1 Thursday, 3 November 2022 2 (10.11 am) 3 MR JEREMY FOLKES (continued) 4 Questioned by MR BEER 5 SIR WYN WILLIAMS: Thank you. 6 MR BEER: Good morning, sir, to you and your assessors. 7 Mr Folkes, good morning to you. Can I ask you 8 a question, please, picking up on something that you 9 said yesterday. You told us, when I showed you the 10 EPOSS task force report, that you didn't know about the 11 EPOSS task force at the time but that, after, I think, 12 you left the company, you spoke to people who were 13 involved, you spoke to them informally over a pint -- 14 A. Yes. 15 Q. -- and they said that Pathway ploughed as many people as 16 they could find into the EPOSS system to try and get it 17 to be fixed or fix the issues in it? 18 A. Yes. 19 Q. And the feedback that you got from them was that that 20 process was introducing as many issues as were being 21 fixed. I'm summarising, not quoting verbatim from the 22 transcript. Can you tell us who you spoke to, please? 23 A. I suppose I have spoken to a number of people. The 24 world of account automation is fairly small, so people 25 who worked there I have come up since. 1 1 There are people who I have worked with within 2 Escher who formerly worked back in Fujitsu. I believe 3 as one gentleman called Dai Jones who I spoke to. There 4 was another gentleman called Nick Wright and there may 5 have been others. 6 Q. Certainly Dai Jones and Nick Wright? 7 A. Yes. 8 Q. Thank you very much. Can I turn to the fifth role that 9 you undertook as part of this programme, namely the live 10 trials and acceptance phase. You tell us in your 11 witness statement, and it is WITN05970100, at page 47 -- 12 you are here dealing with the live trial process in 1999 13 and, at paragraph 141 at the bottom, you say: 14 "I have been asked to describe my understanding of 15 the nature, cause and severity of Acceptance Incidents 16 identified during the Live Trial. I remember the Live 17 Trial exposed many issues with Horizon as supported by", 18 and you refer to a pack of AI forms: 19 "These become visible to us via Acceptance Incidents 20 (AIs). These spanned a variety of areas, from training 21 and helpdesk, through to accounting in EPOSS down to the 22 underlying system stability, and included the interface 23 to the POCL backend system TIP." 24 As you say, the issues that were being raised in the 25 course of the live trial became visible to you via 2 1 Acceptance Incidents forms, AIs, yes? Can we just look 2 at an example of one of those, please, POL00028357, and 3 look at page 57, please. 4 This is a AI form. It is, in fact, for AI376 in 5 which the Inquiry is interested. Can you help us, on 6 what system were these AIs kept? 7 A. I believe it was a system owned by Post Office or run by 8 the programme. I don't actually know whether this was 9 a formal system or whether these were maybe Word 10 documents on a server. Whatever it was, I didn't have 11 direct access to them but I saw many of them, they were 12 emailed out, or whatever, to people. 13 Q. So, to your knowledge, there wasn't necessarily a system 14 or an application which operated the AI forms, you got 15 sent them or presumably were shown paper copies of them? 16 A. There was an acceptance team who managed them. I don't 17 know what tools they used to manage them. 18 Q. Was there any way for you to look at all and any AIs or 19 could you only look at those that were sent to you? 20 A. I believe only those that were sent. 21 Q. Could you make changes to the text within them? 22 A. Not directly but I believe we could contribute changes 23 further down the form. There were various AI meetings, 24 et cetera, and the outcome of some of these meetings 25 would have been recorded. They wouldn't have been 3 1 recorded directly by myself but the people managing the 2 AI process would have then gone back and updated them. 3 Q. If we look at the foot of the page, there seems to be 4 a requirement at the foot of the page for them to be 5 signed off by a witness or reviewer. The witness or 6 reviewer, can you help us as to which organisation that 7 person might come from? 8 A. I presume the witness or reviewer would have been the 9 person who witnessed the test and, therefore, witnessed 10 the failure of the test, given it would be a failure 11 that caused the AI. 12 Q. So that could be either POCL or ICL Pathway? 13 A. Potentially, yes. 14 Q. Then "Horizon Acceptance Test Manager", was that -- 15 A. It would have been POCL, I believe. 16 Q. That would have been in POCL? 17 A. I couldn't give a name to it but that would have been 18 a person from Horizon, ie at that point POCL, who was 19 running that acceptance test. 20 Q. Pathway is obvious. Then "AIM", can you help us as to 21 what that is? 22 A. I can't. I can make a guess it was the AI manager maybe 23 but that would be a guess. 24 Q. We see that there are some now irrelevant issues, a DSS 25 acceptance manager at the foot of the page. Then "POCL 4 1 Business Assurance". Who would that have been? 2 A. That I presume would have been somebody within John 3 Meagher's team or the relevant business person in the 4 relevant business area. So if this was talking to -- 5 this one is related to the link to TIP, I believe, so it 6 may have been a relevant person within the TIP team. 7 Q. As a matter of practice, were these, in fact, signed and 8 completed? The ones we have got aren't. 9 A. I can't remember seeing any that were signed but, you 10 know, what I remember seeing was many iterations of 11 them, in that an AI would be raised and then it would be 12 updated with progress and discussions and whatever and, 13 therefore, every time it was printed out -- it wouldn't 14 be resigned every time it was printed out. 15 Q. These forms cross refer to PinICLs quite often? 16 A. Yes. 17 Q. Did you have access to records of PinICLs? 18 A. No. 19 Q. Did, to your knowledge, anyone within POCL have access 20 to PinICLs? 21 A. To my knowledge, at this point, middle of 1999, no, we 22 didn't have access to PinICLs. 23 Q. On what system were PinICLs kept? 24 A. PinICLs was an internal ICL or Pathway tool. I believe 25 it was something wholly within the Pathway internal 5 1 systems, and probably only, therefore, accessible within 2 Pathway's own internal networks. 3 Q. Do you know the system on which they were kept or not 4 because it was in ICL Pathway? 5 A. No. There were a number of internal systems that any 6 software provider would have and a fault management 7 system would be one of those. But as to what server it 8 would go on, something internal to them. 9 Q. These AIs sometimes refer to information coming in from 10 helpdesks? 11 A. Yes. 12 Q. What access to Helpdesk records did you, within POCL, 13 have? 14 A. Within POCL, I remember we had initially no direct 15 access to information. In the middle of 1999 there was 16 something called the "problem management system" running 17 on a problem management database web server that Pathway 18 introduced. This wasn't direct access to the Helpdesk 19 system, it was something derived from it. I remember we 20 were given access to that and it is actually mentioned 21 in POL28397. It is probably not relevant to bring it up 22 but that document confirms we had access to this drive 23 system. We found that wasn't satisfactory, it didn't 24 provide enough detail and I was then asked by Bruce 25 McNiven to draft a letter that he could send to John 6 1 Bennett, that I did on 13 July of that year asking for 2 full access to HSH. 3 Q. Were you given full access to HSH? 4 A. I believe at some point after that we probably were. 5 I didn't personally see it. The problem that we had was 6 that this drive system, this problem management system 7 we were given, which was running on this separate web 8 server, I remember when we looked at it, in the letter 9 I wrote to John Bennett for Bruce, it said "the system 10 appears to be incomplete", it only contained 14 problems 11 when we looked at it. Well, 14 problems as of 12 July 1999, to me, was not a credible or accurate 13 extract. So what we were being shown at that point was 14 some kind of extract. We didn't know how it came from 15 there but we commented it was incomplete and it didn't 16 appear to be in its original form, so we pushed that we 17 needed the access to the real HSH logs to be able to 18 understand what was happening in the field. 19 Q. Can we go back to your witness statement please, 20 WITN05970100 at page 48. It is paragraph 143 of your 21 witness statement. You say: 22 "My view was that these incidents ..." 23 These are the incidents that you spoke about as 24 depicted on the AIs: 25 "... were of significant severity, especially those 7 1 which rendered the system unstable and by nature 2 'encouraged' the user to reboot." 3 Why were they of significant severity? 4 A. Well, this one in particular, 298, which I think I was 5 given to run with internally, the system in front of the 6 counter clerk and subpostmaster, would lock-up or run 7 very slowly and it was unusual, they couldn't serve with 8 it. When this happened they could either try and 9 wait -- if you have got a Post Office full of people 10 that's not awfully satisfactory -- or you reboot. The 11 process of rebooting a PC, back in that side of 12 technology and what you had to go through, might have 13 taken 15 minutes. So 15 minutes with a PC being down, 14 again with a queue out of the door, was also 15 unsatisfactory and deeply annoying. 16 What we found, in the next paragraph, it states what 17 I argued here, we felt it was likely -- and by talking 18 to people, we believed this to be the case -- that if 19 the system locked up they wouldn't try and ring the 20 Helpdesk and say "What do I do", or wouldn't always do 21 that because it might take them a significant amount of 22 time to get through to the Helpdesk and the Helpdesk 23 would then go through the whole process of what's gone 24 wrong and ask them their details, to then be told to 25 reboot. So what we felt was, if the system was locking 8 1 up, that what would happen is that, as a matter of 2 course, many people would say "Well, the last five times 3 I rang the Helpdesk, they told me to reboot. I am going 4 to reboot". And as with any system, if you keep 5 rebooting it is not be very -- it's not a satisfactory 6 experience and it is also potentially going to lead to 7 the danger of things going wrong. 8 Q. Thank you. Can we turn forward to page 50 please. 9 Paragraph 149 of your witness statement. You say: 10 "I have been asked for my assessment of ICL's 11 Pathway rectification plans and whether my assessment 12 changed over time. I remember it seemed that Pathway 13 were more interested in talking down severity of AIs, 14 rather than actually trying to engage to resolve issues, 15 in what [I] felt was a war of attrition." 16 I think that's meant to read, yes? 17 A. What it felt, yes. 18 Q. You say there that Pathway seemed more interested in 19 talking down the severity of AIs. Was that based on 20 rumour or personal experience? 21 A. Personal experience in the AI workshops. 22 Q. Over what period? 23 A. Over the, I think, August/September time probably, in 24 particular, in 1999. What I mean by that is 25 a category one or "A" was potentially a show stopper, 9 1 there was a threshold of any one. A category "B" they 2 were allowed, in the weakened contract that we signed up 3 for, twenty. So, there was a massive incentive, I would 4 suggest, on behalf of Pathway to avoid anything being 5 a category one. 6 Our view was that a system which had to be -- 7 required a large number of reboots in the field was, 8 therefore, unstable but that was enough for it to be 9 a category one. Especially with the effect that that 10 would have both upon the operation of the Post Office 11 and trying to serve end customers but also the whole 12 experience of the subpostmaster. 13 Q. Can we go forward please to page 66 of your witness 14 statement, to paragraph 202. 15 You are addressing here "Looking back", so some 16 retrospection at the fitness for purpose of the system 17 at rollout. In the third line you say: 18 "Looking back, given the somewhat chequered history 19 of the development of Horizon, including the problems of 20 Assurance, the withdrawal of the Benefits Agency, the 21 number of Acceptance Incidents, the number of late 22 changes to AIs and the need for the Suspension of the 23 Rollout to get remediations completed, it would be hard 24 to argue that the system or Pathway's overall service 25 would have magically become 'fit for purpose', for 10 1 a full national rollout and immediate switch to Business 2 as Usual." 3 That appears to be an answer to a question: given 4 all the issues that you identify there, why was it 5 rolled out nationally? Yes? 6 A. That, I believe, was the question, yes. 7 Q. You identify a series of answers. In paragraph 203, you 8 say: 9 "... the expectation was ... there would be 10 extensive monitoring/handholding during the rollout and 11 first national running." 12 Where did that expectation come from? 13 A. I think -- a general view -- okay, the view was that, up 14 to that point, there had been maybe 200 offices and then 15 the number went up a little bit but that the only way 16 the system was going to be proven was by putting it out 17 into a larger number. I think there was a step of 18 2,000. Ideally, it would have been proven through all 19 the assurance processes and everything else that we 20 discussed in detail over the past 24 hours. We didn't 21 manage those and, I think, the view generally was we 22 have got to get this thing out there to try it. But 23 I don't think anybody had the view it was going to be 24 perfect. 25 I don't know what happened during 2000, if that view 11 1 changed, but the view was we put it out there and it 2 would need extensive monitoring and handholding by -- it 3 would have been Business Service Management, because it 4 was live, at that point, who would have done it, but 5 there would need to be monitoring going on to test it 6 during that larger rollout. 7 Q. You give a second answer at 204: 8 "I do believe there was also a general view in POCL 9 that they had to get this system into a real live 10 operation in a representative number of offices to 11 really see how it operated ..." 12 A. Yes. 13 Q. It might be suggested that that means that you needed to 14 increase the number of guinea pigs. What would you say 15 to that suggestion? 16 A. I think I hear where you are coming from with the 17 statement of that. I think the view, with any system 18 that needs to be incrementally trialled, what you would 19 need to do -- that would be the case with, I think, any 20 IT system -- the important thing is that you know when 21 to stop and, if it turns out not to be working, that you 22 pull back. You certainly don't roll it out any further. 23 You monitor it. 24 What it does require is openness from the provider 25 and everybody as to what the state of the system is so 12 1 you go into that in an open mind. Bear in mind that 2 when the decision was taken to do that rollout, in 3 theory, the Acceptance Incidents had been fixed or 4 mitigated, or there were -- so the known bugs had been 5 addressed. 6 Q. I think that's the third answer you give, just looking 7 on in 205: 8 "From a Contractual point of view, I am not sure 9 whether POCL could have prevented rollout once Pathway 10 had completed the AI remedial actions", ie from the 11 contractual point of view there was no choice to be had? 12 A. Yes, and I think the problem we had here, if you like, 13 was the case of the known unknowns and the unknown 14 unknowns, or whatever. I was certainly well aware that 15 the system had gone through what I think I referred to 16 here as a very chequered upbringing or development. It 17 was not a good place to start from but the Acceptance 18 Incidents which had been raised during acceptance had 19 been cleared or mitigations had been put in place and 20 the contract, therefore, said that it needed to go 21 forward. 22 Q. Thank you. 23 My last set of questions. Your time came to an end 24 at POCL in February 2000. You moved to another company 25 and you tell us in your witness statement that, in the 13 1 last few weeks, you wrote what you described as a "brain 2 dump paper". I wonder whether we could look at that, 3 please. It is WITN05970123. It has a grander title 4 than "brain dump: 5 "A Reflection on the Past Five Years: Lessons Issues 6 and Key Points." 7 You authored this document? 8 A. I did. 9 Q. You can see that the date underneath your name is 10 February 2000 and then, at the foot of the page, it says 11 "Braindump 2000" and then "Updated 2022". What changes, 12 if any, were made in 2022? 13 A. When I printed it out there was one statement I believed 14 was incorrect in it and so I updated it and struck it 15 through but it is still within the document -- and when 16 I disclosed that when I disclosed it -- just because 17 I didn't want it to be a distraction. But the words 18 that I had at that point and there is a -- are still in 19 the document. 20 Q. So we can see it, it is transparently there and it is 21 scored through? 22 A. Yes. 23 Q. Thank you. Can we look at page 2 and read the 24 introduction together. You explain that: 25 "During the last five years ... there has been 14 1 a considerable turnover of staff ... leading at times to 2 a lack of continuity and certainly a loss of key 3 knowledge and accumulated wisdom. This loss naturally 4 leads to a reduction of the amount of reliable 5 information on which to base decisions, the growth of 6 unsubstantiated rumour about many aspects of Horizon, 7 and a severe risk of wheel reinvention." 8 Your document was: 9 "... intended to help mitigate the effect of the 10 loss of a further batch of staff. It evolved from 11 a concept of producing a general 'brain-dump' 12 document ..." 13 You say: 14 "[It] has been produced for Dave Miller, the 15 Managing Director of Post Office Network Unit ..." 16 Did anyone actually commission this or was it your 17 initiative? 18 A. I believe in discussion with Dave Miller I said I would 19 like to create a kind of brain dump or reflection. 