COMPANY IN CONFIDENCE
Re)
FUJITSU
FUJ00155478
FUJ00155478
HNG-X CHANGE PROPOSAL
CP NO: 4867
CP TITLE: HNG-X CP0336 - Enable analysis of
Counter event messages within the HNG-X Audit
solution
DATE RAISED: 26" February
2009
REQUIRED IMPLEMENTATION / PURCHASE DATE:
30" April 2009
ANTICIPATED CP CLOSURE / COMPLETION DATE:
30" April 2009
DATE BY WHICH CP TO BE IMPACTED:
17" March 2009
ORIGINATOR: Alan Holmes
CHANGE OWNER: Pete Sewell
(RECEIVED)
TECHNICAL SPONSOR: Alan
Holmes (RECEIVED)
CP CLASSIFICATION:
FAST-TRACK/URGENT/ROUTINE/FOR INFORMATION*
(‘strikethrough as applicable)
‘Budget Holder Approval for Impacting:
(Email or Hard Copy Signature)
S Denham (RECEIVED)
W Warham (RECEIVED)
J Jukes (RECEIVED)
DAB Required: Yes/No (Strikethrough as
applicable)
Date DAB Authorised:
LIFECYCLE STAGE:
(‘strikethrough as applicable)
Stage 4 : Solution Specification
Stage 5 : Solution Build & Test
Stage 6 : Implementation
Net Applicable
RELATED Change Request/Request for Work Package: N/A
RELATED PEAKs: PC0152376
RELATED HORIZON CPs: N/A
RELATED HNG-X CPs: N/A
Impact statements must consider all transitional states between Horizon and HNG-X, as well
as the final HNG-X solution.
Description of Change Proposed:
The Audit system supports a service (the Prosecution Support Service) whereby POL can request an
extract of historical data that is held within the Audit archive. Typically this requires retrieval of
archived Riposte transaction data. The data, as returned to POL, is often used to support legal
proceedings where, say, a postmaster is accused of fraud. In such cases, we must also provide a
witness statement with the audit data which attests to its provenance and integrity.
In order to further automate this service under HNG-X, for every branch Riposte data retrieval, the
archived events generated by counters at the branch are also analysed to identify any possible
occurrences of problems which might adversely affect the integrity of the transaction data.
The current Horizon tactical solution is a largely manual process, the operation of which is reliant on a
few key individuals. Whilst we believe that we will have to live with this tactical solution for the
remaining life of the Horizon Audit system, a permanent solution for the HNG-X Audit solution is
required. In outline, this will require the following:
@ Amending the HNG-X Audit server (ARC) and workstation (AUW) applications to
automatically retrieve and filter Events data when performing Horizon branch data retrievals.’
@ Amending the HNG-X Audit server (ARC) and workstation (AUW) applications to
‘The HNG-X Audit solution will need to continue to support the retrieval & analysis of Horizon branch audit data for seven
years
©Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE Ref. PGMICHM/TEM/0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED Page No: lof 5
FUJ00155478
FUJ00155478
FUJITSU COMPANY IN CONFIDENCE
automatically retrieve and filter Events data when performing HNG-X branch data retrievals.”
@ \ntroduce Prosecution Support process changes around the operation of the amended
system.
@ \dentify suitable skilled & committed resources to perform any manual analysis required.
@ Identify all ongoing operational costs associated with operating the revised service.
Acceptance Criteria and Methods (Functional and Non Functional):
Testing will be required to ensure that all counter events are extracted by the system and presented to
the Audit workstation user for further analysis
Reason for Change and Justification for Required Date (above):
While we do not believe that (due to time constraints) it is practicable to introduce this change into
Horizon, it is required to ensure the viability of the ongoing Prosecution Support service within HNG-
x.
Consequences if Not Approved:
@ Weare obliged to present, and vouch for the integrity of, Audit data that is-fit for purpose-
meets the contractual requirements (amended at CCB 31/03/09) - i.e. admissible as evidence
in court. If this change is not approved, we will need to continue operating the current
Horizon tactical process for the lifetime of HNG-X.
This solution has a number of deficiencies :
It is a largely manual process which is error prone & time consuming.
It involves moving large volumes of data between the Audit server and workstation
It is reliant on ad hoc tooling & hardware
It is reliant on a few key individuals
It requires local & insecure storage of event audit data, invalidating certain statements made
within the current witness statement
@ \thas no DR mechanism in the event of DR from BRAO1 to LEW02
BRAVA
Platforms (Physical) Affected: (insert identity and details of all platforms requiring software update by this CP - where
known)
@ ARC - Audit Server
@ AUW- Audit Workstation
Business Applications Affected: (insert identity and details of all Applications requiring update by this CP - where
known)
@ Audit Server retrieval application
@ Audit workstation client application
External Impact Assessment Distribution: (insert contact details and additional rows as required)
Name: Organisation: Contact No:
N/A N/A N/A
Impact on Royal Mail Group Account: (insert adsitional rows as required)
Resource Grade Man-days Non Labour Cost (£)
TBA TBA TBA
TOTAL.
