these provisions, it would be necessary for 15 it to understand what is required in order to make 16 information evidentially admissible and capable of 17 certification in England and Wales, in accordance with 18 the Police and Criminal Evidence Act 1984? 19 A. That's the requirement as stated, yes. 20 Q. It's the requirement as stated but, in order for 21 compliance to occur, it would be necessary for your 22 company to understand what is required in order to 23 ensure that such relevant information is evidentially 24 admissible, ie how do we go about carrying that 25 provision into effect? 52 1 A. I agree, absolutely right. That's what is required of 2 us and that's what we should have done. Now, what 3 I can't speak to is personal knowledge of those details. 4 They are very important details but I was not involved 5 in that. That whole area was, as I recall, Martyn 6 Bennett, risk management -- part of his portfolio. 7 Q. But would you agree that it would -- it, ICL Pathway -- 8 only be able to comply with the provision if it knew 9 what the requirements of the law were, so that it could 10 ensure that data was captured, retained and enjoyed 11 sufficient integrity and reliability and be placed in 12 a suitable form evidentially to a court? 13 A. So my understanding was -- I never looked at this in 14 detail, this provision in detail myself, but my 15 understanding was that the information provision that 16 was agreed between ICL Pathway and POCL, specifically 17 around the third supplemental agreement and the related 18 control documents, were designed to deliver precisely 19 this and there was a mass -- as I was alluding to 20 earlier -- a mass of audit trail information behind 21 that. 22 So out of all of that, I would have expected all of 23 the substance to be satisfied. What I don't know about 24 is the form and the detail of those requirements. 25 Q. You said in the middle of that answer that you didn't, 53 1 I think, concentrate on this requirement in detail at 2 the time. You did tell us in your witness statement 3 that you were aware that the codified agreement required 4 Pathway to provide audit trails when requested to do so 5 to support private prosecutions? 6 A. Correct. I was aware of these two paragraphs. 7 Q. Being aware of those two paragraphs, to your knowledge, 8 did ICL Pathway seek advice on what the requirements 9 that had been placed upon it were, in order to be able 10 to achieve compliance with the contractual provisions? 11 A. I have to say, I don't know. I covered a lot of ground 12 but I didn't cover this ground. This was, as 13 I recall -- as I said before, the remit of Martyn 14 Bennett. Whether he took external advice or not, I'm 15 afraid I can't tell you. 16 Q. Would you agree that, in the absence of either such 17 advice or a very good existing understanding of the 18 criminal law, which is perhaps unlikely within IT 19 professionals, compliance with the clause at a practical 20 level would be difficult to achieve? 21 A. I don't know. It's -- if all of the basic data was good 22 data, was kept and was made available, then I should 23 have thought that that was what this was pointing to, 24 but I don't know. 25 Q. Well, for example, you wouldn't, unless you knew what 54 1 the law required, either because you knew it or because 2 you had been advised about it. You wouldn't build into 3 your systems a requirement or a process which says if 4 a client ever wishes to use the data, which our system 5 is producing or handling, for the purposes of criminal 6 proceedings, then we would have that data ready for 7 disclosure and for such use in a state that's 8 evidentially sound. You wouldn't design your systems 9 that way. 10 A. You wouldn't necessarily make any changes to the design 11 of the system which was designed to flag issues and, to 12 the extent possible, identify the root causes and the 13 appropriate course of action and report on them in 14 a day-to-day operational sense. 15 So if it satisfies those and it satisfied the Post 16 Office requirements, which were very detailed indeed 17 about reporting, then I should have thought that their 18 requirements at the CCD level -- sorry, contract control 19 document level -- would have encompassed this because 20 they were the people who were basically the custodian of 21 this process for the Post Office. If they weren't 22 satisfied with what we were doing, I would have expected 23 them to have told us that and if they had looked at it 24 and felt it was wanting, then it would have come to me 25 as a contractual issue, but it didn't. 55 1 Q. Well, one approach would be to say "Look, we know, or we 2 have been advised that at this time the criminal law, 3 a provision in Police and Criminal Evidence Act 1984, 4 says that it may be necessary for an employee of Pathway 5 to say to a court 'There are no reasonable grounds for 6 believing that the data produced by our system is 7 inaccurate by improper use of it', how are we going to 8 be able to say that in a witness statement to a court? 9 Can we design our system in a way that allows 10 an ICL Pathway employee to say such a thing?" 11 A. So, taking your question in the two parts, taking the 12 second part first, the design of the system was first 13 and foremost to ensure accuracy, but also then 14 operationally, if there was an error identified, 15 identify the error, identify the root cause where 16 possible, what fixes would be needed and the processes 17 for managing that all through and reporting on it. So 18 if you have satisfied those then I can't imagine, apart 19 from presentation, that there would be anything more 20 that we would need to do to satisfy this condition, but 21 that's -- that statement is a statement out of not 22 knowing the detail of the law. 23 Now, as I said, Martyn Bennett would have had this 24 responsibility. There were people in probably second or 25 third line support who would have been charged with 56 1 pulling out the audit trails and producing the evidence. 2 We also, at the time, had an in-house lawyer. He 3 may or may not have looked at it. 4 Q. What was his name? 5 A. Warren Spencer. You may recall him from the organogram. 6 So what I don't know is whether these -- my colleagues 7 looked into this at that sort of legal level and 8 satisfied themselves that, based on the operational data 9 that we would be producing, that we would be compliant. 10 Now, as for getting one of our people to talk to the 11 accuracy -- and I -- I would always hope that there 12 would be a degree of caution inserted in any statement 13 that can guarantee that this is accurate, because with 14 IT systems sometimes they do go wrong, that's just the 15 nature of them, particularly, as I said, where they're 16 distributed, you have breaks in communication between 17 the branch and the centre, you can have a printer fail 18 in the middle of a transaction, there are all manner of 19 things -- or ran out of paper in the middle of 20 a transaction -- all manner of things that can go wrong 21 and if they can then they will, particularly at such 22 a large scale. 23 So you've got to allow for the possibility that 24 something has gone wrong that we don't actually 25 understand. 57 1 Q. You said that Martyn Bennett had responsibility for 2 ensuring the discharge of this obligation? 3 A. I thought so. This would logically have come under him. 4 Alternatively it would have come under -- 5 Q. Just stopping you there. We can take that down from the 6 screen now. 7 A. Okay. Alternatively, it would have fallen to my service 8 director colleague, Steve Muchow, at the time, so it 9 could have simply been given to him to enact, but in 10 terms of satisfying ourselves that we could satisfy 11 this, I would have expected that to have been Martyn 12 Bennett and possibly Warren Spencer. 13 Q. Why would you expect it to have fallen to Martyn 14 Bennett? 15 A. Because this was viewed as, I think, to the extent 16 I recall it at all, a risk item, but it could also have 17 been a support item which would have made it Stephen 18 Muchow, so I genuinely don't know. 19 Q. Why would it have been viewed as a risk item? 20 A. Because it's -- risk was his title but he was also head 21 of assurance, audit and the like, so this would have 22 come under his other responsibilities to do with audit. 23 Q. Who, if anyone, would have been the liaison point within 24 Post Office Counters Limited in relation to this issue, 25 the design of a system, or the enactment of policies 58 1 that carry this high level statement into practical 2 effect? 3 A. I'm afraid I don't know and it's possible that it was 4 missed at the outset until it started to happen. I mean 5 I just do not recall this ever having come across my 6 desk, sorry. 7 Q. Are you aware of any policy, protocol or other document 8 that does in fact carry this contractual obligation into 9 effect at a practical level? 10 A. No. As I said, there were lots of service incident 11 problem management, and such-like, documents which 12 talked about what you do when something goes wrong, but 13 not in regard to this, no. 14 Q. Yes, there are many, many documents that deal with the 15 operation of the system and the rectification of errors 16 within it at an operational level, as you rightly 17 described it. I'm not looking at this through 18 an operational lens. 19 A. I understand. 20 Q. I'm looking at it through the lens of a contractual 21 provision that says you've got to be ready to disclose 22 things in a form, effectively, that's evidentially 23 secure for the purposes of the criminal law. 24 A. So "secure" in that context, for me, would mean it's -- 25 it has integrity, it's accurate and it's complete and 59 1 whether that is -- those are requirements, in any event 2 under the contract, as far as I'm concerned. So there 3 was nothing that I thought at the time -- benefit of 4 hindsight is a wonderful thing -- that I needed to look 5 at this provision specifically because I felt that all 6 the other things would, in a sense, provide the detail 7 behind it. 8 Q. Did you know Gareth Jenkins? 9 A. His -- I know his name and I don't recall actually ever 10 having had dealings with him. 11 Q. What did you understand, at the time, his role within 12 ICL Pathway to have been? 13 A. I can't remember. He was not someone I can recall 14 dealing with. All the material I have gone through to 15 prepare for this session -- I mean, his name has 16 obviously come up in the context of these proceedings, 17 but I don't recall his name being on any of the PinICLs 18 or any of the AIs, so I wouldn't have dealt with him. 19 He was in the support group and I wouldn't have dealt 20 with him -- sorry, development group. 21 Q. Do you know why he was selected as a person to give 22 evidence as a witness with expertise or as an expert 23 witness on the Horizon System? 24 A. Well, bear in mind when I left the programme there were 25 people like Terry Austin still there, senior people, 60 1 more senior, as I understand it, than Gareth but, by the 2 time a lot of this happened, I would have said, from 3 what I have seen, that he was probably the most senior 4 person and was, therefore, designated to act for 5 ICL Pathway, but I don't know. 6 Q. Are you aware of a practice where, in the course of 7 a prosecution of a subpostmaster for theft and/or false 8 accounting, a request was made for data by them about 9 the operation of the Horizon System and, by then, 10 Fujitsu representatives asked for payment for producing 11 the documents that the individual requested? 12 A. No, I'm not aware of that and I would have said that was 13 wrong. 14 Q. "Wrong" because it would be in breach of the contractual 15 obligation to provide the data or the evidence? 16 A. Well, wrong for that reason and wrong morally, as well, 17 I would have thought. 18 Q. Can I turn to AI (Acceptance Incident) 376 and the cash 19 account discrepancies issue. Can we look at this issue, 20 and this forms a large part of the evidence in your 21 witness statement, so I'm going to spend some time on 22 it. 23 Can we start, firstly, by explaining to those who 24 don't know what a AI is? 25 A. An Acceptance Incident. So the codified agreement 61 1 requires that we run a trial, a live trial, for a period 2 of three months on 300 post offices, at the end of which 3 there would be, basically, an Acceptance Review. 4 Q. Just stopping there, because that language may be 5 unfamiliar to non-IT professionals: an Acceptance 6 Review? 7 A. Okay, so an Acceptance Review would be, basically, that 8 POCL would have looked at the system, looked at the 9 data, looked at basically everything they could look at 10 and determine if it was working according to the 11 specification, or the requirements, so was it working 12 properly, or were there defects and, if there were 13 defects, then how serious were the defects. And there 14 was a classification grid, if you will, of A, B, C 15 severity defects and we were allowed so many As, so many 16 Bs, so many Cs -- in fact, we weren't allowed any As, we 17 were allowed up to ten Bs, from memory. 18 Q. Zero As, ten Bs. 19 A. Ten Bs. So, basically, it was a granular review of the 20 performance of the system, as I say, across 300 post 21 offices and three-month trial period. 22 Q. So the "acceptance" in the phrase "Acceptance Incident" 23 refers to acceptance by Post Office? 24 A. Acceptance by Post Office, correct, and an incident 25 obviously means that something was wrong, it was 62 1 an incident, a bit like an incident as it would be 2 reported from a -- again, an operational standpoint. 3 Q. So with that helpful introduction, can we look, please, 4 at AI376. That is POL00043691. Can we turn to page 57. 5 Thank you. I'm just going to spend a little bit of time 6 on this because this is the first time the Inquiry, 7 I think, has seen an Acceptance Incident form. 8 You can see in the top left-hand corner that it is 9 described as an "Acceptance Incident form", yes? 10 A. Yes. 11 Q. Then on the right-hand side, the Acceptance Incident 12 number is included. This one is 376. 13 A. Yes. 14 Q. Are those numbers generated by ICL? 15 A. You mean the incidents? 16 Q. Yes. 17 A. They have been raised by TIP. TIP is POCL, so what 18 would have happened there is ICL Pathway would have 19 transferred data, which would have come from the 20 branches into the correspondence servers, moved into our 21 so-called TMS system and, from there, transferred to 22 TIP, and TIP would have compared, in this case, two sets 23 of data and would have identified that they were 24 inconsistent with the cash account. 25 Q. My question was much simpler, I think. It was: who 63 1 attributes the number on the top right-hand side, 376? 2 A. Oh, I'm sorry. I think that was POCL. The Acceptance 3 Incidents were, as I recall, recorded and flagged by 4 POCL and they led to the AI workshop that we were 5 talking about. 6 Q. How did they generate Acceptance Incidents, POCL? 7 A. I'm not absolutely sure. I mean, they would have 8 identified, if you like, a bundle of similar problems, 9 errors, like these 821, 822, et cetera, et cetera, and 10 they would have recognised that they were all of the 11 same ilk, put them together. We might have called that 12 a problem under normal operational conditions, when you 13 have similar things producing similar bad outcomes, so 14 we would look at that as a problem and, in this context, 15 they were examples of this particular Acceptance 16 Incident, which was designated 376 and we had 218 and 17 others as well. 18 Q. Hundreds of them, yes. 19 A. I'm not sure there were hundreds, but -- but logically, 20 with 376, I suppose there must have been, yes. 21 Q. Yes. My question again was more basic. How did they 22 physically generate a new Acceptance Incident? So not 23 why would they do it -- 24 A. I don't know. 25 Q. -- or what would cause them to do it. 64 1 A. I don't know. 2 Q. Would they pick up the phone and say, "We've got 3 a series of problems, they are as follows, please 4 generate a new Acceptance Incident", or could they 5 create this form? 6 A. They would have created this form. Martin Box -- 7 Q. I'm sorry? 8 A. Sorry, they would have created this form. The facility 9 was this form, which they would then fill in, as they 10 have done here. Martin Box is the same Martin Box 11 I recognise from that PinICL that we talked about 12 earlier. 13 Q. So are you saying that Martin Box drafted the form? 14 A. No, we would have agreed the form between us. I can't 15 remember who instigated it, whether it was them or us, 16 probably POCL, and then they would have populated it and 17 then we would have responded to it. 18 Q. So you think that somebody from POCL could get into the 19 system that maintained Acceptance Incident forms and 20 write text into them? 21 A. Absolutely. This would have been their form, not our 22 form. 23 Q. So this is a POCL form, not a -- 24 A. Yes. 25 Q. -- ICL form? 65 1 A. Yes, yes. It was POCL who raised the Acceptance 2 Incidents and we had to deal with them. Correct. 