POL00143058
POL00143058
Message
From: Andy J Jones [IMCEAEX-
_O=MMS_OU=EXCHANGE+20ADMINISTRATIVE+20GROUP+20+28FYDIBOHF23SPDLT+29_CN=RECIPIENTS_CN=ANDY+2EJ+2EJON
96C2-42E2-87C6-54385FBD94E5 @C72A47.ingest.local]
on behalf of Andy J Jones <IMCEAEX-
_O=MMS_OU=EXCHANGE+20ADMINISTRATIVE+20GROUP+20+28FYDIBOHF23SPDLT+29_CN=RECIPIENTS_CN=ANDY+2EJ+2EJON
96C2-42E2-87C6-54385FBD94E5 @C72A47.ingest.local> [IMCEAEX-
__O=MMS_OU=EXCHANGE+20ADMINISTRATIVE+20GROUP+20+28FYDIBOHF23SPDLT+29_CN=RECIPIENTS_CN=ANDY+2EJ+2EJON
96C2-42E2-87C6-54385FBD94E5 @C72A47. ingest. local]
Sent: 17/05/2012 14:09:03
To: Sarah Hall I
ce: Lesley J Sewe 5 Susan Crichton: ; Richard J Barber
; Neil Lecky-Thompson
Subject: RE: E&Y management response and briefing paper
Attachments:simplified audit briefing document v1.doc; EY 2011-12 draft response v10.doc
I have updated the management response document and produced a ‘layman’ version which for each observation area
has a definition, observation from last year, observation from this year and what we have done to improve’. This was
created with Richard last night and again during his journey to Chesterfield this morning, so Richard has not had a chance
to see the final versions, so may wish to amend (as the majority owner of actions). It should give Chris the background he
was looking for. It's a delicate balance between saying too much, too little and talking techie, so hopefully we have struck
the right balance. It does give a small story for each area and could be his crib. Richard being at the 9.30 meeting will help
tease those specific points out I think.
Regards,
Andy
Andy Jones
IT & Change
Quality & Standards Manager
© 2” Floor. Bunhill Row Wii 48 Old Street. London EC1V 9HQ
6
G
6
o
Building a Post Office® we can all be proud of
Confidential Information:
This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any
unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient please contact me by reply
email and destroy all copies of the original message.
From: Sarah Hall
Sent: 17 May 2012 11:39
To: Andy J Jones; Nigel Tuppen
POL00143058
POL00143058
Cc: Lesley J Sewell; Susan Crichton; Richard J Barber; Neil Lecky-Thompson
Subject: RE: E&Y management response and briefing paper
Hi,
I've lost track of all the email changes now. Please could you send me the latest version of the cover paper, the lay man's
brief to explain the individual items and the management responses so I can review (as the lay man in mix!) before we talk
to Chris (another lay man!).
Thanks,
Sarah
Sarah Hall
Financial Controller
Post Office Limi
148 Old Stree!
Please note that my office telephone number has changed
From: Andy J Jones
Sent: 17 May 2012 11:30
To: Nigel Tuppen
Cc: Lesley J Sewell; Susan Crichton; Sarah Hall; Richard J Barber; Neil Lecky-Thompson
Subject: RE: ExY management response and briefing paper
Thanks Nigel. I may reword ever so slightly as there are a few to many ‘actions’ in the sentence, but it wont change the
sentiment.
Regards,
Andy
Andy Jones
IT & Change
Quality & Standards Manager
Building a Post Office® we can all be proud of
Confidential Information:
This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any
POL00143058
POL00143058
unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient please contact me by reply
email and destroy all copies of the original message.
From: Nigel Tuppen
Sent: 17 May 2012 10:38
To: Andy J Jones
Cc: Lesley J Sewell; Susan Crichton; Sarah Hall; Richard ] Barber; Neil Lecky-Thompson
Subject: RE: ExY management response and briefing paper
Andy,
Based on your feedback propose following-want to keep the summary as “punchy” as possible.
Neil,
This wording is aimed for the mgt response to be included in the EY mgt letter as an overall comment-expressing the
overall improvement and commitment on the EY IT issues. The board paper has these themes already but in little more
detail in section 5 (2011/12 audit).