20 I felt there were a number of -- we had gone through 21 a tough five years and there were a number of things 22 that I felt that I wanted to be able to write down to -- 23 should anybody try to do this thing again, to avoid some 24 of the problems. 25 So I said, as part of my wind down, to Dave Miller 15 1 that I would write this and I did send it to him at the 2 end of my tenure. I don't believe I had any discussions 3 on its content with him. 4 Q. Understood. So it was sent to Mr Miller. Who else was 5 it sent to, if anyone? 6 A. I can't remember who else. It may have been shared with 7 other people from the assurance team at that point or 8 what had been the assurance team. Bear in mind, at this 9 point, the programme was effectively being wound down or 10 had been wound down and this is the usual functions of 11 taking over running the system. So a number of the 12 people who would have been around who I might have been 13 copying things to before were no longer around. 14 Q. This document is, essentially, a contemporaneous view, 15 from your perspective, of the state of Horizon as at 16 February 2000? 17 A. Yes. 18 Q. You had intimate knowledge of the project, as we have 19 seen, over the proceeding five years at this point, in 20 a variety of team leader and management roles? 21 A. Yes. 22 Q. What did you expect, if anything, to be done with the 23 document? 24 A. I hoped people would at least read it and anybody new 25 brought in, maybe at a senior level, would be given it 16 1 to read. There are a number of comments in it that 2 relate to how the procurement were done or unrealistic 3 expectations in the procurement. Those things would 4 probably not be relevant, unless we were going to be 5 doing another procurement. 6 Q. It is a 32-page document -- 7 A. Yes. 8 Q. -- and it speaks for itself. I'm not going to go 9 through it in any detail. 10 A. But it does cover -- it kind of covered the five-year 11 period and was -- as it sort of said, it was a dump of 12 my view of what had happened over those years and what 13 we got right and didn't get right. 14 Q. I just want to look at one part of it which may be of 15 particular relevance to us, on page 21 onwards, please. 16 So page 21, please, under the heading "Some technical 17 capability still to be proven". You say: 18 "This section outlines a number of technical areas 19 which it would be relies to 'watch', although they are 20 not the subject of any outstanding [AIs]." 21 Why were you suggesting to the Post Office that 22 there should be technical areas that should be watched, 23 even though they are not the subject of outstanding AIs? 24 A. I guess from my experience and professional view, these 25 were potential weaknesses. We had not -- as discussed, 17 1 we had been able to go through the assurance process 2 that we might have wanted but these were areas that 3 didn't seem strong and what I was trying to do is point 4 out here, maybe to people who weren't so techie, that 5 these were not things that were going to go wrong, 6 because if we knew they were going to go wrong we should 7 have done something about it, but areas where the 8 solution or Pathway's ability to manage appeared weak, 9 in my view. 10 Q. Thank you. You outline seven areas. The first is 11 "Software Distribution", and you say: 12 "The distribution of new versions of software to the 13 field is an area which ICL Pathway have been shown to 14 have some difficulty in the past ..." 15 The second issue -- 16 A. Can I just say on that, that was a case where there was 17 a AI, AI372, which I think I was the technical expert, 18 or whatever the word was, within the programme. The AI 19 was cleared to our satisfaction and they had done 20 a successful release. Obviously, this is a sort of 21 scalability type issue, in that releasing a new version 22 of software to 20,000 offices or 40,000 terminals spread 23 around the country over the network, as it then existed, 24 was going to be challenge to anybody, and I felt it was 25 one that we should be continuing to watch. So they had 18 1 proven it at whatever few hundred or a thousand -- or 2 whatever number of offices we were up to at that 3 point -- but it was one that I -- that we should be 4 continuing to watch, and when there was a next big 5 release of software, we shouldn't be blasé about it. 6 Q. Thank you. The second is the "Effect of replication 7 delays/failures", and we can see what we say there. 8 Over the page, please, the third issue was 9 "Communications Failure/Poll Failure". The fourth issue 10 was "Integrity during failure conditions". Then this is 11 the passage that you struck through, the example? 12 A. Yes. 13 Q. The fifth issue was "Scalability". Reading on, the 14 sixth issue was "Performance over time", warning that we 15 should be aware that the performance of computer systems 16 can degrade over time, and the seventh issue was "System 17 Management", where you say: 18 "... Pathway's ability to detect and manage certain 19 failures in the system is as yet somewhat unproven ..." 20 Was that a complete list of the issues as you 21 understood them, that were risk areas for the Post 22 Office as at February 2000? 23 A. They were the ones that jumped out at me in the areas 24 I'd looked at, at that point. 25 Q. Just two other questions that are unrelated to this. 19 1 We can take that down, please. Thank you. 2 You mentioned in your witness statement, hostile 3 testing and proposal that you made. You wrote 4 a document proposing hostile testing. What prompted you 5 to write that document or make the proposal? 6 A. My concern was that the testing that the Post Office 7 themselves were doing was all very much functional 8 testing, as far as I understood it, for instance model 9 office testing, having an office, putting in 10 transactions, making sure the right numbers came out at 11 the end. 12 There was technical testing that had gone on in 13 other areas, I know, and were done by Pathway. But 14 I was concerned that it comes down to this issue of 15 failure conditions and failure analysis. I was 16 concerned that not enough appeared to have been done or 17 we had not had enough visibility of it, as to how the 18 system would behave in cases of failure. 19 Again, 40,000 end points spread across the country 20 and all sorts of communications or hardware going down, 21 whatever, things would go wrong: cables would drop out, 22 people would push the wrong buttons, power will go off 23 at the wrong points. 24 Q. What happened as a result of your proposal? 25 A. I'm not aware that anything was done with it. 20 1 Q. You are aware of the reasons why your proposal was not 2 accepted? 3 A. I'm not. 4 Q. The second issue is that we have seen a number of 5 references in contemporaneous materials over problems 6 with reference data and the reference data system. Who 7 out of ICL Pathway and POCL were responsible for the 8 provision of reference data? 9 A. Okay, there was a reference data management system that 10 POCL has, this is standard, every Post Office would have 11 it, somewhere where they would master the reference data 12 of their products and services. 13 The intention was that that system would feed 14 Pathway and Pathway would then do whatever was needed 15 with that data to drive what was happening down at the 16 counter. 17 Q. Yes. 18 A. Obviously, that system in POCL probably drove a number 19 of other systems, presumably it drove the existing ECCO 20 and APT systems and probably the backend systems. 21 I believe there was a requirement that said that Pathway 22 should robustly integrate or robustly import, or 23 whatever, but the view was it was -- a feed would be 24 made available to Pathway and it was then their job to 25 take that feed and do whatever they needed to it to be 21 1 able to run the counter system. 2 Q. I can understand that it would be POCL's responsibility 3 for provision of reference data, ie to say that the 4 price of a First Class stamp has increased from 16p to 5 17p, or whatever. You are telling us as well that the 6 reference data system was a POCL system? 7 A. I believe so. So the person in POCL who said the price 8 of a stamp is going to go up from 16 to 17 -- those were 9 the days -- 16 to 17 pence on this date would be 10 somebody sitting within POCL at a POCL system. 11 Q. What was the system called, can you remember? 12 A. I think it was just known as RDM or RDMC, reference data 13 management, but I didn't really have visibility of what 14 that system was, I do not think I ever saw it. 15 Q. Who within the Post Office, not name but organisational 16 unit title, was responsible for the operation and 17 management of it? 18 A. I don't know, sorry. 19 MR BEER: On that note, Mr Folkes they are the only 20 questions that I have of you. If you wait there, there 21 may be some other questions? 22 A. Thank you. 23 Questioned by MR JACOBS 24 MR JACOBS: Good morning, I have some questions. 25 Mr Folkes, good morning, I ask questions on behalf 22 1 of 153 Core Participants, subpostmasters, who are 2 represented by Howe+Co. 3 I want to ask you about POCL's reliance on the 4 Benefits Agency revenue stream and you have dealt with 5 that at paragraph 26 of your statement. Perhaps if we 6 could call that up. It is WITN -- it is there already. 7 That's very good. 8 So you say that: 9 "POCL were scared that the BA would take their 10 business elsewhere, (as they eventually did, into the 11 banking system) which would dramatically reduce POCL's 12 revenue stream, and that this would threaten the whole 13 future of POCL (and in particular the role of POCL as 14 the front office of government). So for POCL the 15 success of the overall Benefits Payment Service was as 16 important as the other, POCL-centric, services." 17 The question I have for you, Mr Folkes, is: do you 18 agree that the aims and objectives of the Benefits 19 Agency and POCL were misaligned from the very beginning 20 because the Benefits Agency always preferred automated 21 banking to the Horizon product and, we say, that was 22 quite well known? 23 A. I think between the two organisations at top level they 24 obviously had a different view of it because, I think, 25 BA were a less -- or DSS were less keen on this than 23 1 POCL. POCL were incredibly keen. I think when it came 2 down to the people within the programme itself, and the 3 people that I would have worked with on a day-to-day 4 basis from BA, the objectives were more aligned because 5 we were all there to do the job. But at the corporate 6 level, maybe, yes; but at the worker level, we are all 7 doing the job. 8 Q. Thank you. Do you accept, because of this issue with 9 the Benefits Agency, that Horizon was, from a financial 10 point of view, always going to be precarious because of 11 the revenue stream that could be lost with the Benefits 12 Agency potentially withdrawing? 13 A. I do not think I really considered it from that point of 14 view. I'm from a software engineering point of view, 15 not a corporate finance point of view. 16 Q. Is that something that you were aware of though? 17 A. Certainly we were very aware that the Benefits Agency 18 part of this was incredibly important to Post Office and 19 that if Benefits Agency pulled out of it it was going to 20 cause problems. 21 If Benefits Agency pulled out of paying through post 22 offices, it was going to cause problems to Post Office. 23 Obviously, all the -- from the procurement point of 24 view, they were trying to go for the best value 25 solution. So money is always important in a public 24 1 sector procurement. 2 Q. Our clients have told the Inquiry, in their evidence in 3 February and through to May this year, that the Post 4 Office ruthlessly pursued them for large sums of money 5 without properly investigating whether these sums were 6 actually due and the question I have to ask you is: this 7 financial uncertainty, do you agree that that 8 contributed to the stance that Post Office took towards 9 the subpostmasters, this need to recover money that had 10 been lost? 11 A. I can't comment on that. I think what happened was 12 dreadful but I have no basis to say what happened 13 five years after I left the Post Office with -- due to 14 them trying to make a profit out of it or what else. 15 Q. Can I ask you to -- can I then ask you about what you 16 have said about POCL oversight and assurance issues and 17 if we go to paragraph 89 of your witness statement and 18 that's at WITN05 -- we have it already here. So you 19 say -- you have been asked to what extent did POCL have 20 adequate oversight of design of the Horizon IT system. 21 And this formed quite a large feature of your evidence 22 yesterday and you say that: 23 "POCL had very limited over sight of the application 24 design of the system; formally [you] had access to very 25 few documents; informally to specific versions (not 25 1 maintained) of a small number of ... documents and 2 otherwise we had rather bitty information that we 3 managed to obtain from specific activities or if we had 4 raised specific risks in the evaluation (where a paper 5 might be provided)." 6 If we could go also to paragraph 196 of your 7 statement. 8 I have the reference for that. It is WITN05970100, 9 54 and 55 of 75. Thank you. 10 It is the same point that you make here. Sorry, 11 196. My fault. Wrong reference. I can read it. 12 Page 65 and 75. We have it there. You say: 13 "We had a Service Provider who largely blocked and 14 dismissed our attempts at Assurance, and the nature of 15 the contract prevented POCL from having adequate 16 visibility of the problems it seems Pathway were having 17 in development. The Assurance Team ... consistently 18 flagged the problems with Assurance to the PDA and 19 subsequently POCL Horizon management, and worked 20 persistently and doggedly to get what they could from 21 Pathway, but sadly it appeared that we were constrained 22 by the Contract and no long-term solutions were found." 23 You said yesterday afternoon that you told Project 24 Mentors that there was a suspicion that the right level 25 of documentation hadn't been developed? 26 1 A. I don't know if I told Project Mentors but I certainly 2 believed that. 3 Q. Right. In your evidence yesterday morning you said that 4 in a population of 40,000 terminals, if it can go wrong 5 it will. 6 So terminals were obviously going to go wrong and 7 POCL didn't know what Pathway was going to do about it, 8 is that right? 9 A. Put very simply, yes. I would characterise it as: 10 things were going to go wrong in the network -- the 11 network of post offices, including your clients 12 obviously -- that would be everything from the wide area 13 network not working, to local area network not working, 14 to PCs going wrong and to all the rest. And 40,000 is 15 a big enough system that yes, if it can go wrong it will 16 over the next ten years. And my point was that what we 17 wanted in the assurance process was to understand how 18 the Pathway solution would cope with those failures. 19 And to make sure that Pathway had considered those 20 failures. 21 So, it wasn't so much we wanted the nitty-gritty of 22 exactly what's going to happen but had they thought it 23 through, had they got the solution or were they, as 24 I indicate in here, giving us the impression that it is 25 not going to happen anyway, it is dismissing the concern 27 1 rather than showing us that they have addressed the 2 concern. 3 Q. Yes. So do you accept, then, that under the PFI 4 arrangement the position of subpostmasters, who were on 5 the ground to operate the system, wasn't really 6 protected because of this disconnect? 7 A. I think it was -- I think POCL and the subpostmasters 8 were exposed because of the way in which the service 9 provider operated. My view, as I think I say elsewhere 10 here, is that I don't believe that PFI was 11 a particularly appropriate way for getting a highly 12 complex, bespoke service. PFI, my understanding was, 13 had been used for more off the shelf things, hospitals, 14 schools, where you could easily specify it and the one 15 you put in Darlington can be roughly the same you put in 16 Bolton. 17 This was a one off system that -- this combination 18 of BA and POCL was unique in the world. Therefore the 19 concept of giving it to a firm of experts, whoever good 20 those experts may be, and you going away and "trust me 21 I'm a doctor" sort of approach, made me uncomfortable. 22 And the point I -- that Mr Beer read out, I think, 23 yesterday -- was that the whole concept was around risk 24 transfer. 25 You can transfer the financial risk if it goes wrong 28 1 and if you don't pay the service provider but it doesn't 2 transfer the risk of your business, including the 3 relationship with your subpostmasters and everything 4 else, going pear shaped. 5 Q. Thank you that's helpful. The next -- moving on from 6 the PFI to what followed. You said, yesterday, that 7 POCL missed a trick by not taking steps to vary the 8 contract, after the Benefits Agency withdrew, to ensure 9 more visibility. You were asked by Mr Beer, yesterday 10 afternoon, why the concerns that you raised in 11 documents, that we saw about the technical aspects of 12 the Pathway system being brought into account, weren't 13 added into the renegotiation of the contract. 14 You said that you didn't know why that was, you 15 would hazard a guess but you didn't want to speculate. 16 Was the real reason then, that POCL were not interested 17 in the details but just wanted to steam roll through to 18 save the project, in light of the Benefits Agency having 19 withdrawn? 20 A. I don't think I can say that they wanted to steam roll 21 through. There was certainly a strong desire -- I would 22 go as far as maybe saying a "gun to the head" -- to get 23 the new contract -- the contract had to be signed by 24 a particular date and from what we have read elsewhere 25 there was pressure from not just the Post Office but 29 1 from up into government to get the contract with Fujitsu 2 signed. Therefore, my -- it is just a guess -- is that 3 the idea of reopening a can of worms and going back to 4 Pathway and saying, "We will sign a new contract with 5 you but we want this, this, this and this" in 6 particular, if they knew that getting "this, this, this 7 and this" would immediately result in us having access 8 to the kind of documentation that was revealed to me 9 a couple of days ago, which would have made the whole 10 thing explode, was not going to happen at that point. 