FUJ00170220
FUJ00170220
From: Godeseth, Torstein[/O=FUJITSU EXCHANGE ORGANIZATION/OU=EXCHANGE
ADMINISTRATIVE GROUP
(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=73367F867463422895A41 1E49BD]
Sent: Wed 01/03/2017 8:08:17 AM (UTC)
To: Keating, Lewis (UK - Leeds)f
ee
Ce: Wolstencroft, Liam (UK - Manchester):
‘jonathan. gribbet
Subject: I RE: Bramble: call to discuss analytics (Privileged & Confidential)
Lewis,
We have now amended the query and re-run the ’25 ARQ set’ and the data should be coming across if it’s not already
there.
I have checked that we now have the correct number of records on the detail sheet when compared against the
number of JSNs reported on the summary sheet.
The query we ran previously specified ‘GenericRequestDTO’ as you can see on the summary sheets of the previous
set -
t
for $s in fn:doc("Filteredhx.xml")/*/GenericRequestDTO
In the new query we have removed this restriction which allows the hitherto missing JSNs to be picked up.
{
for $s in fn:doc("Filteredhx.xml")/*/*
You will see that these JSNs relate to CutOff reports.
Regards etc
Torstein
From: Keating, Lewis (UK - Leeds)
Sent: Tuesday, February 28, 2017
To: Godeseth, Torstei:
pes
Mark Underwood1
k, Mark (UK - Manchester)!
losifidou, Elena (UK - London):
Newsome, Pete:
Cc: Wolstencroft,
<jonathan.gribbet
Subject: RE: Bramble: ca’
GRO J
iscuss analytics (Privileged & Confidential)
Thanks Torstein
Is there any update on the below?
Thanks
Lewis
From: Torstein.O.Godese'
FUJ00170220
FUJ00170220
Sent: 22 February 2017 1:
Keating, Lewis
Cc: Wolstencroft, Liam (UK - Mancheste
Subject: RE: Bramble: call to discuss analy'
Just a quick update to say that we have found a problem with the query and we are double checking that there are no
more.
The re-assuring news is that there is no evidence of missing JSNs.
Regards etc
Torstein in
Sent from my Windows Phone
From: Godeseth, Torstein
Sent: 22/02/2017 11:55
To: Mark Underwood1; Keating, Lewis (UK - Leeds); Westbrook, Mark (UK - Manchester); Newsome, Pete; losifidou,
Elena (UK - London
Cc: Wolstencroft, Liam (UK - Manchester)
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Thanks — we have the data and will look at it shortly.
Regards etc
Torstein
From: Mark Underwood1i. GRO.
Sent: Wednesday, February 22, 2017 11:31 AM
To: Keating, Lewis (UK - Leeds)! GRO}; Godeseth, Torstein
jark (UK - Manchester:
ifidou, Elena (UK - London}
Newsome, Pete!” >; losi
Cc: Wolstencroft,
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Torstein should now be in receipt of the files.
Mark
Mark Underwood
Head of Portfolio: Legal, Risk & Governance
From: Keating, Lewis (UK - Leeds)
Sent: 22 February 2017 10:07
To: Torstein.O.Godeset!
losifidou, Elena (UK - London)
Cc: Mark Underwood1; Wolstencroft, Liam (UK - Manchester)
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
estbrook, Mark (UK - Manchester); pete. newsome”
FUJ00170220
FUJ00170220
Hello
We have provided some files to Huddle, the platform we are using with POL to share data.
The 3 files uploaded are:
Summary sheet showing the 25 new ‘ARQ’ sets of data sampled, and from the 25 we sampled, the 4 which
had gaps. (“Analyticl_GapsInSessionID_Sample25”)
- List of all JSN gaps from the 25 new ‘ARQ’ sets of data. (“Analytic1_MissingJSNs”)
- Detailed example of 1 ARQ file requested based on missing Session ID’s in original data provided, with our
formulas in there so you can see where the gaps in JSN are (where the final column is greater than 1 after the
JSN have been ordered). (“Project_Sparrow”)
Mark U ~ are you able to process these to Torstein somehow? Alternatively if you are all happy for me to
password protect the documents and send via email with password being sent separately please let me know.
Thanks
Lewis
From: Torstein.O.Godesethi,
Sent: 20 February 2017 17:30
To: Westbrook, Mark (UK - Manchester]
Keating, Lewis (UK - Leeds)
lena (UK - London)
Could you send me a spreadsheet which you believe demonstrates missing JSNs please? I presume this is one of the
25 ‘new’ ARQs which we provided. I have only looked at a couple of these.
