FUJ00176265 - Audit Data Extraction Process V.3
Fujitsu Services
Audit Data Extraction Process
Company-in-Confidence
Ref:
Version:
Date:
FUJ00176265
FUJ00176265
IA/PRO/004
3.0
01/02/2005
Document Title:
Document Type:
Abstract:
Document Status:
Originator & Dept:
Contributors:
Internal Distribution:
External Distribution:
Approval Authorities:
Audit Data Extraction Process
Process
This document establishes the process undertaken by Post Office
Account CS Security Prosecution Support Section to locate,
retrieve, extract, filter and prepare audit data for despatch to
authorised requesters
APPROVED
Neneh Lowther - Customer Service Security
Jan Holmes / Penny Thomas/Bill Mitchell
Jan Holmes/Bill Mitchell
Jamie Henderson (POLIA) and Graham Ward (POL SI)
(See PA/PRO/010 for Approval roles)
Name Position Signature Date
Jan Holmes Programme Assurance
Manager
Bill Mitchell Customer Service Security
Manager
Dave Baldwin Customer Service Director
Company-in-Confidence Page: I of 1
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
FUJ00176265
FUJ00176265
Fujitsu Services Audit Data Extraction Process Ref: IA/PRO/004
Version: 3.0
Company-in-Confidence Date: 01/02/2005
0.0 Document Control
0.1. Document History
Version No. I Date Reason for Issue Associated
CP/Peak
01 01/01/02 Initial draft based on CSR+ version [A/PRO/003
0.2 15/04/02 Addition of comments and change to Fujitsu Services
1.0 29/05/02 Approved
Ll 17/01/03 Update to BI3 system and contractual changes
2.0 27/01/03 Approved
2.1 26/10/04 Addition of comments and change to internal
processes
3.0 01/02/05 For approval after review comments received.
0.2 Review Details
Review Comments by :
Review Comments to :
Mandatory Review Authority Name
Programme Assurance Manager Jan Holmes
Customer Service Security Manager Bill Mitchell
Audit Development
Alan Holmes
Audit Development
Brian Muir/Oddette Moronfolu
Optional Review / Issued for Information
(* ) = Reviewers that returned comments
0.3 Associated Documents
Reference Version I Date Title Source
PA/TEM/001 8.0 19/12/02 Fujitsu Services Document PVCS
Template
TA/SPE/008 Audit Data Catalogue
Company-in-Confidence Page: 2 of 1
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
Fujitsu Services
Audit Data Extraction Process Ref: 1A/PRO/004
Version: 3.0
Company-in-Confidence Date: 01/02/2005
FUJ00176265
FUJ00176265
IA/SPE/018 Audit Data Catalogue - ADC
(Consignia SIS)
IA/SPE/019 Audit Data Catalogue
(Consignia AP Clients)
TA/SPE/020 Audit Data Catalogue (System
Management
1A/SPE/021 Audit Data Catalogue (System
Management)
TA/SPE/021 Audit Data Catalogue (Internal
Audit)
RS/MAN/010 SecureID Normal Token User
Guide
NB/MAN/002 PSS Database Manual
CS/SER/016 Service Description for
Security Service Management
Unless a specific version is referred to above, reference should be made to the current
approved versions of the documents.
0.4 Abbreviations/Definitions
Abbreviation Definition
ARQ Audit Record Query
AS Audit Server
AW Audit Workstation
CD-W Writeable CD
OBCS Order Book Control System
PIN Personal Identification Number
Peak Problem Management System operated by Fujitsu Services
POLIA Post Office Limited, Internal Audit
PSS Prosecution Support Section
ARQ Request For Information (ARQ is synonymous with ARQ.)
