FUJ00157889
FUJ00157889
From: Mark Underwood! [i
Sent:
To: Godeseth,
Westbrook, Mark (UK -
lewsome, Pete!.
Ce: oy
Subject:
Hi Lewis,
I had a meeting with Fujitsu this afternoon, during which Pete said he and Torstein are working on this and should be
able to provide you with answers by the end of this week.
Mark
Mark Underwood
Head of Portfolio: Legal, Risk & Governance
Sent: 28 February 2017 17:06
To: Torstein.O.Godeset! “Mark Underwood1; Westbrook, Mark (UK - Manchester);
pete.newsome, losifidou, Elena (UK - London)
Cc: Wolstencroft, Liam (UK - Manchester); ‘jonathan.gribben}_
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Thanks Torstein
Is there any update on the below?
Thanks
Lewis
From: Torstein.O.Godese'
Sent: 22 February 2017 18:
To: Torstein.O.Godeset!
(UK - Leeds) I
ete.newsom
Cc: Wolstencroft, Liam (UK - Manchester) ¢_
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Keating, Lewis
Just a quick update to say that we have found a problem with the query and we are double checking that there are no
more.
The re-assuring news is that there is no evidence of missing JSNs.
Regards etc
Torstein in
FUJ00157889
FUJ00157889
Sent from my Windows Phone
From: Godeseth, Torstein
Sent: 22/02/2017 11:55
To: Mark Underwood1; Keating, Lewis (UK - Leeds); Westbrook, Mark (UK - Manchester); Newsome, Pete; losifidou,
Elena (UK - London’
Cc: Wolstencroft, Liam (UK - Manchester)
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Thanks — we have the data and will look at it shortly.
Regards etc
Torstein
From: Mark Underwood] [mailto}
Sent: Wednesday, February 22, 2017 11:31 AM
Tc Keating, Le
“>; Godeseth, Torstein
}; Westbrook, Mark (UK - Manchester) <_
losifidou, Elena (UK - London
Newsome, Pete _
Cc: Wolstencroft, Liam (UK - Manchester) <i
Subject: RE: Bramble: call to discuss analyti
Torstein should now be in receipt of the files.
Mark
Mark Underwood
Head of Portfolio: Legal, Risk & Governance
From: Keating, Lewis (UK - Leeds) [mailt:
Sent: 22 February 2017 10:07
To: Torstein .0.Godesetf
Cc: Mark Underwood1; Wolstencroft, Liam (UK - Manchester)
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
___GRO
Hello
We have provided some files to Huddle, the platform we are using with POL to share data.
The 3 files uploaded are:
- Summary sheet showing the 25 new ‘ARQ’ sets of data sampled, and from the 25 we sampled, the 4 which
had gaps. (“Analyticl_GapsinSessionID_Sample25”)
- _ List of all JSN gaps from the 25 new ‘ARQ’ sets of data. (“Analytic1_MissingJSNs”)
- Detailed example of 1 ARQ file requested based on missing Session ID’s in original data provided, with our
formulas in there so you can see where the gaps in JSN are (where the final column is greater than 1 after the
JSN have been ordered). (“Project_Sparrow”)
FUJ00157889
FUJ00157889
Mark U ~ are you able to process these to Torstein somehow? Alternatively if you are all happy for me to
password protect the documents and send via email with password being sent separately please let me know.
Thanks
Lewis
From: Torstein.O.Godeseth, _GRO GRO
Sent: 20 February 2017 17:30
To: Westbrook, Mark (UK - Manchester) ¢
a pete.newsomet
Keating, Lewis (UK - Leeds)
losifidou, Elena (UK - London)
Subject: RE: Bramble: call ‘to discuss analytics (Privileged & Coifidential)
Could you send me a spreadsheet which you believe demonstrates missing JSNs please? I presume this is one of the
25 ‘new’ ARQs which we provided. I have only looked at a couple of these.
Alternatively if you can send me the just the ‘Summary’ sheet from any suspect ARQs I can get the data from our
support team.
Regards etc.