Alternatively if you can send me the just the ‘Summary’ sheet from any suspect ARQs I can get the data from our
support team.
Regards etc.
Torstein
From: Westbrook, Mark (UK - Manchestet
Sent: Monday, Februar >M.
_ GRO
Newsome, Pete
+ Keating, Lewis (UK - Leeds)
; losifidou, Elena (UK - London)
Cc: Mark Underwood1i. GRO
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Hello Torstein,
Just to check we are on the same page, we've taken onboard the fact that the session IDs are not
necessarily continuous, but that the JSNs are. My comments below are focused on the fact that the
new data, centred on JSNs, also has gaps in the sequencing. Given this seems too fundamental to the
correct operation of the system to possibly be true, I felt that there must still be a filter applied, and
picked out the italicised text from one of your previous emails which might support this:
FUJ00170220
FUJ00170220
“The explanation is that it is the JSN (journal sequence number) that is guaranteed to increase by
exactly one — i.e. no gaps. The JSN is used for more than just basket identifiers and so the gaps in the
Sessionid are explained by instances where the JSN has been used against something other than a
basket to record a block of data in the audit trail. In the specific example that I looked at the ‘missing’
JSN was used to record assembling a pouch in the branch.
The extract that was produced for this ARQ confirmed that there were no gaps or duplicates in the
JSN sequ ummary pag recking thi is part of th standard h
I’ve highlighted the key sentence in yellow. Does this account for the gaps in the new data?
Sorry if you already had grasped all of the above and your below email remains pertinent, but felt it
worth double checking that you were aware we’re now focused on the new data centred on JSN,
because as far as we can see there are definitely gaps!
Thanks,
Mark
Mark Westbrook
ager I
TMarkwestbrook www.deloitte,co.uk
From: Torstein.O.Godeseth¢”
Sent: 20 February 2017 15:41
_To: Westbrook, Mark (UK - Manchester}
pete.newsomeé
}; Keating, Lewis (UK - Leeds)
josifidou, Elena (UK - London)
Ce: Mark Underwood1;
Subject: RE: Bramble: c:
Mark,
There are no gaps in JSNs from my analysis.
I will have another go at providing the explanation when I back to my laptop - probably tomorrow.
A key point, which I had missed previously is that the session ID which you have looked at in your analysis is not based
on JSN, so any gaps in session ID does not imply any gap in JSNs. The completeness of the sequence of JSNs for each
ARQ is confirmed on the Summary sheet in the spreadsheet.
Regards etc
Torstein
Sent from my Windows Phone
From: Westbrook, Mark (UK - Manchester)
Sent: 20/02/2017 12:35
To: Godeseth, Torstein; Keating, Lewis (UK - Leeds); Newsome, Pete; losifidou, Elena (UK - London)
Cc: Mark Underwood1
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Hello Torstein,
FUJ00170220
FUJ00170220
Thanks for the response below.
We have reviewed the response below and gone back over all evidence received on this analytic. In summary:
- The original Huddle data was used for Analytic 1 ‘gaps in transaction logs’. Gaps were found however further
investigation noted the analytic was ran on Session ID, not JSN as per description below. As such we obtained
new data including JSN field.
- New data for the specific instances where gaps were found was provided, this included the JSN field.
- We have re-ran the analytic and still found gaps in the JSN using this data (you can see gaps by simply
filtering A-Z in the JSN column.
o For example on sheet 403 (which you provided in the below email) the JSN numbers include 166762,
166765, however omit 166763 & 166764. There are many other gaps.
o We have also re-reviewed the full new dataset provided (i.e. all the new ARQ data) and have found
many gaps throughout. We had a detailed look at one sheet (REF: POIA43298B, BranchID: 223644) and
again noted many gaps in JSN (631447 — 631451)
- This causes concern as per your statement below there should be no JSN gaps ” this is explicitly confirmed as
part of the standard extract process — for each counter included in the extract we show the lowest message
number (JSN) and the highest message number and confirm there are no gaps and no duplicates.”
- Are you able to advise on a reason for these gaps? You noted someway below that
“The explanation is that it is the JSN (journal sequence number) that is guaranteed to increase by
exactly one — i.e. no gaps. The JSN is used for more than just basket identifiers and so the gaps in the
Sessionld are explained by instances where the JSN has been used against something other than a
basket to record a block of data in the audit trail. In the specific example that I looked at the ‘missing’
JSN was used to record assembling a pouch in the branch.