TMS Transaction Management System
0.5 Changes in this Version
Company-in-Confidence Page: 3 of 1
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
FUJ00176265
FUJ00176265
Fujitsu Services Audit Data Extraction Process Ref: IA/PRO/004
Version: 3.0
Company-in-Confidence Date: 01/02/2005
Version Changes
3.0 Updated after review comments received.
0.6 Changes Expected
Changes
Company-in-Confidence Page: 4 of 1
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
FUJ00176265
FUJ00176265
Fujitsu Services Audit Data Extraction Process Ref: TA/PRO/004
Version: 3.0
Company-in-Confidence Date: 01/02/2005
Table of Contents
1.0 INTRODUCTION
2.0 SCOPE.
3.0 TERMINOLOGY.
4.0 AUDIT DATA INTEGRITY.
41 RETRIEVAL SCHEMATIC. 10
5.0 OVERVIEW.
5.1 AUDIT RECORD QUERY......
5.2. MARKING FILES AND TAPE
5.3. AUDIT TRACK RETRIEVER...
POLLS THE USER AREA BUFFERS AND MAKES THEM AVAILABLE TO SEALER FOR SEAL,
VERIFICATIONAUDIT DATA CHECK SEAL... cece . 11
AubIT DATA CHECK SEAL. - ses ees eecceeeeeeenenee 12
5.4 AUDIT TRAIL EXTRACTOR...
6.0 RETRIEVING & EXTRACTING AUDIT DATA.
6.1 RECEIVING THE ARQ
6.2 INTERPRETING THE ARQ. .
6.3 LOGIN AUDIT WORKSTATION. 14
6.4. PRELIMINARY HOUSEKEEPING. 14
7.0 USING AUDIT WORKSTATIONS.
8.3. AUDIT EXTRACTOR CLIENT — RETRIEVER SCREEN.....-:.0ssso0ssceseeeseee seseeeeneee
3CTION CRITERIA. 20
9.0 NT EXPLORER....
10.0 INTRODUCTION TO R-QUER'
10.1 INVOKING R-QUERY AND CONNE!
10.2 RQUERY MAIN SCREEN....
10.2.1 Save and Restore - Restoring Retrieval Scenario:
10.2.2 Where - Changing Retrieval Parameters...
10.2.3 Select Cols - Selecting TMS Fields for Disp
10.2.4 Order By Tab...
10.2.5 Groups Tab.
10.2.6 Output Options.
10.3. RUNNING THE QUERY..
11.0 DATA RETRIEVAL - MISSING DAY.
ING TO A CORRESPONDE
Company-in-Confidence Page: 5 of 1
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
FUJ00176265
FUJ00176265
Fujitsu Services Audit Data Extraction Process Ref: TA/PRO/004
Version: 3.0
Company-in-Confidence Date: 01/02/2005
12.0 DATA RETRIEVAL —- NO RECORDS FOUND.
CREATING CDS.
13.0 DESPATCH OF AUDIT DATA.
14.0 APPENDIX.
14.1.1...
14.L.1.1 Heading 4 St essen a ae . . sos
14.L.1.1.1 Heading 5 Style . 38
Company-in-Confidence Page: 6 of 1
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
FUJ00176265
FUJ00176265
Fujitsu Services Audit Data Extraction Process Ref: TA/PRO/004
Version: 3.0
Company-in-Confidence Date: 01/02/2005
1.0 Introduction
The Horizon system generates significant amounts of data that is of interest to Post Office Ltd
Internal Audit and other groups.
Subject to certain constraints the audit data must be made available to POLIA or other
authorised groups within time scales established in the Audit Data Retrieval Requirements
(CSR+) [3] and the Network Banking Internal Audit Requirements [10].
This document establishes the process for requesting audit data extractions and subsequent
activities undertaken to locate, retrieve, extract & filter and prepare for despatch on behalf of
authorised requesters.
2.0 Scope
Should future releases of Horizon bring about changes to the way that data is extracted this
process will be updated to reflect those changes.
This process applies to ALL audit data extraction requests in respect of:
1. PSS ARQs
2. Other requests from POLIA
3. Internal Requests
Internal requests for audit data extraction will also be subject to this process. In these cases
the use of an Audit Record Query (ARQ) form is optional but a Peak must be raised to the
data extraction stack.
Company-in-Confidence Page: 7 of 1
(CONTRACT CONTROLLED - Leave Blank if Not Applicable)
©Copyright Fujitsu Services Limited 2004
Fujitsu Services
FUJ00176265
FUJ00176265
AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
3.0 Terminology
Within this process certain terms are used which have specific meaning within the Horizon
Audit Solution. They are:
Gatherer :
Sealer :
Hoarder :
Retriever :
Extractor :
Centera :
The module responsible for collecting the audit files from the hosts, agents,
correspondence servers and interface mechanisms. This module is also
responsible for the application of the audit file naming policy.
The module responsible for calculating the checksum seal of each audit data file
before it is written to audit archive. This value is recalculated after data is
extracted by the Retriever and compared to the original value when first sealed.
Used to ensure data integrity during storage on audit archive.
The module responsible Pre-Bi3 for writing audit data files onto DLT at pre-
defined intervals. From Bi3 sealer writes audit data to Centera cubes.
The module responsible for moving audit data from the buffers where it is
placed when retrieved by Centera .
The Client/Server system responsible for retrieving data from Centera and
managing Audit Data Extractions.
Online mass disk storage unit selected by Post Office Account to store and
manage audit data from Bi3.
A more complete explanation of these modules can be found in the Horizon System Audit
Manual [2].
© 2003 Fujitsu
Services COMMERCIAL IN-CONFIDENCE Page: 8 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: IA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
4.0 Audit Data Integrity
The integrity of audit data must be guaranteed at all times from its origination, storage and
retrieval to subsequent despatch to the requester. Controls have been established to provide
assurances to Post Office Internal Audit that this integrity is maintained.
During audit data extractions the following controls apply:
a Extractions can only be made through the Audit Workstations, which exist at Feltham,
Bracknell and the 2 Data Centres. These are all subject to rigorous physical security
controls appropriate to that location. Specifically, the Feltham AWs — where most
extractions will take place — are located in secure rooms subject to proximity pass access
within a secured Fujitsu Services site.
a Logical access to the AWs and their functionality is controlled by dedicated Logins,
password control and utilises the NT and Post Office Account security features defined in
the overall Horizon security policy.
a All extractions are logged on the Audit System and supported by documented ARQs,
authorised by nominated persons within POLIA. This log can be scrutinised on the AWs.
a Extractions will only be undertaken by individuals previously notified to POLIA. Currently
this is limited to Post Office Account Audit and Post Office Account CS Security
Prosecution Support personnel. Any additions will be notified to POLIA.
a Agreement has been reached with POLIA regarding their rights to witness extractions
without warning or to request repeat extractions that they can witness.
a Checksum seals are calculated for audit data files when they are written to audit archive
and re-calculated when the files are retrieved.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 9 of 1
Fujitsu Services
AUDIT DATA EXTRACTION PROCESS Ref:
Version:
COMMERCIAL IN-CONFIDENCE Date:
1A/PRO/004
2 21
15/09/04
4.
