FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
Document Title — Audit Acceptance Specification
Document Type —_ Acceptance Specification
Abstract This document describes the Acceptance Test for Audit
Status Issued
Author J CC Dicks
Approval By (approved version)
Distribution Pathway Management Team
Test & Integration Manager
Pathway Library
POCL/DSS Paul Redwood
Jeff Austen
PDA tba
Recommended ICL Pathway Test Manager Authority(ies) Test Manager
for Approval
Signature
Name
Date
Approved For and behalf of ICL For and behalf of Authority(ies)
Pathway
Signature
Name
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORMAT ]
CONTRACT CONTROLLED Page 1 of 37
obligations or creating new contractual obligations between ICL Pathway and the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
Date
1_ DOCUMENT CONTROL
24 DOCUMENT HISTORY
Version Date Reason
Ou
1.0
1
1.2
13
14
2.0
1/5/97
12/5/97
29/4/98
23/7/98
2/9/98
20/10/98
13/11/98
First draft for internal Pathway review
Issued for joint review
Revised for New Release 2, issued for partial joint review
pending availability of Business Thread and HLTP
Version factoring in BT and HLTP material
Version treating additional comments
Version factoring in agreements from QR meeting 8/10
Approved version to accompany CCN361
ASSOCIATED DOCUMENTS
Reference
Acceptance
Standard
Acceptance
Standard
Authorities’
Agreement
POCL
Agreement
DSS
Agreement
Authorities’
Agreement
Version Date
Ol
1.2
7.2
7.2
8.1
13/09/96
13/7/98
22/5/97
22/5/97
22/5/97
8/3/98
Title
Standard for Raising and
Progressing Acceptance
Incidents.
Standard for documenting
Acceptance Specifications
Acceptance Procedures
Schedule (A)Ao7
Acceptance Procedures
Schedule (P)Au
Acceptance Procedures
Schedule (D)Au
Requirements Schedule
(A)Bo4
Source
Pathway
Pathway
DSS/POCL
POCL
DSS
DSS/POCL
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE
MERGEFORMAT ]
CONTRACT CONTROLLED
Printed on: [ DATE \*
Page 2 of 37
obligations or creating new contractual obligations between ICL Pathway and the DSS and/or
POCL.
FUJ00119615
FUJ00119615
Ic. Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
Reference Version Date Title Source
(8) Authorities’ 81 8/3/98 Solutions Schedule Pathway
Agreement (A)Bo5
(9) DSS 81 8/3/98 Requirements Schedule DSS
Agreement (D)A15,
(io) DSS 81 8/3/98 Solutions Schedule Pathway
Agreement (D)A16
(u) POCL 8.0 13/u/97__—_ Requirements Schedule POCL
Agreement (P)A15
(iz) POCL 81 8/3/98 Solutions Schedule Pathway
Agreement (P)A16
(13) CR/FSP/oog 4.0 30/9/97 — Service Architecture Pathway
Design Document
(44) PA/STR/oog 2.0 24/2/98 Release Contents Pathway
Definition for Pathway
New Release 2
(15) CR/FSP/o06 2.3 20/10/98 Audit Trail Functional Pathway
Specification
(6) IA/MAN/o03 0.3 2/7/98 Pathway Internal Audit Pathway
Manual
(17) IA/MAN/o04 0.2 tba Horizon Audit Manual Pathway
(NR2)
(18) CR/SPE/ooz 0.4 30/4/98 Specification for PAS Card Pathway
Payment Accounting &
Reconciliation (CBoS)
Reports -From Release
NR2
(a9) TD/STD/ooo1 1.0 9/03/98 Host Application Database Pathway
Design and Interface
Standards
(20)
0.3 ABBREVIATIONS
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 3 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/1/98
APS Automated Payment Service
BES Benefit Encashment Service
BPS Benefit Payment Service
BT Business Thread
CAPS Customer Accounting and Payments Strategy
CAS CAPS Access Service
CCN Change Control Notice
CMS Card Management Service
DLT Digital Linear Tape
DSS Department of Social Security
HAPS Host APS
HLTP High Level Test Plan
NPO Nominated Post Office
OBCS Order Book Control Service
OPS Office Platform Service
PAS Payment Authorisation Service
PCHL Payment Card Help Line
PDA Programme Delivery Authority
POCL Post Office Counters Ltd
RED Reconciliation Exceptions Database
SIS Strategic Infrastructure Service
0.4 CHANGES IN THIS VERSION
Version raised to 2.0 to accompany CCN361.