3 Q. So we will see that the second box down to the left, the 4 acceptance test name is "TIP Interface". What does that 5 mean, "Acceptance Test Name"? 6 A. Sorry, where is that? 7 Q. Second box down on the left-hand side, underneath 8 "Acceptance Form" it says "Acceptance Test Name"? 9 A. Yes, TIP interface, right. So this is what I was trying 10 to describe before, so there's a daisy chain of data 11 transfers -- 12 Q. Just stopping you there, I'm not asking about the TIP 13 interface, I'm asking what an "Acceptance Test Name" is? 14 A. Well, it simply identifies where the problem occurred. 15 Q. Okay, so this is locating within -- 16 A. Yes. 17 Q. This box is locating in generic terms where in the 18 system the problem exists? 19 A. Exactly. 20 Q. "Source", box 3. So you see after all of the boxes 21 there is a number in parentheses, and I'm going through 22 them in order. I think each time you are diving down 23 into box 10. I'm just taking this very slowly because 24 you are our first witness on this. What does "Source" 25 mean? 66 1 A. Well, the person who would have spotted the problem, so 2 this was, I think, POCL's business support management, 3 I think. 4 Q. Then the "Date Observed", in this case, 19 July. 5 A. Yes. 6 Q. Box 5, "Witness/Reviewer who observed Incident", and you 7 have said already that Martin Box was a POCL employee. 8 A. Yes. 9 Q. "Authority" in box 6, what was that authority for or 10 about? 11 A. I can't recall. I really don't know. 12 Q. And box 7, the "Incident Type". Can you tell us the 13 difference between "Criterion not met" and "Substantive 14 fault"? 15 A. (Inaudible). 16 Q. I'm sorry? 17 A. I would say no, I can't. I could guess at it, but these 18 were determined by POCL not us. There would have been 19 discussion about them but there was very often something 20 of a disagreement between us as to how severe a given AI 21 was. I mean, there was some debate about that. It 22 wasn't an acrimonious debate but there was a debate. We 23 would always, obviously, prefer something to be less 24 serious and they would sometimes, you know, argue that 25 it's more serious than we really thought it was. 67 1 Q. Why would you obviously want something to be less 2 serious? Surely you wanted to do the accurate thing? 3 A. Absolutely right, but there was a question -- if it had 4 no impact on the integrity of the system, then it should 5 be classed as a C category and then it could be swept 6 up, dealt with and released in the next release. 7 If it's an A, it's a show stopper, you can't go 8 forward, you have to identify it and fix it as 9 an emergency update, in effect, before doing anything 10 else. 11 If it's a B, again, it sits somewhere between the 12 two, so you really need to determine the impact or 13 potential impact of whatever it is that's been flagged 14 as wrong. 15 Q. You have already addressed box 9 on the right-hand side. 16 Can we move to box 10, the "Description of the 17 Incident". As this is our first AI, I'm going to read 18 it as a whole: 19 "Description of incident 20 "New Description: AIS contravention/Data 21 integrity -- derived cash account not equal to the 22 electronic cash account. Incidents ..." 23 Then there are a series of TIP numbers given: 24 "... have been raised by TIP in respect of all 25 transactions that constitute a cash account have not 68 1 been received by TIP or when electronic cash accounts 2 received where transactions that have been conducted and 3 received by TIP are missing from the respective cash 4 account lines. These issues have come to light when 5 comparing a TIP derived cash account with the electronic 6 cash account sent by Pathway. Not all instances of 7 similar occurrences have been logged by TIP as the 8 physical resource to check each occurrence of 9 a difference within the derived versus the electronic is 10 not available. It was expected that this facility would 11 by now be comparing like with like. This is very 12 significant. Missing transactions and missing cash 13 account line entries cause reconciliation failures 14 within POCL back end systems and error resolution is 15 invoked. The cash account produced by the 16 Organisational Unit in these instances must be in doubt 17 and is not a fair reflection of the business undertaken 18 at each Organisational Unit. A subpostmaster may be 19 asked to bring to account an error, but the error was 20 produced via system failure rather than human failure. 21 Many hours of investigation at both the front end and 22 back end have taken place to help resolve these 23 problems. The benefits assigned to POCL back end system 24 in respect of an automated cash account are being 25 questioned." 69 1 So, just looking at that text for the moment, you 2 will see that, about ten lines in, the author, whoever 3 it was, says that the incident that they are describing 4 is very significant. Would you agree with that? 5 A. Yes, I would. 6 Q. Why would you agree that, at this stage, the incident 7 was very significant? 8 A. Well, for all the reasons set out in that long 9 paragraph. There's nothing I would disagree with in 10 there. 11 Q. It's very serious because what is described undermines 12 not only the very purpose of the system, it means that 13 the system lacks integrity, it lacks veracity and it 14 lacks reliability, doesn't it? 15 A. At that point, 19 July, summarising things that have 16 been found up to that point, yes. That position was 17 untenable and there's no way we could have gone on and 18 we didn't. 19 You then need to look at what actually transpired 20 after that. 21 Q. We're going to spend the next two or three hours, 22 I think, doing that. 23 A. Okay, fine. But yes, this was a show stopper and 24 I would have had it down as substantive or whatever -- 25 this is a category A. I mean, there's no doubt about 70 1 it. 2 Q. Reading on just after the sentence "This is very 3 significant", the sentence: 4 "The cash account produced by the Organisational 5 Unit in these instances must be in doubt and [it] is not 6 a fair reflection of the business undertaken at each 7 Organisational Unit." 8 That's one of the reasons why the issue is very 9 significant, isn't it? 10 A. Well, it's one. It's also -- it then goes on to talk 11 about the impact on the branch and the subpostmaster, so 12 this is, as I said, an absolute show stopper. You've 13 got to then look at actually what caused the problems 14 and what was done about them. 15 Q. Put in blunter language, that sentence means that it's 16 not a fair reflection on the subpostmaster because the 17 system is showing a false balance? 18 A. It is, that's absolutely right, which is why this needed 19 to be looked at in significant detail. 20 We had only recently -- this was summarised 21 19 July -- only recently really got going with 22 interfacing with TIP on EPOSS transactions. Most of the 23 previous effort had been on the Benefits Agency up 24 until June of 1999. It had been virtually all Benefits 25 Agency, no EPOSS transactions all, so all of the 200, as 71 1 they were, post offices running Child Benefit in the 2 North East and South West were only doing Child Benefit 3 and order book control. 4 So this was new and it was, you know, clearly a show 5 stopper, as I say. The question was what was done about 6 it and where did we end up. 7 Q. The next sentence: 8 "The cash account produced by the Organisational 9 Unit ..." 10 You have referred to the branch. That's another way 11 of referring to the branch, yes? 12 A. That would be my interpretation. It's not a term I'm 13 familiar with. 14 Q. I will read it as branch for the moment: 15 "The cash account produced by the [branch] in these 16 instances must be in doubt and [it] is not a fair 17 reflection of the business undertaken at each [branch]." 18 Then: 19 "A subpostmaster may be asked to bring to account 20 an error, but the error was produced via system failure 21 rather than human failure." 22 That sentence there in a single sentence describes 23 one of the main issues being investigated now, doesn't 24 it: the Horizon System created the balancing errors by 25 the way that it operated, but suggested that the 72 1 balancing error was that of a human and not a computer? 2 A. That was the case then. To what extent did that 3 continue to be the case after all of the remedial work, 4 that -- that would be, for me, the key thing, but at 5 this stage it's a bad indicator, I agree. 6 Q. Although the wording of that sentence about accounting 7 is perhaps a little opaque, would you agree that what is 8 being suggested is that a subpostmaster may be asked to 9 account for an error, even though it was not his or her 10 error? 11 A. Yes. 12 Q. Would you understand that "account for" doesn't just 13 mean provide an explanation for, it means, in context, 14 paying for it or facing the consequences of not paying 15 for it? 16 A. Yes, and I would simply add "and POCL knew that", which 17 is -- goes to my earlier remarks about their knowledge, 18 that there were, at this stage, unacceptable errors to 19 the point where it shouldn't rollout, hence the AI 20 process, and subsequently that there was still always 21 going to be a risk that such a thing could occur and it 22 would need to be investigated. 23 Q. Moving on, if we scroll down please: 24 "Severity: POCL -- high -- would effect POCL's 25 ability to produce an accurate cash account." 73 1 So POCL are describing the severity of the incident 2 as high: 3 "PWY [that's Pathway] -- accept the problem exists. 4 Would argue about the severity -- would it genuinely 5 affect the accounting integrity as it currently 6 [stands]?" 7 You have told us this morning that, on the basis of 8 the earlier text, this was "a show stopper", the point 9 was "made the system untenable", it was a fundamental 10 issue and was undoubtedly high. Do you know why Pathway 11 are recorded as saying they would question the severity 12 and were asking -- 13 A. I think the -- 14 Q. -- "would it genuinely effect accounting integrity"? 15 A. So we're now going back 20-whatever years. I can't 16 defend the proposition that it should be anything other 17 than a major, high severity fault. I think it -- I can 18 only assume that there was an assumption there wouldn't 19 be very many of these, we've got PinICLs that were being 20 fixed and that when those had been fixed -- we 21 understood, in other words, the nature of the problem 22 and when they had been fixed that would resolve the 23 problem. Now -- 24 Q. That's a different way of looking at it, isn't it? 25 A. Well, it's -- 74 1 Q. -- as I think you know, Mr Oppenheim. This isn't saying 2 "We can fix it in the future", or "We're developing 3 a fix for it and therefore when that takes effect the 4 severity might be downgraded"; this is at the point of 5 reporting, saying that Pathway were questioning or 6 arguing over the severity, isn't it? 7 A. All I can do is give you a view as to the way that my 8 colleagues would have thought about this. So when Steve 9 Warwick says "We understand this, we're on top of it, 10 we've got a fix or fixes in process and there's 11 a substantive software update in process that will deal 12 with this", I can imagine they would say, "Look, we're 13 onto it, it's not going to be a problem, or not 14 a serious problem, we think it's a medium-sized 15 problem", and that would be my interpretation. But it 16 was wrong to assert that, given the facts as they were 17 at that point. I do agree with that. 18 Q. Thank you. Moving on, it says: 19 "Rectification: Steve Warwick ..." 20 He was an ICL employee? 21 A. Yes, he led the development of the EPOSS team. 22 Q. "... to provide rectification of this issue. [Pathway] 23 understand the problem and are currently working on the 24 fix. Steve Warwick to provide details." 25 Just stopping there at the moment, and without 75 1 looking forwards to what happened at the moment, would 2 you agree that if you were a subpostmaster accused of 3 stealing thousands of pounds from the Post Office, and 4 you believed that you had not done so and instead the 5 Horizon System was faulty and was responsible for the 6 imbalance shown, and you were before a criminal court, 7 you would wish to know about this document here, 8 wouldn't you? 9 A. What I would say is I'm not sure who Pathway was in this 10 instance. There are no names given other than, at the 11 bottom, Steve Warwick, so I don't know who asserted 12 that -- this argument about severity and, without 13 knowing that, I can't really answer. I would say it was 14 not representing Pathway because, when it came to the 15 AIs, I represented Pathway and we accepted that this was 16 a high severity issue, so this was on the way to getting 17 there. 18 I'm not going to excuse it. I don't agree with it 19 but I don't know who it was that expressed this view. 20 It would have been at a low-level. 21 Q. Putting the issue of the classification of severity to 22 one side, but just looking at the document itself, if 23 you were a subpostmaster accused of stealing thousands 24 or tens of thousands of pounds, and you believed that 25 you hadn't done so and that the system was responsible 76 1 for the imbalance shown, you would want to know about 2 this document here, wouldn't you? 3 A. Very likely you would. The point about the possibility 4 of error goes to what I was saying earlier, that one 5 would need to look in detail, before mounting 6 a prosecution, at what had actually happened, what had 7 actually gone wrong. This was very, very early, is the 8 point I would emphasise. 9 I don't agree with the proposition by whoever it was 10 in Pathway that it would be low severity -- I know you 11 suggest that it should be put to one side, but the point 12 is that it triggered a massive amount of work 13 subsequently, on both Pathway's side and also Post 14 Office's side because one of the problems was, as you 15 referred to earlier, was reference data. So reference 16 data errors were the reason for quite a lot of these 17 mistakes. 18 Q. Can we move to box 11 and display a little bit more of 19 that, please. We will see that box 11 has not been 20 completed. It's a little difficult for me, at least, to 21 understand who is supposed to complete what here. Under 22 the first box underneath "Signatures", 23 "Witness/Reviewer". From which organisation would you 24 believe that the witness or reviewer would come in order 25 to complete that box? 77 1 A. POCL. 2 Q. The "Horizon Acceptance Test Manager", from which 3 organisation did that person come? 4 A. That would be Pathway, I think. 5 Q. Then, on the right-hand side, it's got "Pathway". Do 6 you know what or who was supposed to complete that box? 7 A. I don't. My guess is it would be the -- when we came to 8 the AI resolutions, the person designated as lead for 9 a given AI. 10 Q. Then, on the far right-hand side, "AIM". Do you know 11 what that refers to and who would sign and date that 12 box? 13 A. Sorry, no, I don't. 14 Q. Underneath -- underneath the dates, that is -- the "DSS 15 Acceptance Manager". In July 1999, did the DSS 16 acceptance manager have any role to perform? 17 A. No. 18 Q. Is that a relic? 19 A. This is a relic. This was a form that was devised prior 20 to the DSS dropping out. Bear in mind this was dated 21 July and they only dropped out in May/June. 22 Q. "POCL Business Assurance", on the right-hand side. Do 23 you know who or what that refers to? 24 A. I can only assume that it was someone in POCL who was 25 looking over the shoulder of the people we were dealing 78 1 with. 2 Q. Then, lastly, on this page, I think a date for entrance 3 into an acceptance database. What was the acceptance 4 database? 5 A. We had an Excel spreadsheet which listed all the AIs, 6 but I -- that's the only one I can think of that was 7 a database and it tracks day by day every movement and 8 the status, so I'm assuming that's what it would be. 9 Q. So if, in future, any person, whether they are 10 a prosecutor, a defence lawyer or a court wished to 11 examine whether there were issues -- to use a neutral 12 term -- with the reliability or integrity of the system 13 in its design, implementation and rollout phases, could 14 look at an acceptance database, for example, to see 15 whether such issues were recorded there? 