Following completion of Phase 6 of the public Inquiry into the Post Office scandal, the Institute of Directors (IoD) recently published a Policy Paper "The Post Office Scandal – A failure of governance".  It describes a board which on the surface appeared to be operating normally, but one where the mindset "often fell short in terms of independence, curiosity, commitment to ethical standards and cognisance of the public interest".

In its paper, the IoD has set out a number of lessons for directors to consider, which are summarised below, together with some of our thoughts and suggestions for action.

Don’t ignore red flags

In the two decades following installation of the Horizon system in 1999, the Post Office was confronted with numerous red flags concerning the viability of the system and the safety of its prosecution strategy. Thousands of sub-postmasters raised concerns about the system they were using. The number of prosecutions increased significantly, rising from an average 3.5 per year to 26 per year between 1999 to 2004. This fact alone, coupled with what must have been spiralling legal costs of prosecutions, should have made it obvious that something was wrong.

Various reports flagged potential miscarriages of justice and flaws in the Horizon system.  At least some of the red flags were visible at board level, but the board found it too easy to ignore failings and had little interest or curiosity in understanding the situation of the sub-postmasters who were contesting their convictions or civil claims.

Suggested actions:

  • Curiosity should be encouraged amongst directors, making them more likely to pick up on internal and external signals that might indicate something is wrong, or that something which might appear low risk is escalating into something more. 
  • When issues arise directors should be persistent in understanding their cause and consequences and be ready to take remedial action promptly.

Face up to uncomfortable truths

The Horizon system represented a huge investment and was crucial to the commercial success of the organisation. Any criticism was seen as damaging the integrity of the organisation's image, so the system was fiercely defended, and those who challenged it were accused of "jumping on the Horizon bandwagon" Directors joining the Post Office board were rapidly absorbed into the false narrative of the organisation – that SPMs were not to be trusted, and the Horizon system was fit for purpose.

The judge in the 2019 group litigation commented that there was "simple institutional obstinacy or refusal to consider any possible alternatives to their view of Horizon, which was maintained regardless of the weight of factual evidence to the contrary."

Directors seem to have been comfortable in not pursuing Horizon issues too vigorously, as the feeling was that the integrity of the Horizon system "only affected a small number of cases" and therefore the prosecutions were unimportant in the scheme of things. There appears to have been a complete lack of curiosity as regards what was really going on. People “didn’t see things, didn’t hear things”.

Suggested actions:

  • Directors should be consistent and persistent in challenging decisions and be satisfied their decision-making is based on robust evidence.
  • Where there are the attitudes or assumptions that are taken for granted within the organisation, there should be a willingness to discuss them or test them with fresh evidence.

Break out of the boardroom bubble

The Post Office board was almost entirely guided by the perspectives of senior executives as to the Horizon system's integrity and failed to adequately test these perspectives by engaging directly with other key stakeholders, such as SPMs, MPs, Fujitsu or external experts. The influence of these executives and the continuity of the assurances over time made it difficult for new board members to challenge the established belief in Horizon’s reliability. In other words, they fell into the groupthink trap. The board minutes indicate that a limited amount of time at board meetings was devoted to the consideration and evaluation of Horizon issues. 

Suggested actions:

  • Make sure the board listens to a diversity of voices, and encourage open communication with stakeholders, including employees, customers, and regulators. 
  • The chair should facilitate robust discussion and debate at board meetings and allow sufficient time for deliberation.

Ensure proper governance

A fundamental cause of the Post Office scandal was the mismanagement of the IT outsourcing relationship with Fujitsu. Post Office relied too heavily on Fujitsu’s assurances regarding the viability of the Horizon system. Fujitsu’s narrative became entrenched in the organisation because it was too difficult to challenge or uproot. Unfortunately, as the judge in the group litigation found, Fujitsu were "less than forthcoming in identifying problems" and as one witness told the Inquiry they "would basically tell the Post Office what they wanted to hear."

Directors were somewhat lax about maintaining oversight and control of delegated work. Non-executives were happy to leave matters with the executive and generally the board was happy to leave matters with sub committees to whom they delegated authority, particularly in aspects of the business where they did not have expertise such as conduct of the group litigation. 

Suggested actions:

  • The board must keep control of outsourced projects, particularly IT projects. The more critical the contract, the more important it is to keep progress and performance under close scrutiny.
  • Where work is delegated to specific committees the scope of decision-making authority should be clear and the board must retain effective oversight.

Directorship is about more than one thing

Ultimately, directors are ultimately responsible for all areas of the business, but many of the directors recruited onto the Post Office board saw their primary role as navigating "complex and fraught" business challenges and advising management on how to transform the commercial viability of the organisation. Their focus was on future strategy rather than dealing with the problems of the present and the past, and they appeared to have considered the problems with Horizon as being of comparatively little importance and low risk.

There appears to have been "remarkable confusion" at senior level about who was responsible for what.  In particular, the legal team seemed to operate outside the governance structure, and many of the directors did not appreciate that the Post Office itself was the prosecuting authority.    

Suggested actions:

  • Directorship should involve a balance of activities, including reviewing past decisions and holding management to account for past performance.
  • Clarify team responsibilities and reporting obligations within a group structure.
  • Make sure that no team within the business operates in a silo.