The extract that was produced for this ARQ confirmed that there were no gaps or duplicates in the
JSN sequence on the summary page; checking this is part of the standard extract process. However,
the data that is output to the spreadsheet is tailored to provide specific pertinent data.”
- If the above holds true for the gaps in JSN noted above, are you able to advise how we can evidence this?
Currently these gaps in the JSN sequencing feel so fundamental to the correct operation of the Horizon system, that I
suspect there is still some kind of filter being applied to the data (especially given your commentary in the
penultimate bullet above), as the alternative would be fatal to all previous understanding and assurance over the
system.
Thanks,
Mark
Mark Westbrook
“THiaTRWESHBFOS WWW ARTSTEE.CO.uk
From: Torstein.O.Godeseth¢ GRO i
Sent: 12 February 2017 13:33
To: Keating, Lewis (UK - Leeds) ; pete.newsome
Manchester? GRO +; losifidou, Elena (UK - London
Cc: Mark Underwood1! GRO ms
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Westbrook, Mark (UK -
FUJ00170220
FUJ00170220
Lewis,
As indicated in my response of February 1* I promised I would check the ‘5’ you noted in the JSN/Session Id
comparison. I’m afraid I now have to grovel as my explanation of how the session number is generated was wrong — I
had jumped to a conclusion from a small sample of data. The integrity of the audit trail is not affected by my error, but
I am embarrassed nevertheless.
In fact the session number is generated using the USN (not the JSN). The definitions from DES/APP/HLD/0083 are
pasted below
JSN Journal Sequence Number. Every auditable message from the counter to
the BAL (e.g. settlement) will have a JSN associated with it.
Session Id / SSN Each Basket will have a unique Session Id associated with it. Session Ids
have the property that they contain a number that is always increasing for a
given counter.
Note: Session Ids are held “Mod 1,000,000” and so they can occasionally
wrap around to zero. This needs to be taken into account when comparing
values
USN The USN is a Unique Sequence Number managed by the Counter Business
Application for systems that require one. One is allocated by the counter for
each recoverable transaction. Its presence defines the transaction as
recoverable.
Note USNs are not used exclusively for recovery (e.g. Postage Labels)
From DES/APP/IFS/0018
horizonTxld Transactions id of the form “O0-“ + branch accounting code + “-” +
counter id + “-“ + usn
The JSN is the number that must have the property of incrementing by exactly 1 to demonstrate that no auditable
messages between counter and the central systems have been lost or inserted.
You will see from the ‘Summary’ sheet on the ARQs that this is explicitly confirmed as part of the standard extract
process — for each counter included in the extract we show the lowest message number (JSN) and the highest
message number and confirm there are no gaps and no duplicates.
There is no need for Session Id’s to demonstrate the same property as they are derived from a different source,
I have asked our support team to regenerate a couple of the ‘ISN’ queries to show the Sessionld (where there is one)
and attach these for information. These queries give a pretty good overview of the activities that took place at each
counter. Other, more specific queries, drill into the detail.
Regards etc.
Torstein
FUJ00170220
FUJ00170220
From: Godeseth, Torstein
Sent: Wednesday, February 1, 2017 10:03 AM
To: 'Keating, Lewis (UK - Leeds)'
Westbrook, Mark (UK - Manchester’
G i
Cc: Mark Underwood1} GRO +
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Newsome, Pete
Lewis,
Pete asked me to respond on the ‘new’ ARQ questions.
- Much fewer columns in ‘new’ ARQ data
This is a new query written specifically to show that all the JSNs are accounted for. In my view the query does that —
when you find ‘gaps’ in the original query you are able to confirm that the JSN was used for some other purpose (and
what that purpose was).
- ‘Time’ column called something different in both & also has a different time format.
The names given to columns are specified in the query used and I did not specify that the column name had to be
identical in this new query; we could obviously do this but I don’t think it would add value.
- JSN & SessionID column are called different things, and in the New extract this column seems to be prefixed
with a ‘5’. I don’t think the different format for time should be an issue — Excel may well have decided to
present it in a prettier way; if the values were different then that would be an issue.
As above on the column names; as this query is looking at JSNs specifically I would argue that JSN is the appropriate
heading. The previous extract it is appropriate to use SessionID as that has more meaning to the POL Business as a
‘session’ means something to a SubPostmaster whereas it is unlikely they would warm to the more technical
Finally I can assure you that the data in the new queries has been extracted from the same source with all the
checking of digital signatures and other safeguards that we have explained in the past.
Regards etc.
Torstein
From: Keating, Lewis (UK - Leeds} GRO i
Sent: Tuesday, Janu:
Westbrook, Mark (UK - Manchester)
losifidou, Elena (UK -
Cc: Mark Underwood1;.