Circulation updated.
0.5 CHANGES FORECAST
Revisions for changes in levels of associated documents.
Inclusion of BIT HLTP defined test conditions.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 4 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/ou
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
0.5 TABLE OF CONTENT
1, DOCUMENT CONTROL .......sccscssesserssseesessesseeseesesssessesessessesssessesseessenseeeeees 2
Ll DOcUMENT HIsTORY sed
0.2 ASSOCIATED DOCUMENTS 2
03 ABBREVIATIONS.........4+ 3
0.4 CHANGES IN THIS VERSION. 4
0.5 CHANGES FORECAST . 4
O5 TABLE OF CONTENT . 5
1. PURPOSE & SCOPE ......csccsssssssssssessesseeeesseesssesseesscesseeecnsenseeeesesesenseneeeenensee 6
2. ACCEPTANCE INCIDENTS........sccscssessesessessessesesessesseseseeseeseessenseneesessesnensees 6
3- ACCEPTANCE PERIOD. ........cccccsscsssesseesseeseesssesseessceeseseecsseessecsseeseesenesenensee 6
4. DELIVERABLES & SERVICES ....c.sssssssssssessssssscsssscsssscsesucsesscassncnsesenssneneescecsee 7
5. ACCEPTANCE CRITERIA .......ccsssesscsssessesssesssesssesseeseneeessenseeseseeseasensseenenees 8
5a ACCEPTANCE CRITERIA AND TEST CONDITIONS.........0000+5
5.41. Description Of Tests Conducted By Acceptance Trial.
5.42 Description of tests conducted by Acceptance Review
5.2 CRITERIA FOR LATER ACCEPTANCE
53 CRITERIA SUMMARY......:esseeeeeeee
6. ACCEPTANCE INCIDENT SEVERITY ........sscssssessessesessessesseesssesresseseenesseseees 28
6. HIGH SEVERITY INCIDENTS...
6.2 MEDIUM SEVERITY INCIDENTS
63 Low SEVERITY INCIDENTS
7. TEST DATA...
8. AUTHORITY RESPONSIBILITIES. ........ccsccsscssesessesesccssesecssseeesesseneesenseeees 28
81 APPOINT TEST MANAGER
8.2 ACCEPTANCE INCIDENT REPORTS
83 ACCEPTANCE INCIDENT ANALYSIS REPORT!
8.4 ATTENDANCE AT TRIALS AND REVIEWS ..
85 MANAGEMENT AND CO-ORDINATION .
8.6 PROGRESS REVIEWS .......sesssee00e
9g. CONTRACTOR RESPONSIBILITIES ......ccsescsseceesseseeerseteeesssssseeesseneeseees 28
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 5 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
1o. ACCEPTANCE TRIAL TEST CONDITIONS
1 PURPOSE & SCOPE
This document describes the Acceptance Test for Audit in accordance with the
Acceptance Procedures that are set out in the Schedules referred to in section 0.2
and also in the Pathway document “Standard for Documenting Acceptance
Specifications”. This Test will determine that Audit meets all the Acceptance
Criteria that are agreed in the Acceptance Specification and that are within the
scope of the “Pathway Release Contents Specification” document for New Release 2,
if applicable.
Schedule C3
Policies & Standards
Customer Service
Education Levels
POCL/DSS POCLIDSS POCLIDSS
Implementation Implementation Implementation
2 a
lool PAS CMS
3 2
5 2 3
‘Help Desks 2 < &
Reference F
Data H
Z
POCL
Infrastructure
APS
BES orcs oS EPOSS
Figurei-1; This Acceptance Test in relation to others
2. ACCEPTANCE INCIDENTS
The standard and method for originating, progressing and resolving Acceptance
Incidents shall be as described in the associated Document “Standard for Raising
and Progressing Acceptance Incidents”.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 6 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
3. ACCEPTANCE PERIOD
The Acceptance Period for the Acceptance Tests, which comprise the Operational
Trial, is as determined by schedule Bo7 of the AUTHORITIES’ Agreement.
The Pathway programme plan details the schedule for the Audit Acceptance Test.
4 DELIVERABLES & SERVICES
This section details the Deliverables and Services that are the subject of this
Acceptance Test and as defined by the related Agreements.