_
Retrieval Schematic
AUDIT SERVER AUDIT WORKSTATION
—
} oat
searoa ay
- amaras
Tis JOURNAL 4
ona Avo was Lz.copy are
exc —— —— — Post Office
Torn
centr futons
Storage -—— Requester
oracle ¢ )
TABLE [Oracle Tables I — Discoverer
eDUItO
OPERATIONAL ENVIRONMENT AUDIT ERTRAGTOR
Nuive-oracte 7 Direct link to
Database I Live databases
AUDIT > )
exTRAcTiON Fed
rere Tanwar see
aan 24 senpon Sane
FUJ00176265
FUJ00176265
© 2003 Fujitsu Services
COMMERCIAL IN-CONFIDENCE
Page: 10 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
5.0 Overview
The process assumes that audit data has been Gathered, Sealed and written to audit archive.
The five main types of files are :
a. TMS Journals from the Correspondence Servers.
b. Flattened Oracle tables output from regular OBCS database purging cycles.
c. Transaction files to and from PO systems
d. AP Client Files
e. Tivoli Event files
All file types are referenced in TD/ION/011.
The process is invoked through the receipt of an ARQ into Post Office Account CS Security
PSS. Expressed in business terms, the ARQ must be interpreted into its component Audit
Points and Sub-points. This then enables specific files to be identified and retrieved by the
Audit Retriever, formatted as appropriate and then further Extracted against the ARQ criteria.
Depending on the extraction method the data can be extracted to standard MSExcel 97 before
being placed onto CD-W. The CD is then checked for despatch to the ARQ originator.
The following paragraphs present an overview of each step in the extraction process and are
ordered to reflect the actual processing of a Audit Record Qu ery (ARQ) by Post Office
Account CS Security PSS.
5.1 Audit Record Query
All POLIA requests for audit data must be made via the Audit Record Query form. This will
contain a description, in business terms, of the times, outlets, events, items activities that the
Auditors are interested in. This request has to be interpreted by Post Office Account CS
Security PSS and mapped onto the Audit Points and Files described later in this document.
Internal requests (e.g. from Post Office Account investigations personnel) will typically be in
the form of a Peak on the ‘Dataextraction’ stack for CS Security.
5.2. Marking Files and Tapes
Based on the above interpretation of the ARQ, as many files of audit data that are needed to
satisfy the request are ‘marked’ for retrieval.
5.3. Audit Track Retriever
Polls the user area buffers and makes them available to sealer for seal verification
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 11 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: 1A/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Audit Data Check Seal
To assure the integrity of the audit data while on the audit archive the checksum seal for the
file is re-calculated by the Audit Track Sealer and compared to the original value calculated
when the file was originally written to the audit archive. The result is maintained in a Check
Seal Table.
5.4 Audit Trail Extractor
This is a facility that uses various tools to extract or reform the retrieved audit data in
accordance with the ARQ. It also places the information onto a CD-W, or other suitable
media, for despatch to the ARQ originator.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 12 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
6.0 Retrieving & Extracting Audit Data
6.1 Receiving the ARQ
a) POLIA requests for audit data extractions must come to Post Office Account CS Security
PSS in the form of an Audit Record Query. An example of this form can be found at Annex A.
The ARQ may be mailed, faxed or e-mailed to Post Office Account CS Security PSS.
ARQs will only be accepted from persons fulfilling the following role or their delegate :
POL Internal Audit. Casework Manager: Tel i-
-GRO_
Current names of persons fulfilling this role will be confirmed in writing by POLIA Internal
Audit and held locally by PSS.
If other parts of the Post Office, or other organisations, require audit data extractions they
must be channelled through POLIA to Post Office Account CS Security PSS.
Contractual limits and turnaround times for the provision of Audit Record Queries are detailed
in the document CS/SER/016.
b) Internal requests will be in the form of a Peak, allowing the requestor’s identity to be
verified. Requestors should state what media is acceptable (e.g. CD-W, email of WinZipped
file up to 500kB) The despatching of confidential data is bound by Fujitsu Services policy. For
TMS files - also referred to as “message store” or “Correspondence Server”- they should also
specify the output file format(s): text, MS-Excel or MS-Access. (See Section 8 for more
information).
POLIA and Internal requests are recorded on the PSS Database (User Guide for
Prosecution Support Database [12]). They should be logged to record the following
information: Request id (e.g. ARQ no.), the date the request was received, the FAD and date
range to search. Turnaround times are covered by contract as specified in the CCD
CS/SER/016.
6.2 Interpreting the ARQ
It is necessary to interpret the ARQ by identifying the audit points and sub points that
generated the records that are required and, through the Audit Data Catalogues [4-8], the files
produced at those audit points and sub points.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 13 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
6.3 Login Audit Workstation
Carry out following procedure to Login and obtain necessary shares
1. Login 1 HH
2. Password : *#### IR
3. Domain :PWYDCS
At this point the SecureID Authentication is invoked. See SecurID Normal Token User Guide
& am out the following procedure to authenticate yourself as an authorised user
1. Enter passcode _: <personal 6 digit PIN and 6 digit SecureID token display>
The AW will present a blank desktop with a START icon in the bottom left of the screen.
Using pull up <Programs> will reveal the extent of products available for any subsequent
extraction work, as shown in Figure 1.
