The Nimrod Review - Official Documents

Chapter 11 – Nimrod Safety Case: Analysis and Criticisms
be considered completed when hazards remained “Unclassified”? How could the aircraft be considered ALARP
when hazards remained “Open” and “Unclassified”? Instead, he appears to have been content simply to sit,
essentially passively, throughout the Sixth PSWG meeting. He should not have allowed the Nimrod IPTL to
accept the completion of BAE Systems’ work at the meeting without taking proper steps to satisfy himself that
this was, in fact, justified and appropriate.
(7) QinetiQ subsequently supported the ‘sign off’ of BAE Systems’ NSC reports in
circumstances where it was manifestly inappropriate to do so: (a) without even
having read any of them and (b) in the absence of an ISA audit report in breach of
Def Stan 00-56.
11.301 In my judgment, it is surprising and disturbing that QinetiQ was prepared to ‘sign-off’ on the BLSC Reports: (a)
without having read or checked them; and (b) in the absence of an ISA Report in breach of Def-Stan 00-56. This
was a fundamental abrogation of QinetiQ’s duty as an ‘independent advisor’.
11.302 Following the Customer Acceptance Conference, on 5 November 2004, Martyn Mahy produced a situation
report on the BLSC for the QinetiQ TRM regarding Witness O [QinetiQ]’s attendance at the ‘Customer Acceptance
Conference’ on 31 August and 1 September 2004. That situation report stated: “QQ were happy with the SC
presentation and the examination of the CASSANDRA database and supported the sign-off of the Baseline
Safety Case.” The QinetiQ TRM took place on 19 November 2004. The minutes record in terms that Martyn
Mahy reported that “QQ were now ready to sign off the BLSC”. There is a clear statement recorded in the
minutes: “QQ (Mr Mahy) reported that QQ were now ready to sign off the BLSC...”. It does not appear, however,
that anyone at QinetiQ had actually read any of the Nimrod BLSC Reports (see Chapter 10B).
Inappropriate for QinetiQ to have supported ‘sign-off’ of NSC
11.303 In my judgment, it was manifestly inappropriate for QinetiQ to have ‘signed-off’ or agreed to ‘support the
sign-off’ of the NSC task and BLSC Reports in these circumstances, for the following reasons. First, it was well
known and understood by everyone concerned, in particular the key participants at QinetiQ, that JSP553 and
Def-Stan 00-56 mandated that an independent review (ISA) must be carried of the NSC before it could be
finally ‘signed-off’ as completed. Second, QinetiQ had had early involvement in the process “to ensure that the
[Nimrod] Safety Case is independently assessed without any surprises”. 139 Third, QinetiQ had not themselves
prepared any ISA report verifying the NSC work as required by JSP553 Def-Stan 00-56, and were not aware of
any third party having prepared such a report or being asked to do so. Fourth, QinetiQ had never even seen,
let alone read, any of the deliverable reports comprising BAE Systems’ work on the NSC, in particular the BLSC
Reports themselves.
Previous Task Manager
11.304 Witness L [QinetiQ] said in evidence to the Review that it was “bizarre” for QinetiQ to have signed-off the NSC
Reports, not least because QinetiQ had not done or seen an ISA review, nor even read the Reports. I agree. It is
unfortunate that Witness L [QinetiQ] left QinetiQ in the summer of 2003. He was impressive and rigorous. I have
no doubt that had Witness L [QinetiQ] stayed at QinetiQ for the remainder of Phase 2, he would have done two
things. First, he would have pointed out to the Nimrod IPT that it was required to appoint an ISA under Def-Stan
00-56 because Class A and B risks were involved. Second, he would not have agreed to ‘sign-off’ the NSC as
Martyn Mahy did and would have firmly pointed out to his superiors, including Witness N [QinetiQ], that there
had been a non-compliance with Def-Stan 00-56 and that, therefore, QinetiQ should not sign-off and if it did,
it would be doing so ‘at risk’.
139 Frank Walsh’s e-mail leading to 17 June 2004 meeting (see Chapter 10B).
329