16 A. So the acceptance database, I know, dealt with the As 17 and Bs and there was reference to the Cs but I don't 18 think it went into detail around the Cs. At least, it 19 was a level of -- if it did exist -- probably did -- 20 it's not something that I ever focused on, but the As 21 and Bs definitely and I think that's probably what we're 22 concerned with here. 23 Q. So, in answer to my question, there would be a ready 24 catalogue of issues -- 25 A. Yes. 79 1 Q. -- that such a person could look back on. 2 A. Yes, certainly the formulation of -- this is 3 specifically the Acceptance Incident process, the 4 workshop process. That was all very, very carefully 5 documented and I have seen in my review of the papers 6 I have seen examples of that. I think I got them from 7 Fujitsu, rather than yourselves, but I think I referred 8 to them in my witness statement. If not, I can share 9 them with you. 10 Q. Can we go to the second page of the AI, please, so 11 scroll down. We can see in box 4 "Analysed Incident 12 Severity", "High/Medium/Low"; that should be completed, 13 shouldn't it? 14 A. It says in the second box "Low", so -- 15 Q. Yes, so this is read in the context of the page before, 16 the reporting of the incident severity, and then this is 17 after analysis; is that right? 18 A. I -- 19 Q. Do you remember the previous page? 20 A. I'm just thinking, sorry. I think that must be 21 logically the case. 22 Q. And analysed by who? 23 A. If this was Fujitsu's response -- sorry, ICL Pathway's 24 response, which I assume it is, it looks like it, then 25 does it have a name at the bottom? Would it be Steve 80 1 Warwick? 2 Q. No, the form -- well, there is a name at the bottom in 3 some of the boxes of somebody called John Pope. 4 A. Okay, John Pope was the analyst who worked for John 5 Dicks, who you may recall from the organogram, and he 6 was one of those charged with the resolution of these 7 AIs, so he was somebody I worked closely with at the 8 time and he would have gone through with the Steve 9 Warwicks of this world to determine what, you know, the 10 position was. He would have analysed the data. 11 Q. Does it follow from the answers that you gave earlier 12 that you would fundamentally disagree with the analysis 13 that the severity of the incident was low? 14 A. I did say earlier, in fairness, as I recall, that one 15 needs to look at what happened subsequently and this is 16 what happened subsequently. I'm sorry I didn't 17 remember. So here he is saying that: 18 "There is no suggestion or indication that there is 19 a fault in the calculation or reporting of the Cash 20 Account ..." 21 Q. Just before we get to that, you are reading from box 6. 22 A. Yes, I am. 23 Q. Let's read that together: 24 "Pathway has analysed all occurrences where the 25 (TIP) derived cash account does not equal the actual 81 1 cash account ... There is no suggestion or indication 2 that there is a fault in the calculation or reporting of 3 the Cash Account; the incidents relate to an occasional 4 missing transaction when reporting to TIP. This had 5 a rate of occurrence of [around] 1% of outlets per week 6 based on an analysis of the reported TIP incidents. It 7 is agreed this would have been unsustainably high when 8 considered against a target population of 20,000 9 outlets." 10 So that's about 200 a week, yes? 11 A. Yes. 12 Q. "The agent modification referred to in previous analyses 13 has been operational since [3 August] and is operating 14 successfully. 15 "An updated summary of TIP incidents was supplied 16 [11 August] as actioned. As noted the root problem has 17 been diagnosed in all non 'serve customer' transactions 18 leaving one further problem under diagnosis relating to 19 occasional scales transactions, which are all in serve 20 customer mode and are corrected by the agent 21 modification noted above. 22 "In addition Pathway has established routine 23 monitoring for all harvesting exceptions and should any 24 occur will notify them to TIP in advance and has agreed 25 a suitable procedure with TIP, thereby substantially 82 1 reducing the TIP effort in handling any exceptions. 2 "POCL has removed the aspect concerning the 3 reference data change from core to non core from this AI 4 and re-raised it as AI410 ... In this case there is 5 no fault within the Pathway system. Pathway has 6 proposed an approach to POCL to avoid this problem 7 through the use of product types within RD", within 8 reference data. 9 So can you to a naive audience translate what 10 perhaps Mr Pope has written? 11 A. Okay, so going back to what was stated at the beginning, 12 that was a very -- you know, a very unacceptable -- it 13 was an unacceptable position, if confirmed. So if the 14 cash accounts were going wrong, then that was 15 unacceptable. What this is saying is that the cash 16 accounts weren't going wrong but there were problems 17 with "harvesting" all the transactions and reporting 18 them faithfully to TIP. Transactions are needed by TIP 19 for them to reconcile the -- for Post Office to 20 reconcile with their clients. So it's very important 21 that they all be complete. 22 Why would some be missing? Because there was 23 a problem with one of the agents, so an agent 24 modification was put in place 3 August. Now, what -- 25 Q. What's an agent modification? 83 1 A. An agent -- an agent basically looks at the data in 2 the -- I think the correspondence server, or it could be 3 the branch, I'm not 100 per cent sure, and it pulls that 4 data into the database, into TMS. TMS is transaction 5 management system, which was ICL Pathway's database that 6 then transferred the data to TIP. So, as I said, this 7 is something of a daisy chain which operates remotely in 8 a world before the internet, when dial-up modems were 9 still, you know, standard. 10 So you had an ISDN link, had to get the data from 11 the branch to the central data warehouses and then make 12 sure that they were converted into the format that TIP 13 required and we were operating to a draft specification 14 for the TIP interface still, at that stage, by the way, 15 and TIP would sometimes struggle, let's say, with what 16 was being sent across. 17 Now, the agent is what sucks in all of that 18 transaction data and there had clearly been a problem 19 which required a modification. The modification had 20 been applied on the 3rd of the 8th, which wasn't that 21 long after this AI had been raised -- 22 Q. 19 July. 23 A. 19 July. So as it said at the bottom of the original 24 paragraph, Steve Warwick's got a bug fix in process on 25 this issue, which, as I said, I think is why he thought 84 1 it wasn't going to be such a big deal. 2 As reported as a possible, it would have been a big 3 deal. This says, actually when you look at the detail, 4 the cash accounts were okay but there was a problem with 5 harvesting individual transactions, which would have 6 been an issue for the Post Office reconciling with its 7 clients in a timely fashion. 8 So that's the most of it. The bottom paragraph: 9 "POCL has removed the aspect concerning the 10 reference data change from core to non core ..." 11 That was included in the numbers that had been 12 considered at the outset but it was a very particular 13 problem that occurred back in June I believe. 14 Q. June 1999? 15 A. June 1999, which I referred to earlier as being 16 a reference to the first of the reference data PinICLs 17 that we flagged and this had to do with, as I recall, 18 sign change. This will probably come up again later, 19 whereby there's a convention around signage, plus or 20 minus, and if you get it wrong you get an error 21 times two, in actual fact. You don't actually nullify 22 it, you just get it the wrong way round, so instead of 23 adding it you subtract it and that's going to throw out 24 a cash account and that's potentially very serious, but 25 all of that is driven by reference data. 85 1 Should I just describe what reference data -- 2 Q. No, we know what reference data is. 3 A. You know what that is. 4 Q. Thank you. Can we move down the AI, please, and a bit 5 more please, thank you. "Clearance Action", block 7: 6 "The fix to reconstitute missing transaction 7 attributes was introduced [3 August]. Pathway confirms 8 that at the time of completing this analysis no further 9 missing transactions have been noted to date by Pathway 10 internal monitoring. 11 "Subject to satisfactory processing by TIP of the 12 cash account for week 19 in line with the reduced 13 incident rate proposed by Pathway, and with the above 14 procedure in place to notify any exceptions, Pathway 15 assess the severity of the incident as 'low'. 16 "Ongoing monitoring for the next three months should 17 progressively reduce occurrence to a maximum of 18 0.1 per cent at which point the incident be closed." 19 Mr Pope has written his name -- or his name is 20 written next to "I propose the clearance action and 21 incident status described above", incident status 22 "Resolved", 11 August 1999. So is that essentially 23 Mr Pope signing this AI off as resolved, three weeks 24 after the AI had been opened? 25 A. He is proposing that it should be regarded as resolved, 86 1 but it can't be resolved without the agreement of the 2 Post Office. 3 Q. Where should we see their signature? 4 A. Does it not go on? 5 Q. Yes, so underneath "I accept/reject", can you see that? 6 A. Yes. 7 Q. That's where we should see -- 8 A. So that's where you should see a rejection by POCL. 9 Q. So the proposal was from ICL Pathway that this can be 10 cleared in three months' time if incidents progressively 11 reduce to an occurrence of a maximum of 0.1 per cent. 12 Is that 0.1 per cent per week -- 13 A. Yes. 14 Q. -- per cash accounting period? 15 A. Yes, it would be. And I'm guessing the reason that 16 there's no corresponding POCL signature is because who 17 is to say whether it was going to be achieved, this 18 0.1 per cent proposition, within three months. At the 19 point where this was written, no one would have known 20 that. 21 Q. What do you say to the suggestion that a three month 22 monitoring period was shortsighted or ill-advised when 23 the national rollout was yet to commence and so the 24 sample size was small? 25 A. So the -- the sample size was increased by 1,800 in the 87 1 period September/October 1999, so by the end of the 2 three-month period you were up at 2,100 from memory. So 3 it was a decent sample size and it was a very good thing 4 that the 1,800 were rolled out because it gave a lot 5 bigger sample size and a lot more feedback. It also 6 exercised, in earnest, the reference data system, which 7 had been subject to a freeze for a period and that was 8 possible when you weren't adding post offices. As soon 9 as you add post offices you have to add new reference 10 data because you have reference data by post office, so 11 you couldn't freeze it. There had been a moratorium 12 because there had been these reliability issues. 13 So I personally think a sample size of 2,100 for 14 three months is not unreasonable. 15 Q. Do you read this as meaning that after the end of that 16 three-month period it would be acceptable for the full 17 Post Office estate, some 19,000 or 20,000 branches, for 18 the system to continue to operate at an error occurrence 19 rate of 0.1 per cent? 20 A. If POCL felt they could manage it, because it was not 21 affecting the cash account, subject to that condition 22 I would say yes because, as I said, the practical 23 reality was we were dealing with 25 years ago technology 24 to gather millions of transactions a day and you're 25 going to get some glitches. Just anybody in -- on 88 1 you know, involved in that programme must have realised 2 on both sides of the fence. So you have to allow for 3 that possibility. You can't have 100 per cent SLAs and 4 zero incidences of failure, that's just not the real 5 world I'm afraid. The question is, what you do about it 6 and how you contain it, how you flag it, how you 7 protecting stakeholders when this does happen. 8 Here, this is not an error. This asserts, in this, 9 there's no errors in the cash account, and there would 10 be errors in the cash -- but that's a different matter. 11 Q. Can I draw your attention to another document, please, 12 POL00083922, at page 5, please, and if we can just 13 enlarge that, please, because it is on a fax and 14 therefore has reduced in size a little. I wonder 15 whether we can display two documents at once, so keep 16 that one and look at the document we were just looking 17 at which was POL00043691 at page 57. Then try and 18 highlight -- thank you very much. 19 The document on the right we can see is another copy 20 of AI376, can you see that? 21 A. Yes. 22 Q. We can broadly see, certainly in box 6 -- sorry, on the 23 page on the right can we go back a page, please, and 24 then highlight the relevant section. Thank you. 25 We can broadly see that they are the same, if you 89 1 just look at the data on the left-hand side and the 2 right-hand side. 3 A. Yes. In fact, I think they are the same, aren't they? 4 Q. They are identical. There are some colour differences 5 or shading differences. 6 Then if we scroll down both of them, please, we can 7 see that the data within them is the same, yes? 8 A. Yes. 9 Q. Then if we go over the page for both of them, please, we 10 can see that box 4 is different. It says "Medium" 11 rather than "Low" and box 6 is entirely different. It 12 has just got completely different text in it. 13 A. After "20,000 outlets", yes. So one looks like 14 an update on the other. Firstly, there's a causal 15 analysis -- there are two causes. 16 Q. Yes, if we read that: 17 "There are two causes. 18 "very occasionally a transaction is recorded at the 19 outlet with a missing attribute (start time or mode). 20 The processing rules specified for the TPS harvester 21 reject any transaction which has a missing attribute, 22 meaning these transactions are not forwarded to TIP. 23 They are however, correctly posted in cash accounting 24 processing. 25 "The harvester specification is being modified to 90 1 (i) reconstitute any missing start time attribute by 2 interpolation from immediately preceding transactions 3 within the customer session, or (if none is present) to 4 log an event and (ii) map any ..." 5 I think "full mode"? 6 A. "Null". 7 Q. "null mode", thank you: 8 "... attribute to 'serve customer' attribute." 9 I will skip the next bit: 10 "Pathway will monitor occurrences of any such null 11 attributes and work will continue to ensure that all 12 transactions are correctly recorded with all attributes 13 at the outlet. This will eliminate this problem; it is 14 theoretically possible that a very occasional 15 transaction will result with an invalid item transaction 16 mode, although there has been no instance of this 17 detected in any of the analysed cases. 18 "[Second cause] on one occasion a reference data 19 change from core to non core and the new Reference Data 20 mapping of products to Cash Account may cause 21 transactions conducted within the [Cash Accounting 22 Period] prior to the [Reference Data] change not to be 23 posted to the Cash Account. In this case there is no 24 fault with the Pathway system. Pathway has proposed 25 an approach to POCL to avoid this problem through the 91 1 use of product types within RD." 2 That last sentence bears some similarity to what had 3 happened -- what was described in the document that 4 I showed you earlier. 5 Can you explain, please, is this how these forms 6 worked, that there could be something written in one 7 version of an Acceptance Incident, that could be 8 deleted, and then something new could be written into 9 it, rather than a progressive, chronological account of 10 the development of the problem and the solutions to it? 11 A. I am surprised to see this. I would have expected 12 exactly what you have just described. 13 Q. Why are you surprised to see it? 14 A. Because the documents I looked at -- I didn't go through 15 all of these. I went through the Excel spreadsheets 16 that I was describing earlier which are the -- you know, 17 the register -- and those showed day by day, 18 sequentially, everything that happened, who said what, 19 what actions have been taken, what actions were placed, 20 who responded to what actions, how, on both sides, 21 because these were joint activities. 22 So there was no question there of anything being 23 wiped or written over -- 24 Q. Deleted or overwritten? 25 A. Exactly, no question at all. I am surprised to see this 92 1 here, I must admit. 2 Q. Then if we can read on in both documents down to the 3 clearance. 4 Thank you, and then on the right-hand side, thank 5 you. Just a bit more, thank you. 6 I think we can see that there's a different 7 clearance action in this document. We can see that it 8 is signed off by Mr Dicks himself. 