Torstein
From: Westbrook, Mark (UK - Manchester) [mailto
Sent: Monday, February 20, 2017 4:30 PM
is (UK - Leeds)
josifidou, Elena (UK - London)
Newsome, Pete
Ce: Mark Underwood1 I
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Hello Torstein,
Just to check we are on the same page, we’ve taken onboard the fact that the session IDs are not
necessarily continuous, but that the JSNs are. My comments below are focused on the fact that the
new data, centred on JSNs, also has gaps in the sequencing. Given this seems too fundamental to the
correct operation of the system to possibly be true, I felt that there must still be a filter applied, and
picked out the italicised text from one of your previous emails which might support this:
“The explanation is that it is the JSN (journal sequence number) that is guaranteed to increase by
exactly one — i.e. no gaps. The JSN is used for more than just basket identifiers and so the gaps in the
Sessionld are explained by instances where the JSN has been used against something other than a
basket to record a block of data in the audit trail. In the specific example that I looked at the ‘missing’
JSN was used to record assembling a pouch in the branch.
The extract that was produced for this ARQ confirmed that there were no gaps or duplicates i in the .
I’ve highlighted the key sentence in yellow. Does this account for the gaps in the new data?
Sorry if you already had grasped all of the above and your below email remains pertinent, but felt it
worth double checking that you were aware we’re now focused on the new data centred on JSN,
because as far as we can see there are definitely gaps!
FUJ00157889
FUJ00157889
Thanks,
Mark
Mark Westbrook
Senior.Manaagec.J.Deloitte LLP
CO.UK
From: Torstein.O.Godese'
Sent: 20 February 2017 15:
To: Westbrook, Mark (UK - Manchester Keating, Lewis (UK - Leeds)
pete.newsom _osifidou, Elena (UK - London)
Cc: Mark Underwood! ¢
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Mark,
There are no gaps in JSNs from my analysis.
I will have another go at providing the explanation when I back to my laptop - probably tomorrow.
A key point, which I had missed previously is that the session ID which you have looked at in your analysis is not based
on JSN, so any gaps in session ID does not imply any gap in JSNs. The completeness of the sequence of JSNs for each
ARQ is confirmed on the Summary sheet in the spreadsheet.
Regards etc
Torstein
Sent from my Windows Phone
From: Westbrook, Mark (UK - Manchester)
Sent: 20/02/2017 12:35
To: Godeseth, Torstein; Keating, Lewis (UK - Leeds); Newsome, Pete; losifidou, Elena (UK - London)
Cc: Mark Underwood1
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Hello Torstein,
Thanks for the response below.
We have reviewed the response below and gone back over all evidence received on this analytic. In summary:
- The original Huddle data was used for Analytic 1 ‘gaps in transaction logs’. Gaps were found however further
investigation noted the analytic was ran on Session ID, not JSN as per description below. As such we obtained
new data including JSN field.
- New data for the specific instances where gaps were found was provided, this included the JSN field.
- We have re-ran the analytic and still found gaps in the JSN using this data (you can see gaps by simply
filtering A-Z in the JSN column.
o For example on sheet 403 (which you provided in the below email) the JSN numbers include 166762,
166765, however omit 166763 & 166764. There are many other gaps.
FUJ00157889
FUJ00157889
o We have also re-reviewed the full new dataset provided (i.e. all the new ARQ data) and have found
many gaps throughout. We had a detailed look at one sheet (REF: POIA4329B, BranchID: 223644) and
again noted many gaps in JSN (631447 — 631451)
- This causes concern as per your statement below there should be no JSN gaps “ this is explicitly confirmed as
part of the standard extract process — for each counter included in the extract we show the lowest message
number (JSN) and the highest message number and confirm there are no gaps and no duplicates.”
- Are you able to advise on a reason for these gaps? You noted someway below that
“The explanation is that it is the JSN (journal sequence number) that is guaranteed to increase by
exactly one — i.e. no gaps. The JSN is used for more than just basket identifiers and so the gaps in the
Sessionid are explained by instances where the JSN has been used against something other than a
basket to record a block of data in the audit trail. In the specific example that I looked at the ‘missing’
JSN was used to record assembling a pouch in the branch.
The extract that was produced for this ARQ confirmed that there were no gaps or duplicates in the
JSN sequence on the summary page; checking this is part of the standard extract process. However,
the data that is output to the spreadsheet is tailored to provide specific pertinent data.”
- Ifthe above holds true for the gaps in JSN noted above, are you able to advise how we can evidence this?
Currently these gaps in the JSN sequencing feel so fundamental to the correct operation of the Horizon system, that I
suspect there is still some kind of filter being applied to the data (especially given your commentary in the
penultimate bullet above), as the alternative would be fatal to all previous understanding and assurance over the
system.