11 Q. Thank you. 12 You told the Inquiry yesterday afternoon that the 13 problem -- this problem, the assurance issue, was known 14 about and it was obvious that something should have been 15 done. Are you able to -- but you didn't know why 16 nothing was done when the contract was renegotiated. 17 Are you able to tell the Inquiry who it was that was 18 responsible or would have been responsible for the 19 decision not to include that provision in the contract 20 when it was renegotiated? 21 A. It is hard to say who was responsible for not doing 22 something. The contract was renegotiated by -- on 23 instruction from above by the then head of commercial 24 who was the late Keith Baines. I have every respect for 25 Keith. I don't know if Keith wasn't the sort of person 30 1 who would -- had any mal intent by not including it. 2 I don't know whether -- I think, as I say, their remit 3 was they had to get this contract signed and there was 4 a lot of work that went on at that point. Trying to 5 take these three contracts down to one, the codified 6 agreement. And this was a massive contract, I think the 7 effort went into doing that. 8 Q. You accept, do you, that had this step been taken, the 9 subpostmasters would have been better protected both 10 from the problems in the Horizon system and from the 11 subsequent conduct of the Post Office? 12 A. I think I do, yes. I can't comment on the subsequent 13 conduct of the Post Office but what I do think is if 14 those steps had been taken and there had been a review, 15 the whole direction of the project would have been 16 different and it actually may have collapsed because 17 stuff that was withheld from us, once it became exposed 18 to us, might have rendered a significant delay, the kind 19 of decisions as to whether things should be re-written. 20 Can I just say we were unaware at that point that 21 during the latter part of the -- middle to latter part 22 of 1999 that within Pathway they were considering 23 whether EPOSS at that point should be re-written. If 24 we, at that point, had been told, "Oh well you signed 25 a new contract with the Post Office but, by the way, one 31 1 of the main components you are taking on, it is so bad 2 that we might want to rewrite it". 3 Q. Thank you. 4 A. You know what I mean? 5 Q. That's helpful. 6 Finally, Mr Folkes, we have been contacted by 7 a number of our clients who have been listening to your 8 evidence with interest. One of our clients, Mark Kelly, 9 has asked that we put a question to you. 10 I have already flagged this with Mr Beer and he's 11 happy for me to proceed, sir. 12 If I could just ask Mr Kelly's question. Mr Kelly 13 points out that subpostmasters were told by retail line 14 management departments in the Post Office and by the 15 legal departments within POCL that the system was 16 infallible. Were the assurance concerns that you have 17 raised fed down or through to those departments within 18 POCL or the Post Office? 19 A. From the programme point of view, we had no contact with 20 the regional people. Any contact with them, I guess, 21 would have been through Business Service Management and 22 if problems had started to occur, I would have expected 23 that Business Service Management would have been 24 involved. 25 What we do know from the audit document that Mr Beer 32 1 questioned me on yesterday, that the audit community, 2 who are tied in to the investigations community, had 3 raised concerns about the number of cash account errors, 4 et cetera. I don't know whether you want to bring up 5 that document, but the document that I had commented on 6 by putting comments in boxes. They had, within that 7 document, raised concerns at that point about the number 8 of errors coming out of the cash account process 9 I think. 10 So, clearly, there was an understanding within the 11 audit community that there were problems that were being 12 pursued. 13 Q. Thank you. 14 A. As I said yesterday, or say in the statement, what 15 I don't understand is how magically this went from 16 a system which was getting out there, things were being 17 fixed but may be shaky, to anybody thinking it was in 18 the right state to go round prosecuting without doing 19 the correct investigations in the middle. 20 Q. I think I have some other questions that I'm going to be 21 asked to ask you. (Pause) 22 SIR WYN WILLIAMS: While you are thinking about that, could 23 we put up paragraph 207, please? 24 That paragraph in your written statement effectively 25 encapsulates what you have just said to Mr Jacobs, 33 1 doesn't it? 2 A. Yes. 3 SIR WYN WILLIAMS: I agree with you, Mr Folkes: this is 4 a key question for this Inquiry and, because it is a key 5 question I presume your invitation is that I should 6 answer it, yes? 7 A. I hope so. 8 SIR WYN WILLIAMS: Well, given you have great knowledge of 9 what went on over four years, have you thought about the 10 answer to that question? 11 A. I have thought long and hard about it. 12 SIR WYN WILLIAMS: I don't want you to be like a politician 13 on the Laura Kuenssberg show, invited to draft a budget 14 as we are going along but, since you have thought about 15 it and if you have given it careful consideration, would 16 you like to tell me the fruits of your considerations? 17 A. I think it's probably not very helpful, I don't have the 18 full answer. 19 SIR WYN WILLIAMS: I will be very happy with any kind of 20 answer at the moment because I'm gathering evidence. 21 You just tell me what you think and then it is for me to 22 make what I will of it. 23 A. What I have seen from the other evidence is that during 24 2000 the system continued to have certain problems and 25 it didn't mysteriously on the day I left turn out to be 34 1 perfect. So it is not just a matter that the Horizon 2 programme, which was only a transient -- a rather 3 long-term transient body, but wasn't just the team that 4 I was part of disappeared. For the next year, at least, 5 we have seen issues that did relate to integrity of the 6 accounting. 7 So, it continued with its chequered history, if you 8 like, during at least 2000. My only way of answering 9 the question is that there were people within the 10 investigation and prosecution side in POCL who -- 11 I think it is called "confirmation bias". They were 12 convinced that subpostmasters were misbehaving and then, 13 if the system came up and showed that somebody was 14 14,000 down, rather than taking into account "Is the 15 system right or is there some mistake?" it gave them 16 what they wanted. 17 What I would say is, if you are an investigator or 18 prosecutor, presumably the people -- your job is to 19 investigate and prosecute. 20 SIR WYN WILLIAMS: So, in summary, on this point, you think 21 I should dig deep into investigation and prosecutorial 22 processes. That's fine. 23 What about within your own team, and I don't mean 24 "team" in the literal sense, I mean the community of 25 people in POCL who were involved in the development and 35 1 rollout of Horizon, without wishing to be, in any sense, 2 detrimental -- sorry, let me re-phrase that. 3 Without wishing to doubt what you have told me for 4 the moment, was your view of what you found universally 5 held or were there people in your team, with your 6 experience, who took a less dim view of the problems 7 within Horizon? 8 A. I think the people immediately around me shared the 9 view. I was probably one of the more techie people, if 10 you like, which is why I ended up on not the 11 applications but the infrastructure side and you will 12 see some of the areas that we pursued were deep down the 13 technical stack. But I believe the other people who 14 were in the assurance team shared the view. Elsewhere 15 on the programme, hard for me to say whether they had 16 a much rosier view. 17 SIR WYN WILLIAMS: Can I put it to you in this way, did you 18 ever come across persons with a technical background 19 similar to yours who expressed substantially different 20 views about the state of Horizon to those which you 21 expressed in many papers? 22 A. Not within Post Office. Yes, within Fujitsu. 23 SIR WYN WILLIAMS: No, sure. That's what we are talking 24 about, Post Office. 25 A. Yes. 36 1 SIR WYN WILLIAMS: So that there was a general consensus, 2 would I be right in thinking that, amongst the technical 3 community in Post Office and you articulated it in 4 various papers? 5 A. Yes. 6 SIR WYN WILLIAMS: All right. 7 A. I think the other -- when you talked about the 8 prosecution policy or processes, I think the other key 9 thing is the -- just the whole investigation side, as in 10 long before you get talking to prosecute somebody, 11 presumably you are trying to look at the evidence -- if 12 somebody -- you go in and do a "audit account" in 13 an office and they are 14,000 down, then you don't 14 immediately jump to the conclusion -- I would not jump 15 to the conclusion that that £14,000 has gone out of the 16 back door in their pocket. You are going to look at the 17 system and the evidence supporting it. 18 There seems to be a view that they could not get 19 hold of necessary data. Now, we know from the document 20 that Mr Beer put up yesterday, the audit manual, there 21 was a process by which Post Office should be able to 22 access data. I don't know how that was used. 23 Obviously, by the -- I had gone by then, but there was 24 a process then for data to be obtained centrally. There 25 was also processes for data to be obtained from the 37 1 office to pull off reports. 2 I think the question I would want to ask is: was 3 that done and why didn't it work. There seems to have 4 been this view "Oh, well, we would have to pay for it". 5 I would not often have agreed with Tony Oppenheim but 6 I agree with what he said that you wouldn't expect to 7 pay for it. There was nothing in the contract I was 8 aware of that to audit your own system you would have to 9 pay for it. 10 The only thing you would have to pay for is if they 11 wanted to build a new Fraud Risk Management System, 12 which we debunked yesterday. So the question is: what 13 was done to be able to access data and were the 14 necessary experts brought in to look at that data? 15 SIR WYN WILLIAMS: Thank you very much, Mr Folkes, I'm glad 16 I brought out my fishing rod again. 17 Any more questions? 18 MR JACOBS: Sir, there were a couple of questions, I have 19 taken instructions. 20 You raised these issues with other people 21 internally, do you feel you were listened to? 22 A. In hindsight, I guess the answer has to be not enough. 23 We did raise these issues and they are documented over 24 an extended period of time. It was maybe -- the 25 technical side that we were raising was maybe only one 38 1 view going in. There were others involved in testing, 2 there were others involved in contract, others involved 3 in everything else. Certainly it would appear that it 4 didn't get adequate visibility or adequate attention. 5 Q. Did you think about raising the issue maybe in a public 6 forum, given the concerns that you have identified? 7 A. No. In 1999/2000, I think, the appropriate route was 8 to -- we raised these concerns all the way through up 9 the management chain. 10 Can I just add a supplemental point to that. When 11 it got to 1999 and acceptance finally took place, what 12 I felt was the system was unproven and it had an unhappy 13 childhood, and I'm not belittling it by that. It had 14 not gone through the kind of assurance process I would 15 have wanted and we hadn't got evidence as to how it had 16 been built. We now have evidence to show it had been 17 built rather poorly but we didn't have -- but all the 18 bugs that had been found had been fixed. So there was 19 a view then that, okay, it can move the system on, it 20 was then going to go out and then be carefully managed. 21 If there had been bugs in it at that point still, 22 then -- known bugs, then it wouldn't have gone out. So 23 the problem was that the known issues had been fixed. 24 But I think the system was, at that point, at a stage 25 where there was still much that was unproven. 39 1 If you like, it wasn't negative, but it was not yet 2 positive. 3 Q. With hindsight, do you think these issues should have 4 been put into the public domain, someone in the 5 assurance team or you should have flagged them up? 6 A. I don't know whether in 1999 -- we were, if you like, 7 discussing the absence of something, rather than -- it 8 wasn't "Look, our post offices is going live with these 9 900 bugs". It was "Post offices are going live where 10 inadequate assurance had been done but in a contract 11 where, in theory, this expert company had been building 12 the system". I'm not convinced that if I had tried to 13 flag it -- I'm not quite sure what you suggest, you 14 know, a newspaper or journalist or whatever -- if we had 15 tried to flag it at that point what route we would have 16 taken at that point. 17 Q. Finally, Mr Folkes, I ought to say I have been passed 18 a note, one of our Core Participants, Mr Gordon Martin, 19 has asked us to express his appreciation to you for the 20 candour of your evidence. 21 So thank you, Mr Folkes. 22 A. Thank you. 23 MR JACOBS: No further questions from me, sir. 24 SIR WYN WILLIAMS: Do you have any questions, Ms Page? 25 Mr Moloney? 40 1 Anyone else? 2 MR BEER: No, I think that brings Mr Folkes' evidence to 3 an end. However, I do know that he wanted to say a few 4 words before he finished giving his evidence. 5 I think that is right, Mr Folkes, isn't it? 6 A. Thank you. I just wanted to say we have sat here rather 7 coldly discussing a 25 year old IT project. In reality, 8 I know this is much more than that and it had a massive 9 effect on lots of hardworking subpostmasters and I have 10 worked in post offices for -- since I was 27 or 11 something. I feel part of the Post Office community and 12 I feel appalled at what happened. 13 I would like to offer my genuine sympathies to what 14 happened. I have no idea what it is like to be falsely 15 accused of something but I am sure it has put people 16 through total hell and I would just like to offer my 17 unreserved apology if anything I did or didn't do 18 contributed to what actually happened in this much 19 bigger picture. 20 Finally, if there's anything else I can do -- 21 obviously, we have covered phase 2, but anything else 22 I can do to help the Inquiry, I'm happy. 23 SIR WYN WILLIAMS: No doubt my very hardworking team will 24 take that on board and consider it, Mr Folkes. At the 25 beginning of your evidence, Mr Beer thanked you for your 41 1 very detailed written statement and he thanked you for 2 coming to give evidence to the Inquiry. I now repeat 3 those thanks and include within them my thanks for the 4 very detailed oral answers you have given to very many 5 questions. Thank you. 6 MR BEER: Thank you, sir. Can we take the morning break now 7 and have our next witness Mr Andrew Simpkins. I'm not 8 going to be very long with him, an hour, an hour and 9 a half. 10 SIR WYN WILLIAMS: We will indulge ourselves and we will 11 start at 11.35 am. 12 MR BEER: You are most generous sir, thank you. 13 (11.17 am) 14 (A short break) 15 (11.35 am) 16 MR BEER: Thank you, sir, can I call Andrew Simpkins please. 17 ANDREW SIMPKINS (sworn) 18 Questioned by MR BEER 19 MR BEER: Please do take a seat, Mr Simpkins. 20 Can you give us your full name, please? 21 A. Andrew John Dennis Simpkins. 22 Q. Thank you. Thank you very much for coming to give 23 evidence to the Inquiry and thank you also for providing 24 the witness statement that you have. We are very 25 grateful to you for the assistance that you are giving 42 1 this investigation. 2 Can we look at your witness statement please. You 3 should have it in front of you. Excluding the exhibits, 4 it is 20 pages in length. It is dated 13 September. 5 Can we look and find your signature please on page 20 of 6 it. Is that your signature? 7 A. Yes. 8 Q. For the transcript that is WITN06090100. Are the 9 contents of that statement true to the best of your 10 knowledge and belief? 11 A. Yes. 12 Q. A copy of that witness statement will be uploaded to the 13 Inquiry's website. So I'm not going to ask you about 14 every part of it, just selected extracts. Do you 15 understand? 16 A. Yes. 17 Q. In terms of your background and experience, I think you 18 retired in 2018; is that right? 19 A. Yes. 20 Q. I just want to summarise -- and apologies for doing it 21 this way -- your working life. You were a programmer 22 initially; is that right? 23 A. Yes. 24 Q. You then joined Coopers & Lybrand in '78; is that right? 25 A. Yes. 43 1 Q. They were, I think, most well known then as accountants 2 but also management consultants; is that right? 3 A. Yes, it was one of the major management consultancies in 4 the UK at the time. 5 Q. And you worked there as a systems analyst and in project 6 management; is that right? 7 A. Yes. 8 Q. You joined TSB as it was then known in '88 and you were 9 a senior manager, again, in IT information technology? 10 A. Yes. 11 Q. You joined a company called French Thornton in 1997 as 12 a management consultant when you worked on large scale 13 IT projects, in particular for the Post Office and for 14 government departments; is that right? 15 A. Yes. 16 Q. I think after the events with which we are concerned you 17 became a freelance consultant? 18 A. Yes, towards 2007. 19 Q. Have I missed anything out? 20 A. Not that I'm think is worth stressing at the moment. 21 Q. All right, good. Now, in terms of your first 22 involvement with the Horizon project, I think you were 23 assigned to the project whilst you were working for 24 French Thornton with Post Office Counters Limited as 25 your client, essentially, in April 1998? 