Start Menu
Figure I
6.4 Preliminary Housekeeping
It is highly likely that an average ARQ will need a significant number of files to satisfy it. To
avoid the AW filestore becoming clogged with hundreds of files it is strongly recommended
that a working directory is established on the AW to hold all files relevant to a particular ARQ
1. Select <Windows_NT_Explorer> from the drop down menu.
2. Set up <New Folder> as D:\audit data\ARQ Reference No.
6.5 Targeting the Data Files
At this stage of the retrieval procedure the Audit Extractor Client is used to identify and mark
the files required for retrieval.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 14 of 1
Fujitsu Services AUDIT DATA EXTRACTION PROCESS
COMMERCIAL IN-CONFIDENCE
Ref:
Version:
Date:
TA/PRO/004
21
15/09/04
FUJ00176265
FUJ00176265
7.0 Using Audit workstations
Each Audit Workstation is loaded with the following programs;
1. Audit Extractor Client
2. NT Explorer
3. RQuery
4. Roxio
An explanation of the functionality of each program is detailed in the following sections.
8.0 Extractor Client Functionality
The Audit Extractor Client is invoked from the start menu. The user will select the Data
Centre they wish to work with as depicted in Figure 2. The Audit Extractor Client refers to
ARQ.
I
abou ‘About
OstaCene (SE ———] DataCerte [RY]
' - Baste
ene Audit Extractor Client - I _—_—_
Centre Selection I wreauoos
The Audit Extractor Client (Figure 3) has three main options;
<New ARQ> (Figure 4)
<Open ARQ> (Figure 7)
<Close ARQ> (Figure 9)
[wewara] ‘Open ARQ I ‘Dlose ARQ I
You are logged in as
nilonO1
at the
Bootle
data centre
Ext
f
t
Figure3 Audit Extractor Client — Main Screen
Figure 2
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE
Page: 15 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
8.1 New ARQ
This option is used to setup an audit trail for each request and to specify the search criteria
identified from the ARQ form. See Figure 4.
nee
gant Frocks] Date Received [oes
Cadonetiy [Bale Renuted. [Tamaya
Receit Refoonee [S57
‘Access Reason
Pos Otice Nano, FAD code, dae range equedted
Figure 4
Raise New Request
sean I seeragnt I Atm
Requester — Drop down list.
Other 3” party
Post Office Account IA (Post Office Internal Audit, ARQs are always POIA)
Post Office Account Other
Post Office Account SSC
POCL IA
POCL Other
POCL Security
Date Received — Date ARQ received, taken from ARQ form
Date Required — Date ARQ must be completed. Use SLA target times to calculate date to be
completed by
Catalogue Entry - Blank
Receipt Reference - ARQ Number, taken from ARQ form
Access Reason — Post Office Name, FAD and dates specified on ARQ form
<Specify Selection Criteria> See Figure 5 below.
From Date — The first date requested on the ARQ
To Date — The last date requested on the ARQ + 2 days. This ensures if data hoarded late that
all files are identified.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 16 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
eee Search Criteria Audit Points
ie ane Sen ait
Pas +i ade Pot Sub Poe Code ‘he:
aha i wae
Sle sags
sie I saree
pelt Figure 6 feta
<Update> See Figure 6 above.
Audit points — Used to select AP Client files and Tivoli events, etc
Subpoints — Used to narrow audit point selection
FAD code — FAD code from ARQ
<Add> - input above value and click add to enter the details
<Delete> - Select any values in List of current Audit points and click delete to
remove them
<Return> - Click to return to Search Criteria Screen (Figure 5)
<Search files> — when file search completes, the ‘Retriever’ screen opens, see Figure
10.
<Save selection> - saves the selection criteria
<Return to menu>-— returns to main screen (Figure 3)
<Save request> - saves the request
<Return to menu>— returns to main screen (Figure 3)
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 17 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
8.2 Open ARQ Figure 7
Open Existing Request
pen Request : Retun to Menu
Select the ‘Request Reference’ from the drop down list i.e. POIA001B
<Show Details> - Figure 8 below.
‘Audit Extractor - Close Query i ES
Query Reference [Gace ~] ‘Show Query Details ‘
Access Reason
UPPER HIGH STREET 246546 23/03/04
Files Names for ARQ Reference POIA7438. ~ —— ~ ;
I [Bien I Size] Stas] va]
i FNO1_TMS_Cluster1B_B_6_20040325_15495000_V. 63570095 ‘SealK I
I] FNoI_TMS_Clustert8_B_6_20040325_14100700_V. 63979511 Seal i
I_I Not TMS_Chster18_B_6_20040225_12364000_V. 59432324 © SealK I
I FNO1_TMS_Clustert I251500_V. 60773313 SealOkK }
II rvorctns-ce 5400-V 72899508 Seak I
FNOT_TMS_Cluster1B_B_6_20040325_09122800_V. 74330749 Sealk 1
II rrioy2rs-custert8876- 20040325 -00022700.¥ 51689012 SeaDk I
I FNO1_TMS_Cluster1B_B_6_20040324_19253200_V. 61619869 SealK I
1 FNO1_TMS_Cluster1B_B_6_20040324_18205200_V. 55870870 ‘SealdK I
Hees TMS, Cute 6 2040024 1551590 4a SK oft
pees : »
I I
fe I
26 Files Found
Close Query. Retum to Menu
Ir-Please noe: Closing wil mean no luther updates are possible forthe que. “=
This lists the details of the request as inputted in Figure 4, New ARQ. The user can not add
or update any fields.