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Thanks Pete
In addition to the below, we have a question on the additional ARQ data which we have received.
It is in a different format to the original data we received and we would like to understand why if possible. I will list a
few of the differences below for ease, however Torstein we can provide you with a line from each output in a
password protected excel via email if this will help.
- Much fewer columns in ‘new’ ARQ data
FUJ00170220
FUJ00170220
- ‘Time’ column called something different in both & also has a different time format.
- JSN & SessionID column are called different things, and in the New extract this column seems to be prefixed
with a ‘5’,
Are we able to understand why these differences exist, has the data been extracted in a different way / froma
different source. This may be easier to discuss on a call.
Thanks
Lewis
From: pete.newsome; _
Sent: 30 January 2017 14:11
To: Westbrook, Mark (UK - Manchester] 4 _..-} Mark Underwood1
! +; Keating, Lewis (UK - Leeds) _
llosifidou, Elena (UK - London): GRO i
t Kathryn Alexander
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential
Mark
Still in discussion. Will resolve this week.
Pete
Pete Newsome
Business Change Manager
Pos}-Office Accaunt., Fujitsu UK&l
Web: http://uk.fujitsu.com
Web: uk.fujitsu.com
SS Fujitsu named as
Responsible Business
of the Year
Fujitsu is proud to partner with Action for Children
I-ClO: Global Intelligence for the ClO. Fujitsu's online resource for ICT leaders
Sponsors of the 2015 Rugby World Cup
= Please consider the environment - do you really need to print this email?
From: Westbrook, Mark (UK - Manchester)!
Sent: 27 January 2017 1:
“} Mark Underwood1!
Godeseth, Torstein +__
To: Newsome, Pete
Keating, Lewis (UK - Leeds) :
losifidou, Elena (UK - London) I
GRO
FUJ00170220
FUJ00170220
Hello all,
I believe this is the latest email in the trail relating to further investigations on this analytic. I wanted
to keep this front of mind, and enquire as to latest status?
Thanks,
Mark
Mark Westbrook
From: pete.newsome:
Sent: 19 January 2017 1.
Keating, Lewis (UK - Leeds)
_5 losifidou, Elena (UK - London)
“>; Gribben, Jonathan
Mark
am discussing currently with colleagues the amount of the work involved. I will hopefully be able to give a definitive
answer shortly.
Pete
Pete Newsome
Business Change Manager
Post Office Account, Fujitsu UK&l
Web: uk fujitsu.com
o £I¥inIe\c-
¢
& Fujitsu named as
Responsible Business
of the Year
Fujitsu is proud to partner with Action for Children
FUJ00170220
FUJ00170220
\-ClO: Global Intelligence for the ClO. Fujitsu's online resource for ICT leaders
Sponsors of the 2015 Rugby World Cup
vA Please consider the environment - do you really need to print this email?
GRO-
From: Mark Underwoo
Sent: 19 January 2017 1.
To: Keating, Lewis (UK - Leeds,
GRO bi Godeseth, Torstein
a (UK - London)
Westbrook, Mark (UK - Manchester)
en, Jonathan i.
Kathryn Alexander ¢
all to discuss analytics (Privileged & Confidential)
Cc: Newsome, Pete:
4 Parsons, Andrew
Subject: RE: Bramb!
Importance: High
Torstein,
Have you managed to address the points Lewis raises below just yet? From reading the below, it appears that to do so
will require a call. As such, could you please advise on which dates and timings you are available for the call to take
place?
Many thanks
Mark
From: Keating, Lewis (UK - Leeds);
Sent: 12 January 2017 1.
To: Torstein.O.Godeseth¢ I losifidou, Elena (UK - London)
Cc: pete.newsome: C estbrook, Mark (UK - Manchester); Gribben, Jonathan; Parsons, Andrew;
Kathryn Alexander; Mark Underwood1
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Torstein
Thanks for the response below.
We have reviewed the evidence/rationale provided and are broadly comfortable they provide a reasonable
explanation for 8 of the 15 items provided.
I think the next steps here are:
i) To see the other evidence to support the other items within the 15 provided. (we only have a rationale
for 8/15 to date)
ii) Conversation with you (or other Fujitsu SME) to discuss:
a. The evidence presented in order to confirm the source of the evidence & be verbally taken through it.
b. Review the evidence for all of the 15 items once they are provided (see point i), as the screenshots
only cover 2 items.
