The System That Could Not Be Wrong: A Catastrophic Design Flaw at the Centre of the Post Office's Operating Model

Foreword

Much has been written about the Post Office scandal. The prosecutions, the suffering, the cover-up, the slow grind towards accountability. No reasonable person could read it without feeling the weight of what was done to innocent people, the injustice and frustration. But I am sure there is an operating model angle nobody has taken.

The Post Office built an operating model with a single, catastrophic design flaw at its centre. It outsourced its core transaction processing to Fujitsu, then structured its entire accountability, audit, and prosecution capability around one assumption: that Fujitsu's system was infallible. When Horizon produced a shortfall, the operating model had no mechanism to question it. Only to act on it.

And now, having finally acknowledged that the system was wrong, the Post Office has spent five years and over £1.1 billion attempting to replace it.¹ The in-house replacement was cancelled. Fujitsu has just been paid another £41 million to keep Horizon running until March 2027.²

My speculation — and I want to be clear it is speculation, not legal opinion — is that the organisation cannot escape the operating model it knows destroyed innocent lives, because it has never designed a replacement for it.

This is not a technology view, and it is not a legal view. It is my speculation on the state of the operating model, and it is the angle I intend to explore.

The Scale of the Failure

The numbers reveal the consequences of an operating model built on an unchallenged assumption.

The Human Cost: 900+ wrongful prosecutions

Between 1999 and 2015, more than 900 subpostmasters were prosecuted. Around 700 of those prosecutions were carried out by the Post Office itself using its own private prosecution powers, without police involvement or Crown Prosecution Service oversight.³ Hundreds went to prison. Many were bankrupted. The scandal has been linked to at least thirteen suicides.

The Inquiry Verdict: "Profoundly disturbing"

The Post Office Horizon IT Inquiry's Part 1 report, published in July 2025, found that at least 10,000 people were impacted to different degrees. Fifty-nine victims had contemplated suicide. The inquiry chair, Sir Wyn Williams, described the picture that emerged as "profoundly disturbing."⁴

The Replacement Bill: £1.1 billion and counting

The project to replace Horizon — the New Branch IT programme — launched in 2022 with a £180 million budget, was rated "unachievable" by the Infrastructure and Projects Authority and subsequently cancelled.¹ The taxpayer bill reached £1.1 billion before the plug was pulled. Fujitsu, the supplier whose system caused the crisis, was paid a further £41 million in April 2026 to extend the contract for another year.²

This is not a technology problem. This is not a legal problem. This is an operating model that was built wrong, prosecuted innocent people for fifteen years, and has since proved impossible to replace.

Three Operating Model Failures

The OMDDMS® diagnosis reveals three fundamental operating model failures that turned a public institution into an engine of injustice.

1. Accountability Model: No mechanism to challenge the data

An operating model defines how an organisation delivers its purpose. In the Post Office's case, a central element was the relationship between branch accounting and institutional accountability. The question it needed to answer was: when a shortfall appears, what happens?

The answer the Post Office built into its operating model was this: the shortfall is real. The subpostmaster is responsible. Act accordingly. There was no counter-mechanism. No independent review capability sitting between Fujitsu's output and the Post Office's prosecution function.⁵

2. Governance Model: Victim, investigator, and prosecutor were the same organisation

The Post Office identified the shortfall. The Post Office investigated the shortfall. The Post Office prosecuted the subpostmaster. At no point in that chain was there a structural requirement to question whether the source data might be wrong.

The inquiry heard that confirmation bias led the Post Office to prosecute subpostmasters without adequate investigation.⁵ Subpostmasters who called the helpline to report problems were told they were the only ones experiencing difficulties — even when call handlers knew that was not true. The operating model had no independent audit function capable of identifying a pattern across branches.

3. Supplier Model: Outsourced capability without retained oversight

The Post Office outsourced its core transaction processing to Fujitsu in 1999. Over twenty-five years, it lost the internal capability to understand, challenge, or replace what Fujitsu had built. When the High Court ruled in 2019 that Horizon contained bugs, errors, and defects, the Post Office discovered it could not escape the system it could no longer understand.³

The inquiry revealed that Fujitsu was aware Horizon contained bugs as early as 1999.⁵ That information was not disclosed to subpostmasters or to courts during criminal proceedings. A senior Fujitsu engineer who served as an expert witness in multiple prosecution cases was aware of bugs and defects in the system but had not disclosed that information in his evidence.⁵

The Replacement That Cannot Be Delivered

In 2019, the High Court confirmed what subpostmasters had been saying for twenty years: Horizon was flawed. The Post Office had no choice but to replace it. What followed was a second operating model failure, compounding the first.

The NBIT Disaster: £180 million became £1.1 billion

The New Branch IT project was announced in May 2022 with a budget of £180 million and a completion date of 2025.⁴ By 2024, the Infrastructure and Projects Authority had rated it as "unachievable." Independent reviewers described the project as "not currently in a healthy place," with low morale, mutual distrust between the project team and Post Office leadership, and a negative culture. The budget had reached £1.1 billion. The project was cancelled.

The Root Cause: Wrong question, wrong sequence

Post Office chairman Nigel Railton told the public inquiry that NBIT was "set up to fail" from the outset. Two fundamental mistakes: the objective was framed as "getting off Horizon" rather than building a system for the future, and the decision to build it in-house.⁸

That sequencing error — technology first, operating model second — is one of the most common and most costly mistakes I see in transformation programmes. The question being asked was wrong before a single line of code was written.

The Current Position: Fujitsu is still being paid

Horizon will not be fully switched off until at least 2030 — and possibly not until 2033.⁷ In the meantime, the Post Office agreed in April 2026 to pay Fujitsu a further £41 million to extend the Horizon contract until March 2027.²

The Metropolitan Police's Operation Olympos investigation, with eight suspects and 53 persons of interest, is considering charges including corporate manslaughter.⁶ No executive at the Post Office or Fujitsu has yet been held to account.

Why This Matters for Boards

The Post Office scandal is extreme in its human consequences. It is not extreme in its operating model characteristics. The pattern is one I have seen across financial services, government, defence, and utilities.

If the Post Office had asked these questions in 1999, it would not have spent fifteen years prosecuting innocent people. If it asks them now, it might avoid a third failure of transformation.

Conclusion

The legal proceedings are live. The Part 2 inquiry report, which will address systemic failures and accountability, has not yet been published. What follows is speculation, not fact. It is an operating model practitioner's reading of publicly available evidence.

My speculation is that the Post Office has never completed the most fundamental step of its recovery: designing the operating model it needs to become.

The NBIT project was framed as a technology replacement, not an operating model redesign. Its successor tender is framed the same way. The question being asked is still "what system replaces Horizon?" rather than "what operating model does the Post Office need, and what role should technology play in it?"

Until that question is asked and answered in the right order, the Post Office will remain an organisation that has replaced its technology without replacing its foundations. When the Part 2 report is published, I intend to return to this subject.