“This year has shown considerable progress from the prior year results with no high risk issues arising.
Post Office have taken firm action in the prior year report to actions previous actions further reduce the
number of actions raised from 70 in the prior year to 25 for 2011/12. We have significantly closed down the
risks relating to the prior year actions with extensive additional controls and processes we put in place with our
suppliers ensuring no high risk items have arisen.
Management will continue this focus on continuous improvement with clear action plans for those
outstanding issues. A risk based approach will be taken to ensure the issues raised and their related risk
are further actioned and mitigated. This will be formerly monitored and managed through a Post Office
lead IT Audit Steering Committee in liaison with our key supplier Fujitsu.
The move to a SAS70 style report produced annually now referred to as an ISAE 3402, will further assist
with the move to greater standardisation of controls and continuous evidenced compliance.”
Nigel
Nigel Tuppen
Business Risk & Assurance
Legal & Compliance
Post Office Limited
Direct Tell.
POL00143058
POL00143058
From: Andy J Jones
Sent: 17 May 2012 08:17
To: Nigel Tuppen; Sarah Hall; Richard J Barber; Neil Lecky-Thompson
Cc: Lesley J Sewell; Susan Crichton
Subject: RE: ExY management response and briefing paper
Nigel
One minor comment if I may. The reference to 70 actions last year and 25 this year, sounds a bit like we only completed
45 actions from the previous audit. Could it be made slightly clearer that we had 70 last year and closed these actions
down with the extensive controls and processes we put in place with our suppliers. This year those improvements were
reflected in only having 25 actions with none being rated high.
What do you think? Of course you can play with the words, but the sentiment I think is there.
Regards,
Andy
Andy Jones
IT & Change
Quality & Standards Manager
© ..2° Floor..Bunbill Row.Wing..148 Old Street. London EC1V 9HQ
@ Andy,j.jones
oe www.postoffi
Building a Post Office® we can ail be proud of
Confidential Information:
This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any
unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient please contact me by reply
email and destroy all copies of the original message.
Sent: 16 May 2012 16:13
To: Andy J Jones; Sarah Hall; Richard J Barber; Neil Lecky-Thompson
Cc: Lesley J Sewell; Susan Crichton
Subject: RE: E&Y management response and briefing paper
All
POL00143058
POL00143058
As discussed in meeting below is a brief proposed summary for the management response document.
“This year has shown considerable progress from the prior year results with no high risk issues arising.
Post Office have made significant efforts to implement the actions to further reduce the number of actions
raised from 70 in the prior year to 25 for 2011/12.
Management will continue this focus on continuous improvement with clear action plans for those outstanding
issues. A risk based approach will be taken to ensure the issues raised and their related risk are further actioned
and mitigated. This will be formerly monitored and managed through a Post Office lead IT Audit Steering
Committee in liaison with our key supplier Fujitsu.
The move to a SAS70 style report produced annually, now referred to as an ISAE 3402, will further assist with
the move to greater standardisation of controls and continuous evidenced compliance.”
Nigel
Nigel Tuppen
Business Risk & Assurance
Legal & Compliance
Post Office Limited
‘rom: Andy J Jones
Sent: 16 May 2012 12:19
To: Sarah Hall; Nigel Tuppen; Richard J Barber; Neil Lecky-Thompson
Cc: Lesley J Sewell; Susan Crichton
Subject: ExY management response and briefing paper
PSA the latest version of the briefing paper for senior management and the expected management response to the E&Y
observations as part of the IT controls audit.
The call at 1pm will look to finalise both these papers for effective ‘sign off’ prior to issuance. Although there will be some
remedial work after the call.
Apologies for the lateness of these documents so close to 1pm but we have been working on them up and to now.
Speak to you all at 1pm
Regards,
Andy
Andy Jones
POL00143058
POL00143058
IT & Change
Quality & Standards Manager
2™ Floor. Bunhill Row Wing. 148 Old Street. London EC1V 9HQ
@® = www.postoffice.co.uk
Building a Post Office® we can all be proud of
Confidential Information:
This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any
unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient please contact me by reply
email and destroy all copies of the original message.