Thanks
Lewis
FUJ00170220
FUJ00170220
From: Torstein.O.Godese'
Sent: 22 December 2016 10:
To: losifidou, Elena_(U:
Cc: pete.newsome! ; Gribben,
Jonatha “I Keating, Lewis (UK - Leeds) 4. Parsons,
‘athryn Alexander’
Andrew
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Elena,
Please find attached my explanation of the Analytic 6 observations as promised.
As you will be aware all of these observations relate to the now retired Horizon system and so we no longer have the
audit data for a number of them. The Mails application at the time was a package which was integrated into the main
Horizon system. The package was not written by Fujitsu.
It appears that on occasion the Mails package wrote records to the audit file which missed technical detail but there
is no reason to think this would have affected the postmasters’ accounts as far as I can see. Obviously we cannot
recreate the scenarios discussed in the attachment as we don’t have the facilities to run the old software.
Regards etc.
Torstein
From: losifidou, Elena (UK - London{,
Sent: Tuesday, December 20, 2016 11:26 AM
To: Godeseth, Torstei
Cc: Newsome, Pete
Westbrook, Mark (UK - Manchester)
Keating, Lewis (UK -
‘Kathryn Alexander’
Gribben, Jonathan:
‘arsons, Andrew
Thanks Torstein makes sense.
Looking forward to the response you mentioned below.
Kind Regards,
Elena
Elena losifidou
Deloitte LLP I Risk Analytics
From: Torstein.O.Godese'
Sent: 20 December 2016 10:37
To: losifidou, Elen:
Ce: { ribben,
Jonathan ; Keating, Lewis (UK - Leeds) _§ Parsons,
Andrew <i... athryn Alexander’ {" ; Mark
Underwood1
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Elena,
FUJ00170220
FUJ00170220
I cannot give guidance on whether further work should be done looking at other modes as it depends on what Post
Office is trying to achieve.
From my perspective the exercise using SC has identified a small number of instances where we can see that the
data from the audit trail has not been extracted by the extract tool, and I am finalising a response on that which will
explain the glitch. I am comfortable that for all the cases identified to date we can see detail in the audit trail which
shows what items were sold in the branch for each session in mode SC (Serve Customer).
Regards etc.
Torstein
From: losifidou, Elena (UK - London):
Sent: Monday, December 19, 2016 10:48 AM
To: Godeseth, Torstei:
Cc: Newsome, Pete r
Keating, Lewis (UK -
‘Kathryn Alexander’
arsons, Andrew ¢_
'b; Mark Underwoo:
Torstein,
The analytic was designed to look at imbalances with session ids under mode ‘SC’. For those cases as I mentioned
below all the cases fall into your buckets of a) being relatively small and b) being negative.
If we want to look at session ids with all modes then I will have to re-design the analytic (and I don’t know what the
results will look like) and this is what I am asking whether it’s something you want us doing or not to help with your
investigation.
Kind Regards,
Elena
Elena losifidou
Deloitte LLP I Risk Analytics
I eiosifidoug~~
From: Torstein.O.Godesetl
Sent: 19 December 2016 10:40
To: losifidou, Elena (UK - London)
Cc: pete.newsomet,
Jonathar,
Andrew <
Underwood! <.
Subject: RE: Brambl
Keating, Lewis (UK
‘athryn Alexander’
all to discuss analytics (Privileged & Confidential)
Elena,
lf you have identified other issues in interpreting the data which currently show imbalances can you send the details
as soon as possible so that we can investigate further.
Regards etc.
Torstein
From: losifidou, Elena (UK - London)!
FUJ00170220
FUJ00170220
3; Keating, Lewis (UK -
‘Kathryn Alexander’
all to discuss analytics (Privileged & Confidential)
Hi Torstein,
To answer your question below - with the analytic performed on the session ids with ‘SC’ mode, all the imbalances are
relatively small and negative.
If we want to include the full population, I believe there were bigger imbalances involved but I will have to re-run the
analytic to confirm that - will that help with your investigation?
Kind Regards,
Elena
Elena losifidou
Deloitte LLP I Risk Analytics
From: Torstein.O.Godese'
Sent: 16 December 2016 16:38
To: losifidou, Elena (UK - London):
Cc: pete.newsome
Subject: RE: Bramble: cal
iscuss analytics (Privileged & Confidential)
I think I saw one instance where it looked as though the basket would balance if you included a non ‘SC’ item in it. I
think I would go for the full population as being valid for balancing the session.
Regards etc.
Torstein
From: losifidou, Elena (UK - London
Sent: Friday, December 16, 2016
To: Godeseth, Torstei:
Cc: Newsome, Pete i
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Torstein,
Do you have a view on whether the balancing of the session ids should have happened on the ‘SC’ mode only or the
full population?
