It is far more complicated than that - the system would have been designed by system analysts, possibly working from a brief generated by one or more business analysts. It was then written by computer programmers and then tested by a (separate) testing team. Specialist code, such as comms or security software (as in a distributed system such as this) is often the product of a separate development team, as commercial developers rarely do systems or comms software.
Once the application has been passed by the software house team it should be tested by a separate team at the client, who in larger systems also use computer auditors to validate the results generated by the system. Even after that you'd normally have a live test pilot run with (hopefully) a manual audit to confirm results.
At all stages bugs are noted and passed back to the development team to be corrected. But the decisions sbout what gets fixed is ultimately down to nanagement, not developers. So just who do you prosecute?
More of concern was a tiny clip supposedly set at Fujitsu in Bracknell, in their "operations centre", where an operator seems to have been telling someone that they could modify transactions to correct computer errors! In any secure system this should be simply impossible to do. If the comms is corrupting records then the software needs to be amended in such a way that this becomes either impossible or at worst exceptionally rare. The error log which was produced later in the program I watched would seemto imply that comms errors were occurring far too frequentently. IMHO that is where the real IT issue lies. Who permitted these operations centre staff to make such changes? What was done to ensure that these errors were trapped and corrected? So not quite a development or testing issue - more a management issue, surely?
As to a "foreign company", hardly. Fukitsu was originally called ICL (International Computers Ltd) and were very British. Their software is allegedly still developed here, but they hardly fill me with confidence given how much of a bunch of jobsworths they at one time were (and still are according to.one acquaintance who is in IT management). My missus worked for them for a while; I worked with them on several projects in the past - which tends to bias us both somewhat
.
Systems analysts do not specify the overarching system requirements.
Neither do business analysts.
Both are functionaries, implementing the requrements from the boss, who should defer to whatever legislative structure applies.
Something like the question of whether the postmaster's figures could be changed without their knowledge, is higher that either of those operatives can decide.
This abortion was something done to the users. It wasn't transparent, and it wasn't consentual.
There are
multiple standards for systems and software from ISO and others, which say you must to justify every decision you take so others can go back and see why you did things the way you did, and how the criterion is satisfied, inter alia. ISO 9000/1, 25010 and others I can't remember. At every level, it's the company's responsibility to make sure such standards are complied with. Many "programmers" and "project leaders" haven't a clue how to do it. It was reported that there were very few capable, in place.
In comparison with Grenfell; in that case, the appropriate Building Regulations should have been consulted, and the BR should have protected the occupants, and the builders should have complied with the BR.
As far as I've heard there wasn't an equivalent in the PO, so the PO were able to do whatever the hell they liked, and then prosecute, ffs.
The PO were responsible for the suitability of the software and systems they used.
Systems auditors should have checked the system was doing what the bosses wanted, not what the business analysts or programmers wanted.
That's the regulatory framework you have in a bank - this is similar enough, which anyone should have seen.
WHO gave the PO that authority without checking they were competent and accountable?
Maybe there is no such legislative reequirement, but to not see, and/or to take antagonising action when questions arose, was in my view criminal and prisonworthy.