I am absolutely flabbergasted. At least for American public companies, SOX compliance requirements make it impossible for something like this to ever happen wit

I am absolutely flabbergasted. At least for American public companies, SOX compliance requirements make it impossible for something like this to ever happen without an explicit authorization in place. The rule is simple: every destructive action (think mutable) needs to have one requester and one approver. As long as it is logged in some system, you’re golden. This is somewhat enforced through regular publicly disclosed audits. I suppose that’s what Ernst and Young did when they noted in an audit that Fujitsu has unrestricted access to modify accounts without the postmasters knowledge, and this poses risk. What strikes me as bizarre is that no regulatory body took any action on that report. Maybe the report was private, I’m not sure - I don’t know how things work in the UK. In any case, this really takes your trust away from public institutions. You’re left to wonder, if this was possible, what else might still be possible?