Kind Regards,
Elena
Elena losifidou
Deloitte LLP I Risk Analytics
From: Torstein.O.Godeseth
FUJ00170220
FUJ00170220
Sent: 16 December 2016 15:36
To: losifidou, Elena (UK - London):
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Elena,
Apologies. A cut and paste problem on my part.
The missing text is:
e The amount is negative
© = The amount is relatively small
Regards etc.
Torstein
From: losifidou, Elena (UK - London}
Sent: Friday, December 1€ 2011 x
To: Godeseth, Torstein ¢
arsons, Andrew
Mark
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Hi Torstein,
Thanks for coming back to us with regards to analytic6.
I just wanted to clarify, to be able to progress your diagnosis, are you asking for the remaining cases or is there some
text missing after “:-‘ below?
Kind Regards,
Elena
Elena losifidou
Analytics
I ciosifidoul. "GRO:
From: Torstein.O.Godeseth,
Sent: 15 December 2016 11:06
To: losifidou, Elena (UK - London): _
Cc: Westbrook, Mark (UK - Manchester)
pete.newsomel
Keating, Lewis (UK - Leeds:
Kathryn Alexander' <2
arsons, Andrew
>; Mark
Elena,
I am responding to the request for an update on analytic6 — see highlight below.
FUJ00170220
FUJ00170220
We have now looked at the raw data from the audit files for a number of the cases you identified and I can confirm
that there is data which is not being extracted into the spreadsheet. For the cases we have analysed there is a
common cause for the failure to extract, but it would help us to progress our diagnosis if you could confirm that in all
instances you have foundi
Regards etc.
Torstein
From: losifidou, Elena (UK - London)i..
Sent: Tuesday, December 13, 2016 10:13 AM
lewsome, Pete /.
Gribben, Jonathan
Keating, Lewis (UK - Leeds’ ' Parsons, Andrew
i
Underwood1
Subject: RE: Bramble: ca’
Hi Torstein,
Thanks for the response below with regards to analytic1.
We have discussed internally and to get the assurance we need on this, we propose the below approach, let
us know you thoughts:
Deloitte to select a sample of 25 session ids identified with gaps and share them with you and for those
Kind Regards,
Elena
Elena losifidou
Deloitte LLP I Risk Analytics
I eiosifidoug
From: Torstein.O.Godese'
Sent: 09 December 2016 12:04
To: losifidou, Elena (UK - London) £7
Cc: Westbrook, Mark (UK - Manchester) GRO
Keating, Lewis (UK - Leed
‘Kathryn Alexander’ I
G6 }
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Elena,
Now I am back from leave I have had a look at the query about ‘missing sessions’ that you raised in your
email of 30" November (analytic 1). I looked specifically at the example
M126\ARQ 247\01-31 Aug 201 1.xls 151306
FUJ00170220
FUJ00170220
The explanation is that it is the JSN (journal sequence number) that is guaranteed to increase by exactly one —
i.e. no gaps. The JSN is used for more than just basket identifiers and so the gaps in the Sessionld are
explained by instances where the JSN has been used against something other than a basket to record a block of
data in the audit trail. In the specific example that I looked at the ‘missing’ JSN was used to record assembling
a pouch in the branch.
The extract that was produced for this ARQ confirmed that there were no gaps or duplicates in the JSN
sequence on the summary page; checking this is part of the standard extract process. However, the data that is
output to the spreadsheet is tailored to provide specific pertinent data.
J attach the raw data for JSN 11425.
Regards etc
Torstein
From: losifidou, Elena (UK - London
Sent: Wednesday, November 30, 2016 12:54 PM
To: Godeseth, Torstein
Cc: Westbrook, Mark (UK - Manchester)
Newsome, Pete {
Gribben, Jonathan
‘arsons, Andrew
Mark
‘Kathryn Alexander’
Underwood1i ROW
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Torstein thanks for the note below.
Pete — let me know if you need any clarification on the revised output of analytic 6.
On the call we had previously, one of the agreed actions for analytic 1 (Identify gaps in audit log sequencing) was to
test whether the session ids have gaps between them instead of the combination of session ids and transaction ids we
used previously.
Therefore, we re-designed the analytic to look at gaps in session ids only, but we still found gaps between them.
I have attached 5 example cases and I also copied the data from their raw files on the respective tabs highlighting
where the issue is. Torstein/Pete, can you please have a look on the attached to check whether this is something
you’d expect or whether we are missing anything? Could it be branches with multiple stock units?
