COMPANY IN CONFIDENCE
Fe)
FUJITSU
FUJ00155474
FUJ00155474
HNG-X CHANGE PROPOSAL
CP NO: 4867
CP TITLE: HNG-X CP0336 - Enable analysis of
Counter event messages within the HNG-X Audit
solution
DATE RAISED: 26" February
2009
REQUIRED IMPLEMENTATION / PURCHASE DATE:
30" April 2009
ANTICIPATED CP CLOSURE / COMPLETION DATE:
30" April 2009
DATE BY WHICH CP TO BE IMPACTED:
17" March 2009
ORIGINATOR: Alan Holmes
CHANGE OWNER: Pete Sewell
(RECEIVED)
TECHNICAL SPONSOR: Alan
Holmes (RECEIVED)
CP CLASSIFICATION:
FAST-FRACK/URGENT/ROUTINE/FOR INFORMATION*
(‘strikethrough as applicable)
‘Budget Holder Approval for Impacting:
(Email or Hard Copy Signature)
S Denham (RECEIVED)
W Warham (RECEIVED)
J Jukes (RECEIVED)
DAB Required: Yes/No (Strikethrough as
applicable)
Date DAB Authorised:
LIFECYCLE STAGE:
Stage 1: Strategie Approval
Stage 2 : StartUp & Feasibility
Stage 3
Stage 4 : Solution Specification
Stage 5 : Solution Build & Test
Stage 6 : Implementation
(‘strikethrough as applicable)
RELATED Change Request/Request for Work Package: N/A
RELATED PEAKs: PC0152376
RELATED HORIZON CPs: N/A
RELATED HNG-X CPs: N/A
Impact statements must consider all transitional states between Horizon and HNG-X, as well
as the final HNG-X solution.
Description of Change Proposed:
The Audit system supports a service (the Prosecution Support Service) whereby POL can request an
extract of historical data that is held within the Audit archive. Typically this requires retrieval of
archived Riposte transaction data. The data, as returned to POL, is often used to support legal
proceedings where, say, a postmaster is accused of fraud. In such cases, we must also provide a
witness statement with the audit data which attests to its provenance and integrity.
In order to further automate this service under HNG-X, for every branch Riposte data retrieval, the
archived events generated by counters at the branch are also analysed to identify any possible
occurrences of problems which might adversely affect the integrity of the transaction data.
The current Horizon tactical solution is a largely manual process, the operation of which is reliant on a
few key individuals. Whilst we believe that we will have to live with this tactical solution for the
remaining life of the Horizon Audit system, a permanent solution for the HNG-X Audit solution is
required. In outline, this will require the following:
Amending the HNG-X Audit server (ARC) and workstation (AUW) applications to automatically
retrieve and filter Events data when performing Horizon branch data retrievals."
Amending the HNG-X Audit server (ARC) and workstation (AUW) applications to automatically
retrieve and filter Events data when performing HNG-X branch data retrievals.”
Introduce Prosecution Support process changes around the operation of the amended system.
“Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE Ref PGM/CHM/TEMI0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED PageNo: J of 3
FUJ00155474
FUJ00155474
Fe)
FUJITSU COMPANY IN CONFIDENCE
Identify suitable skilled & committed resources to perform any manual analysis required.
Identify all ongoing operational costs associated with operating the revised service.
Acceptance Criteria and Methods (Functional and Non Functional):
Testing will be required to ensure that all counter events are extracted by the system and presented to
the Audit workstation user for further analysis
Reason for Change and Justification for Required Date (above):
While we do not believe that (due to time constraints) it is practicable to introduce this change into
Horizon, it is required to ensure the viability of the ongoing Prosecution Support service within HNG-
x.
Consequences if Not Approved:
We are obliged to present, and vouch for the integrity of, Audit data that is-fitforpurpese- meets
the contractual requirements (amended at CCB 31/03/09) - i.e. admissible as evidence in
court. If this change is not approved, we will need to continue operating the current Horizon
tactical process for the lifetime of HNG-X.