Requester Details
e Requester
e Date Received
e Date Required
e Catalogue Entry
e Receipt Reference
e Access Reason
Selection Criteria
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE
Page: 18 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
e From Date
e To Date
File Source Requirement
e Audit Points
e Sub Points
e FAD Code
e File Name Template
<Close> Closes ‘Details’ screen and returns to ‘Open ARQ’ screen
<Open Request> Displays Figure 10
<Return To Menu> Returns to Figure 4
8.2 Close ARQ
Figure 9
When all work has been completed the ARQ must be closed on the Audit Extractor Client.
Request Ref - Select reference from drop down list (ref POIA***)
Access Reason
Filenames for ARQ reference POIA**
<Close Request> - once the request is closed the audit log is written to the request directory
on the Audit Server, Figure 13. A copy of an example audit log can be viewed in appendix 2.
<Return To menu> - returns to Figure 4
<Show details> — Figure 8 this function displays the ARQ details as in ‘Show Details’ from
“Open ARQ’ screen
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 19 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: = 2.1
COMMERCIAL IN-CONFIDENCE, Date: 15/09/04
8.3 Audit Extractor Client — Retriever Screen
Selection Criteria
These fields are as entered on the ‘New ARQ’ screen, Figure 4.
Time Period Required
From Date
To Date
File Source Required
Audit Point Selection Criteria
Audit Points
Audit Subpoints
FAD Code
Filename Template
File Names for ARQ Reference POIA***
The Audit Extractor Client retrieves the following information using the search criteria
inputted in the ‘New ARQ’ screen, Figure 4
Filename
Size
Status
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 20 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Current List Control
<Amend Criteria> - If the original search criteria is too narrow, select this button to re-input
the search criteria and re-search for the required files. This facility is not available once files
have started to restore.
Selected File List Control
<Restore Files> - Mark the files required by either holding the <CTRL> key and marking the
individual files spaced throughout the range listed or select the first file in a group, hold the
<SHIFT> key and select the last file to mark a consecutive group of files. Once all the
required files are marked click the ‘Restore Files’ button to restore the files from archive.
<Replace Files> - Mark the required files, select “Replace Files’ and the files not selected will
be removed.
<Delete Files> - Similar to ‘Replace Files’ except the marked files are removed from the list.
<File Status> - this function updates the status of a set of selected files so that the user can
identify progress and seal validity.
<List Update> - this function updates the audit workstation in line with the audit server
File / Close — This exits the ‘Retriever’ screen
Actions / Check Actions — Actions allow the user to view the status of each function/facility as
detailed throughout section 9.0 of this document, thus allowing the user to identify when each
process completes and if it completes successfully.
Actions Screen
Figure 11
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 21 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
TMS
Once the TMS Archive files have been deposited in EXTRACTED_AT they must be ‘built’
into a pseudo Correspondence Server for R-Query to access. Further filtering is available to
restrict the number of Outlet records that are included in the re-build activity based on the
original ARQ.
Clear MessageStore — This clears the current messagestore on the audit workstation
Generate MessageStore — enter the date parameters and FAD code, as depicted below
in Figure 12 and then ‘Generate MessageStore’ to generate the message store on the
audit workstation.
5 Audit Extractor - Generate Riposte MessageStore
Data centre: Bootle ARQ: POIA?50I
Start Date al October 2004 End Date 2 October 2004
for for
messages é messages
List of FAD Codes
Post Olfice FAD Code [250511 350511
<-Delete
Generate MessageStore I Cancel I
Server MS Build — Used to generate a messagestore on the audit server. Only one
workstation at a time can generate a messagestore on the audit server. This shall only
be used as a last resort.
Oracle / Build Table — Allows the user to rebuild Oracle back up files in the Oracle format.
Unzipping Zipped Flat Files - It is strongly recommended that files to be unzipped are
transferred from the AS to the AW in their zipped state and unzipped on the AW. This can
produce space savings of the order of 90%.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 22 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
9.0 NT Explorer
7 _
— [elie nee Ta NT Explorer
seuz it Figure 1b
e PI . -
‘Bobyects) (4 1RB [Dick ee ace 77368) ve eS PRT ‘, oi z z eT
Misia] SAP: POU 2B Staten MIF] Emploring FA “BY Micsouct Wend Document
NT Explorer is used as a tool for viewing files associated with an ARQ. As each new request
is logged on the Audit Extractor Client using ‘New ARQ’ a directory will be created on the
audit server for which the request was initiated from. Each directory takes the Audit
Extractor Client ARQ Reference i.e. POIA****. This main directory holds the sub
directories; Extracted_at, Restore_at and Retrieved_at. The main directory includes a txt file
named using the Audit Extractor Client ARQ reference. This files contains details of each
process initiated through the Audit Extractor Client. NT Explorer allows a window to view
these files and directories.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 23 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
10.0 Introduction to R-Query
R-Query is an interrogation tool used to extract data from a Correspondence Server. It has
powerful SQL type features, which are used to define the extraction scenarios and the ability
to output the results to standard MS-Office utilities.
It is a vital element in the Audit Workstation tool set and requires that a Correspondence
Server exists on one of the Audit Workstations or Servers. Details on how to achieve this pre-
requisite can be found earlier in this procedure.