Kind Regards,
Elena
Elena losifidou
Deloitte LLP I Risk Analytics
From: Torstein.O.Godeseth
Sent: 25 November 2016 18:32
To: losifidou, Elena (UK - London)
Gribben, Jonathan
Lewis (UK - Leeds)
+ Kathryn Alexander’
FUJ00170220
FUJ00170220
Apologies - whilst I have had a very quick look at this I have not been able to spend enough time on it.
I will be in leave this coming week and will catch up with Pete on my return.
Regards etc
Torstein
Sent from my Windows Phone
From: losifidou, Elena (UK - London
Sent: 22/11/2016 23:35
To: Godeseth, Torstein
Cc: Westbrook, Mark (UK - Manchester); Gribben, Jonathan; Newsome, Pete; Keating, Lewis (UK - Leeds); Parsons,
Andrew; 'Kathryn Alexander’; Mark Underwood1
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Hi Torstein,
Thanks for sending the below information through for analytic 6. We took that into account and re-
performed the reconciliation.
Please note that this is work in progress but there are still 40 session ids that don’t balance — I am attaching
the top 15.
Would it be possible to have a look at these please as it might help us identify another cause of this?
Finally we were advised by the case handlers to perform this exercise on the ‘SC’ mode only, is that your
understanding too?
Kind Regards,
Elena
Elena losifidou
Del LLP I Risk Analytics
....il eiosifidoug
From: Westbrook, Mark (UK - Manchester)
Sent: 17 November 2016 16:37
To: Torstein.O.
ete. newsom:
3Gribben, Jonathan 4_
Lewis (UK - Leeds)
; losifidou, Elena (UK - London)
>; Parsons, Andrew
>; ‘Kathryn
Alexander’
Subject: RE: Bramble: call to discuss analytics (Privileged & Confidential)
Thanks Torstein.
That would appear to likely explain it. Should hopefully be a simple job for the data team to revise
their analytic to account for and check this explains those 59 cases.
Thanks,
Mark
Mark Westbrook
w.deloitte.co.uk
FUJ00170220
FUJ00170220
From: Torstein.O.Godesethy
Sent: 17 November 2016 16:
To: Gribben, Jonathan <Jonatha
Leeds) <Ikeating
Manchester)
Alexander’
Subject: RE: Brambl:
all to discuss analytics (Privileged & Confidential)
All,
My curiosity got the better of me and I asked our support team to redo the first two ARQs on the Analytics 6 sheet.
In both cases I get the session to balance to zero — as it should.
What looks likely here is that the basket was not fully captured in the analysis as the size of the ARQ extends to two
sheets in Excel — this was set up in the days when you could only get 60,000 or so rows on a sheet; in both cases there
are entries for the basket (Sessionld) on the both sheets. In both cases the values on Sheet 1 sum to the Balance
shown on the Analytic 6 summary.
Hope this helps resolution. The attachment lists all of the records I found.
Regards etc.
Torstein
From: Gribben, Jonatha
Sent: Thursday, November 17, 2016 11:59 AM
To: Newsome, Pett
Parsons, Andrew
Kathryn Alexander’
Dear all,
Here are the agreed actions arising out of this morning's (slightly delayed) call:
Analytic 1
In light of Torstein’s explanation that transaction IDs do not need to be continuous, whereas session IDs contain the
last few digits of JSNs and therefore should be continuous, Deloitte are going to check whether there are any gaps in
the session IDs.
Deloitte to arrange a walkthrough to observe/verify the effect of a branch deleting a transaction on the Branch
Database.
Analytic 6
In the first instance Kath is going to review the data in respect of the 15 samples identified by Deloitte and look for any
FUJ00170220
FUJ00170220
patterns (e.g. transactions that are common to every example). That will inform next steps.
One option might be for Fujitsu to re-extract data for audit trail, although everyone expects that the data will be the
same as that previously extracted.
If no patterns are identified and data is the same on re-extraction, we may be in genuine exception territory. However
Deloitte could attempt validation by reviewing documents in relation to Legacy Horizon.
Please let me know if I've missed anything and thanks again for your time.
Kind regards
Jonny
From: Keating, Lewis (UK - Leeds)
Sent: 16 November 2016 14:50
To: Gribben, Jonathan.
GRO >; Parsons, Andrew
Westbrook, Mark (UK - Manchester) !
‘Kathryn Alexander’
losifidou, Elena (UK - London) ¢.