Thanks,
Mark
Mark Westbrook
Senior Manager I_D
bi GRO
GRO
www. deloitte.co.uk
GRO! [mailto! “GRO
From: Torstein.O.Godese'
Sent: 12 February 2017 13:33
To: Keating, Lewi:
Manchester)
Cc: Mark Underwood1
Subject: RE: Bramble:
Lewis,
As indicated in my response of February 1% I promised I would check the ‘5’ you noted in the JSN/Session Id
comparison. I’m afraid I now have to grovel as my explanation of how the session number is generated was wrong — I
had jumped to a conclusion from a small sample of data. The integrity of the audit trail is not affected by my error, but
1am embarrassed nevertheless.
In fact the session number is generated using the USN (not the JSN). The definitions from DES/APP/HLD/0083 are
pasted below
JSN Journal Sequence Number. Every auditable message from the counter to
the BAL (e.g. settlement) will have a JSN associated with it.
FUJ00157889
FUJ00157889
Session Id / SSN Each Basket will have a unique Session Id associated with it. Session Ids
have the property that they contain a number that is always increasing for a
given counter.
Note: Session Ids are held “Mod 1,000,000” and so they can occasionally
wrap around to zero. This needs to be taken into account when comparing
values
USN The USN is a Unique Sequence Number managed by the Counter Business
Application for systems that require one. One is allocated by the counter for
each recoverable transaction. Its presence defines the transaction as
recoverable.
Note USNs are not used exclusively for recovery (e.g. Postage Labels)
From DES/APP/IFS/0018
Wy
horizonTxld Transactions id of the form “O0-“ + branch accounting code +
counter id + “-“ + usn
The JSN is the number that must have the property of incrementing by exactly 1 to demonstrate that no auditable
messages between counter and the central systems have been lost or inserted.
You will see from the ‘Summary’ sheet on the ARQs that this is explicitly confirmed as part of the standard extract
process — for each counter included in the extract we show the lowest message number (JSN) and the highest
message number and confirm there are no gaps and no duplicates.
There is no need for Session Id’s to demonstrate the same property as they are derived from a different source.
I have asked our support team to regenerate a couple of the ‘JSN’ queries to show the Sessionld (where there is one)
and attach these for information. These queries give a pretty good overview of the activities that took place at each
counter. Other, more specific queries, drill into the detail.
Regards etc.
Torstein
From: Godeseth, Torstein
Sent: Wednesday, February 1, 2017 10:03 AM
Newsome, Pet
josifidou, Elena (UK - London)
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Lewis,
Pete asked me to respond on the ‘new’ ARQ questions.
- Much fewer columns in ‘new’ ARQ data
This is a new query written specifically to show that all the JSNs are accounted for. In my view the query does that —
when you find ‘gaps’ in the original query you are able to confirm that the JSN was used for some other purpose (and
FUJ00157889
FUJ00157889
what that purpose was).
- ‘Time’ column called something different in both & also has a different time format.
The names given to columns are specified in the query used and I did not specify that the column name had to be
identical in this new query; we could obviously do this but I don’t think it would add value.
- JSN & SessionID column are called different things, and in the New extract this column seems to be prefixed
with a ‘5’. I don’t think the different format for time should be an issue — Excel may well have decided to
present it in a prettier way; if the values were different then that would be an issue.
As above on the column names; as this query is looking at JSNs specifically I would argue that JSN is the appropriate
heading. The previous extract it is appropriate to use Session!D as that has more meaning to the POL Business as a
‘session’ means something to a SubPostmaster whereas it is unlikely they would warm to the more technical
terminol The JSN i di structing the SessionID.
Finally I can assure you that the data in the new queries has been extracted from the same source with all the
checking of digital signatures and other safeguards that we have explained in the past.
Regards etc.
Torstein
From: Keating, Lewis (UK - Leeds) [ma
Sent: Tuesday, Januar
To: Newsome, Pete
Westbrook, Mark (UK - Manchester)
odeseth, Torstei >; losifidou, Elena (UK -
Cc: Mark Underwoodi }” GRO
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Thanks Pete
In addition to the below, we have a question on the additional ARQ data which we have received.