This solution has a number of deficiencies :
It is a largely manual process which is error prone & time consuming.
It involves moving large volumes of data between the Audit server and workstation
It is reliant on ad hoc tooling & hardware
It is reliant on a few key individuals
It requires local & insecure storage of event audit data, invalidating certain statements made
within the current witness statement
It has no DR mechanism in the event of DR from BRAO1 to LEW02
Platforms (Physical) Affected: (insert identity and details of all platforms requiring software update by this CP - where
known)
ARC - Audit Server
AUW - Audit Workstation
Business Applications Affected: (insert identity and details of all Applications requiring update by this CP - where
known)
Audit Server retrieval application
Audit workstation client application
External Impact Assessment Distribution: (insert contact details and additional rows as required)
Name: Organisation: Contact No:
N/A N/A N/A
Impact on Royal Mail Group Account: (insert additional rows as required)
Resource Grade Man-days Non Labour Cost (£)
TBA TBA TBA
TOTAL
Documents Affected: (insert additional rows as required)
Document Reference I Title [Current Version
‘The HNG-X Audit solution will need to continue to support the retrieval & analysis of Horizon branch audit
data for seven years
? While there is no reason to believe that the HNG-X counter will suffer the same deficiencies as the Horizon
counter, it is advisable that similar checks are performed in both environments
‘©Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE Ref PGMICHM/TEM/0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED PageNo: 2 of 3
FUJ00155474
FUJ00155474
Fe) ~
FUJITSU COMPANY IN CONFIDENCE.
[184 TBA TBA ]
©Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE Ref: PGM/CHM/TEM/0001
Version: V1.0
Date: 47-NOV-07
UNCONTROLLED IF PRINTED Page No: 3 of 3
FUJ00155474
FUJ00155474
Oo ~
FUJITSU COMPANY IN CONFIDENCE.
CHANGE PROPOSAL
ID: PWY_CP_4867 Create Date: 26-FEB-2009 14:17:01
Status: APPROVED Originator: Ken.Westfield
Title
HNG-X CP0336 - Enable analysis of Counter event messages within the HNG-X Audit solution
Related Items
Affected
4 PWY:CP_4867_1.A-CDATTACH:]1 (Affected) Ken.Westfield
(CP_4867_1.xls)
CP 4867 - Attachment 1 - CP Impact Spreadsheet
Response
4 PWY:CP_4867_1.A-CDATTACH:2 (Response) Ken.Westfield
(CP_4867_L.xls)
CP 4867 - Attachment 1 - CP Impact Spreadsheet
Response
4 PWY:CP_4867_1.A-CDATTACH:3 (Response) Ken. Westfield
(CP_4867_.xls)
CP 4867 - Attachment 1 - CP Impact Spreadsheet
Related Child Change Documents
Related Parent Change Documents
Info PWY_PR_152376 CLOSED PCMS - CM Dept. (PCMS)
FAD005948 BM stock unit was rolled over it was forced to clear the local suspense account
Impact Notes
Commercial & Finance New CP
CS: Service Support New CP
Service Delivery New CP
Security & Risk New CP
Service Introduction New CP
Service Transformation New CP
Core Services New CP
DEV: ACE New CP
AASS New CP
Agent New CP
‘©Copyright Fujitsu Services Ltd 2007 ‘COMPANY IN CONFIDENCE Ref. PGMICHM/TEM/0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED PageNo: 4 of 3
FUJ00155474
FUJ00155474
Oo ~
FUJITSU COMPANY IN CONFIDENCE.
APOP Admin WS New CP
Athene New CP
Audit New CP
AutoConfig & CtrSched New CP
Counter APS New CP
Counter EOL New CP
Cryptography New CP
Data Warehouse New CP
DELT New CP
Design Authority New CP
FTMS New CP
Host APOP New CP
Host APS New CP
Host DRS New CP
Host LFS New CP
Host NPS. New CP
Host RDMC New CP
Host TES New CP
Host TPS New CP
Infrastructure New CP
MTAS New CP
Maestro New CP
Message Broadcast New CP
Networks New CP
OCMS New CP
Ops Documentation New CP
Proxy Delivery Service New CP
Reference Data New CP
Secure Builds New CP
SMG New CP
Tools & Emulators New CP
VPN New CP
ITU: RV New CP.