Godeseth, Torstein
i ; Newsome, Pete
GRO ?
ject: RE: : cuss analytics (Privileged & Confidential)
Hello all
Please find attached some samples for the 2 analytics we are following up / discussing tomorrow.
Thanks
Lewis
Jonathan Gribben
Managing Associate
Bond Dickinson LLP
Follow Bond Dickinson:
oO
www.bonddickinson.com
FUJ00170220
FUJ00170220
From: Gribben, Jonathan
Sent: 15 November 2016 12:58
To: Gribben, Jonathan; Parsons, Andrew; Westbrook, Mark (UK - M,
Elena (UK - London); 'Kathryn Alexander’; Torstein.O.Godesetht
Subject: Bramble: call to discuss analytics (Privileged & Confidential)
When: 17 November 2016 11:00-12:30 (UTC+00:00) Dublin, Edinburgh, Lisbon, London.
Where: Conference Call
Dear all,
Thank you for confirming your availability to attend this call.
Data samples will be circulated in advance.
Kind regards
Jonny
Join by Phone
Find a local number
Conference ID: 3926783
Forgot your dial-in PIN?I First online meeting?
froctv033081
Please consider the environment! Do you need to print this emai
IMPORTANT NOTICE
This communication is from Deloitte LLP, a limited liability partnership registered in England and Wales with registered number 0C303675. Its registered office is 2,
New Street Square, London EC4A 3BZ, United Kingdom. Deloitte LLP is the United Kingdom member firm of Deloitte Touche Tohmatsu Limited (“DTTL”), a UK private
company limited by guarantee, whose member firms are legally separate and independent entities. Please see www.deloitte.co.uk/about for a detailed description
of the legal structure of DTTL and its member firms.
This communication contains information which is confidential and may also be privileged. Itis for the exclusive use of the intended recipient(s). If you are not the
intended recipient{s), please (1) notify it.security.uk by forwarding this email and delete all copies from your system and (2) note that disclosure,
distribution, copying or use of this communication is strictly prohibited. Email communications cannot be guaranteed to be secure or free from error or viruses. All
emails sent to or from a Deloitte UK email account are securely archived and stored by an external supplier within the European Union
To the extent permitted by law, Deloitte LLP does not accept any liability for use of or reliance on the contents of this email by any person save by the intended
recipient(s) to the extent agreed in a Deloitte LLP engagement contract.
Opinions, conclusions and other information in this email which have not been delivered by way of the business of Deloitte LLP are neither given nor endorsed by it.
‘only is authorised to access this e-
lelete any copies. Unauthorised
7} please notify jonathan.gribhen{.. GRO fas $001
FUJ00170220
FUJ00170220
use, dissemination, distribution, publication or copying of this communication or attachments is prohibited and may be unlawful
Any files attached to this e-mail will have been checked by us with virus detection software before transmission. Bond Dickinson LLP accepts no liability for any loss or damage
which may be caused by software viruses and you should carry out your own virus checks before opening any attachment.
Content of this email which does not relate to the official business of Bond Dickinson LLP, is neither given nor endorsed by it.
This email is sent by Bond Dickinson LLP which is a limited liability partnership registered in England and Wales under number 0C317661. Our registered office is 4 More
London Riverside, London, SE1 2AU, where a list of members’ names is open to inspection. We use the term partner to refer to a member of the LLP, or an employee or
consultant who is of equivalent standing. Our VAT registration number is GB123393627.
Bond Dickinson LLP is authorised and regulated by the Solicitors Regulation Authority.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
FUJ00170220
FUJ00170220
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
JF RISE CIR SIC ICC 3 ICC FR A ICC oR FCI RoR ACCOR oF ECR oR ACCOR oR ICES ROR ACCOR oR ICC a CAE
This email and any attachments are confidential and intended for the addressee only. If you are not the named
recipient, you must not use, disclose, reproduce, copy or distribute the contents of this communication. If you
have received this in error, please contact the sender by reply email and then delete this email from your
system. Any views or opinions expressed within this email are solely those of the sender, unless otherwise
specifically stated.
POST OFFICE LIMITED is registered in England and Wales no 2154540. Registered Office: Finsbury Dials,
20 Finsbury Street, London EC2Y 9AQ.
SIO ISIS CIC ICICI SIOIC ICICI ISICI ICR ICICI I 3 ICC ICR oR ICC oR oF ICR oR ACCOR oR ICC AOR ACCOR oR ICC RGR AR CAC
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
FUJ00170220
FUJ00170220
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.
Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No
96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker
Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) and Fujitsu
Laboratories of Europe Limited (registered in England No. 4153469) both with registered offices at: Hayes
Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is
virus-free.