Deliverable or Contract Method
Service. Reference
Audit Requirements Schedule (A)Bo4. Acceptance Trial
Requirements Schedule (D)A15 Acceptance Review
Requirements Schedule (P)A15
Schedule A3 (version Jao3v5op.doc,
10/5/96)
Table of Deliverables and Services.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 7 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
5 ACCEPTANCE CRITERIA
This section lists the identifier of each Acceptance Criterion that will be
demonstrated by the Acceptance Test. It also lists the Acceptance Test Conditions
that are used to determine whether (or not) the Acceptance Criterion has been met
together with the applicable test Phase, Technical Test, or Live Trial.
Acceptance Criteria are split into three sets of tables according to the nature of the
acceptance method, one set for those tested by Acceptance Trial, a second for those
tested by Acceptance Review and a third which lists those criteria which are for
Acceptance at a later release. The Release on which Acceptance is to be conducted
is defined by reference to the Release Contents Description included in the
Associated Documents section of the Acceptance Specification. Exceptionally, it
may be necessary for one particular Acceptance Criterion to be tested by a
combination of trial and review in which case there are entries for Trial and Review.
5.1. ACCEPTANCE CRITERIA AND TEST CONDITIONS
Conformance of the Audit Acceptance Criteria will be demonstrated through
Acceptance Trials and/or Acceptance Reviews.
Tests conducted by Acceptance Trials comprise practical tests using prepared test
scripts. If applicable the Test Condition(s) appropriate to a criterion are specified
in section 5.1.1 together with a description of the test. Detailed composition of the
test in terms of sequences of Test Conditions is contained in Section 10. In the
tables in section 5.1.1 the rows labelled Function Run Entry will be populated
immediately prior to the running of the Acceptance Trials in a working version of
the Acceptance Specification. These will provide invigilators with references to the
checklists used to monitor the progress of the testing. The order of running of Test
Conditions will not necessarily correspond to the order presented in HLTPs
because of the “physicalisation” of the testing. The Function Run Entry will allow
the invigilator to read across from the criterion to the checklist.
Tests conducted by Acceptance Review comprise typically document reviews, site
visits or presentations. If applicable the Test Condition(s) are described in section
5.1.2.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 8 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/1/98
5.1.1 Description Of Tests Conducted By Acceptance Trial
The tables below show which Acceptance Criteria will be met by Acceptance Trial.
All of the tests in this section will be scheduled during the Technical Test phase.
699
1-5,10
Requirement
1. An audit trail shall be maintained during periods of Service
operation including fallback and Recovery.
2. The audit trail shall record all Data File transfer, messaging
and processing, whether as a result of manual or automated
action.
3. The information recorded shall be sufficient to identify the
action, by whom it was undertaken, when it was
undertaken, why it was undertaken, where it was
undertaken and the resulting outcome.
4. The audit trail shall allow activities that utilise more than
one of the Services to be traced across the Services from
start to finish, or from an intermediate Service in any
direction, with certainty.
5. The audit trail shall provide information to allow the
original Transaction to be recreated.
6. The integrity of the audit trail shall be continued during
periods of partial or complete service loss or failure.
HLTP Audoio1 / BT Audo1 / BT Refs 1-24
Business oriented processing will be performed to prove the
Audit Tracks for POCL SIS and POCL Client (DSS) and to
record the list of Audit events from Tivoli Event Management
Server.
1, 2,10 Both main Audit Tracks are populated with a full
representation of traffic including fallback and recovery and
automated and manual transactions.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 9 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
Audit Ref.: CR/ACS/ou
Version: 2.0
Acceptance Specification Date: 13/1/98
FUJ00119615
FUJ00119615
BPS customers and payments
Stopped Payments
Encashed payments
Recalls and reissues following NPO change
Despatched card batches
[Despatched Temporary Token batch purging (NR2+)]
Temporary Token operations
Removing unwanted notes
PCHL operation
10. Counter auditing at session level
u. Table level audit monitoring changes
12. Medium term Post Office closures
13. Stopped card damage reorder control
14. Reissued card damaged reorder control
15. Overdue payment stops
16. Exception tables purging
17. Contingency payments
18. “40/14” type exceptions
19. Reference data changes including revalued stock
20. Duplicate payment stops
21. Cardholder amendments
22. CAS log files
23. OBCS stops and recalls
24. OBCS book handling and encashment
CRY AVAWNE
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 10 of 37
obligations or creating new contractual obligations between ICL Pathway and the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/ou
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
699
80
Requirement
The audit trail shall be available for inspection by the
AUTHORITIES or their representatives as listed in
paragraph 2.1 of Schedule Ao3 of the AUTHORITIES’
Agreement.