44 1 A. Yes. 2 Q. And for how long did you work on the Horizon project; 3 what was the end date? 4 A. The final end date was September 2000. I was involved 5 with the main project up to the rollout, around -- at 6 the end of 1999 and then I was moved off onto a new 7 development, the CSR+ development, for the Logistics 8 Feeder Service system. So I was moved away from the 9 main system and the ongoing rollout to help manage the 10 development of this new module that was going to be 11 added to Horizon in due course. 12 Q. And can you explain to the Chair what the purpose of, as 13 you understood it, the involvement of an external 14 management consultant expert in IT was? 15 A. I mean this was an assignment where I wasn't operating 16 as people might think of as a consultant. You know as 17 an external independent adviser reviewing certain parts 18 of the project. I was more what people would think of 19 as a contractor. I was working within the Post Office's 20 management structure for the project. I was filling, in 21 some ways, a role that could have been filled internally 22 but there weren't the necessary or sufficient skills 23 around. So in some ways I was working as a line manager 24 within the client structure, rather than as an external 25 consultant reviewing the project. 45 1 Q. Was that unusual? 2 A. No it does happen. It does happen from time to time. 3 You know I have done both kinds of those roles but, yes, 4 sometimes in certain circumstances a client wants you to 5 fulfil a vacancy within its structure rather than bring 6 you in as a consultant to do some kind of external 7 review as people would think of it. 8 Q. So you were actually embedded within the management 9 structure? 10 A. Yes, I felt during the project I reported to Dave 11 Miller, not to somebody in French Thornton, if that 12 makes it clear. 13 Q. And was that, in fact, your line of reporting? 14 A. Yes, up to Dave Miller. 15 Q. What was your role when you were appointed, what were 16 you focused on? 17 A. I think my title was sort of -- I think my title was 18 release manager but the nub of the role was to take on 19 responsibility for the planning side of the project, 20 from the POCL -- on behalf of the Post Office -- to work 21 on the development and the agreement and the deployment 22 of plans on the programme. 23 So -- 24 Q. What does release management mean? 25 A. A release is when you put the major piece of software 46 1 live. So those would obviously be crucial points in the 2 programme. You are about to put a major piece of 3 software live, that is a release, so you need to manage 4 that release in terms of its approval and content. 5 It is a bit of a misnomer because I think, probably, 6 if people had saw me in operation they'd have thought, 7 "Well Andrew deals with the plans. Andrew is dealing 8 with the plans". When I arrived on the project -- 9 perhaps to give you some context -- When I arrived on 10 the project I think, like on the first day, knowing that 11 was going to be my role, I sort of said "So, where's the 12 plan", you think "There must be a plan I'm going to 13 inherent here". And my memory of it was, sort of, 14 "Well, the plan is with Pathway, Pathway had the plan". 15 And I thought, from my consulting experience, "Hang 16 on a minute, you are the clients, you are the client. 17 This programme is going to have a major impact on your 18 business, you need to have some visibility and control 19 and agreement to this plan". So I felt my initial 20 mission was to produce a plan that was transparent to 21 all the parties concerned and to try to negotiate 22 agreement about what should be the main target dates and 23 phases of the programme. 24 Q. I think you worked in that role for some six months or 25 so until September 1998? 47 1 A. I was in that role really from April 1998 right through 2 to the end of 1999. 3 Q. Right. 4 A. That role really continued, probably, until about 5 September/October because, if I remember it, around that 6 time, I start -- I was giving more focus to the CSR+ 7 development that was going to follow on after the main 8 Horizon system. 9 Q. I understand. Who, if anyone, did you manage underneath 10 you? 11 A. I wasn't particularly managing a team of people. My 12 role was fairly -- self-contained is perhaps not the 13 right word but it was a role that I mainly performed on 14 my own. I think later on I possibly had one or two 15 other people in the team working on the more detailed 16 level plans with different parts of the programme, but 17 in some ways my role was -- it didn't require 18 a particularly major team to perform it. 19 Q. I understand. You have given us a clue already but can 20 you tell us what your overall impression was of the 21 state of the project when you first walked through the 22 door in April 1998? 23 A. Yes. I mean as you all know this is a long time ago so 24 you are trying to think of what impressions you had. 25 I mean I had been given some briefing, from, I think, 48 1 one of the directors in French Thornton, that this was 2 a difficult project, had had a difficult history, they 3 were trying to reset things. Obviously there was the 4 end of the PDA as a management approach to it. So they 5 were trying to reset things. It is a key programme for 6 the Post Office, quite a lot of pressure around it but 7 our aim will be to try to help the Post Office deliver. 8 So I think when I walked in through the door, if you 9 ask me to describe the atmosphere, I think I would use 10 the word "tense". I think that is the word that comes 11 to mind. Tense, because that history of difficulty over 12 those previous years had created a climate of -- I would 13 use a strong word of possibly distrust. Some climate of 14 distrust between the Post Office and BA and Pathway 15 because of the difficulties that had occurred. 16 So I was aware of that but I think -- my memory is 17 that I felt with David Miller and Mike Coombs from the 18 Pathway side, that they were trying to establish a more 19 constructive relationship. I joined the project where 20 perhaps, "We have got a bit of a fresh start here, 21 perhaps we can move on here from those previous 22 difficulties and establish a better relationship". So 23 I felt that I should be part of that endeavour. Because 24 there's no benefit in being in conflict with your 25 supplier. If it was possible to establish a better 49 1 relationship with Pathway, a more constructive 2 relationship, then that is what we should do. 3 Q. You mentioned the director at French Thornton told you 4 that this had been a difficult project. Looking at the 5 whole period of your involvement, so fast forwarding 6 right to the end -- looking at your career as a whole -- 7 where did this project sit in terms of its ease or 8 difficulty? 9 A. Well, you know, if I look back over, what, 35 years of 10 working on IT programmes and projects, I always remember 11 this as the most difficult one. This was the most 12 difficult programme I ever worked on. It had a kind of 13 everything -- I won't say everything, let's not 14 exaggerate. 15 First of all, it was clearly a political project. 16 You know, the government had quite a big stake in this 17 programme. The government clearly wanted it to succeed. 18 So at the stratospheric level, I was not involved in any 19 dealings with the government but you could feel that. 20 It had some major technical challenges. I mean, 21 I had worked at TSB that had a branch network of 1,200 22 branches, I knew what a large branch network environment 23 was like but this was 17,000 branches, without quite the 24 same infrastructure as a bank would have. 25 And you were dealing with a client that -- for whom 50 1 this was the first real major automation project. So 2 there was limited experience in the client for dealing 3 with this kind of complexity. So does that partly -- is 4 that something of an answer to that question? 5 This was not an easy environment and I suppose two 6 other things that made it difficult, the PFI contract -- 7 I mean, Mr Folkes as has touched on a number of these 8 points in his testimony I realised. The PFI contract. 9 This was the first time I worked on a programme under 10 the PFI project. For someone who was more concerned 11 with implementing the project than the commercial 12 contractual issues, my experience was, whenever we 13 bumped up against the PFI contract, it was unhelpful. 14 I think Mr Folkes, I know, has already said quite 15 a lot about that, in terms of access to documentation 16 and design. So that was -- to me, trying to get 17 a project in successfully, that was -- posed problems. 18 I think I was going to make another point. 19 Q. There was a second thing as well. 20 A. Yes. The fact that the programme had two separate 21 sponsors, POCL and the BA, with different business 22 objectives and, as we know, how fraught that 23 relationship became and how it terminated. 24 Probably, more will come out on that in the next few 25 minutes, but, I mean, I was dealing with one of those 51 1 clients, obviously, I was working for the Post Office 2 but I was keenly aware that, as it were, within this 3 structure, there was another client. 4 Q. In this first period from the April until the Christmas, 5 you were involved, I think, in a series of testing 6 cycles; is that right? 7 A. Yes. 8 Q. You tell us at paragraph 8 of your witness statement, 9 perhaps if we just look at it, please, WITN06090100, at 10 page 6: 11 "In late October, with the completion ..." 12 That's '98? 13 A. Yes. 14 Q. "... of the second of the three test cycles, a Testing 15 Review was conducted, where it became clear that serious 16 concerns had arisen with the accounting and 17 reconciliation processes, especially with the cash 18 account production in the test outlets and with the 19 accounting results passed to the POCL backend system 20 (TIP)." 21 You reference a document. Can we look at the 22 product of that testing review. That's POL00028435. 23 I think this is the document you are referring to. 24 A. Yes. 25 Q. Can you tell us who wrote this report, please? 52 1 A. Yes, it doesn't say, does it? 2 Q. No. 3 A. And it doesn't have a date on it which is -- I mean, it 4 says "Draft". 5 Q. This is the best we have got. 6 A. Yes, this is the best we have got. I recognise the 7 content and I remember that I was part of the team that 8 put this together, but I can't remember who actually 9 drafted it. You know from looking at the document, it 10 is in something of a draft state although there is a lot 11 of good information in it. 12 Q. If we look at the third page, please. I'm not quite 13 sure what this is. Can you help us? 14 A. Yes. I will give you some context. We are going 15 through these cycles of testing, as per the plan and the 16 timescale, and, you know, Pathway are giving kind of 17 reasonably positive noises about how it is going on. 18 But then it comes into the programme that the people in 19 Chesterfield, the Post Office people who are running the 20 backend systems primarily TIP, are not happy with the 21 results, and particularly with the quality of the data 22 that is coming through the test system into their 23 backend systems. 24 They are not happy and they don't feel their voice 25 is being heard. So, like, a mini project was put 53 1 together to review this situation and these, you can see 2 here, these are the participants. You have the right 3 participants, people from TIP, people from Pathway, 4 other people on the Horizon team. I mean, it is 5 interesting on that sheet you have got French Thornton 6 and myself with two of my colleagues. I think that's 7 indicative that we were kind of put into this sort of 8 mini project to try to provide some kind of independent 9 objective assessment of what was going on and possibly 10 to help, if I said arbitrate, between the Post Office 11 and Pathway as to what the problems were here. 12 Q. If we go forwards, please, to page 5. There is 13 a passage called "The Chesterfield View". 14 A. Yes. 15 Q. So this is -- is it right -- a repetition or a summary 16 of those people in POCL, based in Chesterfield, on what 17 they were saying? 18 A. Yes, this is the concerns that we were getting from the 19 Chesterfield people and, I mean, if you look at the 20 penultimate bullet point here, "Is everyone clear that 21 we have not yet done a cash account". 22 Q. What does that mean? 23 A. That means that the system in testing has not yet 24 produced almost like the fundamental accounting document 25 in the branches, to the level of accuracy that the 54 1 Chesterfield people knew was necessary. 2 Q. Why was a cash account fundamental? 3 A. Because that showed the -- I mean, I wasn't -- as best 4 as I can explain it, the cash account is like the key 5 financial document in the branch. I believe they 6 produced it weekly. So that would show, in summary, the 7 accounting status for that branch as a result of that 8 week's transactions. 9 So that was, obviously, a key document for the 10 branch and that document electronically would be 11 transferred up to the TIP backend system. So the fact 12 that this kind of fundamental accounting document within 13 the system hadn't yet been -- I mean, here it even says 14 "we have not ... done a cash account". It is a little 15 bit ambiguous, isn't it? Does that mean they have not 16 done a correct cash account or they haven't done a cash 17 account at all? But, clearly, there is a problem at 18 that level and some more detail comes out elsewhere in 19 there. 20 Q. The bullet point above it: 21 "The weekly testing meeting is 'very politically 22 driven ... issues don't get aired'." 23 Can you recall what that was a reference to, what 24 the Chesterfield people were saying there? 25 A. Yes. This, I think, illuminates the point I made 55 1 earlier, that the Chesterfield people did not feel that 2 their concerns were being understood and addressed by 3 Pathway in the weekly testing meeting. So they felt 4 that -- yeah, issues don't get aired, people are not 5 really facing up to and discussing what are the problems 6 at this stage and are they getting addressed. This is 7 why our sort of review is going on, isn't it? Because 8 there is an awareness, perhaps at the management level, 9 that this is happening and, therefore, you want to get 10 these issues out on the table. 11 Q. Thank you. Then over the page, please. Is this 12 a summary of the concerns that were being reported by 13 those responsible for TIP? 14 A. Yes. I mean, each of these are significant aspects of 15 the TIP concerns and, I mean, you see it summarised by 16 Dave Parnell at the moment. 17 Q. "Dave P", at the bottom? 18 A. Yes, that is Dave Parnell, one of the Chesterfield 19 people. 20 Q. We saw his name in the meeting list at the beginning? 21 A. Yes. So the cash accounts do not balance. That is 22 a fundamental accounting error. The reference data -- 23 Jeremy tried to explain this earlier today, didn't he? 24 This is kind of like key control data on the products in 25 each outlet. If there is a mismatch here between what's 56 1 held at the backend and at the front end, you will get 2 potential accounting discrepancies. Files rejected 3 by -- there seems to be validation errors in the files 4 that are coming through to the backend, and then 5 problems actually running the Model Office test scripts, 6 and so forth. 7 But the comment at the bottom there, quite 8 rightly -- this is the accounting system, we "cannot 9 take risks on this ... it's a showstopper". I can 10 entirely understand why -- I don't know if Dave is 11 a qualified accountant, but I can quite understand why 12 the people at Chesterfield are expressing that concern. 13 Q. Over the page, again, please. "The Feltham View", what 14 does the Feltham view represent? 15 A. So this is the Pathway view. This is the other side of 16 the coin, in a way. 17 Q. So this is what they were saying? 18 A. Yes. 19 Q. Incidentally, the handwriting that we see on that, do 20 you recognise the handwriting? 21 A. It is not mine. 22 Q. It is definitely not yours, okay. 23 A. I don't know where this document was sourced from. 24 Q. We got it from the Post Office. 25 A. Whether it's possibly David Miller. But I don't know. 57 1 I don't recognise it. 2 Q. Can we go forwards, please, to page 15 of the document. 3 Is this part of the proposed solution? 4 A. I mean, these people needed to talk together more, to be 5 frank with you. They needed to work together more. 6 They needed to have a better mutual understanding so 7 that, instead of "Issues are not getting resolved", 8 issues are getting resolved. So there were behavioural 9 issues here. There is a need for greater honesty in the 10 reporting. 11 "Documents and letters [are] 'on message'". We 12 don't want documents and letters on message. We want 13 documents and letters that tell us the truth. 14 Q. So that bullet point on the right there that's been 15 added, "economical with" -- 16 A. Yes, exactly. 17 Q. -- we don't get the rest of it, that might be 18 economical -- 19 A. Economical with the truth. 20 Q. -- with the actuality or with the truth or whatever, 21 perhaps? 22 A. Yes. 23 Q. Then, if we can go forward to page 25, please, which is 24 towards the end of the document. I think it is the last 25 page: 58 1 "TP worry they have to be the 'conscience' of POCL, 2 isn't that the Test Manager's job?" 3 Who was the test manager? 4 A. The test manager at that time was Simon Rilot. That is 5 the "SR" in the next line. There was a slightly unusual 6 set up here, in that, although Horizon -- the Post 7 Office Horizon team had test people in the testing, they 8 were not, as it were, kind of fully independent of 9 Pathway. They were kind of in with the Pathway people 10 testing the system. So when Simon says "I feel in the 11 middle", I mean, who is he really working for here? 12 Is he working for Pathway or is he working for -- 13 strictly, he is working for the Post Office, but he is 14 kind of caught between what Pathway are telling him, 15 asking him and what the other Post Office people are 16 asking him. So the "TP worry" is that the test manager 17 is not proving sufficiently independent and they are 18 having to act as the conscience of POCL in saying what 19 is really the case. 20 Q. What is the reference to "the 'conscience' of POCL" 21 a reference to? What does that mean, "the 'conscience' 22 of POCL"? 