Demand full access to all relevant information

The withholding of crucial reports and information from board oversight was a key governance failure. This included advice from barrister Simon Clarke in 2013, which revealed major issues with the Post Office's prosecution conduct, including that the key prosecution witness, had been discredited. Further, a review by Jonathan Swift KC in 2015 highlighted significant issues with Horizon including the ability to remotely alter branch accounts. This review was commissioned by incoming Chair, Tim Parker, but was not disclosed by him to the board due to a misunderstanding of legal privilege. 

Simply having the information is not always enough – the board frequently received summaries of reports rather than the full documents, and even when full reports were available to the board, they were rarely requested or read, so that crucial information was missed which could have provided a better understanding of critical matters.

Suggested actions:

  • Think carefully about the sufficiency and sources of information provided to the board.   Encourage directors to request and scrutinise data.  
  • Minimise reliance on board papers – better for appropriate individuals to present their topics allowing directors opportunity to interact and question. 
  • Make sure the concept of legal privilege is understood.

Advisers advise, directors decide

Board members demonstrated an excessive deference to the views of internal and external legal advisers, and there is little evidence that directors directly challenged legal advice even when they felt uncomfortable with it. Although legal advice, and that of other types of consultants and advisers, may be a crucial input into board decision-making, it should not be accepted without question.

Suggested actions:

  • Directors should understand how the duty to exercise independent judgment interacts with obtaining professional advice.
  • Ensure that advisers are used appropriately, that the ambit of the advice is clear, and any recommendations or reporting is tested and challenged.

Proper director training

Several Post Office directors joined the board without any previous experience or training as a director. Others had a significant track record as directors and executives but nonetheless demonstrated a weak understanding of what a director is actually required do. There was little evidence that directors were given instruction on their statutory duties to the company.

Suggested actions:

  • Make sure all directors undertake specific director training to ensure a common baseline of knowledge and have a thorough understanding of their role and responsibilities, both collectively and individually.

Due diligence and induction

Many Post Office directors, including incoming chairs, started their roles with an incomplete understanding of the historic liabilities or ongoing issues facing the organisation. One NED said that on his appointment in 2016 he was "completely unaware of the history and what had recently happened", indicating a startling lack of interest in the business he was joining.  There was an absence of corporate memory, with each director seemingly starting from a blank sheet. Unresolved historical issues only became visible to board members when it was too late. By 2016, none of the NEDs had been in post at the time when the original Horizon system was in operation and the private prosecutions were ongoing. The Senior NED appointed at this time described feeling as though "they had been left holding the baby and we had to decide what to do with it based on our limited background knowledge."

Suggested actions:

  • Individual directors must undertake rigorous due diligence of organisations before they accept board roles.
  • The induction process needs to be systematic and expose directors to the history and culture of the organisation.

Use board evaluation as a key governance tool

Robust board evaluation processes might have offered the Post Office board an opportunity to reflect on its functioning. In particular, an externally facilitated review would have provided an independent perspective on director behaviour. This might have helped counter excessive complacency and groupthink. However, this opportunity does not appear to have been adequately grasped.

Suggested actions:

  • Follow the recommendation of the UK Corporate Governance Code to conduct an internal review every year, with an external independent review every three years.

IT literacy and other skills

The Post Office failed to successfully manage a critical IT project, with catastrophic consequences for individuals and the organisation. For most of the period, there was no one on the board with any significant IT experience, who understood the challenges of rolling out a complex new system and the level of support and training required. Consequently, there was no one capable of asking probing questions as to the system's capability or the adequacy, particularly when faced with technical reports.  Instead, they relied heavily on the competence of their IT provider, Fujitsu. Similarly, when it came to managing the group litigation, they relied heavily on internal and external legal advisers.

Suggested actions:

  • AI transition and management of cybersecurity threats will become increasingly important, so a high level of tech literacy should be seen as a prerequisite for directorship.
  • Complex issues may require a mix of skills, so consider appointing directors with expertise in areas such as finance, operations, and law.
  • Bring different perspectives into the mix by appointing people with different backgrounds and personal strengths.  Don't shy away from appointing directors who will challenge the status quo.

Maintain a moral compass

In the midst of the Post Office Horizon scandal, executives and board members lost sight of basic principles of ethical business behaviour. Many persuaded themselves that they were doing the right thing when that was palpably not the case. They became absorbed into a corporate culture which propagated a distorted vision of the best interests of the organisation.

Suggested actions:

  • Poor behaviour and toxic corporate culture must be scrutinised and challenged.
  • All directors and boards should align themselves with an explicit code of conduct, such as the IoD Code of Conduct for Directors (a revised version was published by the IoD in October).

Conclusion - a passive board in a dysfunctional organisation

Although recognising that there will be individual culpability, the IoD concludes that "the roots of the scandal are not to be found in the lines of code in the Horizon software, but in the performance of the board, management and ownership function of the Post Office, who should have delivered better supervision and oversight", laying significant blame for the Post Office scandal on corporate governance failings. Not as in previous governance scandals, through hubris, personal greed or large-scale fraud. But simply because the board (described mainly as "well-meaning people who had convinced themselves that they were doing the right thing for the organisation") fell short in terms of knowledge, skills and mindset.

The IoD believe that what is needed are better directors with appropriate knowledge, skills and attitudes, which will require a shift towards a professional framework including training, certification and ethical standards. Although there is no guarantee this will eliminate future scandals, it would certainly represent a significant step towards better corporate governance. 

If you would like to discuss the corporate governance issues arising out of the Post Office scandal, or how your organisation might better navigate these challenges, please contact, Sharon Ayres