Dear Post Office Limited,

In her letter of 24th June to the BEIS Select Committee ex-POL CEO Paula
Vennells refers to remedial actions taken by POL in response to the 2011 Ernst & Young management letter which had exposed weaknesses in the control and security procedures around Horizon. She maintains ‘improvements to controls’ and ‘focused management action’ resulted in an ‘ultimately positive outcome’ as E&Y audits of 2012 and 2013 ‘made less significant recommendations for further improvements’ (Link, p12, para 40).

https://committees.parliament.uk/publica...

In the Horizon Issues Judgement, however, Judge Fraser is clear that Privileged User Access logs were not adequately maintained until 2015 which he considers ‘...a serious deficiency both in the required level of controls in Horizon, in the recording of what privileged users were actually doing...and also a corresponding absence of recording and auditing those activities’
(Horizon Issues Judgement p218, para 692-694, p118, para 393-394).

https://www.judiciary.uk/wp-content/uplo...

i) Please can POL release relevant passages of the E&Y SAS70 audit reports and/or management letters of 2012, 2013 and 2014 which address ongoing weaknesses in the control and security procedures around Horizon.

ii) Please can you confirm if these audits reports and/or management letters were considered by POL’s Audit, Risk and Compliance Committee and if so please supply minutes of the relevant meetings identifying all attendees.

Yours faithfully,

Eleanor Shaikh