23 A. Well, being honest about the state of the system. Being 24 honest about how well or badly it is going and -- 25 exactly that. 59 1 Q. Why was it necessary for people to be reminded of their 2 conscience, ie to be honest? 3 A. Perhaps the way to understand it is this: the Pathway 4 system is providing the crucial accounting data and that 5 accounting data has to go into the Post Office backend 6 systems. It doesn't just sit within the Pathway 7 environment. The accounting information has to go into 8 their backend accounting systems. So the Chesterfield 9 people had got to control that interface. 10 They have got to be responsible that clean data goes 11 into their accounting systems. If they are not getting 12 clean data, they have got to say it. So that's what 13 I think is implied by "the 'conscience' of POCL". If 14 they are not getting clean data out of the system, they 15 have to put their hands up and say "This isn't working 16 right, we have got to do something about it". 17 Q. Thank you, I understand. That document can be taken 18 down. 19 Now, I think, notwithstanding the knocking heads 20 together or bringing parties together that we see 21 reference to in that report, and the solutions 22 identified in that report, I think it is right that by 23 the completion of testing in mid-November of the third 24 cycle of Model Office testing and the third cycle of 25 end-to-end testing, that hadn't led to an improvement in 60 1 the situation? 2 A. No. I remember that this was kind of a seminal moment 3 for me on the programme. Perhaps because I had worked 4 on accounting systems at Coopers & Lybrand, for a major 5 audit firm. How can I put this simply? I knew that 6 accounting systems had to work. Accounting systems had 7 to have financial integrity, unequivocally. So to have 8 a concern at this stage, as I itemise in this 9 memorandum, that it is not working is fundamental. I'm 10 looking at my own witness statement here, where on 11 page 6 I say: 12 "We have not demonstrated the end-to-end data and 13 financial integrity of the system to the extent that is 14 required for entry into the final Model Office test and 15 end-to-end run." 16 We had not demonstrated end to end financial 17 integrity. That is a fundamental requirement of the 18 system. 19 Q. Sorry to interrupt you. I think you wrote a briefing 20 note to it? 21 A. Yes. I think I was alarmed -- I think would be fair to 22 say -- I was alarmed at this point and I think, because 23 of some of these communication issues that we have 24 already touched on, I thought "We have just got to spell 25 this out". So, this possibly was not the job of the 61 1 planning manager but because I had been in that review 2 meeting, the review meetings that had led to that 3 report, I wrote initially a paper for the Horizon team 4 spelling out these problems and what needed to be done 5 and then a couple of weeks later you can -- on my 6 witness statement, page 7, I wrote a further memo 7 on 4 December which went to Pathway which again itemised 8 the issues that needed to be addressed. 9 Q. Let's look at both of those. Can we start with the 10 first of them, the memo of 20 November. That is 11 POL00028431. Can you see at the top it says: 12 "Briefing note on status of testing -- 13 20th November 1998." 14 A. Yes. 15 Q. If we go to the second page. We can see that it is in 16 your hand? 17 A. Yes. 18 Q. "Andrew Simpkins Horizon release management 19 20th November 1998", same date. Again, the writing on 20 it, that's not yours? 21 A. No, it isn't and I think that is probably Dave Miller 22 writing that. 23 Q. Ie: 24 "Clear statement of what is essential prior to start 25 of model office testing and final pass of E2E." 62 1 A. That's end to end yes. 2 Q. If we go back to the first page please. The MOR3, what's 3 the MOR3 cycle? 4 A. As in most system implementations you will run a number 5 of cycles of testing because one cycle is never enough 6 to get rid of all the problems. So the idea was there 7 would be three cycles of testing, MOR1, 2 and 3. 8 Probably, functionality would be added, to a degree, to 9 each of these cycles but the idea is that at the end of 10 MOR3 you should have a system that is essentially 11 working so that when you go into Model Office test, you 12 are more concerned about the -- that the overall 13 procedures are working, that all the accounting numbers 14 add up correctly because the MOT -- approving MOT will 15 actually take you into live trial. 16 So, you needed to be in pretty good shape at the 17 MOR3. Not perfect, there are almost bound to be some 18 issues outstanding, probably a few bugs that will need 19 to be -- quite a few bugs that will need to be fixed 20 before you go into MOT, but you have got to have -- you 21 can see in the second paragraph: 22 "... we have not demonstrated the end-to-end data 23 and financial integrity of the system 2 to the extent 24 that is required for entry to the final MOT and [end to 25 end] run." 63 1 Q. That's what you have said in your witness statement and 2 you obviously italicised it and emboldened it. Was that 3 the key message from this document? 4 A. Yes. That's why it is in bold italics at the top. 5 Q. You say underneath: 6 "These failures can be attributed to", and you set 7 out five bullet points. 8 Is that a high level summary of the difficulties, or 9 the issues that then existed? 10 A. Yes. It tries to be high level but reasonably 11 comprehensive summary of what the problems are at this 12 point. 13 Q. So "functional errors in cash account production", 14 that's what you mentioned already? 15 A. Yes. That's top of the list. 16 Q. You described that as, I think, critical and 17 fundamental; is that right? 18 A. Yes. 19 Q. At this stage, presumably you didn't have an eye on the 20 use of cash accounts for use in prosecution of 21 subpostmasters accused of false accounting or theft. 22 You are looking at this from simply a business as usual 23 operational perspective, that it is essential to produce 24 an accurate cash account? 25 A. Yes, I'm looking at it in terms of basic accounting 64 1 principles. I mean, this is November 1998. There's 2 nearly a year of work that follows this to try to get 3 the system up to scratch. But, I mean the question that 4 you asked me -- I mean this is -- I never knew, in my 5 entire time on the project, that there even was a Post 6 Office investigations team let alone that people could 7 be prosecuted. 8 I just did not know that existed. So, I mean -- 9 this will come on perhaps nearer as we get nearer to the 10 rollout but I had honestly -- I had never been in 11 a business environment where, in Lloyds TSB or the 12 Inland Revenue, where there is a discrepancy in 13 accounting report and someone goes to prison for it. 14 I mean, that was just beyond my conception. I mean 15 if -- I mean, this is a bigger point, isn't it? 16 This is a bigger point because -- where, within the 17 programme, at any point up until rollout, was that risk 18 identified? I never saw it in any documentation. 19 I never heard it mentioned in a meeting. I don't think 20 people -- I know it sounds astonishing in retrospect, 21 but I don't think people -- I mean, certainly people 22 like myself, Post Office people. I think, probably, 23 many people within the team did not understand, did not 24 conceive that if you had these accounting discrepancies 25 in the branches, there would be -- I mean, this is such 65 1 a huge issue, isn't it -- they didn't understand that if 2 you had these accounting discrepancies in the branches 3 that the postmasters couldn't explain they would be held 4 liable. I do not think that was really understood. But 5 it wasn't. 6 In my view, that was not understood and that's a key 7 factor, isn't it, in the whole unfolding of this 8 tragedy. 9 Q. If we go to the second page, please. In terms of the 10 consequences. In the second paragraph having set out 11 some work that needs to be done you say: 12 "This work will mean that [Model Office Testing] 13 cannot start on 14 December ... The scale of the problem 14 suggests that a January start date may be achievable but 15 this will be clarified next week." 16 A. I'm responsible for the plan here and I have had a plan 17 which, up to this point, had said we are going to start 18 Model Office testing on 14 December. That has a whole 19 series of knock-on effects through the plan as to what 20 live trial would happen, as to when national rollout 21 would happen. So I have just discovered that this, kind 22 of, has just rendered the current plan redundant because 23 we can't hit this key date -- we clearly can't hit this 24 key date. 25 In the plan, which had been largely -- initially it 66 1 had been constructed around what Pathway predicted what 2 were the length of the test cycles. At this point 3 I thought "This is not holding water any longer". 4 Fortunately, in the plan, we had put some contingency 5 time in, in case things had gone wrong, so I knew I had 6 at least a month's contingency in the plan to address 7 these kinds of problems. Not all was lost but at this 8 point we are starting to see an impact on the probable 9 live trial date and national rollout date because these 10 problems need to be fixed, as far as possible, before we 11 move forward. 12 So the scale of the problem suggests a January start 13 date -- a late January start date may be achievable but 14 more work needs to be done. 15 Q. Thank you. Can we go back to your witness statement, 16 please. WITN06090100 at page 7, please. You refer, at 17 the foot of the page, to the second report that was 18 produced on 4 December. In the interests of time, I'm 19 not going to look that up, but you say in the last five 20 lines: 21 "At this point in early December 1998, there was 22 therefore an unequivocal assessment regarding the 23 serious seasons of faults that had been found in these 24 first circles of testing. ICL Pathway accepted the need 25 to address these faults and that additional testing time 67 1 was required." 2 Is that right? 3 A. Yes. So I think we had spelled out the problem as 4 clearly as possible. We weren't saying that it was, 5 obviously, impossible to recover from this situation. 6 That Pathway accepted the need to address the faults. 7 A time was allowed for that to be done. Additional 8 testing activity was introduced into the plan. 9 So the hope was that they would fix it. But 10 I didn't want anybody to be under any doubt about the -- 11 that we were not, by quite some way, fit for purpose at 12 this point. 13 Q. In fact, I think that last phase of testing occurred in 14 February and March 1999; is that right? 15 A. Yes. 16 Q. You weren't actually, I think, involved in carrying out 17 the testing or indeed evaluating it? 18 A. No. 19 Q. But you were copied in on the reports of such 20 evaluation; is that right? 21 A. Yes. 22 Q. If we go over the page in your witness statement. You 23 tell us in paragraph 11 that although progress had been 24 made, there was still concerns that new faults were 25 identified, but the assessment of the POCL Horizon team 68 1 and more broadly within POCL was that these were not 2 "show stoppers". 3 A. No. 4 Q. Do you know how that view was reached? 5 A. This was a difficult moment. It was a difficult moment 6 because I wasn't -- and I think some other people on the 7 team -- you weren't convinced that it was all really 8 working right, yet. I mean the reports out of 9 end-to-end testing and Model Office testing were, in 10 some ways, positive. 11 I mean, clearly, progress had been made and there 12 were fewer problems in those test runs but there was 13 still some worries. Some significant worries but 14 here -- you are in a very difficult balancing position 15 here. You are trying to say "Yes, you have still got 16 some problems that will need to be fixed in the software 17 but the programme isn't just the software. The 18 programme is the employment of that software to 17,000 19 offices and the training of 40000-plus staff". 20 So for the programme to be successful, you really 21 needed some evidence, as soon as possible, as to how 22 good is the training of staff? How good is the Helpdesk 23 support to staff? How resilient is the hardware 24 environment in the branches? Do you see what I mean? 25 Because all of these are essential ingredients to 69 1 providing a solution. 2 So at this point, on any programme, you are having 3 to make a kind of balanced judgement between "Okay, we 4 think there are possibly going to be a few problems in 5 the software", but that is outweighed by the benefit of 6 getting real evidence on these other issues and real 7 evidence of how the software works in a live 8 environment. 9 I mean, you always learn things moving from testing 10 to some live operation. Something always comes out when 11 you go into live operation. 12 So there was a balance in this decision. So you go 13 into a live trial, 200 offices -- it seems a lot but it 14 is probably not a lot in the scale of the Post Office as 15 a whole -- you ring fence those offices and you seek to 16 give those offices some extra support so that you can 17 begin to understand what might be the bigger issues when 18 you come to rollout to 17,000 offices. 19 So you are trying to progress that aspect of the 20 programme at the same time as improving the quality of 21 the Pathway software. 22 Q. You say at the foot of the page: 23 "Another area identified as needing careful 24 attention in live running ..." 25 Stopping there. In "live running", do you mean -- 70 1 A. The live trial. 2 Q. Still the trial? 3 A. Yeah, in the 200 offices. 4 Q. "... was the ongoing reconcilliation of accounting data 5 between the outlets ..." 6 By "the outlets", do you mean the branches? 7 A. Yes. 8 Q. "... and the back-end systems and the accurate 9 synchronisation of updates to the live reference data 10 which could impact the accuracy of reporting. These 11 were important observations that would need to be 12 addressed in the Live Trial and in National Rollout, and 13 indeed in ongoing operation of the system." 14 You are describing amongst the things you say there, 15 reconciliation of data between branches and back-end 16 systems needing to be addressed in the ongoing operation 17 of the system after live -- the live trial and national 18 rollout. 19 A. But that would be -- 20 Q. How would that be addressed? 21 A. I mean that issue is like a business as usual issue for 22 any business isn't it? No matter what system you put in 23 and what you are using, you have to maintain a constant 24 monitoring that nothing is going wrong within the 25 accounting system. 71 1 Q. Wasn't this a little more than that? 2 A. Yes. This was more than that. I mean -- I suppose what 3 I'm trying to say is: that's fundamental; isn't it? It 4 is fundamental that you should continue to monitor that, 5 not only in a -- obviously in the live trial and in the 6 national rollout, but on the going -- as part of the 7 business as usual of the organisation -- there would 8 need to be -- there always needs to be some attention, 9 isn't there, that your financial reports are coming out 10 accurately. Does that -- 11 Q. I understand? 12 A. -- answer your point? Obviously, at this stage, I'm 13 thinking of, particularly -- We are going to first 14 experience these issues in the live trial and the 15 quality of what comes out of the live trial and the 16 national rollout may influence how you then see the 17 system going into ongoing operation. 18 Q. Just moving forward to paragraph 12 of your witness 19 statement. You tell us that, by late March 1999, the 20 programme had therefore come to the crucial decision 21 point of whether to grant release authorisation for the 22 start of the live trial. 23 Can we look at a document, please. POL00028405. 24 This is a letter from Stuart Sweetman to the chief 25 executive of the Benefits Agency, Mr Mathison. 72 1 A. Yes. 2 Q. He says, in the third paragraph: 3 "Both the Post Office and ICL Pathway are satisfied 4 that the results of the testing undertaken so far enable 5 us to go with confidence into Live Trial. POCL based 6 its view on an exhaustive process involving all 7 significant stakeholders within the Post Office domain. 8 "I am sorry but I am not prepared to accede to your 9 request for another run of [end to end] and [model 10 office testing] because this would be a repetitive and 11 time consuming reinforcement of what we already know." 12 I think you were copied into this letter if we go to 13 the second page. Can you see that? 14 A. Yes. 15 Q. Can you tell us the context in which this was written? 16 A. A very political context. 17 Q. What do you mean by that? 18 A. Because this is April, isn't it, this is late April '99? 19 Q. Yes. 20 A. As we now know, the BA exited the programme in May 1999. 21 So I'm not involved in any negotiations/discussions with 22 BA really about that issue, but the -- for reasons that 23 one can perhaps deduce, the BA was not happy -- I need 24 to try and use my words carefully here, I'm just trying 25 to be factual -- the BA was not happy to see the 73 1 programme progressing. 2 For example, at this point, they didn't want us to 3 move towards a live trial. Even though the live trial 4 didn't really have much bearing on them, because it 5 didn't affect their functionality, it didn't change 6 their systems, because we were only doing Child Benefit, 7 they were -- how can I put it? I would say they were 8 resistant to progress. 9 So that added to the tension at this point and 10 I think the Post Office were concerned, perhaps not yet 11 knowing how the BA thing would unfold, that the 12 programme was at risk of being slowed down and derailed. 13 So they wanted to just keep making progress and, as 14 I have explained, the progress would be to undertake 15 a limited live trial to gain further experience of the 16 system in the hands of real users. 