9 You remember that, under the document I showed you 10 earlier, the proposal of acceptable occurrence was 11 0.1 per cent per week over a three-month period. This 12 proposal was that the relevant period would be a single 13 cash accounting period, I think that's one week rather 14 than three months, yes? 15 A. Yes, I'm reading this, I think, for the first time. 16 Q. You're just catching up, okay. 17 A. Yes, I'm not familiar with this one, I don't think. 18 (Pause) 19 So the conclusion -- the proposition for what it 20 should be is still the same "Ongoing monitoring for 21 three months ... 0.1%", so that's no different. But 22 this was clearly an interim position as at 9 August, 23 which was then replaced on 11 August. Now, I don't know 24 whether the version as at the 9th was shared with POCL. 25 It's possible that the reason it was overwritten, as 93 1 you say, is because it hadn't been shared, so events 2 have moved on, the bug fix had been applied, it had been 3 successful, whereas on the 9th it was still a work in 4 progress, so that's the best I can do by way of 5 explanation, I'm afraid. 6 Q. In the Clearance section, it says: 7 "For ongoing monitoring, Pathway believe a target 8 maximum occurrence due to this cause for the next [Cash 9 Accounting Period] should be ... (0.67%) at which point 10 the incident should be reduced to Medium." 11 Then the ongoing monitoring at 0.1 per cent, "at 12 which point the incident should be closed". 13 A. So that implies to me that it was viewed by POCL as 14 high. John Dicks was saying "We have made good headway 15 here, we think it's now already medium" and, if it 16 proves -- if events prove over the next three months 17 that it actually has pretty much gone away and POCL are 18 happy with 0.1 per cent, then it should be closed. 19 That's my interpretation of this. 20 Q. Is that a practical demonstration of ICL considering the 21 cash account discrepancies to be less severe than POCL? 22 A. No, this isn't, as I said, to do with the cash account. 23 This is to do with these attributes, these missing 24 attributes and the fact that TIP would reject 25 transactions with missing attributes. That's why TIP 94 1 was missing transactions and those transactions had been 2 included in the cash account, is what this makes clear, 3 and there was, as I understand it, no argument about 4 that. 5 That's not to say there weren't other issues, but 6 not in relation to this. 7 Q. Okay, we can take both of those documents down from the 8 screen now. Can we turn to what was happening in the 9 midst of this, namely the signing of the first 10 supplemental agreement and look at FUJ00000485. Can you 11 see the date of the first supplemental agreement, 12 20 August 1999? 13 A. Yes. 14 Q. Can we just read the preamble together, so under 15 "Recitals": 16 "This Supplemental Agreement is supplemental to the 17 Codified Agreement between the parties dated 18 28th July 1999 ... 19 "The Contractor and POCL have been carrying out the 20 Operational Trial and the other Acceptance Procedures in 21 accordance with the Codified Agreement. 22 "It is agreed that as at the end of the CSR 23 Operational Trial ... Period ... there were ..." 24 Then if we just scroll down please so we can see 25 them all: 95 1 "9 faults (the 'Agreed Category B faults') which 2 both parties agree are medium ..." 3 Then they are listed. 4 "3 faults (the 'Disputed Category A Faults') which 5 the Contractor [that's Pathway] considers to be category 6 (b) faults but which POCL believes are high severity 7 (category (a)) faults ..." 8 They are listed and amongst them is 376. So is it 9 fair to say that at this date, despite what we had read 10 in the AIs of 9 and 11 August, by 20 August there 11 remained a dispute about the severity of AI376? 12 A. Yes. 13 Q. Was that relatively common during the resolution of the 14 AIs because, in part, ICL were permitted no category A 15 incidents and, as you said, only ten category B 16 incidents and, upon which classification acceptance 17 turned and therefore payment to ICL turned? 18 A. So relatively common, no. They were exceptional. There 19 were three where we didn't agree and if I may, on 376 20 there was no disagreement that if the cash account was 21 going to be wrong, that that was a serious issue. The 22 reason that ICL Pathway considered it not to be their 23 serious issue is because they attributed most of the 24 problem to reference data which came from POCL. So that 25 was -- if you just go back to the bottom paragraph of 96 1 the previous report, it was saying "This is excluding 2 the reference data issue". 3 The reference data issue was really serious because 4 that would have caused a cash account problem, but 5 ICL Pathway's position, certainly at the technical 6 level, was "This is not our problem". 7 Now, at my level it's a problem because the end 8 result is going to be wrong for the collective and -- 9 you may come on to this later -- John Bennett wrote in, 10 I think it was early November, to David Smith about this 11 very issue and he more or less said "Unless you can fix 12 it with us, we can't do it on our own, we're going to 13 have to stop rollout". That was ICL Pathway to POCL on 14 reference data. 15 Q. Just on the issue of there only being three disputes, 16 I think we can see underneath there were two faults 17 which were disputed category B faults. 18 A. Okay, point taken. 19 Q. Which the contractor considered to be low but which POCL 20 believed to be B and then over the page, more dispute -- 21 so there were two of those -- and one fault which ICL 22 believed isn't an Acceptance Incident at all but which 23 POCL believed is a category B fault. 24 A. I stand corrected, there were six disputes out of, as 25 you pointed out, scores and quite possibly hundreds -- 97 1 Q. Six disputed faults? 2 A. Yes. I don't regard that as common out of so many when 3 so much was moving and it was acknowledged that there 4 was a disagreement and, ultimately, we accepted that we 5 hadn't passed, hence the supplemental agreement. 6 Q. Can we just move on over the page, please, to 7 paragraph (D) of the preamble: 8 "It is agreed that there is no CSR Acceptance 9 Specification in respect of which there are more than 10 10 category (b) faults." 11 Just explain what that means? 12 A. If there are more than 10 category B faults then we 13 fail. 14 Q. So it was recording the agreement that there were not in 15 excess of 10? 16 A. Yes. 17 Q. Then if we can read down, please, to the agreement 18 itself after the preamble, at 1.1 under "CSR 19 Acceptance": 20 "The parties agree that CSR Acceptance was not 21 achieved as at the end of the CSR Operational Trial 22 Review Period." 23 A. That's what I just said, absolutely. We accepted that. 24 Q. So it was agreed that the core system didn't meet the 25 acceptance criteria at the end of the operational trial? 98 1 A. Correct. 2 Q. As we will see after lunch, I think, when we look at 3 pages 7 and 8 of this document, there was, nonetheless, 4 a timetable for new installations to be ramped up in 5 post offices; is that right? 6 A. There was and I alluded to this earlier. Part of the 7 logic for that was that we needed a bigger sample size, 8 to your point about 200 not being really sufficient -- 9 or was it 300 by then? And we needed the experience of 10 the rollout process itself because migrating data from 11 existing paper-based system to the new system, that of 12 itself could generate problems. 13 So we needed to really test our abilities, jointly 14 with Post Office, to roll this thing out without hitting 15 a wall and that was the proposition -- that happened in 16 October/November -- sorry, September/October/November, 17 such that we would then have a period of time before 18 January resumption of rollout to fix things that were 19 found. That was the thinking. 20 MR BEER: Sir, I wonder whether that's an appropriate moment 21 to break for lunch. It is for me. 22 SIR WYN WILLIAMS: Yes, I think it is. 23 I'm sure you are aware, Mr Oppenheim, but you 24 shouldn't discuss your evidence while you're having your 25 lunch. I'm sure you don't want to but I'm obliged to 99 1 tell you that. 2 A. Thank you, sir. Yes, I'm aware of that. 3 SIR WYN WILLIAMS: All right, 2.00, everyone. Thanks. 4 (1.00 pm) 5 (The luncheon adjournment) 6 (2.00 pm) 7 MR BEER: Good afternoon, sir, can you see and hear me? 8 SIR WYN WILLIAMS: Yes, I can, thank you. 9 MR BEER: Thank you, and likewise. 10 Mr Oppenheim, we were just dealing with the preamble 11 to the first supplemental agreement which was at 12 FUJ00000485. We had gone through the preamble and 13 I think we had identified that there were some 14 15 outstanding faults, of which six or so were disputed. 15 Can we go forwards, please, to page 7 of this document. 16 Look at the foot of the page, can you see the heading at 17 the bottom "Rollout"? 18 A. Yes, I can. 19 Q. Then if we go over the page, the parties agreed in 20 paragraph 4.1 that: 21 "... rollout shall not commence until authorised by 22 the Release Authorisation Board in accordance with 23 paragraph 4 of schedule A11." 24 What was the Release Authorisation Board, please? 25 A. This was a joint POCL/ICL Pathway senior management 100 1 group, which was assembled to make the judgment about 2 whether or not to roll out in the light of AIs and 3 acceptance in general, and anything else. 4 Q. Thank you. Paragraph 4.2: 5 "Notwithstanding [that], the parties agree to 6 install the Core System in additional outlets as 7 follows ..." 8 31 August, Borough High Street, one branch; then 60 9 branches in the week commencing 6 September; 90 branches 10 in the week commencing 13 September: 11 "If by 10 September ... the parties agree that 12 sufficient progress has been made in resolving the 13 Outstanding Faults (and any other outstanding category A 14 or B [AIs]) the parties may agree to install the Core 15 System in further outlets as follows ..." 16 Then, down the page, please: in the week commencing 17 20 September, 158 branches; and in the week commencing 18 27 September, 178 branches. 19 A. Yes, agreed. 20 Q. What would you say to the suggestion that, within a few 21 weeks of the codified agreement being signed, there had 22 been a failure to sign off on the integrity of the core 23 system and yet, nonetheless, there was a planned rollout 24 at scale envisaged by this document? 25 A. So the driver for this primarily was to increase the 101 1 sample size, the point that you made, at some point this 2 morning, 200 was judged to be too small, plus there were 3 incidents to do with -- or AIs to do with rollout 4 itself, for example training, was it 218? So these 5 needed to be exercised. Now, with the benefit of 6 hindsight, this was too aggressive, too soon and, 7 indeed, as you will show me in a moment doubtless, that 8 was swept away fairly swiftly. But the whole process 9 had started some time earlier, before the codified 10 agreement. 11 The codified agreement basically codified -- hence 12 the term, I think -- the memorandum of understanding 13 which was signed in, as I recall, the latter part of 14 May. 15 Q. May. 16 A. And that basically set the roadmap for all the things 17 that had to happen, including the three-month live 18 trial. Otherwise, it wouldn't have completed in this 19 timeframe. 20 So looking at the codified agreement in isolation, 21 I agree, it looks like you sign this, you fail then and 22 still you're going to carry on but, actually, the wheels 23 were set in motion quite some time previously and, in 24 fact, the live trial was in play before DSS dropped out, 25 which is why there was still a reference to the DSS in 102 1 the Acceptance Incident form. 2 The nature of the live trial changed and the focus 3 was very much more on POCL. Now, as we recognised 4 pretty quickly, that this wasn't a sensible thing to do 5 and we agreed to change it. 6 Q. Without the benefit of hindsight, could you not see that 7 this was a recipe for disaster, prematurely rolling out 8 a system that wasn't ready? 9 A. Well, if it hadn't have been ready then we wouldn't have 10 agreed to roll it out, we wouldn't have been allowed to 11 roll it out and we wouldn't have wanted to roll it out. 12 But the premise when the supplemental agreement was put 13 together was that a lot of progress had been made, and 14 it had. I mean, the AI we were looking at in detail 15 before lunch showed that what appeared to be a very 16 alarming state of affairs actually was -- in respect of 17 the Pathway piece -- a much smaller issue -- that's not 18 to belittle it and say it wasn't of any consequence at 19 all, it was, but it didn't affect cash accounts. 20 And so there was a belief that, actually, we were 21 making good progress and, by this future date, we would 22 be -- we stood a chance of being in a good place to 23 carry on, to increase the sample size and get more 24 feedback. 25 Q. You have said on three occasions, I think, that the 103 1 purpose of this was to increase the sample size. Is 2 that right, that this was part of an extended exercise 3 to broaden the test bed or was, in fact, this part of 4 rollout? 5 A. This wasn't part of rollout, this was -- you will find 6 references in various places about the need to increase 7 the size of the operational sample. I can't pinpoint 8 from memory exactly where those references are, but that 9 was definitely part of the rationale. It wasn't just to 10 push out a whole bunch of post offices to hit the 11 numbers early. 12 Q. In your statement -- we need not turn it up, it is 13 paragraph 74 -- you say that once the change in 14 commercial terms had been agreed with Treasury, as 15 a result of the withdrawal of the Benefits Agency, both 16 parties, that's ICL and POCL, were incentivised to 17 proceed as quickly as possible. You say in 18 paragraph 104 that the agreement set an extremely tight 19 timetable and, at paragraph 146, that there was 20 financial pressure on both Pathway and POCL at the time 21 of the rollout. 22 Bearing those things in mind -- incentivisation to 23 proceed as quickly as possible, an extremely tight 24 timetable and financial pressure -- do you think the 25 interests of subpostmasters were suborned from the 104 1 forefront of your company's mind at this time? 2 A. I don't. We readily accepted that we hadn't hit the 3 hurdle that was required of us and we continued to work 4 on it. We worked on it extremely hard, together with 5 POCL. There were things that weren't as they should 6 have been and they needed further work. 7 You asked me a question about the incentives and 8 I answered it honestly in the answer: yes, there were 9 intense incentives but, at the same time, I think I also 10 say the last thing we needed was another false start, 11 given what had happened with the Benefits Agency. So 12 our reputation had taken a hit because it was perceived 13 by many as, really, down to us to have failed in the 14 production of the Benefit Payment Card programme. 15 Q. Thank you. That document can be taken down and replaced 16 with FUJ00079169, please. FUJ00079176. 17 We can see that this is a record of an acceptance 18 workshop held on 17 September 1999 and so over a month 19 after the previous AI forms that we had looked at before 20 lunch. Can you tell us what an acceptance workshop was, 21 please? 22 A. So an acceptance workshop -- that was a workshop which 23 was overarching chaired by Keith and myself and within 24 it each of the AIs was addressed and that process which 25 was written in, I think, two supplemental agreements, or 105 1 was it in the -- yes, in the supplemental agreement -- 2 was that we would work jointly through these various 3 issues. 4 Q. We can see you're present at this one. 5 A. And it is chaired by Peter Copping as expert from PA. 6 Q. Yes, we can see that you are present at this one, in the 7 fourth line. 8 A. Yes, yes. 9 Q. The way that this works is it addresses, AI by AI, page 10 by page. 11 A. Correct. 12 Q. I wonder, therefore, if we can go forward to page 6, 13 please. I think at the foot of the page you can see the 14 heading, "AI376 Data integrity"? 15 A. Yes, indeed. 16 Q. Would that be a fair way of describing the issue with 17 AI376, that it was an issue of the integrity of the 18 data? 19 A. Yes, it's a fair way to express it. 20 Q. Then if we go over the page, please, and then just 21 scroll down a little bit, please, we can see 22 a description on this page of a series of workshops. 23 Are they references to previous workshops that have 24 occurred? 25 A. Yes. 106 1 Q. Okay, and then if we go over the page please to page 8. 2 Again, reference to further workshops in relation to 3 a different aspect of AI376, yes? 4 A. Mm-hm. 5 Q. Then over the page, please, to page 9 and if we scroll 6 down a little bit, please, we see this recorded: 7 "POCL's position is that rollout should not commence 8 until data integrity can be assured. Ruth Holleran ..." 