10.1 Invoking R-Query and Connecting to a Correspondence
Server.
The Riposte Query initial screen is invoked from the start menu.
Figure 14
Riposte Query Initial Screen
' Riposte Query (UK) V4.0. WFEAUDOA (Group:0 Node:41)
‘Alocal or remote Message
Allocal or remote Message Store is required.
‘Your focal machine is; WFEAUDI
Your focal machine is WFEAUDO4
‘You are not connected to any message store ‘You are: Connected fo Server WFEAUDO4 (Group: Node41)
Connect To: uFEAUD04 Localachre “SJ I Connect To: fF EAU006 Loca Mache =I
Buse Tre oo voces nary witestont Pay Une Seve tery ged oe re :
sen sche
‘Status: Welcome To ROUeryUK Please select Message Store from the list above, Status:
eee ys, : Gomrectio I Check tae ae
eon I Decomeet I erage Stoe I Stain Manwers I
Connect to — The user selects the workstation/server for which the message store exists
Audit Trail — User is only required to justify use of servers
<Disconnect> - disconnects any connection from current workstation to messagestore
<Connect to MessageStore> - ‘connect to’ and ‘audit Trail’ are to be specified before
connecting
<Check Store Status> - details of message ranges in the rebuilt message store.
<Check for Gaps>
<Main Menu> - Connects to the main RQuery Screens as detailed in the following sections.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 24 of 1
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref:
Version:
COMMERCIAL IN-CONFIDENCE Date:
TA/PRO/004
21
15/09/04
FUJ00176265
FUJ00176265
10.2 RQuery Main Screen.
This consists of 7 tabs.
Select Cols — Used to select attributes required for output to excel etc.
Where — Used to enter search criteria i.e. date range and FAD code
Order By — Used to specify sort criteria when output to excel
Save and Restore — Used to load and save Query
Output Options — Used to specify file and MS product to export data to.
Groups - Used to specify PAN or STAN identifier
Connect — Used to connect to Messagestore.
10.2.1 Save and Restore - Restoring Retrieval Scenarios
Ue ee
=
> Saving and restoring queries using LOCAL disk files —
[[eaneray EI)
I Save and Retiave Oueties using Mescage Store Save and Restore
I
I
u =i cas Figure 15
Alte Data
Conn 3 ede ok I
‘ape Mest Conmen
i} i}
Dastekar te nae Riposte een I
store. or in disk files “ca I ove
fegagae
Fun Query
The <Save and Restore> dialogue provides the opportunity to restore scenarios that have
already been scripted for further use.
SCENARIOS FOR RE-USE EXIST AT TWO LEVELS:
Those that are associated with the current Correspondence Server.
Those that have been saved to an external file or Catalogue.
Scenarios associated with the Correspondence Server exist only while that particular CS
exists. If the user believe that an extraction scenario is likely to be re-usable it’s as well to
remember that unless the scenario is saved to an external file it will not be available if a new
CS is built for another retrieval exercise.
Use these steps to re-use scenarios associated with current Correspondence Server.
Go to ‘Save and Retrieve Queries using Message Store’ window.
Select <Refresh> to list all scenarios associated with the current Correspondence Server.
Highlight the required scenario and select <Retrieve>.
OR
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE
Page: 25 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Use this step if retrieving scenarios from the Catalogue.
Locate stored scenario from the Catalogue via <Change filename> button to browse as
required.
At this stage the user will have retrieved the scenario complete with the parameter setting used
on the last retrieval activity. If the user want to change any of the parameters they will need to
go to the <Where> tab.
Enter the required Post Office (FAD) code into the <Group ID:> field if it is not shown.
10.2.2, Where - Changing Retrieval Parameters
ste Query {UK} V4.0 Connected to Server: WFEAUDOA (Group:0 Node:41) 3)
ma] oe Loe Ie em] I
Where Screen
[ (Date DGE *0¢Mey-2000") AND (Date
IDLE "11-May-2002" JAND (Exists (
IEPOSSTransaction ProductNo)) AND (
lExicts ( TanData Stert Date) )
Figure 16
= Group ip: [246230
Messages will only be used if they match these criteria See the documentation for
the appropriate syntax. if you are NOT on a production server an index may help if
youre doing multiple searches. (Nore for UK: a Group = Post Office FAD code)
I Benue I
Note that the current version provides significant amounts of assistance with regard to the
structure of the query statement. An ‘Examples’ button (see Figure 17) allows search
parameters to be retrieved and tailored (e.g.):
[idea "I JAND (Nun 1400") OF, Tse STAND en g THOTT Where Example
1
AND {Date OLE "U3 Mar1397" ) AND Evi ( EPO}
tAppicaton EU "APS" AND (Date DGE “Oe Feb 1997).
sR")
I" JAND ( Date DGE "08-Feb-1997" ) AND ( Date DLE "08-Ma_ Screen
(Application EQ “OBCS" } AND { User EQ "CLKOOT™. Jano {Dae ooe "06-Feb-1997" } AND { Date DLE "08+,
I cleton £0 'EPOSSUs”JAND (Data Logue E _
I Cotecton GE "AP" }AND { Cofection LE "AQ" Figure 17
{Gata Teanype 0 ‘encotennt1AN0 (Use EO "CLKOD AND (Apkctin EU BES”) AND [Dat Oi
{ SecutyE vent E ventName EQ “UserCreated™ I OR { SecuriyE vert. EventName EQ "UserModfied"} OF I Secu
I {sera "Sith" OR User EO "Jones" JAND (Transaction Ent Aunt ge £000 OR Exception None EQ "Su
(Collection EQ "RiposteUsers"} OR (Secuityé vent EventName EQ "UserModified") OR Exists ( SecurilyE vent Ev
[Daa Stats €0 Noded}OR (Data Stu EO HOVoded")
Cotecion EQ "Fipotel/se.ogene
Cotecien £0 "HposteUsere
Date CriyMethog Ne "0 a
Sa seed
(Date DGE “29-May-2000”) AND (Date DLE “01-Jun-2000”)
for all dates between 29 May-1 June 2000.