17 I remember this was a very fraught moment, as you 18 can imagine, this period. As I say, I wasn't involved 19 in any of the discussions or negotiations but, I mean, 20 I was aware -- it was very evident to people like me on 21 the programme that this was quite a tense situation, as 22 to what is going to happen at this point. 23 Q. What was your view? Did you think it was necessary to 24 have another run of end to end and model office testing? 25 A. As I just previously tried to explain, I think this was 74 1 a difficult call. I have already explained that I had 2 a strong view about the need for the financial integrity 3 of the system and I wasn't -- I suppose I would have to 4 be honest and say I wasn't wholly convinced at this 5 point that it had been solved but that wasn't 6 necessarily at this point a disaster. It was possible, 7 within the 200 offices, with appropriate understanding 8 and support, to manage those issues. 9 For example, during the live trial, if an outlet 10 came up with a cash account discrepancy, you would 11 expect that within Chesterfield, they have got a list of 12 the 200 offices in the live trial. They would have 13 known to have paid some attention to those 200 offices 14 during the live trial and if those problems occurred, 15 "Well, they are live trial offices, okay, we need to, 16 whatever you say, cut them some slack or give them extra 17 support and not jump to conclusions or anything". 18 If you could manage that risk, you could learn a lot 19 of essential information that would help you when you 20 subsequently came to roll out training and deployment. 21 You see what I mean? You are trying to weigh that 22 up. 23 Q. I understand. In any event, you were appointed the live 24 trial manager for Horizon, which went ahead without the 25 Benefits Agency? 75 1 A. Yes. Can I just say, that role, which was originally 2 identified back in February, didn't really work out in 3 the way that you would expect, in that what I realised 4 was that, because of the contract, the live trial was 5 not just some, like, discrete exercise within the 6 programme, perhaps as I had experienced in other places. 7 You run a live trial as a discrete exercise. You manage 8 the activity and the reporting. At the end of it, you 9 produce an evaluation, you then make a decision. 10 Now, what happened with the contract, which I hadn't 11 appreciated back in February -- and I suspect other 12 people hadn't quite appreciated it because we wouldn't 13 have said things that we said at the time -- was that 14 the live trial very rapidly became embedded in the 15 acceptance process and the issues and the progress in 16 the live trial basically became evidence that fed into 17 the acceptance process not into some separate programme 18 managed activity. Is that clear what I'm saying there? 19 Q. Yes. In terms of what it threw up, the live trial, you 20 tell us that there were cash account accuracy problems, 21 there were concerns over the adequacy of staff training 22 to deal with the complex activity that they were being 23 asked to undertake, there were problems with a high 24 number of callbacks to the Helpdesk -- 25 A. Yes. 76 1 Q. -- which weren't dealt with quickly or easily and that 2 these all featured amongst the list of high, category A, 3 incidents; is that right? 4 A. Yes. So this illustrates what I was trying to say. The 5 live trial threw up these problems but they then got 6 presented in terms of high incidents within the 7 acceptance process. So they were kind of documented and 8 managed as incidents within the acceptance process, and 9 the significance of them being high, as I think has been 10 explained by previous witnesses, is that POCL had the 11 right to refuse to sort of sign-off the system if there 12 were any high incidents remaining at the point of 13 rollout. 14 Q. How did it happen that what was intended to be a live 15 trial, as had been described in your presentation back 16 in February '99, slid into -- my words -- part of 17 an acceptance process? 18 A. The answer to that is, I think, the contract, the PFI 19 contract, because this is what the contract said would 20 be the process towards the approval of the system. We 21 are now touching on a major process issue here as to was 22 that a good idea or not? I don't know if you want to 23 ask me a particular question -- 24 Q. I think you have answered the question you have just 25 asked yourself. What was the major process issue? 77 1 A. This goes to the nub, really, of how the system was 2 endorsed for rollout. The contractual acceptance 3 process made it work in terms of the reporting of these 4 incidents. 5 I mean, if we -- I don't know whether it will be 6 worth going and looking at the next document I reference 7 in my witness statement, towards the bottom of page 11. 8 This might just help me explain. 9 Q. We can certainly do that. 10 A. The "Acceptance Incident Hotlist", or the meeting of 11 13 August, I suspect, we are going to come onto. 12 Q. If you want to look at the hot list first that's 13 POL00028355. Then look at the second page of that 14 document, please. 15 A. Yes. 16 Q. Is that the document you are referring to? 17 A. Yes. 18 Q. This is as matters stood. It is under cover of an email 19 of 13 August? 20 A. Yes. So this is the key control document -- I mean, 21 there is a lot of other documentations but I would say 22 this is the key control document for where we are in the 23 acceptance process. So it is defined in terms of these 24 incidents, these AIs, Acceptance Incidents, which you 25 can see all have a number and a very short description. 78 1 Q. Yes. 2 A. Then, because the rating is the crucial issue here, how 3 are Pathway rating it? And how are Post Office rating 4 it? 5 Q. And on none of them do they agree? 6 A. No. So you can see that this is -- this creates 7 an adversarial process, doesn't it? This clearly 8 creates an adversarial process, where there is 9 a sustained -- for some of these there's a sustained 10 argument as to what is necessary to agree these ratings 11 and, most importantly, whether all of these can be 12 reduced from high to medium. 13 I mean, there's a lot going on here but, in terms of 14 focus, the focus is on the three high ones: 376, 218 and 15 there is one a bit lower down, isn't there? 16 Q. Yes, 298, three from the bottom. 17 A. Yes, "Counter system subject". There is a lot of other 18 stuff in here but, I mean, if I just say, I'm not part 19 of the acceptance approval team here. I'm seeing quite 20 a lot of this stuff because decisions that are coming 21 out of this process are affecting the plan or could have 22 potential impacts on the plan. I'm being informed here. 23 I'm attending some meetings. I'm aware of this process. 24 Q. You were a copy-ee of this email -- 25 A. Yes. 79 1 Q. -- and I think you were an attender at the meeting the 2 day before on 12 August; is that right? 3 A. Yes, the meeting -- 4 Q. There is a minute of it, if we turn that up, please. 5 A. 28332? 6 Q. Yes, POL00028332. Just wait for that to come up. Then 7 turn over to the next page, please. You can see the 8 meeting at Gavrelle House and I think we can see you 9 were down as an attendee and the minute taker. 10 A. I do have a bit of memory of this meeting, partly 11 because it went on for nearly six hours and because 12 I had to have the minutes ready by 10 o'clock the 13 following morning. I kind of have a memory of one 14 particularly long day at the Post Office. 15 Can I just say it is a bit unusual, given that 16 I actually put the word "minutes" after my name there, 17 and I think -- my recollection here was this was called 18 at quite urgent notice to try to give a clear summary of 19 where we were in the acceptance process, in order that 20 that could be shared with the external consultants from 21 PA who were involved in reviewing and advising on the 22 overall situation. And I seem to think that either 23 Bruce McNiven or possibly Chris French said to me 24 "Andrew, we have this urgent meeting tomorrow, we need 25 it properly documented, would you come into it and take 80 1 the minutes?" So I have some recollection of this. 2 Q. What was the outcome of the meeting? 3 A. If you read through the minutes, you can see that in 4 this long meeting I'm trying to capture the key points 5 being made by the Post Office and the Pathway 6 representatives, particularly on the three high 7 incidents -- the long discussions were over the three 8 high incidents. 9 Q. If we just go over the page, and scroll down, please. 10 You will see under 3, "Review of High Priority 11 Incidents" and you deal with 376 first. There is a long 12 three-page section on that. 13 A. Yes. 14 Q. You then deal with 218 and there is a page on that. 15 Then you deal with 369 and there is a page and a half on 16 that. 17 A. Yes. 18 Q. What was the outcome? 19 A. I mean, the Post Office team are really trying to hold 20 the line here. 21 Q. Hold what line? 22 A. Hold the line that these are high incidents that they 23 are not going to downgrade unless there is demonstrable 24 improvements from Pathway. I mean, they are doing the 25 right thing here. They are really resisting giving 81 1 approval until they have seen better evidence that these 2 problems are being dealt with, because they had the 3 right to ask for a rectification plan: clear visibility 4 of the rectification plan, as to how this is going to be 5 fixed and by when. 6 So this lays out the position, makes the views of 7 both parties clear but, at the end of this meeting, 8 those incidents were all still high. 9 Q. Who was ultimately responsible for closing the high 10 critical incidents? 11 A. I mean, this is mid-August. According to the plan, the 12 plan had set a target date of rollout of, I think, 13 31 August. So, at this point on 13 August, we are 14 clearly not going to rollout on the 31st. We are 15 clearly not going to give acceptance because these 16 problems are too serious. 17 So, I wasn't part of resolving any of these 18 incidents. For example, Mr Folkes spoke. He was one of 19 a lot of people given an incident -- a team of people 20 were put on each of these incidents to try to bring them 21 to some resolution or to agree a rectification plan that 22 would bring them to a state that would be acceptable for 23 rollout. There is quite a story, I know, behind each of 24 these. There is quite a bit of documentation -- 25 I haven't seen it all but there's quite a bit of 82 1 documentation as to how each of those high priority 2 incidents were addressed, there would have been 3 a rectification plan and other stuff. That's what is 4 flowing out of this meeting and this assessment. 5 Q. Can we look forwards, please, to POL00028508. We are 6 way ahead now in January 2000 and there is an email from 7 Min Burdett. Can you remember who that was? 8 A. Yes, I recognise the name. We jumped forward a big way 9 here. We jumped forward four months of critical 10 activity. 11 Q. We are going to come back to it, don't worry. Who was 12 Min Burdett? 13 A. Min was again, I think, a contractor working for the 14 Post Office and I think she was administering the kind 15 of follow up to the granting of acceptance, effectively, 16 in her final acceptance around November, and dealing 17 with -- there was still activity that was coming out of 18 the back end of that process and she was trying to 19 manage that remaining activity to some conclusion. 20 Q. It is an email to the late Keith Baines. 21 A. Yes. 22 Q. What was his position at this time? 23 A. Because Keith was the -- as I remember it, Keith was the 24 key acceptance manager within the Post Office domain. 25 So Keith would have been the person with overall 83 1 responsibility for managing this acceptance process to 2 a conclusion. 3 Q. Did he have a technical background or was he commercial 4 or legal? 5 A. I didn't have a lot to do with Keith. I obviously 6 recognise the name, I obviously met him on several 7 occasions. I saw him as one of the contractual people, 8 not a technical person. 9 Q. As you say, the remainder of the document that's 10 attached sets out that Mr Baines was going to be 11 ultimately responsible for closing the critical 12 remaining AIs, including 376. The covering email says: 13 "... I have put down my understanding of how 14 Acceptance should work in future. I will be discussing 15 this with various people next week [including you] to 16 get their buy-in." 17 Do you remember that? That they were approaching to 18 you to buy into this process? 19 A. I don't think I had to give some buy-in to it. I think 20 why I'm in the distribution list is, at this point, I am 21 working on the management of the CSR+ release. A number 22 of these incidents would -- which required sort of 23 non-urgent -- these would be non-urgent software 24 enhancements or fixes. So some of those actions would 25 have fallen to the Pathway development team that was 84 1 actually working on the next release because that's 2 where Pathway were moving their development resources. 3 So it is understandable that some incidents would be 4 perhaps now dealt with under the umbrella of the ongoing 5 development project of CSR+ and, because I was managing 6 that on behalf of the Post Office with other people, 7 they just wanted to make sure that I understood that 8 that was going to be going on and did I have any issues 9 with it? 10 Q. Do you know why Keith Baines was selected as the person 11 who would sign-off closure of the critical AIs, rather 12 than it being a board decision or escalated to Stuart 13 Sweetman, for example? 14 A. I mean, that is a good question about the whole process 15 here. Was the decision taken at a sufficiently high 16 level and with sufficient cognisance of its significance 17 and implications? If that is the kind of questioning 18 you are asking me. 19 Q. Yes. 20 A. That is a very good question to which I don't know the 21 answer. I can give a view on the answer. 22 Q. Can you give us a factual answer as to whether you know 23 why this task was given to Mr Baines? 24 A. No. And I wouldn't -- I mean, that process running 25 between September and November -- I mean, at the basic 85 1 process level, as I have tried to describe, a lot of 2 people are working very hard to find solutions that will 3 fix the high incidents and implement these rectification 4 plans. There is a lot of work going on to kind of clear 5 the technical nature of the problems so that there is 6 some reasonableness in the decision to go forward. 7 But I was aware, although I wasn't involved in it -- 8 but I was aware like everything else on the programme, 9 that there is huge pressure on this issue. Is this 10 system going to go live or not? Is the government's 11 involvement in investment and, to some extent, 12 reputation around this project going to come out okay? 13 We know that BA has pulled out but it is okay, Horizon 14 will go ahead and help save the Post Office. 15 I'm not involved in this but I'm aware that, 16 obviously, this is going on in the stratosphere. So you 17 have to -- you can look at the technical documentation 18 of what is being done to try and clear these hot 19 incidents but that you are aware there are other issues, 20 aren't there, that it is not just the clearing of this 21 hot -- there must be other issues going on. What 22 pressures Dave Miller was under, at this point, I don't 23 know. 24 But, similarly with Keith Baines, to say, "Well, 25 Keith Baines made a decision we should all go live", it 86 1 is not as simple as that, is it? It can't possibly be 2 as simple as that. 3 Q. In any event, you tell us in paragraph 17 of your 4 witness statement that, by January 2000, the contractual 5 acceptance process was largely complete and there were 6 9 medium, 48 low severity incidents outstanding and 7 a new process was documented and put in place. 8 A. Yes. I mean, so -- when I saw this again, I was -- it 9 is somewhat surprising, given what we know now, that 10 there were so few reported incidents outstanding at this 11 point when national rollout was about to start. 12 Q. Why is it surprising? 13 A. Well, given what happened subsequently. If I put it 14 like this, if you read the media, as it were, you are 15 given the impression that "Horizon went live with loads 16 of bugs, why did they let that happen?" But, as I say 17 in my witness statement, it is not as simple as that. 18 In fact, it is quite surprising how few faults were 19 formally reported at this point. Now, you could 20 question the accuracy, perhaps, of this position, of 21 course you could question the accuracy of it, but that's 22 what was on the radar, that these -- it had been reduced 23 to a manageable number of medium and low priority 24 problems. 25 Not no problems, obviously, because this is a major 87 1 computer system, you wouldn't expect it to be completely 2 empty of bugs, that's just unrealistic. But there was 3 an understanding that the problems had been reduced to 4 a manageable level for rollout to start. 5 Q. Just stopping there, you have referred to the 6 stratosphere on a couple of occasions and indicated 7 essentially pressure coming down from above. Could that 8 explain why the Acceptance Incidents had been reduced in 9 severity or description to an acceptable level or, in 10 fact, genuinely had they been reduced to an acceptable 11 level to allow rollout? 12 A. No, I wouldn't -- I think one should be very careful to 13 question the integrity of the people involved in this 14 process. I mean, you have heard from Mr Folkes. I can 15 know other people in the team who were trying to act 16 with full integrity on these incidents and whether they 17 were overruled at some point, I don't know. But, even 18 on AI376, perhaps the most critical one of them all, 19 because that's the financial integrity incident, there 20 was a rectification plan in place. There was 21 a monitoring process in place. 22 Pathway actually produced an enhancement at the end 23 of December 1999 to strengthen the integrity controls 24 within the product. So there wasn't a kind of "Oh, well 25 get it in anyway". That wasn't how it worked out. 88 1 There may have been pressure -- there must have been 2 pressure but there was still, I would say, a serious -- 3 there was a serious effort to get these things fixed but 4 there is that wider context. All I am saying is I don't 5 think one can ignore that, because that context was 6 there. 