The audit trail shall comply with Requirement 829.
[DN: Requirement 829 specifies evidential admissibility.]
A satisfactory Operational Audit Procedure is in operation
and has been exercised by means of sample site visit.
Sample site visit.
(7)
Technical Test
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 1 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/1/98
699
9
Requirement
9. The audit trail shall have a level of security such that it
cannot be altered or deleted.
HLTP Audoio1 / BT Audo1 / BT Refs 25-29
Operational activities available cannot alter or delete the Audit
Trail.
25. Operational checks using Discoverer
26. Restoration of operational data from non-audit archive
27. Audit Archive checked from Audit Workstation
28. Audit Archive - file successfully re-gathered
29. Audit Archive file successfully deleted
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 12 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
ICL Audit Ref: CR/ACS/ou
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
FUJ00119615
FUJ00119615
816
1
Requirement
A complete set of Outlet Records, for a rolling period of 18
months, shall be maintained as available for retrieval and
review (but not amendment).
HLTP Audoioi / BT Audo1 / BT Refs 1, 3-10, 12-14, 17-19, 21, 23-
24, 27-34.
Business oriented processing will be performed to prove the
Outlet records
BPS customers and payments
Encashed payments
Recalls and reissues following NPO change
Despatched card batches
[Despatched Temporary Token batch purging (NR2+)]
Temporary Token operations
Removing unwanted notes
PCHL operation
10. Counter auditing at session level
uu. -
12. Medium term Post Office closures
13. Stopped card damage reorder control
14. Reissued card damaged reorder control
lis. -
16, -
I17. Contingency payments
18. “40/14” type exceptions
19. Reference data changes including revalued stock
20. -
21. Cardholder amendments
PRI AVAWNE
23. OBCS stops and recalls
24. OBCS book handling and encashment
25.-
26, -
27. Audit Archive checked from Audit Workstation
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 13 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
Audit Ref.: CR/ACS/ou
Version: 2.0
Acceptance Specification Date: 13/11/98
28. Audit Archive - file successfully re-gathered
29. Audit Archive file successfully deleted
30. Audit Archive file retrieval
31. POCL Auditor outlet asset verification
32. POCL Emergency Manager operations
33. Horizon Help Desk calls
34. Legato 18 month DLT handling
[DN: Whether the retention period for the operational audit trail
is 18 months or six years is in dispute and has been referred to
the CNT for resolution.]
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 14 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathwoy Acceptance Specification Date: 13/1/98
921
5
Requirement
The circumstance where the [OPS Secure Time-out] facility has
been overridden by an appropriate authority shall be expressly
logged to the audit trail.
HLTP Audotoi / BT Audoi / BT Ref 32
OPS Secure Timeout is recorded
32. POCL Emergency Manager operations
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 15 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
ICL Audit Ref: CR/ACS/ou
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
FUJ00119615
FUJ00119615
942
3 (DSS only)
Requirement
The CONTRACTOR shall provide all Services to support the
functional specification [(15)]
HLTP Audoio1 / BT Audo1 / BT Refs 1-9, u1, 13-18, 20-30, 34.
The DSS related parts of audit are performed.
BPS customers and payments
Stopped Payments
Encashed payments
Recalls and reissues following NPO change
Despatched card batches
[Despatched Temporary Token batch purging (NR2+)]
Temporary Token operations
Removing unwanted notes
PCHL operation
Table level audit monitoring changes
BESS SN AVAWHE
. Stopped card damage reorder control
. Reissued card damaged reorder control
. Overdue payment stops
. Exception tables purging
. Contingency payments
. “40/14” type exceptions
. Duplicate payment stops
. Cardholder amendments
22. CAS log files
23. OBCS stops and recalls
24. OBCS book handling and encashment
25. Operational checks using Discoverer
26. Restoration of operational data from non-audit archive
27. Audit Archive checked from Audit Workstation
28. Audit Archive - file successfully re-gathered
29. Audit Archive file successfully deleted
30. Audit Archive file retrieval
ESSe2tGanes
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 16 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/1/98
33- >
34. Legato 18 month DLT handling
[DN: Whether the retention period for the operational audit trail
is 18 months or six years is in dispute and has been referred to
the CNT for resolution.]