9 Do you remember who she was? 10 A. Yes. 11 Q. Who was she? 12 A. She was certainly on the POCL side, I think operational. 13 Q. "... to consider with the Auditors, and report back to 14 this group, whether the current Pathway checks plus, 15 possibly, continuing POCL checks, would be adequate 16 until Pathway's full data integrity checks are in 17 place." 18 Then skip over the reference, if we may, to the 19 previous workshops and come up to workshop 7, which is 20 this workshop: 21 "Workshop 7 Update: this issue has now focused on 22 the success criteria for NRO resumption ..." 23 National rollout resumption? 24 A. Correct. 25 Q. "... at the review in November. Pathway had previously 107 1 proposed four weeks ... with [equal to or less than] 2 1.5% error rate." 3 Do you remember that having been proposed by 4 Pathway? 5 A. To be honest, I don't. I mean, I see it there recorded 6 but I don't remember it. It's not certainly something 7 that we spent a lot of time talking about. 8 Q. Why didn't you spend a lot of time talking about it? 9 A. Because POCL rejected it and I wasn't going to argue 10 with them. 11 Q. Why was it suggested? I mean, on an estate of 20,000 12 branches, that would be, what, 300 branches a week 13 showing a discrepancy error. 14 A. Yes, but the -- this would have been on the basis that 15 there would have been continuing improvements after 16 that. That would have been a premise made. Rather than 17 rollout from here, you rollout when you get down to here 18 (indicating) and then there would have been continuing 19 improvements. That would have been the premise behind 20 that, not that it would have stayed at less than 21 1.5 per cent, or a limit of 1.5 per cent forever. 22 I agree with you it would have been too high and, 23 indeed, the previous PinICL had acknowledged that such 24 a thing would have been too high. 25 Q. Given that the previous PinICL had acknowledged that 108 1 an error rate of this would be too high, why was Pathway 2 even suggesting it? 3 A. I can't remember who suggested it. At a guess it would 4 have been put forward by the lead analyst responsible 5 for 376 but I can't remember whether that was John Pope 6 or John Dicks directly. It's not something I recall 7 having had any great discussion about. Bear in mind 8 these were going on on pretty much a daily basis and 9 I did have other duties as well. 10 Q. "[Ruth] Baines and Ruth Holleran proposed an error rate 11 of 0.6 per cent (the current average is 1.2 per cent) 12 together with six other conditions, five of which are 13 listed in [Ruth Holleran's] paper and the sixth being 14 a further two weeks period of live running of the 15 permanent Cash Account fix prior to the actual 16 re-commencement of [national rollout] in January." 17 Then you are recorded as responding as follows: 18 "0.6 per cent error rate [was] agreed subject to 19 this being measured as the average of six weeks from 20 4th October to mid-November ..." 21 What would you say to the suggestion that this was 22 conscious risk taking here, accepting even an error rate 23 of 0.6 per cent? 24 A. Yes, but this is the error rate of the type that we were 25 talking about before lunch whereby you could get 109 1 a missing attribute and a TIP mismatch, not the cash 2 accounts, 0.6 per cent of cash accounts were wrong, 3 that's not what this was. 4 Q. So what was the worst consequence of the error? 5 A. It would -- the third supplemental agreement sets it all 6 out as to -- under what failure conditions, what actions 7 would be required, but the generality was that either 8 Pathway -- most often Pathway but otherwise POCL -- 9 would have to make certain error corrections, either 10 manually into a -- key them into the system to correct 11 an imbalance, some missing data, or otherwise, if there 12 were a lot of them, then POCL could require Pathway to 13 provide an update file electronically. So that's 14 also -- I'm getting ahead of myself here. 15 Q. Yes. 16 A. But that's all set out later, but that was the 17 consequence. It was to do with overwhelming -- POCL but 18 not only POCL -- Pathway, in terms of the number of 19 errors that will need to be corrected. 20 Q. Can we see how this was formalised in the second 21 supplemental agreement and turn up FUJ00079316. Can you 22 see this is a document called "The second supplemental 23 agreement", dated 24 September and one of the things it 24 does, as we will see, is reduce into contractual terms 25 what was agreed at that part of the workshop that we 110 1 have just seen. 2 Can we look again at the preamble, please: 3 "This Second Supplemental Agreement is supplemental 4 to the Codified Agreement ... 5 "The Contractor and POCL have been carrying out the 6 Operational Trial and the other Acceptance Procedures in 7 accordance with the Codified Agreement. 8 "By a Supplemental Agreement dated 20th August 1999 9 (the 'First Supplemental Agreement') the parties agreed 10 that [Core System Requirement] Acceptance had not been 11 achieved at the end of the CSR Operational Trial ... 12 Period. 13 "By the first supplemental agreement the parties 14 agreed ... a programme of work with a view to achieving 15 Acceptance and Release Authorisation by 16 24th September 1999, and also agreed that only certain 17 elements of the [CSR] were required to be resubmitted 18 for testing in the Second CSR Acceptance Test and that 19 only certain faults could be raised as Acceptance 20 Incidents in relation to the Second CSR Acceptance Test. 21 "As at the date of this Second Supplemental 22 Agreement the following Acceptance Incidents ... remain 23 outstanding ..." 24 That excludes category C ones: 25 "Category B faults ..." 111 1 They are described in part A and I think we will 2 find that's blank and then: 3 "Faults not falling within recital (E) above 4 "... Acceptance ... described in Part A of 5 schedule 1." 6 I think we will find that at page 9. 7 So this is a list of the AIs that have rectification 8 plans and we can see that 376 is one of them. 9 Can we go back to page 3 of the document please. At 10 paragraph 3.1 we can see: 11 "The Contractor [that's ICL] undertakes to use its 12 reasonable endeavours to resolve each of the Outstanding 13 Acceptance Incidents referred to in part B of schedule 1 14 [which we just looked at] in accordance with the 15 rectification plans listed Schedule 2 ... and the 16 Rectification Timetable. POCL shall use its reasonable 17 endeavours to comply with the obligations imposed on it 18 in the Rectification Plans." 19 Can we go forward to the rectification plans please, 20 they are page 10. We will see that there is a list of 21 rectification plans for each of the AIs. They are 22 called AINs here, is that just AI number? 23 A. You know I'm not sure. When I read this I couldn't 24 recall what the "N" stood for. 25 Q. Can we go forwards then to pick up the one that we're 112 1 interested in, which is on page 13 and down the page to 2 paragraph 20 and at 20.1 and 20.2 we can see the 3 rectification plan for AI376: 4 "Each of the Contractor and POCL shall complete the 5 steps and achieve the objectives applicable to it ... 6 set out in Document ..." 7 It is described: 8 "... and where that document identifies one party as 9 fulfilling an action, the other party shall assist the 10 aforementioned party to reach a successful conclusion. 11 "Each of the Contractor and POCL shall complete each 12 of the ... Obligations applicable to it by the dates and 13 to the standards set out in [another document]." 14 Can we go to page 19 please, for the rectification 15 timetable at the foot of the page, schedule 4, part B. 16 Keep going down. We can see "TIP interface accounting 17 integrity (AI376)" and then if we flip over the page, or 18 carry on scrolling -- thank you -- we can see the 19 timetable and the steps are as follows: 20 "The criteria to be met by 24th November 1999 shall 21 be as follows: 22 "(i) during the period from 3rd October 1999 until 23 14th November 1999 the percentage of Cash Accounts 24 received by POCL across the TIP interface containing 25 Cash Account Discrepancies shall not exceed 0.6 per cent 113 1 of all such ... Accounts ..." 2 That's essentially reducing into writing what had 3 been agreed at the workshop; is that right? 4 A. Yes. 5 Q. "(ii) during the period from 3rd October 1999 until 6 14th November 1999, no Cash Account Discrepancy shall 7 arise as a result of a cause previously reported to POCL 8 as having been remedied." 9 That's obvious what it means on its face: 10 "(iii) all new causes of Cash Account Discrepancies 11 identified after the date of this Agreement shall have 12 been properly analysed by the Contractor and suitable 13 rectification plans therefore submitted to POCL in 14 reasonable detail within ten days of the Contractor 15 becoming aware of such Cash Account Discrepancy." 16 Then (iv): 17 "The Contractor shall have satisfied POCL (POCL 18 acting reasonably) that the Accounting Integrity Control 19 Release would, had it been deployed at the relevant 20 time, have identified all Cash Account Discrepancies 21 reported prior to 24th November 1999 which shall have 22 arisen as a result of any new cause identified after the 23 date of this Agreement ..." 24 No need to read (v). 25 The reference to the accounting integrity control 114 1 release, can you explain what that is, please? 2 A. So this was to basically enhance the controls and the 3 checks three-way between the counter, TMS and TIP, as 4 I recall, so I think otherwise known as a three-way 5 integrity check because, as I have said before, there's 6 the possibility of timing differences, if a post office 7 isn't polled, if the communication network goes down, 8 then you have transactions at the post office that don't 9 get to TIP, basically, and they will catch up in the 10 next period, but in that period they're missing. 11 So you needed a mechanism to do that reconciliation, 12 such that you wouldn't have a situation where TIP simply 13 said "It's wrong, what I've got is wrong". So the first 14 thing was to identify the discrepancies and next it was 15 to aid the process of fixing the discrepancies, the 16 so-called rectified -- sorry, you were going to say? 17 Q. We will come back to the accounting integrity control 18 release. That's a sufficient description for the 19 moment -- 20 A. Okay. 21 Q. -- and I will ask some questions in a little while 22 about, firstly, whether it should have been there from 23 the start and, secondly, whether it was an adequate 24 remedy when it was introduced. 25 A. Okay. 115 1 Q. Before we just leave this agreement can we go back to 2 page 4 please and look at 3.6 at the top: 3 "The contractor shall cooperate and join with POCL 4 in providing such information and explanation to the 5 Post Office's auditors as such auditors may reasonably 6 require in order to satisfy themselves that the audit 7 reports of the Post Office and POCL should not be 8 qualified or contain a fundamental uncertainty paragraph 9 as a result of the circumstances giving rise to 10 Acceptance Incident 376." 11 Can you explain, please, why that was necessary? 12 A. My recollection of this is hazy. I don't recall having 13 to spend a great deal of time on it. The point was that 14 obviously there were people within POCL who were very 15 concerned at 376 and that initial description of 376 16 which painted a very black picture of the likelihood of 17 a lot of errors. As we discovered as we went through 18 it, there weren't a significant number of errors arising 19 from the system that would have affected cash account 20 but, at that time, that wasn't known and there was a lot 21 of concern. Plus there were instances which could 22 affect the cash account, notably and in particular 23 around reference data. 24 So, basically, people had got understandably 25 concerned about it and we were requested to provide, if 116 1 you like, substantiating evidence of the kind that I'm 2 trying to convey now, to show the auditors that it 3 wasn't going to be a disaster. 4 Q. Because, otherwise, there would have to have been 5 a qualification entered into the accounts, or the 6 auditors may have required a qualification to be entered 7 into the accounts. 8 A. That is indeed what they were concerned about, which 9 I could well understand. 10 Q. Can we turn, moving the story on a little, to 11 FUJ00118169. This is a monitoring report dated 12 9 November 1999. You can see that in the bottom right 13 at the foot of the page and it's an update for the 14 meeting the next day, 10 November. You can see that in 15 the top right. Can you see that? 16 A. Yes, I'm sorry, yes. 17 Q. Then, against the third row, AI376/1, which was 18 essentially the first requirement that required to be 19 fulfilled that we have just mentioned in the 20 rectification timetable, namely: 21 "The percentage of cash accounts containing 22 discrepancies shall not exceed 0.6%." 23 I think we can see the figures were, where the 24 target was not exceeding 0.6 per cent for the period 25 from 3 to 6 October, it was just shy of 45 per cent -- 117 1 A. Yes, correct. 2 Q. -- for the period 7 to 13 October, it was just shy of 3 43 per cent; for 14 to 20 October, it was 32 per cent; 4 and then 21 to 27 October it was 2.29 per cent. 5 A. Indeed. 6 Q. Can you recall what accounted for, firstly, the 7 substantial reduction? 8 A. Well, I can describe what caused the very high numbers: 9 that was bad reference data. 10 Q. It was all down to the reference data? 11 A. Well, not all, but something like 2 per cent would have 12 been other things, but all the rest of it was -- 13 I believe was reference data. The vast bulk of that was 14 reference data and it was acknowledged to be by POCL at 15 the time. So you had signage problems that we alluded 16 to earlier, so a 196 reference data update, which we had 17 challenged in June and we were instructed again in 18 October to apply, even though we had said we thought it 19 was likely to create a problem and it duly did and, 20 actually, in one of the documents I have seen, I have 21 seen an acknowledgement that, yes, that's exactly what 22 did happen. 23 That was one example. There were other examples. 24 Reference data was a major problem. 25 Q. When that's stripped out and we get to the week of 118 1 21 October to 27 October, the figure is nearly four 2 times the so-called acceptable level of cash account 3 discrepancies, isn't it? 4 A. It is and I'm not saying that that wasn't the tale of 5 reference data. 6 Q. That could be reference data too, could it? 7 A. Some of it could be. I really can't analyse it. All 8 I can say -- and you may show me a later version of 9 this, a later dated version of this -- is that, by the 10 end of the period, we were either at or very close to 11 the 0.6 per cent, having stripped out these non-data 12 errors, as we referred to them as. 13 Q. Can we go forwards, please, to FUJ00058187. This is a 14 "Monthly Progress Report". I think, is this from ICL 15 to -- 16 A. Yes, this is our -- 17 Q. -- to POCL? 18 A. This is ours. It's internal and it's also to POCL, yes. 19 Q. You would have either seen or contributed to the 20 creation of this? 21 A. I would have seen it. I wouldn't have contributed. 22 Q. Okay. Can we go forward to page 10, please, and have 23 a look at the third bullet point: 24 "Too many reference data errors are being 25 distributed to the counter. End to end design reviews 119 1 are being held to establish what action can be taken 2 swiftly to prevent these occurring in the future. These 3 are having a major impact on [AI] 376. In addition, the 4 performance of the data distribution process is 5 inadequate and must be improved before rollout commences 6 in late January 2000." 7 So this is October 1999 and we see the reference to 8 too many reference data errors. What does the last 9 sentence mean: 10 "... the performance of the data distribution 11 process is inadequate and must be improved ..." 12 A. So this is where we have to get reference data updates 13 out to every counter and every branch before the change 14 in reference data is to take effect and, as I said 15 before, this was before internet and broadband. We had 16 to do that using IBM's Tivoli system, which was 17 state-of-the-art at the time, over ISDN, and the 18 challenge was to be able to get all of these 19 instructions out well in advance, like two days or so in 20 advance, of when they were due to take effect so that 21 there wouldn't be any missed dates. 