7 Q. On any view, however, there was still lots of work yet 8 to be done, including on accounting integrity on systems 9 stability and on support and training for 10 subpostmasters, and we see that reflected, don't we, in 11 the second and third supplementary agreements? 12 A. No, see, I didn't see those supplementary agreements, so 13 I'm not quite sure what degree of ongoing remedial 14 activity was kind of baked into those supplementary 15 agreements. The fact that they were there is a good 16 thing. And I am sure people tried to apply due 17 diligence to make sure that those additional control 18 processes were there. 19 Q. On one view, Mr Simpkins, those second and third 20 supplementary agreements are evidence that a contract 21 was written, that said these are the baseline things 22 that need to be satisfied before we go live. You 23 weren't ready to go live and, therefore, a series of 24 agreements were written that changed the baselines to 25 modify them just to allow the system to go live. 89 1 A. Are you telling me that's what happened? 2 Q. I'm saying that's one view of what the effect of those 3 two supplemental agreements is. 4 A. I never saw these supplemental agreements. I'm a bit 5 blindsided, really, on how to comment on that. I'm not 6 in this acceptance process personally, just to be clear. 7 I'm not in the process. I'm just -- because I'm still 8 on the project, I'm aware that it is going on and I'm 9 aware that a lot of work is being done to try to bring 10 the system up to a state where it could go live. 11 So, that's how I'm perceiving the situation. I'm -- 12 from my perspective, how did I feel at this point? 13 I was -- if I was trying to reflect on how I felt, 14 anxious would probably describe my view. 15 And, as I tried to explain in my witness statement, 16 my attitude here, I think, would be fair to describe as 17 anxious, not because I think there are all these bugs in 18 the system that haven't been fixed or there has been 19 an irresponsible process to close them, it is that 20 I just have concerns about the vulnerability of this 21 system when it goes into national rollout to 17,000 22 offices, because you are now -- 23 There is a lot I could say here but -- and there are 24 multiple issues I'm well aware of at this position. But 25 I'm concerned -- if you said -- my own view was I'm 90 1 concerned, for some reasons I tried to explain in my 2 witness statement, about the vulnerability -- what 3 I call the vulnerability of the system. 4 Q. You say in paragraph 29 of your witness statement, if we 5 just go forward to it, it is page 17: 6 "While I was not personally involved in the 7 specification or testing of the Horizon system, the 8 evidence I saw of the protracted difficulties in testing 9 showed a lack of transparency in how the system worked." 10 Was that one of your worries that you just referred 11 to? 12 A. Yes. I think I'm following up Mr Folkes' evidence, 13 which I'm assuming -- if I can assume you have heard 14 that -- I mean, he rightly placed a lot of emphasis on 15 how the POCL team did not have access to the technical 16 documentation because of Pathway's position that the PFI 17 allow them to deny that access. 18 So that is what I mean here about a lack of 19 transparency, the Post Office team, both at a technical 20 level, so at Mr Folkes's area, so the application area 21 which is more John Meagher's area, they couldn't really 22 see how the system worked. There was a comment -- 23 I think Mr Folkes used the term which was used quite 24 a bit, the solution was a "black box" from the point of 25 view of the Post Office people trying to understand it. 91 1 Obviously, you knew what was going in the front end 2 through the counter terminals and you knew what was 3 coming out the backend, in terms of files going into the 4 TIP system in Chesterfield. But what was actually going 5 on within the EPOSS application, we didn't really know. 6 To me, this is a somewhat unusual situation but you 7 couldn't see how the system worked. 8 People on the POCL team who were saying we're 9 responsible for assurance -- assurance -- couldn't 10 really do their job in the way that you would expect and 11 so I thought it could be quite nicely summed up that the 12 decision to go into rollout was an acceptance decision. 13 It was based on the contractual acceptance process. It 14 wasn't based on what, in many other projects, you would 15 have seen as a technical application assurance process 16 that the system was fit for purpose. 17 There is a bit of a subtle -- it is not that subtle 18 a distinction between the two but, when you are not 19 operating under a PFI contract, you would have gone 20 through a user acceptance test and some kind of 21 assurance process. But, under PFI, you are going 22 through this acceptance process, so it is a different 23 animal and you haven't got the transparency, or the 24 client hasn't got the transparency, as to what is going 25 on and that is significant. 92 1 I use the word, if I may continue, "transparency" 2 here really in two ways, and two really quite different 3 ways, which probably isn't quite helpful. There is the 4 transparency, as I have just described it in terms of 5 you can't see what is going on at a technical level -- 6 Q. Sorry, just stopping you there. That's for POCL 7 technical staff involved, in particular, in the 8 assurance and acceptance phase? 9 A. Yes. So the first -- how I'm using "transparency" here 10 is in that sense, yes. 11 Q. But there is also a second way in which there's a lack 12 of transparency? 13 A. Yes, which comes out in the next sentence, where this 14 explains why the branch staff had difficulties with cash 15 accounts and stock unit balancing, as reported during 16 the live trial. So there is another issue, which is how 17 the system works -- although the branch staff can use 18 it, they are not too clear on how it works, either. 19 Obviously, they don't have to understand it at 20 a technical level, but to cut to the chase here, one of 21 the things that I only discovered reading some of the 22 postmaster testimonies, and has come out in some other 23 literature, is that when the postmaster had a problem 24 with his cash account -- you know, he had a deficiency, 25 he had an unexplained deficiency -- there is nothing 93 1 that he could do to understand how that had happened. 2 Q. So he could not interrogate the system? 3 A. He could not interrogate the system. When I read this 4 a few weeks ago I was a bit astonished to be honest. As 5 I understood it, postmasters are, in a sense, running 6 their own business. I know there is a huge issues about 7 the Post Office contract with postmasters but in some 8 sense these people are running their own business and 9 they have invested their own money in this business, and 10 all the time the system is working fine, okay the system 11 is working fine and there aren't any problems, but when 12 a problem arises you would think that you have got some 13 ability to try and work out, "Well where is it going 14 wrong". 15 Not to the extent, obviously, that you would expect 16 a postmaster to say "It is programme X, Y, Z in 17 Pathway", not that. 18 But I can remember evidence from some of the 19 postmasters who were saying "Well I want some evidence 20 of" -- I suppose you might say an audit trail, "Where 21 is the audit trail that explains my deficiency"? As we 22 know, they could not produce the audit trail and the 23 Post Office refused to give them that information. 24 Q. Just breaking it down. Was the system designed, to your 25 knowledge, in a way that was deliberately opaque for the 94 1 subpostmaster? 2 A. I couldn't say that it was designed. I wasn't 3 responsible at that stage. I think what -- the point 4 I would make though is -- this is a point I actually 5 wrote in my own notes -- when you talk about Horizon, as 6 we know, it is very easy to talk about bugs, errors, 7 fault, defects, you know, "The problem with the system 8 is that it had bugs, errors, faults, defects". What's 9 often missed in systems is omissions. Not things that 10 were going wrong, but things that just weren't there 11 that you realise, in retrospect, it would have been 12 a good idea if that was there. 13 So, if the postmasters had had some facility that 14 would have -- at least given them a clue as to what was 15 going wrong. 16 Q. Or a dispute function? 17 A. Or yes, you could have had -- the other way of looking 18 at it is you would have had a disputes procedure. For 19 example, on the accounting systems that I worked on at 20 Coopers, I would definitely have expected that -- I know 21 this is a different environment but the principle, 22 I think, is the same -- I would have expected, in the 23 system that I had delivered to the client, that when 24 something went wrong the accounting system would have 25 told them where it had gone wrong. 95 1 What type of transaction seems to have been 2 responsible for this? Or what product category? Or 3 what end of day process? Something that gives you 4 a clue as to where it is going wrong or something that 5 gives you evidence that something has gone wrong. You 6 know "I have got a control account here and I have 7 an audit file of transactions and this audit file of 8 transactions does not equal what is in the control 9 account, there is a problem, there is clearly something 10 wrong with the system these two things don't reconcile". 11 You need something like that. I will just make one 12 other point and just stop here. You not only need that 13 for the confidence and credibility of the postmaster's 14 position, if you don't have that information, it is 15 difficult for other people to also understand what the 16 hell has gone wrong in that branch. Because just being 17 told there is a cash account deficiency in the branch, 18 that isn't going to get you very far in trying to solve: 19 where in the system did that happen? 20 MR BEER: On that note, sir, would that be an appropriate 21 moment? 22 SIR WYN WILLIAMS: Yes. 23 MR BEER: Sir, can we say 2.05 pm, please? 24 SIR WYN WILLIAMS: Yes. 25 You are not supposed to talk to anyone about your 96 1 evidence, I am sure you don't want to. We will see you 2 at 2.05. 3 A. Okay. 4 (1.05 pm) 5 (The short adjournment) 6 (2.05 pm) 7 MR BEER: Good afternoon, sir, and good afternoon to your 8 assessors. 9 Good afternoon, Mr Simpkins. 10 One issue I would just like to go back on, which 11 I rather skipped over before the lunch break. In 12 paragraph 23 of your witness statement, no need to turn 13 it up, you say: 14 "The issue was not merely a matter of individual 15 errors but rather the underlying complexity and 16 fragility of the branch accounting system." 17 Can you explain in more detail what you mean by 18 that, please? 19 A. I think for people who are not IT professionals, if 20 I can use that term, there can be this sort of a naivety 21 that a fault in a computer system is just a programming 22 error, an error in a line of program code, and that 23 creates a bug or a fault in the system, and someone just 24 needs to identify that bug and fault and go into the 25 program and correct it and all will be well. 97 1 I could say more about that subject but it starts 2 getting a little bit more technical. But in computer 3 systems you have problems that are not just individual 4 coding errors. You can have problems arising from the 5 design of the system and -- it is difficult to know 6 quite how to explain this in non-jargon terms but the 7 result is that the system is vulnerable to ongoing 8 errors. 9 Perhaps I could say it like this: as I have already 10 explained, we tested Horizon for nearly 12 months and 11 a lot of corrections had to go through the system to fix 12 all different kinds of errors. 13 Now, in a computer program, you get -- if you get 14 a lot of errors in a computer program you are rewriting 15 large sections of code and you are adding to the 16 complexity of that code and, in fixing some lines, you 17 are possibly disturbing other lines. So if you keep 18 making changes to a piece of code because there's just 19 some basic way it is not working, you end up with 20 a fragile piece of software. 21 It is like any piece of technology. If you keep 22 patching it, you get to the point where you say "This is 23 ridiculous, I just need to throw it away and start 24 again". It gets to a state of fragility. 25 And if you keep getting problems, as I identified in 98 1 those phases of testing around Christmas 1998, if you 2 keep getting repeated errors in a part of a subsystem, 3 you think about redesigning it. If you are spending 4 hours and hours trying to work out why it is going 5 wrong, you think would something with the original 6 specification or something with a programmer who did 7 this -- it is just a mess. So it will be better to 8 redesign it and start again. 9 So I don't feel I have explained that very well but 10 it is not just a matter of finding individual coding 11 errors. You get to a point where the basic design is 12 wrong. 13 So I would say, within the EPOSS system, there was 14 some basic misconceptions as to how it had to work as 15 an accounting system. I don't know the background to 16 that. 17 Q. Misconceptions by who? 18 A. By the original requirements gathering process, the 19 original systems analysis, the original systems design. 20 It is as though people didn't realise that, when you had 21 an accounting transaction, it had to generate a debit 22 and a credit somewhere. It wasn't just a matter "Oh, 23 great, we processed the sale of a stamp". So when you 24 process the sale of a stamp what debit and credit 25 transactions does that generate and where are they 99 1 generated in the system? 2 And if people are not clear where those accounting 3 processes are taking place and where that balancing 4 activity is being done in the system, you have got 5 a design flaw. Do you see what I mean? That is a kind 6 of design flaw. You are not clear on how the accounting 7 flows are going to work through the system in order to 8 ensure that everything balances at the end of the day. 9 That's what -- right back from that position in late 10 1998, where I was concerned about the accounting 11 functionality within the system, it is not just because 12 I thought "There's a few lines of wrong programming code 13 here", it is because I thought someone hasn't thought 14 through a robust design how this is going to work in the 15 future, with loads of offices and transactions. Is that 16 good enough? 17 Q. Thank you. You mentioned in late '98 your concern and 18 you mentioned, as an example, a problem with EPOSS 19 system, were you aware of the setting up of the 20 so-called EPOSS task force and a report produced by the 21 EPOSS task force? 22 A. No. I think it was -- you sent me some documentation on 23 it and I think it was an entirely Pathway activity. 24 Q. Can we look at that documentation. FUJ00080690, 25 a document with which the Chair and others are very 100 1 familiar now. 2 Ignore the date in the top right-hand side and treat 3 this as being treated in late '98. Is it right that the 4 first time you saw this was when the Inquiry disclosed 5 it to you recently? 6 A. Yes. 7 Q. I think you have read the document. 8 A. Yes. 9 Q. Were you aware that the task force, so-called, had been 10 set up? 11 A. No, this is part of the general problem of not having 12 visibility of what Pathway are doing inside the black 13 box of their development. 14 Q. On reading it and the concerns that it sets out, is this 15 information that you think ought to have been shared? 16 A. You can see the dates here, August/September 1998. So 17 we are still at a relatively early stage of testing. 18 I didn't become clear, as I said earlier in my evidence, 19 how -- that there were serious problems in this area 20 until about late October, certainly into November. 21 But Pathway are clearly -- know at this time -- 22 well, obviously before 19 August, that the EPOSS system 23 is not functioning robustly, getting a lot of errors, 24 PinICLs, in it, so what are they going to do about it? 25 Q. If we skip forward please to page 7. The line: 101 1 "It is clear that senior members of the Task Force 2 are extremely concerned about the quality of code in the 3 EPOSS product." 4 There was a re-engineering by Escher: 5 "Since then many hundreds of PinICL fixes have been 6 applied to the code and the fear is that code decay 7 will, assuming it hasn't already, cause the product to 8 become more unstable." 9 Is that an element of the description you were just 10 giving a moment ago? 11 A. Yes. I mean, it is saying that, with that number of 12 PinICLs, the product is becoming potentially unstable, 13 yes. You can't be sure that you are going to be able to 14 correct the problems and diagnose them properly in 15 future. 16 I wasn't involved -- I mean, as you know, people on 17 the Post Office side weren't close enough to these 18 technical issues. You know, you are trying to -- the 19 black box problem, as we have described it -- but what 20 I sense when I read this from a wider experience is that 21 the Pathway solution was critically dependent upon this 22 Escher product and it reminds me of other situations 23 where a supplier comes forward in a tender, having 24 a kind of solution, which they think is going to meet 25 the customer's requirements, and they hang their 102 1 proposal on you utilising this product, either 2 an in-house product or, in this case, it was actually 3 a product from Escher. 4 So you base your design on the fact that this core 5 product will allow you to build your solution around it. 6 But then you find that it is not really quite the right 7 product that is needed for this particular clients' 8 requirements. So you are then into a process of what's 9 sometimes called reverse engineering it, or 10 re-engineering it to meet the clients' requirements. 