It is in a different format to the original data we received and we would like to understand why if possible. I will list a
few of the differences below for ease, however Torstein we can provide you with a line from each output ina
password protected excel via email if this will help.
- Much fewer columns in ‘new’ ARQ data
- ‘Time’ column called something different in both & also has a different time format.
- JSN & Session!ID column are called different things, and in the New extract this column seems to be prefixed
with a ‘5’.
Are we able to understand why these differences exist, has the data been extracted in a different way / froma
different source. This may be easier to discuss on a call.
Thanks
Lewis
GRO }
From: pete.newsomel
Sent: 30 January 2017 14:11
To: Westbrook, Mark (UK - Manchester) ¢
Mark Underwood1
‘eating, Lewis (UK - Leeds)
FUJ00157889
FUJ00157889
Torstein.O.Godeset!
Cc: Gribben, Jonathan < C
< GRO >; Kathryn Alexande:
Parsons, Andrew
Mark
Still in discussion. Will resolve this week.
Pete
Pete Newsome
Business Change Manager
Web: uk fujitsu,
&
KS Fujitsu named as
Responsible Business
of the Year
Fujitsu is proud to partner with Action for Children
I-CIO: Global Intelligence for the ClO. Fujitsu's online resource for ICT leaders
Sponsors of the 2015 Rugby World Cup
wv Please consider the environment - do you really need to print this email?
From: Westbrook, Mark (UK - Manchester) [mailto}
Sent: 27 January 2017 12:30
To: Newsome, Pete
Keating, Lewis (UK - Leeds)
losifidou, Elena (UK - Lond
Hello all,
I believe this is the latest email in the trail relating to further investigations on this analytic. I wanted
to keep this front of mind, and enquire as to latest status?
Thanks,
Mark
Mark Westbrook
Senior Manager I Deloitte ULI
)
FUJ00157889
FUJ00157889
{I www.deloitte.co.uk
From: pete.newsomel__
Sent: 19 January 2017 13:59
To: Mark Underwood1
‘eating, Lewis (UK - Leeds)
josifidou, Elena (UK - London)
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Mark
I am discussing currently with colleagues the amount of the work involved. I will hopefully be able to give a definitive
answer shortly.
Pete
Pete Newsome
Business Change Manager
Post Office Account, Fujitsu UK&l
Tel: GRO
Web: uk.fujitsu.com
a
Fujitsu named as
Responsible Business
of the Year
Fujitsu is proud to partner with Action for Children
{-CIO: Global Intelligence for the ClO. Fujitsu's online resource for ICT leaders
Sponsors of the 2015 Rugby World Cup
hv Please consider the environment - do you really need to print this email?
From: Mark Underwood1 [mailto
Sent: 19 January 2017 11:49
C Newsome, Pete
Parsons, Andrew
Kathryn Alexander <
lytics (Privileged & Confidential)
. GRO -
Subject: RE: Bramble: call to discuss a
Importance: High
FUJ00157889
FUJ00157889
Torstein,
Have you managed to address the points Lewis raises below just yet? From reading the below, it appears that to do so
will require a call. As such, could you please advise on which dates and timings you are available for the call to take
place?
Many thanks
Mark
From: Keating, Lewis (UK - Leeds) [mailto:
Sent: 12 January 2017 1
To: Torstein.O.Gode.
Ce: pete.newsomé estbrook, Mark (UK - Manchester); Gribben, Jonathan; Parsons, Andrew;
Kathryn Alexander: Mark Underwood1
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Torstein
Thanks for the response below.
We have reviewed the evidence/rationale provided and are broadly comfortable they provide a reasonable
explanation for 8 of the 15 items provided.
I think the next steps here are:
i) To see the other evidence to support the other items within the 15 provided. (we only have a rationale
for 8/15 to date)
ii) Conversation with you (or other Fujitsu SME) to discuss:
a. The evidence presented in order to confirm the source of the evidence & be verbally taken through it.
b. Review the evidence for all of the 15 items once they are provided (see point i), as the screenshots
only cover 2 items.
Thanks
Lewis
From: Torstein.O.Godeseth
Sent: 22 December 2016 10:22
To: losifidou, Elena (UK - London); GRO
Cc: pete.newsome,
Jonathan ¢
+ Gribben,
Parsons,
Mark
>; Keating, Lewis (UK - Leeds)
; ‘Kathryn Alexander’
Underwood! <i __... GRO I
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Elena,
Please find attached my explanation of the Analytic 6 observations as promised.