22 Q. Can we go forward to page 19 of the document. Under 23 "Detailed Plan Activities", and the "Acceptance 24 Resolution Timetable" and then scroll down. Next to 25 each bullet point is the number of the AI and can we 120 1 look at what John Pope, I think that is, said in 2 relation to 376. John Pope: 3 "This area is of particular concern. The six-week 4 observation period has started. The work is in three 5 parts: fixes yielding a target stability figure of merit 6 of a maximum 0.6% of Cash Accounts in error 7 (approximately 42); additional reconciliation 8 facilities; and new Operational Business Change (OBC) 9 procedures. Although all fixes are implemented, 10 problems arising from Pathway Reference Data handling 11 were encountered and are proving difficult to solve 12 without letting through Cash Accounts in error. The 13 definition work for additional reconciliation is on plan 14 and design is in progress. All the OBC procedure work 15 is completed." 16 We can stop there. So, again, at this point the 17 finger being pointed towards reference data being the 18 problem? 19 A. It wasn't the only problem. I mean, this is a very, 20 very complex multi-layer programme, so it's -- I don't 21 want to give the impression it's the only problem, but 22 it was the overwhelmingly largest problem. But, as it 23 says there, we had issues also with Pathway reference 24 data handling. That's when we received the -- sorry, 25 the reference data instructions from POCL, we then 121 1 needed to "handle it", turn it around and push it out to 2 the post offices and we were having trouble with that, 3 probably just the volume of that, but that's what that 4 alludes to. 5 Q. Thank you. Can we move to a similar progress report for 6 January 2000, FUJ00058189. You can see the date, 7 similar format to before. Can we go forwards, please, 8 to page 26. The first bullet point at the top of the 9 page: 10 "The outturn on AI376 was 0.06% Cash Account 11 Discrepancies, exactly an order of magnitude better than 12 the target." 13 Obviously 0.06 better than the target of 0.6: 14 "Under this activity John P [John Pope] made 15 significant contributions to the Third Supplemental 16 agreement, specified the committed CS Repair Facility, 17 aligned the operating agreement on Reconciliation to 18 support the contract, and sorted out the necessary 19 PinICLs to clear." 20 This reads as if it's a job well done and that's the 21 end of the matter; is that right? 22 A. No. It's a job well done, but it certainly wasn't the 23 end of the matter. 24 Q. Why wasn't it an end of the matter? 25 A. Because we needed the detailed processes that were then 122 1 written into the third supplemental agreement and, 2 subsequently, operational documents that flow from that, 3 so that the fact that he had made significant 4 contributions to an agreement that -- what was the date 5 of this? 6 Q. January 2000? 7 A. I mean, the third supplemental agreement from memory was 8 signed on the 19th, so I don't know whether this was 9 before or after. 10 Q. It's just dated January 2000. 11 A. But, in any event, the work that went into that was 12 very, very significant. 13 Q. Can we look forwards then, please, to the statistics. 14 Can we just look back a moment at POL00090590. We see 15 an email here at the foot of the page, dated 16 6 January 2000: 17 "In advance of tomorrow's delivery meeting, find 18 attached the latest spreadsheet that looks at criteria 19 in relation to 376." 20 Then the thing that we're looking at, 376(i), 21 a 0.17 per cent pass rate, so cleared the ceiling of 22 0.6 per cent, and we see what happened to that by the 23 time of the undated report that we have just read. 24 How far had the accounting integrity control release 25 contributed to this? 123 1 A. I don't know for sure but I would say it was a major 2 contributing factor. 3 Q. The accounting integrity control release, can we 4 understand how it was intended to operate in practice 5 and the function that it was intended to perform. It is 6 set out -- and this is just for the transcript, no need 7 to turn it up -- in the second supplemental agreement at 8 POL00090428, at pages 135 to 137, the document entitled 9 "Logical design for EPOSS/TIP reconciliation controls". 10 I want to try and understand how, in simpler 11 language rather than going through that laboriously, it 12 functioned and the operation that it was intended to 13 perform. Would this be right, that the EPOSS and 14 Transaction Information Processing, TIP reconciliation 15 controls, added some functionality to the system to 16 provide a simple validation, that the transactions and 17 data recorded at the counter, matched the data in the 18 POCL back end systems? 19 A. Exactly right. That's a good high level summary, yes. 20 Q. The way in which the data and transactions were captured 21 and harvested, in broad summary again, worked as 22 follows -- and this is me and my understanding 23 translating what has been read. Firstly, the EPOSS, the 24 Electronic Point of Sale Service transaction data from 25 the counter was captured in something called the office 124 1 platform service infrastructure? 2 A. Mm-hm. 3 Q. The data is harvested by the transaction processing 4 service, that's a POCL database, collecting all 5 transactions from the counters. It is passed to TIP, 6 the transaction information processing, which would in 7 turn feed POCL accounting systems. 8 A. You're asking me to confirm something that's a little, 9 perhaps, too technical for me. I mean I was very happy 10 with what you said previously. 11 Q. The high level summary but not the one beneath? 12 A. I'm not 100 per cent sure that it worked like that. My 13 understanding was the harvesting was done from branches 14 to correspondence servers to TMS to TIP. So that was 15 the route that I was familiar with and then once within 16 TIP, then Post Office would push that same data out to 17 clients and there would be reconciliations between them 18 and the clients. 19 Q. Okay, let's look at it a different way round, looking at 20 the object. The object is to ensure that the 21 transaction records from the counter, which are then 22 subsequently transferred by TMS and TIP to POCL, to 23 their accounting systems, reconcile exactly? 24 A. So, to be precise -- yes, but to be precise, TIP is 25 a POCL system so that's the boundary, TMS/TIP is the 125 1 boundary. 2 Q. Now, the accounting integrity control release 3 introduces, would you agree, some basic checks to ensure 4 that on a daily and then on a weekly basis a certain 5 number of things, collected at counter level, match that 6 that was transferred by TIP? 7 A. Transferred to TIP I would think, yes. 8 Q. To and then by TIP? 9 A. Yes, correct. 10 Q. Firstly, the total number of transactions? 11 A. Yes, and the value. 12 Q. Secondly, the quantity value of them and thirdly the 13 sales value of them. 14 A. Sounds right, yes. 15 Q. They are the three basic data checks that the control 16 release intends to collect and compare? 17 A. Yes. 18 Q. So this new release was intended to ensure that those 19 three data sets, collected at the counter level, matched 20 that data that was transferred via TIP? 21 A. That's my understanding, yes. 22 Q. Then if the output is such that the numbers don't match, 23 it generates an alert essentially -- 24 A. It does, yes. 25 Q. -- and what it generates is identification of the branch 126 1 code and the discrepancy figures are reported, ie what 2 the discrepancy on any one of those data sets that 3 I mentioned is? 4 A. Yes, that's my understanding. 5 Q. Would you agree that, from a technical perspective, that 6 would have required, in this new release, firstly 7 ensuring that a clear marker was used to delineate the 8 start and end time period used? 9 A. You're asking me for a technical view. I mean there 10 were start times in all of the messages and indeed this 11 was one of the reasons for the missing attribute problem 12 that we talked about earlier, so on occasion -- 13 Q. We will pick it up with another witness. 14 A. Yes, I would rather you did. 15 Q. Yes. Why was a system of this nature, carrying out 16 rather basic data integrity controls, not built in from 17 the start? 18 A. That's a very fair question. There was an element of it 19 before: this didn't suddenly get rustled up in no time 20 at all. So we had been working on it I think since 21 about June, recognising that there would be a need, 22 which is how it was that it was possible to deliver it 23 for December. 24 Q. Can I suggest that -- 25 A. I don't think that there was a requirement from POCL for 127 1 it. I don't recall a requirement. 2 Q. Who out of the pair of you in this relationship were the 3 IT experts? 4 A. We both were. They had a lot of technical people on 5 their side. 6 Q. So in your last two answers are you suggesting that it 7 fell to them to suggest that a very basic validation and 8 reconciliation tool should be written into your software 9 code? 10 A. No, I'm not. I'm simply saying, in answer to your 11 question "why wasn't it done sooner", I think there was 12 an element of it before and in fact I can recall 13 a couple of PinICLs talking about -- there were -- 14 I can't remember what there were. There were checks but 15 they weren't organised in the manner that you described 16 and they were more for technical people, so they weren't 17 as useable and they weren't as shareable as they were 18 with POCL. So yes, logically I agree I don't think that 19 it was in a requirement and therefore it got missed. 20 I'm not going to make any excuses for that. 21 Q. Can I turn to a related issue: whether this very basic 22 software, as I described it, was capable of identifying 23 and addressing the underlying root causes of the cash 24 imbalances that it detected. Would you agree that the 25 capability of the software release, as we have just 128 1 described it, was quite limited? 2 A. Yes. 3 Q. That's because all the release did was to flag batches 4 of transactions that didn't reconcile? 5 A. Individual transactions. It would pinpoint those which 6 did not match that three-way check, but it wouldn't, of 7 itself, identify the root cause, correct. 8 Q. Exactly, that was the point I was about to make. It 9 wasn't capable of identifying the root causes of the 10 cash account imbalances, let alone address the root 11 causes? 12 A. Absolutely right. What it did do -- and there was 13 a process for this, very detailed process. Whenever one 14 of these exceptional events was identified, then there 15 was a routine for looking into the transaction logs, the 16 message files, and so on, and so on, to dig into, 17 you know, what had caused the problem. 18 Q. The second limitation, would you agree, was that, even 19 if the release worked properly, it would only highlight 20 a specific set of errors in the system related to 21 harvesting and communication of transactions between the 22 counter and TIP? 23 A. I agree with you. 24 Q. So that, if there was a software or hardware fault at 25 the counter level, that itself prevented transactions 129 1 from being recorded or lost or duplicated, or miskeyed 2 in EPOSS, for example, they wouldn't be captured by this 3 release? 4 A. I think I need to -- if you don't mind -- go into each 5 of those in turn because they're slightly different. 6 Q. Yes. 7 A. I agree the headline principle of what you're saying. 8 It wouldn't have addressed those, it would have 9 addressed timing differences, and such-like, mismatches 10 in communication. What it wouldn't have done is 11 identified if there had been a break in the network, 12 right in the middle of a transaction, such that 13 something was lost. 14 Now, there should be rejects right up until that 15 point and it should be possible to see that the counter 16 clerk had got to a certain point in the transaction -- 17 so, for example, a possible reason for a cash 18 discrepancy, a shortfall, would be there had been 19 a benefits payment made, the cash had been paid out and 20 then, lo and behold, the transaction wasn't recorded. 21 That would be an obvious cause for there being 22 a discrepancy and a shortfall for the postmaster. 23 Now, by analysing the messages right up until the 24 point where there would be a record of the break in the 25 network, you would be able to see that, yes, you had got 130 1 to this point but the receipt hadn't been printed, or 2 whatever, and it hadn't been completed -- the 3 transaction hadn't been closed out as it would normally 4 have to be. 5 The inference of that, we would say, is that 6 transaction actually did complete, the money was paid 7 out and the correction would be to fill in the blanks, 8 as it were, and that would be the correction I would 9 expect my technical colleagues to apply in this -- it 10 was referred to in the previous thing, these 11 rectification files, and they would be transferred 12 across TIP and everything would balance, if it was 13 caught before it was identified and, if not, we would 14 send an error correction afterwards. I'm going off 15 memory for the third supplemental agreement. 16 But -- so that's one cause of failure. Another 17 cause of failure is, let's say, a printer breaks, or 18 more likely runs out of paper in the middle of 19 a transaction. Now, I think that was fixed. I'm pretty 20 sure that was fixed, such that the transaction would 21 have completed anyway but, in the early stages, if that 22 happened then it would not. I believe that was a PinICL 23 that was resolved, so that's another one. 24 There's -- there was the hour glass problem, which 25 you haven't mentioned but let me mention it. Slow 131 1 running of the PC. 2 Q. Yes. 3 A. Very understandably, a postmaster would get impatient, 4 he is up against it, he's got a queue and he might 5 hit -- I have done it myself -- the key twice. If you 6 hit the key twice then, basically, that breaks that 7 transaction, or it did at the outset. I believe that 8 too was rectified but, at the beginning, that kind of 9 involuntary behaviour could cause a transaction to be 10 either missed or duplicated, I can't recall. 11 Q. Is the point this, Mr Oppenheim, the release identified, 12 at a basic level, a basic data set showing 13 discrepancies. It neither identified nor addressed the 14 root causes of them and the only way properly to do so, 15 to identify, diagnose and deduce root causes, is to have 16 a task force of skilled individuals doing so? 17 A. I wouldn't say a task force but you need skilled -- 18 a team of skilled individuals who do that for a living, 19 yes, and that's what second and third line was supposed 20 to be about. 21 Q. Just stopping you there. The helpdesk -- that's what 22 the helpdesk was supposed to be about, was it, the 23 second and third line? 24 A. Helpdesk -- when there's -- the helpdesk would register 25 the fact there had been an error and, if there was 132 1 a correction routine, which it was possible for the 2 postmaster to run for himself, then there should have 3 been a script which had been agreed with POCL that would 4 steer -- the helpdesk first line operator would steer 5 the postmaster through it, such that he could effect 6 that fix himself. 7 I don't know the proportion of those that could be 8 done that way. There was certainly quite a high 9 proportion that could be done that way. Obviously, it 10 relies on the postmaster making the call, picking it up 11 and being able to follow through and I know there were 12 some instances where that went wrong and then he was 13 unable to put it right afterwards, from what I have 14 read. 15 Q. Can we move, please, to the third supplemental 16 agreement, FUJ00118186. This was entered into, we can 17 see on the top of the page there, on 19 January 2000 18 and, overall, would you agree that it defines, at 19 a relatively high level, the measures that were to be 20 implemented to detect, report and remedy cash account 21 errors by various issues, including software faults, 22 coding errors, reference data errors? 23 A. I wouldn't quite characterise it like that. It is 24 actually quite detailed and it went into -- there's 25 a table of, I think, all the known reasons for error at 133 1 the time and it wasn't so much to do with software 2 errors. I mean, there was a process for that. This was 3 not to do with software errors. It was identifying, 4 okay, was it one of these or one of those and it set it 5 out in very, very -- 6 MR BEER: I'm sorry, somebody is drawing something to my 7 attention. 8 The transcript had stopped so we had better stop 9 speaking. 10 (Pause) 11 Can I suggest that we take an early afternoon break 12 and restrict it to ten minutes or so. I haven't got 13 long to go in my cross-examination but if we came back 14 at 3.10. 15 SIR WYN WILLIAMS: Yes, certainly. 16 MR BEER: Thank you very much. 17 (2.58 pm) 18 (Short Break) 19 (3.14 pm) 20 SIR WYN WILLIAMS: Hello. 21 MR BEER: Sir, good afternoon. Sorry that has taken 22 a little longer than expected -- 23 SIR WYN WILLIAMS: That's all right. 