11 Now, that is acceptable to a degree but, once you 12 start to re-engineer more of it, you are going to end up 13 disturbing the basic integrity of that product and 14 complicating it and that's what I fear happened here. 15 The Escher EPOSS product went through so many 16 iterations, it almost became unrecognisable. Not 17 unrecognisable, that's an exaggeration, but it became 18 very different to what was originally the concept. 19 Q. You have read the 20-page report, I believe. 20 A. Sorry the? 21 Q. You have read this 20-page report? 22 A. Yes, for the first time yesterday, I think. 23 Q. If you had known the information contained in it at the 24 time, ie in late 1998, what, if any, impact would it 25 have had on your own conduct? 103 1 A. Because this is still an early stage -- this is still -- 2 I mean, you're into the testing cycle, so it is getting 3 a bit late in some ways but you're still in a kind of 4 early stage of testing. So, you could say there may 5 well be time enough for this problem to be solved. 6 I wouldn't say you would have to leap to a conclusion at 7 this point that this is clearly undeliverable, I don't 8 think you could jump to that conclusion. 9 This would be a worry and it would explain certain 10 things. I would have been more -- I don't know if I'm 11 going to jump ahead of you. I'm more concerned that the 12 document you sent me -- about the review of EPOSS in 13 late 1999. 14 Q. Why were you more concerned about that document? 15 A. Because that document which I think was -- again, it was 16 an internal Pathway document, issued in November 1999, 17 where some of their technical people made a proposal 18 that the EPOSS code should be re-written. 19 Now that is a huge -- that is a huge recommendation 20 to rewrite the core product. Now, that, as I saw in the 21 subsequent documentation, that recommendation was 22 actually turned down by their senior management who 23 thought it would be more cost effective to keep 24 maintaining it. If I -- or, really just personally, but 25 if the Post Office team knew in November 1999, you know, 104 1 like the month you were about to commit to national 2 rollout, that there were people in Pathway -- technical 3 people in Pathway who were so concerned about the 4 stability of this product that they were thinking that 5 it should be re-written, that would have been a red 6 flag. I mean, that would have been very worrying. 7 What decision the Post Office would then have 8 made -- but that is materially significant information 9 to have had, or not had. 10 Q. Would your answer be the same if the proposal was to 11 rewrite the cash accounting part of EPOSS? 12 A. I mean, I don't understand -- as I said, we didn't 13 understand this internal architecture of the system and 14 it wasn't -- I wasn't in the technical or product 15 assurance teams that may have got closer to this. If 16 you say to me, "Given the problems, do you think the 17 accounting aspects of this system should have been 18 re-written"? Yes, I think, given what we have seen, 19 they should have been rewritten. But when they should 20 have been rewritten, the answer to that could have been 21 December 1998 they should have been re-written. There 22 was sufficient evidence at that point to think, "This 23 isn't working very well, we should -- not necessarily 24 throw everything away but this area that is giving us 25 particularly business critical problems, we should take 105 1 a more in-depth look and not just try to fix it, think 2 about whether we have actually got it wrong and we 3 should redevelop it". 4 Q. I'm going to try and draw all the threads together and 5 look at the penultimate paragraph of your witness 6 statement please. WITN06090100, at page 18, please. It 7 is paragraph 30. You say: 8 "At the time I left Horizon I was not so much 9 worried as to whether known faults had been fixed. It 10 was rather that the system delivered into Rollout had 11 an ongoing vulnerability to error due to its complexity 12 and lack of transparency." 13 You have explained that to us already. Then you 14 say: 15 "When errors arose over time during live operation, 16 as they do in all systems, it would be difficult if not 17 impossible for postmasters and postmistresses to 18 understand what had gone wrong." 19 You have explained that to us. Would it be 20 difficult or impossible for POCL to understand what had 21 gone wrong in that situation? 22 A. What could have gone wrong in the live system? I mean 23 you have -- if I just -- I was interested in what 24 Mr Folkes said towards the end of his testimony. From 25 his perspective he felt that although the -- kind of, 106 1 the known visible problems had been fixed at this point, 2 he still felt that there was a certain unproven -- 3 I think unproven was the word he used -- in going into 4 rollout. I'm saying I had exactly the same perception. 5 Therefore, there should have been some activity to 6 have monitored that these issues, that had been such 7 a problem during testing and during acceptance, were 8 showing resolution in the live environment as it was 9 rolled out over the following 12 or 18 months. And you 10 would have thought that, given all that we knew at the 11 time, not now, but what we knew at the time, that there 12 should have been some diligence on areas such as the 13 accounting, such as reference data drops, but that 14 didn't happen, clearly, did it? That did not happen. 15 In fact, it seems that very quickly, in 2000, the Post 16 Office senior management, from what I have read, the 17 National Federation of Subpostmasters, the Post Office 18 investigations department all came to the conclusion 19 that this system is now working perfectly. 20 We are the only major corporation in the world that 21 has got 100 per cent perfect computer system. I know 22 that's a bit strong to put it that way, but for people 23 with any IT background, to think that the senior 24 management of a major public corporation can believe 25 that their system is perfect is just -- well -- I don't 107 1 know what word to use. If I just said, naive. 2 Q. You have explained in your evidence about a lack of 3 transparency. Meaning a lack of ability or facility to 4 look at -- to see how the system was designed and how 5 it, in practice, operated. I'm asking, when the system 6 was live, after national rollout, did that lack of 7 transparency or facility to look under the bonnet still 8 exist? 9 A. Yes. Yes. Can I just add a point of detail here? 10 Q. Before you add a point of detail, why did that lack of 11 transparency or facility, as I call it, to look under 12 the bonnet still exist? 13 A. Are you saying why did the Post Office not have the 14 ability to understand the nature of -- the ongoing 15 nature of these problems? 16 Q. Yes. If they saw, in a Post Office in central London, 17 a balance of minus £10,000 and they said, "Right, shall 18 we assume that the subpostmaster stole it or shall we 19 see whether there is a computer error that has caused 20 that as an artifact", was there a facility, an ability 21 to interrogate the system to see whether the minus 22 £10,000 balance was an artifact of the system? 23 A. I mean clearly Fujitsu should have had the ability to do 24 that. Clearly, technical people within Pathway Fujitsu 25 should have been able to interrogate branch accounts as 108 1 part of the debugging process. So -- but you have to 2 understand, the difficulties of debugging a system of 3 this scale, in so many outlets -- and this was a point 4 I wanted to make. It goes back to the point I made 5 before lunch, that the postmasters, when they had 6 a deficit or an unexplained discrepancy, they could not 7 get anything out of the system to explain what was going 8 wrong. 9 Now, you then have to follow this through. They 10 come up with an unexplained discrepancy. They have got 11 no idea how it has happened. They ring the help desk. 12 They say "I have got this discrepancy, I need some help 13 to resolve it. I am sure I haven't done anything wrong 14 but I have this discrepancy". The Helpdesk make a note 15 of this, "branch so and so, unexplained discrepancy". 16 They have no additional information to explain that. 17 At some point in the next few days, perhaps it is 18 reported into Fujitsu, to cut the story short. So 19 Fujitsu is told "There is a branch that has got 20 an unexplained cash account discrepancy". Where? 21 Where? They have got no information from the postmaster 22 as to what might have gone wrong and where. So where do 23 the Fujitsu people start looking for it? 24 I mean, in testing systems, a crucial ability is 25 replication. You know with you have found a fault 109 1 because you can replicate it within the test 2 environment. That's the way you know you are 3 90 per cent forward in resolving a problem. But if you 4 don't really know what happened, if you haven't got the 5 evidence around the practical business activity that 6 originally led to the fault, you don't know what fault 7 you are trying to replicate. 8 So this is a crucial factor in why I think the live 9 service support to Horizon was poor and why problems 10 didn't get fixed over a period of years, because of, you 11 could say, the lack of transparency in the branches 12 meant that the end users couldn't describe the problems. 13 Do you see -- do people follow that explanation? Does 14 that -- 15 Q. That's what you say in your last sentence: 16 "So a situation arose where they could not validate 17 the integrity of their own financial information ..." 18 A. So they could not validate it, therefore they could not 19 give any guidance to the support area as to where to 20 look for the problem. And so you have got people in 21 Fujitsu being told that there are these problems but not 22 really getting much help into where to look for them. 23 And then, of course, around this, you have got the whole 24 culture of denial that there are problems in the system 25 anyway. 110 1 MR BEER: Mr Simpkins, they are the only questions that 2 I ask. Thank you very much indeed. There may be some 3 more questions. 4 Questioned by MR STEIN 5 MR STEIN: Mr Simpkins, I ask questions on behalf of a very 6 large group of subpostmasters, mistresses and managers 7 and I'm instructed by Howe+Co solicitors. 8 With the permission of Mr Beer, can I turn this 9 around so that we look at it through the lens of your 10 starting point in your evidence, which is that you were 11 not aware that the Post Office was engaged in the 12 occupation of prosecuting people -- 13 A. Correct. 14 Q. -- and that, therefore, that wasn't something that was 15 on your mental desk; is that fair? 16 A. Yes. 17 Q. Now, if the system was purposed to provide evidence to 18 investigators and to support prosecutions, would that 19 have affected, in your view, the requirements for the 20 system build? In other words, the acceptance criteria 21 the requirements being put forward to design the system? 22 A. Yes. 23 Q. Do you agree that that would have radically affected the 24 system requirements and build? 25 A. I would not say it would radically have affected it. It 111 1 would have been -- in other contexts, the ability for 2 an end user department/unit of some kind, to have some 3 audit type information to explain its financial data, 4 you would think, is a pretty standard requirement, 5 wouldn't you? 6 Q. Yes. 7 A. But, within the Post Office, it seemed, yes, we have got 8 a system that will provide this kind of data at the 9 Chesterfield end, but what about in the branch? It was 10 as though you weren't treating the branch as a business 11 unit. 12 I am aware there is a whole kind of legal structural 13 issues here but if you are, in some ways, an independent 14 business unit of some type, you need to have some 15 management control over your financial information. Not 16 just "I stuck all this information into a terminal and 17 I got these reports out, and that's the end of it". 18 I would say, professionally, that that person has 19 got to have the information to discharge their 20 responsibilities. 21 Q. Do you agree that it would also have tightened up the 22 need for robustness within the system and making sure 23 that the system was accurately providing data? 24 A. It may have helped in the design of the system. I mean, 25 not just -- as I said earlier, not just for the 112 1 postmasters but in testing, if there had been better 2 analysis of what was going on within those areas, it 3 would have been easier to test. It is a point I kind of 4 make in my witness statement. 5 If you have got a well designed system, it is easy 6 to test because it is structurally clear. The 7 information flows are clear. The numbers all tie up. 8 Where you haven't got that, you are just making life 9 more difficult for yourself in testing and then, of 10 course, in live operation. 11 Q. Obviously, you understand that information that may be 12 used in criminal proceedings needs to be accurate; you 13 accept that? 14 A. Oh, yes. 15 Q. Does that, of itself, against the other parts of your 16 evidence, where you have been critiquing aspects of 17 testing, the difficulties with reconciliation between 18 terminals and, if you like, the head office, would that 19 emphasise the need to make sure that those things 20 weren't buggy or prone to error? 21 A. I'm not quite sure if -- 22 Q. It may be my fault with the question. Would you agree 23 that, if you had to make sure the system was as accurate 24 as possible for the purposes of using the evidence from 25 it in criminal proceedings, would that have tightened up 113 1 procedures regarding -- 2 A. Yes, you would expect appropriate due diligence, 3 wouldn't you? You would expect appropriate due 4 diligence in that process. 5 Q. Benchmarking, so that you look at rollout, you test the 6 product, and re-test the product through its life? 7 A. Do you mean after rollout? 8 Q. Yes. 9 A. There is a continual -- yes. I think, as I said 10 earlier, you would expect in any business support 11 environment that part of the responsibility is to make 12 sure that something unexpectedly hasn't gone wrong. All 13 kinds of things can go wrong in a live computer system. 14 I say "all kinds of things" but stuff can happen, so you 15 have to have -- it would be a normal process to monitor 16 that possibility. 17 Q. The system itself, you mention the role and the position 18 of some of the software providers. Now, those software 19 providers, as far as we were aware, were never told that 20 it the system may be used for the purposes of 21 prosecutions, in other words that the data that's part 22 of the system better be accurate, better be good and 23 solid. Would that have affected the way that the 24 software providers may have assisted in relation to 25 their double checks, fixes, workarounds of their 114 1 product? 2 A. You are asking me to speculate a little bit on what may 3 have been the dialogue between Pathway and Escher 4 particularly. No doubt Pathway would raise issues on 5 Escher, they would prioritise those issues, they would 6 stress urgency. I am sure they would do that and, if 7 Escher as a professional organisation was told there was 8 a problem with their product, they would respond to it. 9 I can only presume that there was some kind of 10 professional relationship here. If you're saying that 11 we've got a particular crisis because this is really 12 serious, this potential fault because I don't know when 13 Pathway or Fujitsu was aware of these prosecutions 14 taking place, but you would have thought, if they -- 15 I mean, we're getting into deep water here, aren't we? 16 But if they suspected there was an issue within the 17 system they should, of course, have flagged it on those 18 suppliers. But I don't have any evidence -- this is 19 part of the problem, you don't really have much 20 visibility of what went wrong there. As you say, you 21 are speculating as to quite what happened. 22 Q. You seem to overall agree that if there was awareness 23 that the system was going to be used as the basis for 24 the prosecution of individual subpostmasters, it would 25 have affected the different issues that had come up 115 1 within the operation of any system? 2 A. I mean, once you understood that that was the potential 3 significance of some of the Horizon reporting, you know, 4 it was -- I was almost going to use the word "life 5 threatening" here -- because I know this is a very 6 sensitive area. 7 But this is a very high bar, isn't it, in terms of 8 integrity of data: very high bar. So you would have -- 9 what is due diligence? What should due diligence have 10 looked like in a case of that kind? 11 MR STEIN: Thank you, Mr Simpkins. 12 SIR WYN WILLIAMS: Anyone else? Thank you very much. 13 I think that concludes your oral evidence. So thank you 14 very much for coming to give it. 15 A. Thank you. 16 Can I just, Mr Chairman, you know, like with the 17 other people who worked on Horizon, it's -- you know, 18 like other human beings, we feel a grief for what 19 happened to the postmasters as a result and there is 20 still a sorrow that these systems had these 21 repercussions and, you know, even though personally we 22 may feel, on that project, I actually did the best to 23 make it successful, not a failure, you still feel that. 24 You still feel that. We just feel -- we apologise for 25 the consequences of what happened and obviously regret 116 1 it. 2 MR BEER: Thank you. 3 Sir, that concludes the business for today. 4 SIR WYN WILLIAMS: All right. See you all at 10.00 tomorrow 5 morning. 6 MR BEER: Thank you. It's Jonathan Evans and Mr Blake will 7 be taking Mr Evans. 8 SIR WYN WILLIAMS: Is it just Mr Evans? 9 MR BEER: It is, yes. 10 (2.40 pm) 11 (The Inquiry adjourned until 10.00 am on Friday, 12 4 November 2022) 13 MR JEREMY FOLKES (continued) .........................1 14 Questioned by MR BEER ............................1 15 Questioned by MR JACOBS .........................22 16 ANDREW SIMPKINS (sworn) .............................42 17 Questioned by MR BEER ...........................42 18 Questioned by MR STEIN .........................111 19 20 21 22 23 24 25 117