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 17 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/ou
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
942
6-1 (DSS only)
Requirement
The audit trail shall be maintained during all periods of
operation including fallback and Recovery.
The audit trail shall record all Transactions and data passing
across service boundaries and all major processing actions.
The information recorded shall allow tracking of a business
Transaction through the Services and across service
boundaries to other suppliers’ services.
The information recorded shall identify origin of Transaction,
time and outcome.
The audit trail shall be made available to DSS as logically a
single entity showing a chronological trail of events.
[DN: other attributes than date/time may be used and
other arrangements of the audit trail than a single entity
may be formed.]
The CONTRACTOR shall make available utilities to facilitate
inspection of the audit trail by DSS.
HLTP Audouo1 / BT Audo1 / BT Refs 1-9, 11, 13-18, 20-30, 34.
BPS customers and payments
Stopped Payments
Encashed payments
Recalls and reissues following NPO change
Despatched card batches
[Despatched Temporary Token batch purging (NR2+)]
Temporary Token operations
Removing unwanted notes
PCHL operation
lo ON ANA WD &
Satisfactory maintenance, content and usage of the Audit Trail.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 18 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref.: CR/ACS/ou
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
10. -
u. Table level audit monitoring changes
2. -
13. Stopped card damage reorder control
14. Reissued card damaged reorder control
15. Overdue payment stops
16. Exception tables purging
17. Contingency payments
18, “40/14” type exceptions
19. -
20. Duplicate payment stops
21. Cardholder amendments
22. CAS log files
23. OBCS stops and recalls
24. OBCS book handling and encashment
25. Operational checks using Discoverer
26. Restoration of operational data from non-audit archive
27. Audit Archive checked from Audit Workstation
28. Audit Archive - file successfully re-gathered
29. Audit Archive file successfully deleted
30. Audit Archive file retrieval
31.
32. -
33. -
34. Legato 18 month DLT handling
[DN: Whether the retention period for the operational audit trail
is 18 months or six years is in dispute and has been referred to
I the CNT for resolution.]
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 19 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/1/98
5.1.2 Description of tests conducted by Acceptance Review
The table below shows which Acceptance criteria are to be met by Acceptance
Review. Acceptance Tests will use the versions of any relevant documents (as
referenced from section 0.2) contained in the approved version of the Acceptance
Specification.
6907
1-6
Requirement
1. The CONTRACTOR and his sub-contractors shall keep
or cause to be kept Records (including financial
records) of all Services, covering materials and Services
provided, timesheet records, contracts let to sub-
contractors and Charges levied to the AUTHORITIES.
These Records shall not be more detailed than those
held by the CONTRACTOR for its own audit purposes.
2, The CONTRACTOR shall permit the AUTHORITIES or
AUTHORITIES' representatives (including those bodies
listed in paragraph 2.1 of Schedule Ao3 of the
AUTHORITIES’ Agreement) unrestricted access to the
Records for the purpose of auditing and reporting on
the performance, including charging and accounting
aspects, of the Services.
3. DSS shall have the right of access to inspect the DSS
Services and POCL shall have the right of access to
inspect the POCL Services. The AUTHORITIES may
appoint an independent auditor to examine areas that
are mutually commercially sensitive.
4. Such access shall be provided on request and shall
include access to premises, facilities, Services,
documentation, information (magnetic or otherwise),
staff, procedures, timesheets and other data used
directly as a basis for charging belonging to the
CONTRACTOR which relate to the provision of the
Services.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 20 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/ou
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
I 5. The CONTRACTOR shall implement audit
I recommendations in accordance with provisions of the
change control procedures.
6. The CONTRACTOR shall provide within reasonable
I timescales either documentary or demonstrable
evidence of such changes and shall if required provide
access to the AUTHORITIES' representatives to
monitor and confirm the implementation of such
changes.
I A satisfactory Commercial Audit Procedure is in operation.
1. Document inspection, sample site visits, review
meeting
2. Document inspection, sample site visits, review
meeting
I 3. Document inspection, sample site visits, review
meeting
4. Document inspection, sample site visits, review
I meeting
5. Document inspection
6. Document inspection
Technical Test/Live Trial
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 21 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathwoy Acceptance Specification Date: 13/1/98
I 699
413-5
I Requirement
I The information recorded shall be sufficient to identify the
action, by whom it was undertaken, when it was
I undertaken, why it was undertaken, where it was
undertaken and the resulting outcome.