As you will be aware all of these observations relate to the now retired Horizon system and so we no longer have the
audit data for a number of them. The Mails application at the time was a package which was integrated into the main
Horizon system. The package was not written by Fujitsu.
FUJ00157889
FUJ00157889
It appears that on occasion the Mails package wrote records to the audit file which missed technical detail but there
is no reason to think this would have affected the postmasters’ accounts as far as I can see. Obviously we cannot
recreate the scenarios discussed in the attachment as we don’t have the facilities to run the old software.
Regards etc.
Torstein
From: losifidou, Elena (UK - London) [mailto’
Sent: Tuesday, December 20, 2016 11:26 A
To: Godeseth, Torstein
A>; k, Mark (UK - Manchester)
Gribben, Jonathang t—~CSCS GRO. I t; Keating, Lewis (UK -
ons, Andrew < GRO are thryn Alexander’
Mark Underwood1! 7
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential
Thanks Torstein makes sense.
Looking forward to the response you mentioned below.
Kind Regards,
Elena
Elena losifidou
From: Torstein.0.Godeseth
Sent: 20 December 2016 10:37
ribben,
Parsons,
; Mark
Underwood1 GRO. }
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Elena,
I cannot give guidance on whether further work should be done looking at other modes as it depends on what Post
Office is trying to achieve.
From my perspective the exercise using SC has identified a small number of instances where we can see that the
data from the audit trail has not been extracted by the extract tool, and I am finalising a response on that which will
explain the glitch. I am comfortable that for all the cases identified to date we can see detail in the audit trail which
shows what items were sold in the branch for each session in mode SC (Serve Customer).
Regards etc.
Torstein
From: losifidou, Elena (UK - London) [mailto’
Sent: Monday, December 19, 2016 10:48 Al
To: Godeseth, Torstei
Cc: Newsome, Pete
Westbrook, Mark (UK - Manchester)
FUJ00157889
FUJ00157889
<markwestbrook!..... GRO... }
Leeds
Gribben, Jonathan ¢7~ —_ GRO ° “I, Keating, Lewis (UK -
arsons, Andrew < hryn Alexander’
>; Mark UnderwoodT”
Subject: RE: Bramble: call to discuss analytics (Privileged &
Torstein,
The analytic was designed to look at imbalances with session ids under mode ‘SC’. For those cases as I mentioned
below all the cases fall into your buckets of a) being relatively small and b) being negative.
If we want to look at session ids with all modes then I will have to re-design the analytic (and I don’t know what the
results will look like) and this is what I am asking whether it’s something you want us doing or not to help with your
investigation.
Kind Regards,
Elena
Elena losifidou
Del
Mi
From: Torstein.O.Godesetht
Sent: 19 December 2016 10:40
To: losifidou, Elena (UK - London
} Parsons,
; Mark
Underwood1
Subject: RE: Bramble: cal
Elena,
lf you have identified other issues in interpreting the data which currently show imbalances can you send the details
as soon as possible so that we can investigate further,
Regards etc.
Torstein
From: losifidou, Elena (UK - London) [mailto
Sent: Monday, December 1:
To: Godeseth, Torstejn..
Cc: Newsome, Pete < GRO
'Gribben, Jonathan
; Parsons, Andrew ¢_
“>; Mark Underwood1
all to discuss analytics (Privileged & Confidential)
; Keating, Lewis (UK -
Kathryn Alexander’
,
Hi Torstein,
To answer your question below - with the analytic performed on the session ids with ‘SC’ mode, all the imbalances are
relatively small and negative.
If we want to include the full population, I believe there were bigger imbalances involved but I will have to re-run the
analytic to confirm that - will that help with your investigation?
FUJ00157889
FUJ00157889
Kind Regards,
Elena
Elena losifidou
Deloitte LLP I Risk Analytics
From: Torstein.O.Godeseth
Sent: 16 December 2016 16:38
To: losifidou, Elena.
Cc: pete.newsomé _
Subject: RE: Brambl
all to discuss analytics (Privileged & Confidential)
I think I saw one instance where it looked as though the basket would balance if you included a non ‘SC’ item in it. I
think I would go for the full population as being valid for balancing the session.
Regards etc.
