Apologies Are Cheap When No One Can Challenge the Error

Between 1999 and 2015 the British Post Office prosecuted more than seven hundred of its own subpostmasters for theft and false accounting.1 The evidence was the branch accounting system. The system was wrong, and the institution knew it was wrong: internal correspondence discussed the bugs while the prosecutions kept going. People went bankrupt, served prison sentences, and died before their names were cleared. When the apology finally came it was comprehensive, the compensation schemes are still being renegotiated, and the inquiry has spent years establishing what the institution knew and when.

The apology was flawless. For most of those years the institution was identical before and after it.

Horizon usually gets told as a story about accounting software. It’s better told as an unusually clear case of a question every institution faces. The only thing that ever mattered was what the institution’s errors could do: who was allowed to challenge them, at what cost, with what consequence. For fifteen years the answer was nobody, at ruinous cost, with none.2

What the shortfall did

The subpostmasters with phantom shortfalls all did the same thing. They reported the shortfall to the Post Office, which was the only place to report it, and the Post Office received each report as a confession. The shortfall became the subpostmaster’s debt, then the subpostmaster’s prosecution, and the Horizon ledger was, in law, the truth about what had happened in the branch.

One shortfall goes wrong at every step through the institution. Nobody outside the Post Office had standing to report the mismatch to anyone who wasn’t implicated in it, so anyone reporting it could only plead. The Post Office filed every shortfall as a one-off, so no amount of variance ever added up to a pattern that indicted the software. The subpostmaster paid during the entire review, in bankruptcy, prison, and in a few cases a name cleared posthumously, and the payment was recorded as the matter being resolved. No one could force revision of the ledger itself, because the ledger was legally authoritative.

When correction finally came, in 2024, it came by statute, in one act quashing convictions in bulk, because nothing inside the institution could spread it. The compensation schemes that followed have each been reopened because the one before failed the people it covered. The Post Office defined what counted as evidence against its own system, so the examined graded the exam. And the inquiry’s record is the only reason the error can’t happen again unnoticed.

Those failures have names: standing, learning rate, burden, correction authority, scale, consequence, measurer and memory. An arrangement hasn’t finished the job until it can answer all of them. It has to say who may report, how fast variance counts, who pays during review and who can force revision. It also has to say how revision spreads, what has to change, who sets the test, and where the record lives. Most institutions can answer two or three. Speed, accuracy and who-pays-for-the-interval are separate variables, and the three clocks, harm in weeks, review in years, memory in decades, run at different rates.

Several are about error struggling to become known: who may report it, how fast variance counts, who sets the test, where the record lives. In the Post Office’s case the information had already arrived, and the prosecutions weren’t waiting on it. An arrangement can satisfy most of the list and still run on an interest in not acting. That’s why consequence is more than one requirement on the list. An arrangement is corrigible when an error can have consequences without permission from the institution implicated in it.

What I got wrong the first time

I’ve now written that mechanism twice, and the first attempt was wrong in ways the Post Office exposes. The first version treated corrigibility as the central political virtue. It is one pole of a design problem. An institution that cannot be stopped is one failure, and an institution that can only be stopped is the other. The Post Office needed to be able to act on its ledger. It also needed to be stoppable when the ledger was wrong, and getting the design right means keeping both.

The first version had no answer for who pays during review or where the record of the trial lives. The subpostmasters paid, and the inquiry is the record. Without those two, everything else can be satisfied while the harm continues. And the first version treated measurement as technical work. Deciding what counts as evidence decided who counted as a thief. The measurer is a power position, and needs its own correction channel.

The fix has to face the same challenge

Corrigibility, defined this way, can fail from either side. An error that needs the implicated institution’s permission to matter is a suggestion box with stationery, which is what the Post Office’s internal reporting was. A correction mechanism that can’t itself be contested is a new sovereign with better manners. The position lives in the triangle between them:

Diagram

A phantom shortfall, the fix, and who checks the fix

View source

%% title: A phantom shortfall, the fix, and who checks the fix
%% caption: A phantom Horizon shortfall should be able to change the ledger without the Post Office’s permission, and the inquiry and compensation schemes that carry the fix must face the same challenge. Both edges are load-bearing; drop either and the third corner collapses.
flowchart TD
  classDef actor stroke-width:1.6px;
  classDef gate stroke-width:1.6px;
  classDef loop stroke-width:2.4px,font-weight:bold;

  E[Error:<br/>a phantom Horizon shortfall]:::actor
  C[Ledger revised without<br/>the Post Office's<br/>permission]:::gate
  M[Inquiry and compensation<br/>schemes, open to<br/>the same challenge]:::loop
  E -- "subpostmaster reports to<br/>someone not implicated" --> C
  C -- "on the record,<br/>reopenable, sunset-bound" --> M
  M -- "a scheme that fails<br/>is a new error to report" --> E

The mechanism applies to itself. Its corrections are contestable, and so are the corrections of its corrections, and so on down. The regress is accepted because the alternative is an exempt layer, one nobody can challenge, which is what the Horizon ledger was in law.3 The apparatus that corrects institutions carries its own sunset for the same reason.

No verdict closes the file

The settlement position is non-finality, in which a commitment holds until it fails, the mechanism that tests it stays contestable, and no verdict closes the file. Non-finality differs from indecision, because institutions act and acting is the point. It removes only the claim of permanence. The compensation schemes are the object lesson: each has been reopened, widened and renegotiated in turn. A settlement that cannot be reopened is an exempt layer with a signature. A settlement that can be reopened, and that carries material non-abandonment for the people the verdict failed, is a decision an institution can stand behind and repair.4

Non-finality doesn’t reach the person inside several institutions at once. The employer, the clinic and the insurer can each be corrigible on their own terms while the person between them pays for the gap. What Depends on You Is Not Yours carries that collision, and non-finality leaves it standing. Non-finality doesn’t make institutions wiser or end politics either. It only makes domination harder to stabilize. And every requirement can be met on paper and hollowed out in practice, as each of these has been somewhere, in medicine, credit scoring, immigration enforcement, criminal evidence, platform labor. The requirements are the test, and the cases are what the test is for.

An institution is trustworthy to the degree that being wrong about you is expensive for it. For fifteen years, being wrong about seven hundred subpostmasters cost the Post Office nothing at all.