Date DEQ “31-May-2000”
for this day only.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 26 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Enter the required Post Office (FAD) code into the <Group ID:> field if it is not shown. If the
user want to change the TMS fields that will be visible following the retrieval they will need to
go to the <Select Cols> Tab.
Note: Riposte Query can only work with one FAD code (GroupID) at a time. It will need to
be run separately for each Post Office, remembering that by default it may delete the previous
output file
10.2.3. Select Cols - Selecting TMS Fields for Display
‘5. Riposte Query (UK}V4.0 Connected to Server WFEAUDO4 (Group:0 Node:41) 5)
seven oe I [ere oe I
Ad hoe I. 1 Enpeat nite Messages
vew}.0> I IUser
[TxnDate. Container x A308 ‘aa eP pee! a
Add os I [TenDeta Star Date a Attachments
ses [TxnDate Start Time Netwerk Banking
Beriove << I [TxnDota Sessionid
[TenDete Tend
Hsndate Mode Select Cols Screen
IEPOSS Transaction ProductNo I
IEPOsSTransacton Oty
JEPOSSTransacion SaleVelue Figure 18
Select the columns for your report. Hf desired, can also include the entire
‘contents of alf matching records in the spreadsheet. (Double click to edi)
Bun Quen
Note that the current version provides lists of available fields per Horizon application which
can be selected by highlighting and pressing <Add> or <Add (tree view)>. See Figure 19
below. Alternatively to reduce the numbers of fields displayed highlight the field in the window
and press <Remove>.
Attribute: f I ‘Tee View
I _ STANDARD BANKING
bain pts Add Columns
itchment crc eposs I oscs I
ltactment Data
cre peas ec Figure 19
Bata CAPrn CAPMatker nn Memos OTHER
DataMakrn
Date
Enter attribute details, either manually, from the
“recently used" dropdown. of from the selections:
fence _I provided above
If the user want to retrieve the entire message for a given selection parameters <Remove> all
entries in the window and put an ‘x’ in the <Export Entire Messages> field.
Optionally a field “Add CAP and BP rollover data” or “Add ASCII Attachments — EG;
Network Banking“ can also be checked.
The user may now want to choose how the results of the retrieval will be presented. To do
this go to the <Output Options> Tab.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 27 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: = 2.1
COMMERCIAL IN-CONFIDENCE, Date: 15/09/04
10.2.4 Order By Tab
<Atnibute:TenData Start Date><Type Date><Order Forward
1 I Attribute TenDate Stert Time><Type Sting» <Crder Forward?
Order By
Figure 20
Selecting the parameter “Sort By Date” is recommended to ensure ascending time sequence
(where appropriate).
10.2.5 Groups Tab
Groups
Figure 21
The Groups tab on the R-Query tool is used to specify PAN search criteria.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 28 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
10.2.6 Output Options
-WFEAUDO4 (Group-0 Node:41) 5)
‘5, Riposte Query (UK) V4.0. Connect
Output Options
Figure 22
II fevAuditee_8ES_Usrmab Change
T Expt to Ts Fle
Run guey
By default an Excel spreadsheet is created (default name when selected:
C:\Audit\2a_BES_Usr.xls). In the current version there is also an option to export to an MS-
Access database (default name when selected: C:\Audit\2b_BES_Usr.mdb) and a text output
file.
If the user want to export the retrieved message to either an Excel spreadsheet or an Access
database then enter ‘x’ in the “Export Results to Excel/Access, Prompt Export” field.
Using the template.qry file found in d:\audit data gives the report format as shown below
2B Ye ee dee isi
steal ally) x[elelo} ola] za) gail sl wlelfo =) olya)
pala plz { of = lly wl ecI, [sal 9) I I I
ri
= Laas] I Excel Output
[CSTR ESSE STAC
1 tme 122610 M :
Figg) croup: ‘951641 I Figure 23
5
6 EsisisiLogon) I
‘ay cA Date><TypeDale><OrderFanard>> I
[a] ‘ey ctrl Tne><Type Sting» <Order Fowards>
A
[i0}ate Time Logon
Ht] ZaMaa? "52402 Seturot
[I DkMars? 070858 SETUPOI
[33] DkMars? 10820 SETUPDI
a dimars? 104601 BAN
[35] DiMars? 122018 BBANT
a 2iNars? 1307 01 BBANTI
divers? 135908 BeaNTt
DkMars? 170434 BBANT
2eMars? 06 1204 BBANT
Sevag? 094357 BEAN
2eMars? 102852 BBANT
Details of the query statement used will appear on the spreadsheet and this provides the
evidence to POLIA of the search criteria used, in other words, how their ARQ has been
interpreted.