24 MR BEER: -- 15 minutes rather than 10 but just before we 25 pick up, Mr Oppenheim, where we left off in the third 134 1 supplemental agreement, just two clarificatory points on 2 some questions that I asked and answers that you gave 3 earlier. 4 Firstly, could we have back up on screen 5 FUJ00058189. This was one of the monthly reports and 6 I have picked the January 2000 monthly progress report. 7 I think, looking back at the [draft] transcript in your 8 answer, you said that this document was ICL's, ie it was 9 authored by ICL, ICL Pathway, that it was internal and 10 then you added but it is also to POCL. 11 A. Sorry, I was going to say I was -- in a sense both. 12 I wasn't trying to say "Oh, and by the way it was also 13 POCL". 14 Q. On what basis do you say that this report was addressed 15 to and provided to POCL? 16 A. I believe it was -- I believe it was. I'm not 17 100 per cent sure now that I think about it. 18 Q. What is the basis for your belief? 19 A. It was my recollection. I can't say for certainty. If 20 you bring up the distribution -- could you do that? 21 Q. I don't think I can. If you look over the page. 22 A. I haven't got it in front of me. Ah, there, right. 23 Q. One can see a contents page, and then go over the page 24 again, and then go over the page again -- we always find 25 these pages upside down -- then go over the page again. 135 1 Sometimes within these reports one -- 2 A. Oh, I'm sorry, I was referring to a service one. This 3 is the managing director's -- no, I got that wrong. If 4 I may retract that. I thought we were looking at the 5 Acceptance Incident report, not this one. No, this -- 6 the managing director's is internal. My apologies. 7 Q. Thank you, that's the first clarification. 8 The second clarification, you said a number of times 9 in the course of your evidence today and including this 10 morning that the Cash Account -- and I'm going to call 11 it capital C, capital A -- was acceptable, was fine and 12 that this was one reason why it was permissible to seek 13 to recategorise AI376 as a category B incident or lower. 14 When you're referring to the Cash Account here are you 15 referring to it, in a technical sense, to a technical 16 module as part of the system? 17 A. I'm struggling to understand the point. 18 Q. Yes. 19 A. I'm sorry. 20 Q. I have been using the Cash Account problem, describing 21 the Cash Account in a much broader context, ie anything 22 which showed a discrepancy between the cash that 23 a subpostmaster had in branch and the cash value 24 recorded in back office systems -- 25 A. Right, okay. 136 1 Q. -- which I had understood the AI376, certainly the first 2 two incident forms, to be referring to it, in the sense 3 that I was using those words: Cash Account Discrepancy. 4 A. Right, okay. Very important point. I have to say mine 5 is the narrower one, which is more of a technical one 6 I guess, and if we go through aspects of the third 7 supplemental agreement I can point you to how we sought 8 to distinguish between the two, not to belittle the part 9 that it would not identify, but it was never going to 10 identify everything. 11 All it was going to do was identify any differences 12 between the Cash Account as declared by the 13 subpostmaster, or postmaster, what was in the central 14 TMS system and what was sent across to TIP. 15 The Cash Account as committed by the subpostmaster 16 may have been "wrong", and I don't use the term in 17 a pejorative sense. It's what he may have been forced 18 pretty much to commit to in order to carry on because 19 there was an inadequate facility for him to say "Just 20 a minute, I've got a problem", if something didn't 21 balance. And if he made good the imbalance, as 22 I understand it, particularly in hindsight, then the 23 committed Cash Account would have balanced and we would 24 have known nothing about it. 25 The only way we would have known about it is if he 137 1 had reported the problem to the helpdesk, which is what 2 I was talking about before the break, in which case, if 3 he says, "Look, I put through a such and such and it 4 broke" -- you know, I gave a couple of examples, there 5 are more -- "and it didn't complete properly and I'm 6 pretty sure, I have been through my records, and this 7 £300 discrepancy I can relate to that transaction", then 8 we from the helpdesk should have gone into that and got 9 a second line support person, an account specialist, to 10 go in to look at the message store and dig out the audit 11 trail for that particular event. 12 Q. Just stopping there, that requires the people in the 13 helpdesk, the various tiers of the helpdesk, to do what 14 you have just said -- 15 A. Yes. 16 Q. -- for the subpostmaster to have persistence and 17 conviction in what they are saying and not to be told 18 "It's your responsibility to balance the books, make 19 good the difference"? 20 A. Certainly looking at what's happened, yes. It shouldn't 21 have required persistence, it should have required 22 simply an explanation of what had been observed and 23 there should have been, as I said before, a certain 24 amount that he could have done to put it right for 25 himself through a scripted set of instructions. Bear in 138 1 mind the helpdesk person couldn't actually get to the 2 terminal in the post office, that wasn't possible in 3 those days, so he had to steer the subpostmaster through 4 what he would have had to do and some of that would have 5 been quite complicated, and I can imagine some of it -- 6 Well, I have seen some of the evidence, some of it 7 went wrong and you ended up with double the problem that 8 there was in the first place. 9 So the only way to identify and fix those was 10 through that route. 11 This reconciliation process, you're quite right, 12 would not have done that. 13 Q. Thank you. 14 A. And, if I may just one more point, the third 15 supplemental agreement made that clear because it said 16 there's a thing -- it identified a thing called 17 I think -- the second one did as well -- a "not data 18 error", which sounds like a very peculiar term but it's 19 a very deliberate term. In Pathway's terms it means 20 "It's not us", it's reference data, is one example, or 21 it's the postmaster making a mistake. I have to say 22 that, you know: easily done, millions of transactions, 23 right. 24 But it isn't something that's a software bug and 25 it's not something that we can effect and it's not 139 1 something that we can fix and there are references in 2 there to, if it's not clear, we will say it's not clear, 3 we will report that to the Post Office. 4 Q. Thank you. I'm just going to give the cross-reference 5 to that, it's FUJ00118186. We will chase down in due 6 course the paragraphs within the third agreement. 7 I know that you have been reading it or re-reading it 8 over the break. 9 A. Yes. 10 Q. Lastly, can I ask you please to look at FUJ00118188, 11 please. Thank you very much. This is a letter from 12 your counterpart, Keith Baines, dated 20 March 2000. It 13 reads: 14 "TIP Integrity Checking: 15 "The Second Supplemental Agreement (in clause 7.1) 16 provided for a TIP Integrity Checking Period, during 17 which POCL would reconcile transaction and cash account 18 data received in TIP from ICL Pathway. This period was 19 to continue until four consecutive weeks without 20 discovery of any Cash Account Discrepancies not found by 21 the Accounting Integrity Control Release. 22 "I am pleased to be able to confirm that this 23 condition has now been satisfied, with satisfactory 24 explanations having been received by POCL from 25 ICL Pathway for the small number of apparent 140 1 discrepancies that were found." 2 I think this has been drawn to your attention very 3 recently and I don't suppose you remember receiving it 4 at the time? 5 A. That's my "File", writing at the top. 6 Q. Yes. But now you wouldn't remember receiving it. What 7 do you now take from it, having had your attention drawn 8 to it? 9 A. Well, it doesn't surprise me. I think I do remember it 10 because it was a key event. 11 Q. Ah. 12 A. But, thankfully, you were able to produce it. This was 13 very important because, obviously, if you go back to 14 where we were in July/August it was not looking good, 15 but, by this stage, by doing this -- and there was also 16 the attribute checker, which you haven't mentioned but 17 which we also put in place to help POCL with the 18 reference data issues, we had done it. I mean -- but 19 having said that, there were still, inevitably, going to 20 be instances where something went wrong and we have -- 21 I tried to write that into the third supplemental 22 agreement and POCL should have known that. 23 MR BEER: Thank you very much, Mr Oppenheim. They are the 24 only questions I ask at the moment. 25 I think, sir, the next set of questions are to be 141 1 asked by Mr Jacobs on behalf of the Howe & Co Core 2 Participants. 3 Questioned by MR JACOBS 4 MR JACOBS: Thank you, sir. Can I ask if you can see me and 5 hear me? 6 SIR WYN WILLIAMS: I can hear you and I now am able to see 7 you as well. 8 MR JACOBS: Thank you, sir. 9 Mr Oppenheim, I'm asking questions on behalf of 10 153 subpostmasters represented by Howe & Co. Could 11 I ask Frankie, please, to turn up paragraph 59 of your 12 witness statement and that will come up on the screen. 13 That's at pages 19 to 20 of your statement. It's there. 14 If we could just expand that at paragraph 59. 15 Now, this is in respect of Horizon project 16 achievability and you say that in 2001 your confidence 17 in achievability was supported by a statement that the 18 chief executive officer of Post Office made to the 19 effect that the project had been a success and that: 20 "... we have got a product which is working 21 extremely well ..." 22 Now, we, as I have said, represent 153 23 subpostmasters and mistresses, most of whom, if not all, 24 have given evidence to the effect that the product 25 routinely created unexplained and erroneous shortfalls, 142 1 more than occasional mismatches, for which they have 2 been held liable. 3 Now, my question is: do you accept that there is 4 a disconnect between what the contracting parties were 5 saying at this time and what was actually happening on 6 the ground? 7 A. Well, with the benefit of hindsight -- and I -- I don't 8 know the timelines of your clients' events. With the 9 benefit of hindsight, clearly, all was not well, but 10 I have been trying to say throughout that we cautioned 11 the Post Office that this would not be 100 per cent 12 foolproof. 13 Q. Okay, and have you listened, Mr Oppenheim, to what our 14 clients and other people have said in their evidence in 15 this Inquiry from February to May this year? 16 A. I have listened to some of the videos, yes. 17 Q. My next question for you is, with hindsight, do you now 18 agree that Post Office and ICL's confidence in the 19 product was misplaced at the time that this statement 20 was made? 21 A. That presumes that we thought everything in the garden 22 was rosy and we knew it wasn't and we knew that there 23 were things that we didn't know about it. And the point 24 that I made elsewhere in my witness statement was that, 25 with any new programme, you have to look out for the 143 1 things that you don't know about. You can't pick it all 2 up in testing. So, at some point, you have to pull the 3 lever and Go Live and, bearing in mind the volumes, 4 looking at it from that standpoint, from any IT 5 programme -- normal IT programme standpoint, I would 6 have said this would have been viewed as a success, 7 except for the fact that your clients were held to 8 account for things that they didn't do. 9 Q. Well, I accept that and you have said that you can't 10 identify everything in testing, but what did they know 11 about the potential for all these shortfalls that were 12 unexplained? 13 A. Well, I can't answer that. I mean, the -- I would turn 14 it around and say why didn't the Post Office, and also 15 Pathway, note the feedback that was coming back better 16 through the helpdesk -- through the reports of problems 17 back into the helpdesk? 18 Q. Okay, well, that's helpful, thank you. 19 My next questions are in relation to perceived risks 20 prior to rollout and, Frankie, if we could ask for 21 paragraphs 60 and 62 of Mr Oppenheim's statement and 22 they are at pages 20 and 21 of 97. 23 So looking then at paragraph 60, these are the 24 perceived risks of ICL Pathway and the first one that 25 I wish to refer you to is 60.2: 144 1 "The Rollout to 18,500 post offices on the other 2 (sustaining the flow of preparation work, ISDN 3 provisioning, training and equipment supply over almost 4 two years with few breaks)." 5 So that was one of Pathway's perceived risks at this 6 stage? 7 A. Yes, it was. 8 Q. Then moving over to the Post Office perceived risks, 9 which is at paragraph 62, if we could move on to that 10 please. So 62.1: 11 "rolling out 40,000 sets of Counter equipment to 12 18,500 Post Office branches at a rate of hundreds 13 a week, having first connected each branch to the 14 network via ISDN (or otherwise satellite); 15 "modifying the branches to accept the installation 16 of PCs and printers ..." 17 Given the state of technology at the time, and then, 18 finally: 19 "training 67,000 subpostmasters and counter staff 20 (just) before their respective implementation 21 dates ...." 22 Our clients say that the training they received was 23 ineffective and that there were significant problems 24 when the equipment was installed, quite often major 25 power outages. Do you agree, Mr Oppenheim, that these 145 1 particular risks -- and I'm talking about installation 2 and training -- were not adequately mitigated? 3 A. Well, the evidence would suggest not, particularly 4 around training. I think there's definitely something 5 to be said about training. Training was one of the 6 AIs -- was it 218 -- or 298 -- no, 218. It was, as 7 I recall, a two-and-a-half-day training exercise and 8 then there was an extra half day or day for the 9 postmaster. A very complex system, a complete change in 10 business practice for most of them, from manual paper 11 based to system. Was that enough? I think probably not 12 and I have seen that Post Office actually had some of 13 their people and, indeed, some of the more IT literate 14 postmasters help others to augment the training, so 15 I think the evidence is incontrovertible that it wasn't 16 enough. 17 MR JACOBS: Okay, well, thank you. I'm just going to ask 18 those who instruct me if they have any more questions 19 they would like me to ask. 20 (Pause) 21 Thank you, I don't have any further questions for 22 you. 23 A. Okay, thank you. 24 SIR WYN WILLIAMS: Who is next? 25 Questioned by MS PAGE 146 1 MS PAGE: Hello, it's Flora Page here, representing a number 2 of subpostmasters as well. 3 What I would like to do, if I may, is ask some 4 questions relating to the issue that we have come to 5 speak about as remote access, in other words the 6 capacity for Fujitsu to go into accounts and make 7 changes, and the extent to which Post Office would have 8 known about that. 9 What I would like to do, if I may, is refer you to 10 POL00089779. This is a document from 2000, an internal 11 audit plan. You can see you are on the distribution 12 list there and this sort of sets out a series of 13 internal audits for ICL to conduct during the year 2000. 14 I don't know if you have been shown this lately or not. 15 A. Well, if you take me to the bits you want to talk about 16 I will ... 17 Q. Certainly. If we go to page 4 and we look at 18 paragraph 1, it explains that there is actually 19 a contractual right for POCL to do audits on ICL. 20 A. Mm-hm. 21 Q. Do you recall that? 22 A. Yes, I do. 23 Q. It also explains that the plan here -- if we look at (c) 24 it says there that the "independent audit capability 25 within ICL Pathway, as a service to management" is the 147 1 one thing but, on the other hand, there's this idea that 2 there's the POCL internal audit and it seems to be 3 suggesting there -- and you can read it for yourself -- 4 that the plan would be for these ICL audits to be 5 something which the POCL audit could trust potentially; 6 is that fair? 7 A. Yes, I think that's entirely fair. 8 Q. So it sort of anticipates, does it, that the ICL 9 internal audits will be shared with POCL and their audit 10 team would be able to review them and hopefully trust 11 them and rely upon them? 12 A. That's the logic. 13 Q. Well, if we could then have a look at page 6 and it is 14 right down the bottom of the page. There's 15 a paragraph 5.10 and it is sort of at the bottom of that 16 page and it goes over to the next page, so if we just 17 stay there. This refers to an audit of the SSC and is 18 it right that "SSC" is another way of referring to third 19 line support? 