"Turning to the 2010-2011 Ernst & Young audit. The EY audit of the control environment at Fujitsu for the financial year ended 27 March 2011 included the reporting of weaknesses in the IT governance and control framework, particularly in relation to Fujitsu and Horizon and made recommendations for improvements. EY's detailed observations included on page 33 of the management letter that - I quote - that are "inappropriate system principles privileges assigned to the APPSUP role". The risk associated with this weakness was, I quote, "unrestricted access to privileged IT functions increases the risk of inappropriate/unauthorised access which may lead to the processing of unauthorised or erroneous transactions." Ms Vennels was briefed on this audit report by means of a document which appears to have been prepared by Fujitsu in April 2011, with input from Ms Sewell. Ms. Vennels has no reason to think she did not see this briefing, and so this very issue was considered at the Post Office Board meeting on 29 May 2011, at which the Board discussed the steps being taken to implement EY's recommendations. What Ms Vennells did not know though was the significance of the finding which EY had made. She did not know this because she was not told that the existence of the APPSUP role created this risk to the integrity of the accounting data held in the system. Ms Vennells gave oral evidence that it is unlikely that she would have understood at the time, without advice from an IT expert, that EY's comments about the APPSUP role showed that Fujitsu could make changes to branch accounts without the authorisation of sub-postmasters. So the inquiry can be confident that Ms Venels is right that she was not told that the APPSUP role could potentially be used to make unauthorised changes to branch accounts. First, there is no evidence that she was told, and second, the reason why she was not told is obvious from Mr Young's evidence. He knew that as with most IT systems, it was to gain access to the system remotely, and that Fujitsu could make changes to branch accounts with sub-postmaster's consent. However, he, head of IT, had, in his words, "no belief, understanding, or even inkling that Fujitsu made changes to branch accounts without the authorisation of sub-postmasters." Ms Vennells was not told that there was a risk that Fujitsu could use its APSUP privileges to tamper with branch data, because Mr Young did not himself appreciate that this was a real risk. In the meantime, in a report to the Royal Mail Group R in December 2011, Chris Day, the CFO, together with Lesley Sewell and Rod Ismay stated and I quote "as a result of the process and controls in place POL is fully confident in the Horizon computer system operating in its branches. This accounting system and the processes around it enable our branches to maintain accurate and reliable accounts." The text of this report, sir, was run past Mr Young and Ms Crichton for comment. The report also stated, with regard to prosecutions, that, I quote, "POL remains satisfied that this money was missing due to theft in the branch. Due to the controls set out above, POL does not believe the account balances against which the audits were conducted were corrupt." This is the very same message that Ms Venels was receiving from finance, from IT and from legal."