I The audit trail shall allow activities that utilise more than
I one of the Services to be traced across the Services from
start to finish, or from an intermediate Service in any
direction, with certainty.
I The audit trail shall provide information to allow the
I original Transaction to be recreated.
I Satisfactory maintenance, content and usage of the Audit
Trail.
I Inspection of live trial operation of the Services to establish
satisfactory provision of the specified areas of functionality.
The live trial operation inspection will also include the
Reconciliation Exceptions Database.
I 45)(08)
I Operational Trial
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 22 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
699
6
Requirement
The content of the audit trail shall be agreed with the
AUTHORITIES by a date consistent with the project plan
agreed by the parties, such that the date does not adversely
impact contractual milestones as defined in Clause 605.1 of
the Authorities Agreement.
Agreement to referenced documents
Document inspection
05)(08)
I Live Trial
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 23 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/ou
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
699
7
Requirement
Subject to Clause 801 of the Related Agreements, audit trail
records shall be retained for a period consistent with
Companies Act requirements, or for a period of eighteen
(18) months, whichever is longer.
[DN: The operational Audit Trail is to be retained for not
less than 18 months.]
[DN: Whether the retention period for the operational audit
trail is 18 months or six years is in dispute and has been
referred to the CNT for resolution.]
Statement of obligation
Document inspection for explicit obligation
(5)(08)
Live trial
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 24 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/ou
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
699
80
Requirement
The audit trail shall be available for inspection by the
AUTHORITIES or their representatives as listed in
paragraph 2.1 of Schedule Ao3 of the AUTHORITIES’
Agreement.
The audit trail shall comply with Requirement 829.
[DN: Requirement 829 specifies evidential admissibility.]
A satisfactory Operational Audit Procedure is in operation
and has been exercised by means of sample site visit.
Document inspection.
(7)
Operational Trial
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 25 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/1/98
FUJ00119615
FUJ00119615
699
12
Technological changes to the Services or the Service
Infrastructure shall not render the audit trail unusable.
[Note: this criterion is not scheduled for formal test.]
Statement of obligation
Inspection for explicit obligation in functional
specification.
(a5)
Operational trial
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 26 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
Audit Ref: CR/ACS/ou
Version: 2.0
Acceptance Specification Date: 13/11/98
816
1,2 (POCL only)
Requirement
A complete set of Outlet Records, for a rolling period of 18
months, shall be maintained as available for retrieval and
review (but not amendment).
[DN: The test to show that it is not possible to amend a set
of outlet records is included in the Acceptance Trials
Section.]
On retrieval all Records shall be packaged in weekly
batches as a complete POCL Outlet Accounting Period
cycle.
[DN: There is an outstanding interpretation here as to the
intended meaning of week. Note that the Solution specified
“Information will be retrieved as complete set of records for
the specified outlet account period.”]
[DN: Whether the retention period for the operational audit
trail is 18 months or six years is in dispute and has been
referred to the CNT for resolution.]
Satisfactory operation of retrieval and review facility.
Inspection of usage of facility to retrieve and review outlet
records.
None
Technical Test
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORMAT ]
CONTRACT CONTROLLED Page 27 of 37
obligations or creating new contractual obligations between ICL Pathway and the DSS and/or
POCL.
FUJ00119615
FUJ00119615
Audit Ref: CR/ACS/ou
Version: 2.0
Acceptance Specification Date: 13/11/98
942
1,2 (DSS only)
Requirement
1. DSS shall have access to the audit information captured
as part of the audit trail functional requirement. The
nature and form of the access shall be defined by the
CONTRACTOR subject to the agreement of DSS by a
date consistent with the project plan agreed by the
parties, such that the date does not adversely impact
contractual milestones as defined in Clause 605.1 of the
Authorities. Agreement but is likely to be needed to
support some or all of the following:
a) fraud detection and prevention;
b) security violation investigation;
c) probity assurance;
d) failure investigation;
e) Service and contractual disputes;
f) criminal investigations;
g) information to support policy development,
policy monitoring, parliamentary and Ministerial
questions etc.
2. The CONTRACTOR shall provide a detailed functional
specification for approval by DSS prior to implementing
any such Services.