Support New CP
SVI New CP
TD New CP
PMSP: Planning New CP
Project Mgmt New CP
Software CM New CP
Quality & Audit New CP.
Fujitsu Reference Data Required
Post Office Reference Data Required
Post Office Dependency Exists
Archived Impact Notes
Action Messages
‘©Copyright Fujitsu Services Ltd 2007 ‘COMPANY IN CONFIDENCE Ref. PGMICHM/TEM/0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED Page No: 5 of 3
FUJ00155474
FUJ00155474
FUJITSU COMPANY IN CONFIDENCE G&S
Action Number: 2 Date Mar 24 2009 16:53:41 By: Ken.Westfield
Comments
Update from D Hinde regarding Audit Team and impact:
The development impact on this CP was based on retaining a contractor, starting work at the beginning of April
and delivering before end June 2009. This CP urgently needs to progress through the boards for approval if we
are to achieve this.
If approval of this CP is delayed the development impact is likely to increase as we will need to retain the
contractor beyond the end of June or find less skilled resource who will take longer to do the work.
Action Number: 3 Date Mar 26 2009 13:01:39 By: Ken. Westfield
PCCB Minutes (586) 26-Mar-09
CCB_PENDING
CP presented to PCCB by D Hinde on behalf of CS Security.
CP had been fully impacted and based on a delivery from Dev at the end of June, LST would test this after that
This was for a piece of work primarily within the Dev Audit team which the Account had identified as a must-
have. D Hinde confirmed that he had discussed this with W Warham who had agreed that CS would cover the
cost of this work. D Hinde and G Allen stressed the urgency in progressing the CP was that the identified
resource to do the work was due to leave next week.
ChM advised that the only o/s issue was for an impact from CS RM, but that had been delivered before the
PCCB and the paperwork had now been updated.
PCCB had no further comments and set to CCB Pending.
Action Number: 4 Date Apr 1 2009 09:43:15 By: Ken. Westfield
PCCB Minutes (530) 31-Mar-09
APPROVED
CP presented by D Hinde and W Warham who confirmed that this was a must have from CS perspective and as
such W Warham had agreed to cover the 100.5mds impacted (78.5 incremental).
‘©Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE Ref PGMICHM/TEM/0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED PageNo: 6 of 3
FUJ00155474
FUJ00155474
Pe)
FUJITSU COMPANY IN CONFIDENCE
S Denham identified that this was currently being performed by a series of people using manual processes, with
the inherent risk to data integrity and was of the order of 9mds a month. G Wilkerson queried the savings on this
and after discussion S Denham identified that this change was to introduce automation to bring us back to a
baseline position.
W Warham requested S Denham take an action to include this in the CS Forecast for April and S Denham
agreed to do this.
Over and above that W Warham stressed that this was needed for accreditation and for acceptance into service as
reducing litigation risk and improving data integrity and confidence in the records.
R Wright asked when this was expected to be delivered and D Hinde stated that this was towards the end of June
(i.e. post Pilot).
G Wilkerson identified that the CP contained the words d€ceis fit for purposea€ and stated that this statement
should not be used, even on internal documents and P Sewell accepted an action to amend this.
CCB had no further comment and approved the CP.
Actions:
1. S Denham to include the mds are included in the CS Forecast for April.
2. P Sewell to amend words in the CP from a€cea€ if fit for purposea€ to 4€cemeets the contractual
requirementsa€
P.M.N. CP wording updated by P Sewell and ChM to reflect the request made at CCB, Action complete.
‘©Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE Ref PGMICHM/TEM/0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED Page No: 7 of 3