Torstein
From: losifidou, Elena (UK - London) [mailto
Sent: Friday, December 16, 2016 4:35 PM
To: Godeseth, Torstein
Cc: Newsome, Pete <_
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Torstein,
Do you have a view on whether the balancing of the session ids should have happened on the ‘SC’ mode only or the
full population?
Kind Regards,
Elena
Elena losifidou
From: Torstein.O.Godesethi
Sent: 16 December 2016 15:36
To: losifidou, Elena (UK - London) < GRO _P
Cec: pete.newsome!
Subject: RE: Brambl
all to discuss analytics (Privileged & Confidential)
Elena,
Apologies. A cut and paste problem on my part.
The missing text is:
e The amount is negative
e@ The amount is relatively small
Regards etc.
FUJ00157889
FUJ00157889
Torstein
From: losifidou, Elena (UK - London) [mailto:,
Sent: Friday, December 16, 2016 3:04 PM
To: Godeseth, Torstein ¢ GRO
Ce: Westbrook, Mark (UK - Manchester) ¢
RO
Keating, lewis (UK-Teeds
athryn Alexander’
‘arsons, Andrew
Mark
Underwood1
Subject: RE: Bra ged & Confidential)
Hi Torstein,
Thanks for coming back to us with regards to analytic6.
I just wanted to clarify, to be able to progress your diagnosis, are you asking for the remaining cases or is there some
text missing after “-‘ below?
Kind Regards,
Elena
Elena losifidou
From: Torstein.O.Godeseth:
Sent: 45 December 2016 11:06
arsons, Andrew
Mark
Subject: RE: Bramble: call to discuss analytics (Privi jéged & Confidential)
Elena,
I am responding to the request for an update on analytic6 — see highlight below.
We have now looked at the raw data from the audit files for a number of the cases you identified and I can confirm
that there is data which is not being extracted into the spreadsheet. For the cases we have analysed there is a
common cause for the failure to extract, but it would help us to progress our diagnosis if you could confirm that in all
instances you have found;
Regards etc.
Torstein
From: losifidou, Elena (UK - London) [mailto}
Sent: Tuesday, December 13, 2016 10:13 AM
To: Godeseth, Torstein <_
Ce: Westbrook, Mark (UK - Manchester)
arsons, Andrew
Mark
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
FUJ00157889
FUJ00157889
Hi Torstein,
Thanks for the response below with regards to analytic1.
We have discussed internally and to get the assurance we need on this, we propose the below approach, let
us know you thoughts:
Deloitte to select a sample of 25 session ids identified with gaps and share them with you and for those
respective ARQs to get the additional transactions for that month (i.e. the session ids that don’t hit the
basket) to verify the completeness of JSNs? Will that work from your side?
Also hada ch at analytic6.
Kind Regards,
Elena
Elena losifidou
Deloitte LLP LR
From: Torstein.O.Godesetht
Sent: 09 December 2016 12:
To: losifidou, Elena (UK - London)
pete.newsome}
Gribl
>; ‘Kathryn Alexander’ +
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Elena,
Now I am back from leave I have had a look at the query about ‘missing sessions’ that you raised in your
email of 30" November (analytic 1). I looked specifically at the example
M126\ARQ 247\01-31 Aug 2011.xls 151306
The explanation is that it is the JSN (journal sequence number) that is guaranteed to increase by exactly one —
i.e. no gaps. The JSN is used for more than just basket identifiers and so the gaps in the SessionId are
explained by instances where the JSN has been used against something other than a basket to record a block of
data in the audit trail. In the specific example that I looked at the ‘missing’ JSN was used to record assembling
a pouch in the branch.
The extract that was produced for this ARQ confirmed that there were no gaps or duplicates in the JSN
sequence on the summary page; checking this is part of the standard extract process. However, the data that is
output to the spreadsheet is tailored to provide specific pertinent data.
T attach the raw data for JSN 11425.
Regards etc
Torstein
FUJ00157889
FUJ00157889
From: losifidou, Elena (UK - London) [mailto!_.
Sent: Wednesday, November 30, 2016 12:54 PM
To: Godeseth, Torstein
Cc: Westbrook, Mark (UK - Manchester)
Newsome, Pete ¢
Parsons, Andrew
; Mark
8,
‘Kathryn Alexander’
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Torstein thanks for the note below.
Pete — let me know if you need any clarification on the revised output of analytic 6.