A satisfactory Operational Audit procedure is in
operation
2. A detailed functional specification has been provided
Sample access during Live Trial
Document inspections
(a7)
(15)
Live Trial
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORMAT ]
CONTRACT CONTROLLED Page 28 of 37
obligations or creating new contractual obligations between ICL Pathway and the DSS and/or
POCL.
ICL Audit
Pathway Acceptance Specification
FUJ00119615
FUJ00119615
Ref: CR/ACS/ou
Version: 2.0
Date: 13/11/98
[ Operational Trial
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE
MERGEFORMAT I
CONTRACT CONTROLLED
Printed on: [ DATE \*
Page 29 of 37
obligations or creating new contractual obligations between ICL Pathway and the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/ou
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
942
4.5 (DSS only)
Requirement
4. The CONTRACTOR shall ensure that the contents of
the audit trail are accurate and that suitable legal
assurances can be given as to the integrity of the audit
trail
[Interpreted as evidential admissibility in accordance
with Requirement 829].
5. The CONTRACTOR shall ensure that the total ora
filtered subset of the audit trail is delivered to a limited
number of central DSS services for further processing.
The delivery shall include any technical transformation
and/or reformatting that is required to ensure the audit
trail is understandable by the receiving services.
[DN: Horizon provides generic facilities for Oracle based
Host applications to generate audit data. These are
defined in (19) and provide for the self description of files
at the file level described in (15) Section 1.2.8.1).]
A satisfactory Operational Audit Procedure is in operation
The description of the native host file formats is
satisfactory
Sample usage and sample assurance
Sample delivery
(17)(a9)
Live Trial
Live Trial
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORMAT ]
CONTRACT CONTROLLED Page 30 of 37
obligations or creating new contractual obligations between ICL Pathway and the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
5.2 CRITERIA FOR LATER ACCEPTANCE
No Acceptance Criteria are for Acceptance at a later level of specification.
5.3. CRITERIASUMMARY
699 1,2,10 v *
699 9 v
816 1 v *
921 5 v
942 3 v *
942 6-1 v *
697 1-6 v
699 35 v v
699 6 v
699 Z v
699 8-11 v v
699 12 No test
816 1,2 v
942 1,2 v
942 45 v
* The Despatched Temporary Token batch purging function is for introduction at
NRa2+.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 31 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
6. ACCEPTANCE INCIDENT SEVERITY
This section identifies the guidelines to be applied during the analysis of
Acceptance Incidents, in order to establish the severity of such Acceptance
Incidents.
64 HIGH SEVERITY INCIDENTS
Failure to meet an Acceptance Criterion which would have a substantive impact on
the service received by the Customer, e.g. failure to pay benefits to the right person,
at the right place, at the right time.
Failure to meet an Acceptance Criterion which would have a major impact on the
ability of the AUTHORITY or AUTHORITIES to perform their business, or where
there was a major impact on the resources of the AUTHORITY or AUTHORITIES
necessary to overcome that impact on their business, e.g. failure to support
accurate POCL accounting.
Failure to meet an Acceptance Criterion which would impact the security of the
service where there is no acceptable procedural workaround.
Consistent failure to meet Minimum Acceptable Thresholds for Service Levels, e.g.
where particular transactions do not meet the minimum Acceptable Threshold
under normal loading.
6.2 I MEDIUM SEVERITY INCIDENTS
Failure to meet an Acceptance Criterion which is visible to the Customer and is
likely to give rise to an adverse public perception of the service, but does not
substantively impact the service received by the Customer, e.g. incorrect spelling
on a receipt.
Failure to meet an Acceptance Criterion which would have a medium impact on
the ability of the AUTHORITY or AUTHORITIES to perform their business, or
where there was a medium impact on the resources of the AUTHORITY or
AUTHORITIES necessary to overcome that impact on their business, e.g. non-
production of a weekly report, resulting in its manual transcription, which causes
additional resource or effort at every outlet of the average duration of one hour per
week per outlet.
Occasional failure to meet Minimum Acceptable Thresholds for Service Levels, e.g.
at peak loading, some transactions fail to meet Minimum Acceptable Thresholds,
but on average all transactions within the service do achieve Minimum Acceptable
Thresholds.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 32 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
6.3. LOWSEVERITY INCIDENTS
Failure to meet an Acceptance Criterion that is neither visible to nor has
substantive impact on the service received by the Customer e.g. presentational,
style and other cosmetic faults that are only visible to the user.