Documents Affected: (insert additional rows as required)
Document Reference Title Current Version
TBA TBA TBA
‘©Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE Ref: PGM/CHM/TEM/0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED Page No: 2 of 5
FUJ00155478
FUJ00155478
FUJITSU COMPANY IN CONFIDENCE
? while there is no reason to believe that the HNG-X counter will suffer the same deficiencies as the Horizon counter, it is,
advisable that similar checks are performed in both environments
©Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE. Ref: PGMICHM/TEM/0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED Page No: 30f 5
FUJ00155478
FUJ00155478
FUJITSU COMPANY IN CONFIDENCE
CHANGE PROPOSAL
ID: PWY_CP_4867 Create Date: 26-FEB-2009
Status: APPROVED Originator: Ken.Westfield
Title
HNG-X CP0336 - Enable analysis of Counter event messages within the
HNG-X Audit solution
Action Number: 2 Date Mar 24 2009 16:53:41 By: Ken.Westfield
Comments
Update from D Hinde regarding Audit Team and impact:
The development impact on this CP was based on retaining a
contractor, starting work at the beginning of April and delivering
before end June 2009. This CP urgently needs to progress through the
boards for approval if we are to achieve this.
If approval of this CP is delayed the development impact is likely to
increase as we will need to retain the contractor beyond the end of
June or find less skilled resource who will take longer to do the
work.
Action Number: 3 Date Mar 26 2009 13:01:39 By: Ken.Westfield
PCCB Minutes (586) 26-Mar-
09
CCB_PENDING
CP presented to PCCB by D Hinde on behalf of CS Security.
CP had been fully impacted and based on a delivery from Dev at the
end of June, LST would test this after that.
©Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE Ref: PGM/CHM/TEM/0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED Page No: 4of5
FUJ00155478
FUJ00155478
FUJITSU COMPANY IN CONFIDENCE
This was for a piece of work primarily within the Dev Audit team
which the Account had identified as a must-have. D Hinde confirmed
that he had discussed this with W Warham who had agreed that CS would
cover the cost of this work. D Hinde and G Allen stressed the urgency
in progressing the CP was that the identified resource to do the work
was due to leave next week.
ChM advised that the only o/s issue was for an impact from CS RM, but
that had been delivered before the PCCB and the paperwork had now
been updated.
PCCB had no further comments and set to CCB Pending.
Action Number: 4 Date Apr 1 2009 09:43:15 By: Ken.Westfield
CCB Minutes (530) 31-Mar-
09
APPROVED
CP presented by D Hinde and W Warham who confirmed that this was a
must have from CS perspective and as such W Warham had agreed to
cover the 100.5mds impacted (78.5 incremental).
S Denham identified that this was currently being performed by a
series of people using manual processes, with the inherent risk to
data integrity and was of the order of 9mds a month. G Wilkerson
queried the savings on this and after discussion S Denham identified
that this change was to introduce automation to bring us back to a
baseline position.
W Warham requested S Denham take an action to include this in the Cs
Forecast for April and S Denham agreed to do this.
Over and above that W Warham stressed that this was needed for
accreditation and for acceptance into service as reducing litigation
risk and improving data integrity and confidence in the records.
R Wright asked when this was expected to be delivered and D Hinde
stated that this was towards the end of June (i.e. post Pilot).
G Wilkerson identified that the CP contained the words “is fit for
purpose” and stated that this statement should not be used, even on
internal documents and P Sewell accepted an action to amend this.
CCB had no further comment and approved the CP.
Actions:
1. S Denham to include the mds are included in the CS Forecast for
April.
2. P Sewell to amend words in the CP from
“meets the contractual requirements”.
if fit for purpose” to
‘©Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE Ref. PGMICHM/TEM/0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED Page No: Sof 5
FUJ00155478
FUJ00155478
FUJITSU COMPANY IN CONFIDENCE
P.M.N. CP wording updated by P Sewell and ChM to reflect the request
made at CCB, Action complete.
Action Number: 5 Date Apr 1 2009 09:43:57 By: Ken.Westfield
Comments
Please be advised that the following CP has received full approval
from CCB. The CP status in PVCS is 'APPROVED'.
HNG-X CP 0336
Release HNG-X
cT/ccn N/A
Title Enable analysis of Counter event messages
within the HNG-X Audit solution
(PVCS CP Ref: 4867)
Areas affected for Planning purposes:
Dev
Integration
ITU
cs
Areas approved for work to commence for these tasks (i.e. Time
Recording)
All of above
Project Description: 123881
CT/CCN Owner: N/A
CP to be tagged for planning (Activity description and extension
field): 0336 - See notes below
CT/CCN to be tagged for planning (Activity description and extension
field): N/A
Documentation Affected: See CP body and history
Planned Activities Budget Notes:
Work to be planned with budget. The CP Impact Spreadsheet (v3) for
this change is in PVCS.
----------- END OF CHANGE PROPOSAL PWY_CP_4867 ----------
‘©Copyright Fujitsu Services Ltd 2007 COMPANY IN CONFIDENCE Ref: PGM/CHM/TEMI0001
Version: V1.0
Date: 17-NOV-07
UNCONTROLLED IF PRINTED Page No: 6 of 5