On the call we had previously, one of the agreed actions for analytic 1 (Identify gaps in audit log sequencing) was to
test whether the session ids have gaps between them instead of the combination of session ids and transaction ids we
used previously.
Therefore, we re-designed the analytic to look at gaps in session ids only, but we still found gaps between them.
I have attached 5 example cases and I also copied the data from their raw files on the respective tabs highlighting
where the issue is. Torstein/Pete, can you please have a look on the attached to check whether this is something
you’d expect or whether we are missing anything? Could it be branches with multiple stock units?
Kind Regards,
Elena
Elena losifidou
Deloitte LLP I Risk Analytics
From: Torstein.O.Godese'
Sent: 25 November 2016 18:32
To: losifidou, Elena (UK - London) {~
Cc: Westbrook, Mark (UK - Manchester)
Lewis (UK - Leeds)
Kathryn Alexander’
Apologies - whilst I have had a very quick look at this I have not been able to spend enough time on it.
I will be in leave this coming week and will catch up with Pete on my return.
Regards etc
Torstein
Sent from my Windows Phone
From: losifidou, Elena (UK - London
Sent: 22/11/2016 23:35
To: Godeseth, Torstein
Cc: Westbrook, Mark (UK - Manchester); Gribben, Jonathan; Newsome, Pete; Keating, Lewis (UK - Leeds); Parsons,
Andrew; ‘Kathryn Alexander’; Mark Underwood1
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Hi Torstein,
FUJ00157889
FUJ00157889
Thanks for sending the below information through for analytic 6. We took that into account and re-
performed the reconciliation.
Please note that this is work in progress but there are still 40 session ids that don’t balance —I am attaching
the top 15.
Would it be possible to have a look at these please as it might help us identify another cause of this?
Finally we were advised by the case handlers to perform this exercise on the ‘SC’ mode only, is that your
understanding too?
Kind Regards,
Elena
Elena losifidou
From: Westbrook, Mark (UK - Manchester)
Sent: 17 November 2016 16:37
To: Torstein.O.Godeseth
Thanks Torstein.
That would appear to likely explain it. Should hopefully be a simple job for the data team to revise
their analytic to account for and check this explains those 59 cases.
Thanks,
Mark
Mark Westbrook
Senior Manager I Deloitte LLP.
From: Torstein.O.Godese'
Sent: 17 November 2016 11
To: Gribben, Jonathan <
Alexander
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
All,
My curiosity got the better of me and I asked our support team to redo the first two ARQs on the Analytics 6 sheet.
FUJ00157889
FUJ00157889
In both cases I get the session to balance to zero — as it should.
What looks likely here is that the basket was not fully captured in the analysis as the size of the ARQ extends to two
sheets in Excel — this was set up in the days when you could only get 60,000 or so rows ona sheet; in both cases there
are entries for the basket (Sessionld) on the both sheets. In both cases the values on Sheet 1 sum to the Balance
shown on the Analytic 6 summary.
Hope this helps resolution. The attachment lists all of the records I found.
Regards etc.
Torstein
From: Gribben, Jonathan}
Sent: Thursday, November 17, 2016 11:59 AM
To: Newsome, Pete : GRO
Parsons, Andre’
ting, Lewis (UK - Leeds}
Westbrook, Mark (UK - Manchester)
Kathryn Alexander’
Godeseth, Torstei GRO b
iscuss analytics (Privileged & Confidential) ~ :
Dear all,
Here are the agreed actions arising out of this morning's (slightly delayed) call:
Analytic 4
In light of Torstein’s explanation that transaction IDs do not need to be continuous, whereas session IDs contain the
last few digits of JSNs and therefore should be continuous, Deloitte are going to check whether there are any gaps in
the session IDs.
Deloitte to arrange a walkthrough to observe/verify the effect of a branch deleting a transaction on the Branch
Database.
Analytic 6
In the first instance Kath is going to review the data in respect of the 15 samples identified by Deloitte and look for any
patterns (e.g. transactions that are common to every example). That will inform next steps.
One option might be for Fujitsu to re-extract data for audit trail, although everyone expects that the data will be the
same as that previously extracted.
If no patterns are identified and data is the same on re-extraction, we may be in genuine exception territory. However
Deloitte could attempt validation by reviewing documents in relation to Legacy Horizon.