Failure to meet an Acceptance Criterion which would have a minor impact on the
ability of the AUTHORITY or AUTHORITIES to perform their business, or where
there was a minor impact on the resources of the AUTHORITY or AUTHORITIES
necessary to overcome that impact on their business, e.g. non-production of a
weekly report, resulting in its manual transcription, which causes additional
resource or effort at ten or fewer outlets of the average duration of one hour per
week per outlet.
Failure to meet an Acceptance Criterion which would impact the security of the
service but where the workaround is as secure as the original solution (i.e. the only
impact on risk is in ensuring that the workaround is performed, but where
procedures have been agreed and are in place).
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 33 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
FUJ00119615
FUJ00119615
7 TEST DATA
Test data including any operator entered scripts that are required to run the
Acceptance Test are defined below.
Business Test Thread: — Audo1, VI/TSC/128
High Level Test Plan(s): Audouo1, VI/TSC/129
Organisation: Pathway T&l
These references will be replaced with BIT HLTP references as these tests are in
course transfer to the BIT environment.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 34 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
8. AUTHORITY RESPONSIBILITIES
This section describes the AUTHORITY’s or AUTHORITIES’ Responsibilities in
relation to this Acceptance Test. Particular Acceptance Tests may also require
additional participation and responsibility by the AUTHORITY or AUTHORITIES.
8.1 APPOINT TEST MANAGER
The AUTHORITY or AUTHORITIES shall nominate a Test Manager and other
representatives to review the tests prior to commencement of the test.
8.2. ACCEPTANCE INCIDENT REPORTS
The nominated representatives and Test Manager shall be diligent in raising
complete, accurate and timely Acceptance Incident Reports as set out within this
Acceptance Specification.
8.3. ACCEPTANCE INCIDENT ANALYSIS REPORTS
The Test Manager shall be diligent in returning signed Acceptance Incident
Analysis Reports with their decision (e.g. Accept, Reject, Discuss) normally within
five working days, or when urgency is requested by Pathway, within two working
days of receipt from Pathway. A copy of all correspondence will be faxed to reduce
delay.
8.4 ATTENDANCE AT TRIALS AND REVIEWS
The nominated representatives shall at their discretion attend Acceptance Test
Trials and Reviews including repeat Tests at reasonable times and reasonable
locations and with reasonable advance notice by Pathway.
8.5 I MANAGEMENT AND CO-ORDINATION
The Test Manager shall be the single point of communication and co-ordination
with Pathway’s nominated Test Manager for all matters concerning this Acceptance
Test from its initial planning through to Acceptance.
8.6 PROGRESS REVIEWS
Unless otherwise waived by both parties, Pathway’s Test Manager and the
AUTHORITY’s or AUTHORITIES’ Test Manager shall meet each week to review the
progress and actions of both parties until Acceptance of the Acceptance Test is
achieved. The time and location of review meetings will be scheduled with at least
two week’s advance notice by Pathway.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 35 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 2.0
Pathway Acceptance Specification Date: 13/11/98
9. CONTRACTOR RESPONSIBILITIES
The Contractor shall nominate a Test Manager for each Test who shall be the single
point of communication and co-ordination with the AUTHORITY’s or
AUTHORITIES’ Test Manager for all matters concerning this Acceptance Test from
its initial planning through to Acceptance.
Upon receipt of a signed Acceptance Incident Analysis Report from the
AUTHORITY or AUTHORITIES, where correction is required to be re-tested within
the same phase of Acceptance Test, the Contractor will return the amended
component(s), on average, within 4 days. This will include re-testing necessary as
per the agreed test strategies.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORNAT ]
CONTRACT CONTROLLED Page 36 of 37
obligations or creating new contractual obligations between ICL Pathway andl the DSS and/or
POCL.
FUJ00119615
FUJ00119615
ICL Audit Ref: CR/ACS/on
Version: 1.3
Pothwoy Acceptance Specification Date: 2/9/98
1o. ACCEPTANCE TRIAL TEST CONDITIONS
Not completed at this revision, the BT and HLTP documents were provided previously and are in course of transfer to the BIT
environment.
© 1998 ICL Pathway Ltd COMMERCIAL IN CONFIDENCE Printed on: [ DATE \*
MERGEFORMAT ]
Page 37 of 37
Nothing contained herein shall be deemed or consrucd ay affecting existing contractual obligationy or creating newr contractual obligations between ICL
Pathway and the DSS and/or POCL.