20 A. I think that's fair. 21 Q. So this is a planned audit for SSC, or third line 22 support, and I will just read out what it says here, it 23 says: 24 "This is a particularly sensitive area of Customer 25 Services with unprecedented access to live systems for 148 1 support purposes. Previous audits have identified 2 potential control weaknesses which management declare 3 have been addressed. The audit will confirm the current 4 arrangements and assess the strength of the controls in 5 place. Will include a site security audit." 6 So if we can just sort of unpack that a little. 7 There's obviously been some concerns about who has the 8 sort of wider access that you get if you're in third 9 line support; is that fair? 10 A. It's an issue -- it's a worry for any programme, where 11 you have to determine who is trusted to make changes and 12 have access to live systems, and it should be, and it's 13 an obvious area for any audit to focus on. 14 Now, this said that there had been concerns and 15 potential control weaknesses. I mean, this was -- 16 Q. This is in -- 17 A. This was in July 2000. 18 Q. That's right. 19 A. I would say, by then, we should have got on top of 20 those. This says that they have been addressed, 21 according to management. 22 Q. Yes. 23 A. It doesn't -- I'm just reading it as it is written. It 24 doesn't say that they have audited and verified or 25 confirmed that it has. 149 1 Q. No. Well -- 2 A. It says: 3 "The audit will confirm the current arrangements and 4 assess the strength of the controls in place." 5 Seeing that, as I imagine I would have seen it 6 originally, I wouldn't have been unduly alarmed by that 7 because it's right that they should be looking and 8 worrying about these and I would too and it would 9 suggest that there had been some weaknesses, management 10 says they have addressed them, the audit will follow up. 11 Sounds okay to me. 12 Q. I don't seek to suggest otherwise. This is a planned 13 audit. I haven't been able to locate the documentation 14 of the actual audit, so it's unclear what was found when 15 this was followed up. But the point that I would like 16 to sort of tease out, if I may, is that, assuming that 17 audit took place, Post Office would have, according to 18 the plan, then been shown that and it would have been 19 shared with them for their own audit purposes; is that 20 right? 21 A. Well, I'm afraid I don't know. The fact that they could 22 rely on an internal audit -- I don't know that -- 23 I wasn't responsible for this. This is Martyn Bennett's 24 area. I don't know whether he would routinely have 25 shared these with POCL, particularly in the early days, 150 1 or whether the intention was that POCL would say "Look, 2 can you -- have you done an audit on X and would you 3 share it with me". In other words, we would produce it 4 if asked, as opposed to just issuing them all to POCL, 5 or without being asked. 6 I suspect it was -- if asked, we would share it as 7 opposed to "here it is", to be honest. 8 Q. The only way to resolve any problems that ICL picked up 9 in terms of accounts and reconciliations, the problems 10 that we have been talking about with Acceptance 11 Incident 376 was through SSC going into the accounts and 12 doing these changes; is that fair? 13 A. No. There was such a spectrum. There is appendix 4 -- 14 schedule 4 in the third supplemental agreement goes 15 through a long list. For the kind of problems of breaks 16 and such-like that I was referring to latterly, yes, if 17 the postmaster wasn't able to do it for himself under 18 instruction -- under guidance. There was another whole 19 category where a lot of the 376 discrepancies were going 20 to be not automated but semi-automated and didn't 21 affect -- there wasn't a Cash Account error, but some 22 other missing transaction or whatever error. 23 So some but not all, by any means, I think, is the 24 answer. And where it was required, those general 25 provisions, right at the end of the third supplemental 151 1 agreement, require Fujitsu to inform POCL if we made 2 a judgement, and that was really key to me because then 3 it's saying, "Look, we're really not sure", and if then 4 someone is accused of fraud, that will be the first 5 place to look. We would have provided that information. 6 If he had made a call, on such and such a day that which 7 tied in with that discrepancy, that week's Cash Account, 8 then that's at least a starting point for saying, "Just 9 a minute, we knew there was a problem here. This was 10 the assumption we made. Maybe that was a wrong 11 assumption, we should relook at it". 12 Q. But at a more routine level, when it wasn't that sort of 13 "We're not sure" type situation, somebody in SSC would 14 go in and resolve the problem? 15 A. I was not expecting that. I -- for me, this was more of 16 a technical support thing, as opposed to changing data. 17 I did not expect any change of data, particularly 18 without the agreement of the postmaster, so if the 19 postmaster had been talked through a correction routine 20 and it hadn't worked, then I would have expected the 21 helpdesk to say "Well, this is what I'm going to do, I'm 22 going to raise an error report, I'm going to declare it 23 to Post Office and I'm going to make these changes and 24 I will share them with you; is that okay?" Right? 25 They agree what the corrective action should be and 152 1 he does it on the postmaster's behalf. That's what 2 I expected, not that he would do it unilaterally. 3 Now, I have no direct knowledge of what was actually 4 done, I'm afraid, but that was my expectation. 5 Q. Have you read the evidence of Richard Roll at all? 6 A. I have briefly and I -- I didn't know Richard and 7 I found some of what he said -- well, a lot of what he 8 said concerning but I also found some of it quite 9 surprising. I wasn't -- I should stop there. 10 Q. You accept, don't you, that Horizon data was not 11 infallible? 12 A. Yes, yes. I have said that all along. 13 Q. And that the Post Office should not have prosecuted on 14 the basis that it was? 15 A. You're asking me for an opinion. Would I have done it? 16 No, not without digging really deep. 17 Q. Finally, do you accept that it was actually in Fujitsu's 18 commercial interests for Post Office to prosecute on 19 that basis? 20 A. No, I don't accept that at all. I mean it -- quite 21 apart from the moral side of things, I don't understand 22 how even commercially -- oh, you mean to keep in their 23 good books? No, no, no, Fujitsu is not that kind of 24 organisation, not in my day anyway. 25 MS PAGE: Thank you, those are my questions. 153 1 MR MALONEY: Sir, may I ask some questions now? 2 SIR WYN WILLIAMS: Yes, of course. 3 MR MALONEY: Thank you, sir. I know by that answer you can 4 hear me. Can you see me now? 5 SIR WYN WILLIAMS: There is always a delay but now I can, 6 Mr Maloney. 7 Questioned by MR MALONEY 8 MR MALONEY: Thank you. 9 Mr Oppenheim, the Chair has just given you my 10 surname. I'm Tim Maloney and I also represent a number 11 of subpostmasters and, specifically, I act on behalf of 12 subpostmasters whose convictions have been quashed on 13 referral of their convictions either to the 14 Court of Appeal or the Crown Court. 15 A. Understood. 16 Q. I have only very few questions really for you and they 17 concern commercial priorities of POCL, as you understood 18 them, when dealing with the development of Horizon in 19 1999, particularly. 20 Firstly, did you regard the Benefits Agency's 21 cancellation of the Benefits Payment Card in May 1999 as 22 an existential threat to POCL? 23 A. Yes. 24 Q. Why did you regard it as such an existential threat to 25 POCL, Mr Oppenheim? 154 1 A. Because the original plan, the raison d'être for the 2 Benefit Payment Card was to modernise the method of 3 payment through the Post Office to claimants and to make 4 it "a good experience for them to continue to do so", 5 whereas what the Benefits Agency would have preferred 6 was ACT and they actually made no secret of that, so 7 that would have eliminated, at its worst, something like 8 a third, as I recall, of POCL's revenues. 9 So in that sense, yes, it was an existential threat, 10 unless something could be done to mitigate that loss 11 and, hence, the Network Banking solution and also OBCS 12 was an aid in the meantime because it cut down on 13 encashment fraud, even with paper, and it stopped the 14 Benefits Agency from rushing to ACT, which otherwise 15 I think they would have wanted to do. Whether the 16 government would have allowed them to do that or not, 17 I don't know. 18 Q. So there was a necessity to generate alternative revenue 19 streams? 20 A. Yes. 21 Q. Those alternative revenue streams included Network 22 Banking -- 23 A. Yes. 24 Q. -- and OBCS? 25 A. Not really. OBCS was, in a sense, an interim solution. 155 1 It was a way of making the old books secure by putting 2 a barcode on them such that BA could put a stop notice 3 on them, which previously they couldn't have done and 4 that saved, variously estimated, 50 million of the 5 150 million loss of encashment fraud per annum. So it 6 was a good step towards the way. But, no, that was part 7 of the legacy of books and that was going to go away and 8 what needed to replace it was Network Banking, to 9 attract as many POCL customers to continue to use 10 branches and maintain a footfall. 11 Q. Of course, integral to the movement to Network Banking, 12 would be the development of automation? 13 A. Yes. 14 Q. Without automation, there could be no movement there, 15 there could be no alternative revenue streams, the 16 existential threat perhaps became an existential 17 reality? 18 A. Well, it would have been, yes. 19 Q. So was it obvious to you, around 1999 and into 2000, 20 that POCL would be under real commercial pressure if 21 Horizon did not proceed at pace? 22 A. Yes. 23 MR MALONEY: That's all I ask. Thank you, Mr Oppenheim. 24 SIR WYN WILLIAMS: Is anyone else present who wishes to ask 25 Mr Oppenheim any questions? 156 1 MR BEER: No, that's a nil return, thank you, sir. 2 Questioned by SIR WYN WILLIAMS 3 SIR WYN WILLIAMS: Right. Well, I'm going to go on a little 4 fishing expedition with Mr Oppenheim myself, just for 5 a minute or two. 6 Mr Oppenheim, it relates to many questions you have 7 been asked about processes whereby Pathway might provide 8 information to POCL to assist in investigating 9 subpostmasters, all right? 10 A. Mm-hm. 11 SIR WYN WILLIAMS: I don't want to discuss the strict 12 contractual provisions with you. I'm going on what 13 I describe as a fishing expedition because I want to try 14 and identify the people who might know most about this 15 in order to ask questions in the future. Do you 16 understand? 17 A. I do. 18 SIR WYN WILLIAMS: Will you accept from me, because I have 19 reliable evidence to this effect, that investigations of 20 subpostmasters, in reliance on Horizon data, began 21 almost as soon as the rollout began because we have 22 instances of people being in court in 2001 and therefore 23 being investigated in 2000, all right? 24 So in the year 2000, if I was the person in POCL who 25 was charged with accumulating the evidence necessary to 157 1 investigate whether a subpostmaster had committed 2 a crime, I think it's reasonably obvious that I would 3 have to go to someone in Fujitsu to ask for relevant 4 information. 5 A. Mm-hm. 6 SIR WYN WILLIAMS: Yes? Now, I'm not one of the people who 7 were working in the technical teams, I'm now a Post 8 Office investigator, or perhaps even a Post Office 9 lawyer, so I want to locate the right people, if you see 10 what I mean. So can you assist me from your 11 knowledge -- because, in this period, you obviously were 12 very knowledgeable -- who would it be that would most 13 likely tell me what information Pathway might hold and 14 how I might use it? 15 A. Firstly, I don't know the answer, but I'm going to try 16 and give you my best shot. I mean, the information is 17 all operational information, so that comes under the 18 head of services, Steve Muchow, but he is a support 19 function. So support is, by definition, a support 20 function. He is not necessarily the go-to person from 21 within POCL. 22 As I have said before, my working assumption was 23 that anything to do with prosecutions, to do with audit, 24 would have been Martyn Bennett, within ICL Pathway. So 25 that would be, I would have thought, my headline go-to 158 1 person, and then he would go to someone in support, 2 third line support, Steven Muchow -- I'm thinking maybe 3 the very first of these would be groundbreaking, so 4 probably Steve Muchow, to get the evidence to produce 5 the information that was sought. 6 SIR WYN WILLIAMS: So my investigation begins with 7 Mr Bennett and we can ask him what he would have done in 8 my supposed scenario, yes? 9 A. I would definitely put the question to him. I may be 10 wrong in pointing at him, but logically I would have 11 thought that was where it would go. 12 SIR WYN WILLIAMS: All right. 13 A. It could have come up through -- just depending on how 14 POCL raised the matter. Did it go from their 15 prosecution team, their fraud team, to say Keith Baines 16 as the sort of interface to me contractually, who might 17 then have gone to Steve Muchow without my knowing it. 18 I would be surprised -- 19 SIR WYN WILLIAMS: So Mr Baines is another possibility for 20 asking these questions? 21 A. Well, I think -- I think that's not going to be 22 possible. 23 SIR WYN WILLIAMS: No, I'm sorry. Yes, yes, sure. All 24 right -- 25 A. But one of that group of people I would have thought 159 1 would know because why wouldn't they go to them first to 2 say "Have you got any data, operational data, that would 3 help us with this?", before necessarily coming to us, 4 but I don't know. 5 SIR WYN WILLIAMS: All right. I can't be certain about this 6 yet, but no doubt I will get evidence about it, it may 7 be that in that same period there would have been 8 a request, as Mr Beer was putting to you, for a person 9 to give evidence from Pathway about the reliability of 10 Horizon. Who would have been involved in making the 11 decision as to who is best placed to give that sort of 12 evidence, given these two premises: firstly, it would be 13 in the nature of expert evidence where the expert owes 14 duties to the court; but, secondly, also it would be 15 based to a degree on factual evidence, so you would need 16 a suitable person to cover those two things in the 17 Pathway organisation. Who would have made the decision 18 "It's Mr X", or Ms Y? Who was the best placed? 19 A. Can I suggest you ask John Bennett that question. 20 I would have thought this would have been seen as such 21 a major issue that it would have -- any such question 22 would have gone to John for determination. I don't 23 recall discussing it with him, but that may be a lapse 24 of memory on my part. 25 SIR WYN WILLIAMS: Because on any viewpoint there did come 160 1 a point in time where the person giving evidence in 2 court about these issues was being challenged about it, 3 so it's hard to believe that this wasn't, at least by 4 that stage, though I appreciate this might be after your 5 direct involvement, there wouldn't have been a good deal 6 of discussion about this sort of evidence. 7 A. I mean, again, at the risk of repetition, it never came 8 up, it never came across my desk -- I cannot believe 9 I would have forgotten had it done so -- during my 10 tenure. 11 Now, the fact that it only came to court in 2001, 12 that could point to it having been discussed after, just 13 after probably I had left in February, it's possible, 14 but I'm casting around. I'm sorry, I just don't know. 15 SIR WYN WILLIAMS: All right. I will leave my fishing rod 16 aside and we will wait for future witnesses. 17 Thank you very much, Mr Oppenheim, for making 18 a statement and for giving evidence to the Inquiry. 19 A. You're welcome. I hope it helps. 20 MR BEER: Sir, thank you. That's all of the evidence for 21 today. We're back at 10.00 am tomorrow. 22 SIR WYN WILLIAMS: All right. Thank you very much, Mr Beer. 23 MR BEER: Thank you, good night. 24 (3.57 pm) 25 (The Inquiry adjourned until 10.00 am on Thursday, 161 1 27 October 2022) 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 162 1 2 INDEX 3 4 ANTHONY OPPENHEIM (affirmed) .........................1 5 Questioned by MR BEER ............................1 6 Questioned by MR JACOBS ........................142 7 Questioned by MS PAGE ..........................146 8 Questioned by MR MALONEY .......................154 9 Questioned by SIR WYN WILLIAMS .................157 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 163