Please let me know if I've missed anything and thanks again for your time.
Kind regards
Jonny
FUJ00157889
FUJ00157889
From: Keating, Lewis (UK - Leeds);
Sent: 16 November 2016 14:50
i>; Newsome, Pete
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Hello all
Please find attached some samples for the 2 analytics we are following up / discussing tomorrow.
Thanks
Lewis
Jonathan Gribben
Managing Associate
Bond Dickinson LLP
Cond Diclcingow
ico GRO
Office:!_
Follow Bond Dickinson
Wy inI
www.bonddickinson.com
-----Original Appointment:
From: Gribben, Jonathan [ma
Sent: 15 November 2016 12:58
To: Gribben, Jonathan; Parsons, Andrew; Westbrook, Mark (UK - Manchester); Keating, Lewis (UK - Leeds); losifidou,
Elena (UK - London); 'Kathryn Alexander’; Torstein.O.Godeset! pete.newsom
Subject: Bramble: call to discuss analytics (Privileged & Confidential)
When: 17 November 2016 11:00-12:30 (UTC+00:00) Dublin, Edinburgh, Lisbon, London.
Where: Conference Call
Dear all,
Thank you for confirming your availability to attend this call.
FUJ00157889
FUJ00157889
Data samples will be circulated in advance.
Kind regards
Jonny
Join by Phone
Find’a local'number
Conference ID: 3926783
Forgot your dial-in PIN?I First online meeting?
wocqt03300
Please consider the environment! Do you need to print this email?
IMPORTANT NOTICE
This communication is from Deloitte LLP, a limited liability partnership registered in England and Wales with registered number 0C303675. Its registered office is 2,
New Street Square, London EC4A 3BZ, United Kingdom. Deloitte LLP is the United Kingdom member firm of Deloitte Touche Tohmatsu Limited (“DTTL"), a UK private
company limited by guarantee, whose member firms are legally separate and independent entities. Please see www.deloitte.co.uk/about for a detailed description
of the legal structure of DTTL and its member firms.
This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the
intended recipient(s), please (1) notify it.security.ukL__ GRO forwarding this email and delete all copies from your system and (2) note that disclosure,
distribution, copying or use of this communication is strictly prohibited. Email communications cannot be guaranteed to be secure or free from error or viruses. All
emails sent to or from a Deloitte UK email account are securely archived and stored by an external supplier within the European Union
To the extent permitted by law, Deloitte LLP does not accept any liability for use of or reliance on the contents of this email by any person save by the intended
recipient(s) to the extent agreed in a Deloitte LLP engagement contract.
Opinions, conclusions and other information in this email which have not been delivered by way of the business of Deloitte LLP are neither given nor endorsed by it.
Any files attached to this e-mail will have been checked by us with virus detection software before transmission. Bond Dickinson LLP accepts no liability for any loss or damage
which may be caused by software viruses and you should carry out your own virus checks before opening any attachment.
Content of this email which does not relate to the official business of Bond Dickinson LLP, is neither given nor endorsed by it.
This email is sent by Bond Dickinson LLP which is a limited liability partnership registered in England and Wales under number 0C317661. Our registered office is 4 More
London Riverside, London, SE 2AU, where a list of members’ names is open to inspection. We use the term partner to refer to a member of the LLP, or an employee or
consultant who is of equivalent standing. Our VAT registration number is GB123393627.
Bond Dickinson LLP is authorised and regulated by the Solicitors Regulation Authority.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
FUJ00157889
FUJ00157889
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
FUJ00157889
FUJ00157889
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
HERR 22 RR A 2K 2A EAR A 2K 2 2K ARR 0K 21 2 KR 0K 24 2 KOR A Df Oo aaa
This email and any attachments are confidential and intended for the addressee only. If you are not the named
recipient, you must not use, disclose, reproduce, copy or distribute the contents of this communication. If you
have received this in error, please contact the sender by reply email and then delete this email from your
system. Any views or opinions expressed within this email are solely those of the sender, unless otherwise
specifically stated.
POST OFFICE LIMITED is registered in England and Wales no 2154540. Registered Office: Finsbury Dials,
20 Finsbury Street, London EC2Y 9AQ.
HE 2 A FRR 2 2K 2A FAR fA 2 FRR 0K 22 GK 024 KR ER A a aa
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
FUJ00157889
FUJ00157889
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.