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 29 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
10.3 Running the Query
Normally the user would not actually execute the retrieval scenario until such time as they had
built the query statement (the Where tab), selected the fields (Select Cols) and chosen the
output medium (Output Options). However, at any time in this sequence they can run the
query statement by selecting <Run Query> using the button on the “Save and Restore” tab.
Enter the required Post Office (FAD) code into the <Group ID:> field if it is not shown.
Once this has been done an intermediate screen will be displayed, allowing the file format to be
confirmed — select the <Excel> or <Access> buttons or the “text” icon, as appropriate to
commence loading the package and complete the data transfer. This will also allow the data
format to be checked on-screen.
Note: In the case of very large Correspondence Server files spanning a number of days, an
error may be generated on trying to save an Excel file. This will be because the maximum
number of rows (records) has been exceeded. Should this occur, the range of dates should be
covered, say one or two days at a time, and a number of output files generated.
In rare cases it will theoretically be possible to produce a text output file that is too big to be
read by Wordpad. Should this occur, a possible response is to produce output files for a
smaller range of dates, or to initially create data as an Excel working file which can be ‘Save
As’ “Text, OS/2 or MS-DOS”.
It is good practice to check that all output files can be opened before they are copied to floppy
disk or CD-W for onward transmission.
11.0 Data Retrieval — Missing Day
Tf while retrieving data for an ARQ there is no data retrieved for a day, or a sequence of days (but not
all days) duplicate retrieval of data for those missing days from the other server to ensure consistency.
If both servers are consistent, re-run R-Query using templateMissingDay,rft from the day before to the
day after the missing day.
The spreadsheet is sorted by ID and Number
Check that the number sequencing is contiguous from day to day - normal, automatic housekeeping
events, both during the early hours, and at the end of the normal working day, will be present.
If the numbering system is contiguous, it means that there is no sales activity records absent. If in
doubt, call Audit Support to verify.
Save the spreadsheet to the ARQ directory and name using the missing day(s) as the title.
Select Readme for missing day.frt (if not on audit station use from Janes Directory on Bootle) and
complete and save to ARQ directory.
Both should be sent to POL along with the normal ARQ data.
Example - ARQ 464
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 30 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
12.0 Data Retrieval — No Records Found
In the event that during R-Query a message of ‘No Records Found’ is presented for a series of days, it
may be that the outlet has been assigned to the incorrect cluster in Horizon. Another symptom of this
error is that only two files are brought forward when connecting to the store, and checking for gaps.
Ask him to check which cluster the outlet should be assigned to. If it is incorrect in Horizon the Audit
Support team should be advised.
Until the necessary changes are made in the system a manual selection of the cluster will be necessary.
To connect to the correct cluster follow these steps:-
1. Start a new query in Horizon
N
Specify dates required and select ‘update’, as usual
3. DO NOT enter FAD code into the “PO FAD Code’ box as usual
4. Under ‘Audit Point’ select “TMS”
5
. Under ‘Sub Point’ select correct cluster ie ‘Cluster 1B’ or ‘Cluster 1W’ depending on the
server already selected
6. Return, in the ‘FileName template’ box type:
FNOI_TMS_CLUSTERXX_X_X_*
CLUSTERXX — type the relevant cluster code ie CLUSTERIB
Third X - CLUSTERXX_X — type W or B depending on server chosen
Fourth X — CLUSTERXX_X_X - type number displayed on original ARQ request which resulted in
“No Records Found’ from ‘Filename for ARQ Ref POIA...’ ie “FNO]_TMS_CLUSTERIW_W_6 —
this number should also correspond with the third number of the FAD code.
7. Complete data extraction as usual
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 31 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: = 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Creating CDs
Roxio Easy CD Creater is used to copy the ARQ requested information on to CD-R, for
despatch to POLIA.
8 oa
i ‘Share
documents, spreadshoots, and pre:
In the most compatible format.
To launch CD Creator inserts a new CD-R in to the CD writer. This will launch the main
screen (Figure 24) The user selects “Make a Data CD”, then “Data CD Project” this initiates
the Data CD — Easy CD Creator Screen Figure 25.
a
Seer sabhassieeenpnssnneareemiseamupeniapneaiiavenasae i
ois Sete
Gieensrarus Fol ceva 12
II Gee Fle Folder 06/0103 150
I Gitegao File Folder 05/1102 140.
" Baesen Seiot: Fle Folder osyrivae 134
Giorno FTA Fle Folder osnine tz
a Pepa oy reniml
‘Aad Reve
data ee eerste i el Data CD
‘2015-1007 (has =
Project Screen
1
Figure 25
B)I
num 000
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 32 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
From here the user selects the source file from the drop down box. The source file should be
held on the D:\ under Auditdata\ARQ***. The files will appear in the top window, the user
will then drag and drop the required files to the lower window. All CD’s will be recorded as
‘Closed’ to prevent any further data being added to the CD. The CD-W shall be passed to CS
Security and checked for viruses after the data has been written to it and before sending it to
Post Office Ltd.
In order to adopt ‘best practice’ processes all data retrieval completed by Security Department staff is
to be checked by another prior to despatch. These notes contain the fundamental checks required.
A copy of the original request received from Post Office Limited and the resultant CD will be passed to
the checker. The following initial checks should be made:-
«The FAD code has been ticked as checked on the ARQ form
¢ The written details on the disk reflect the requirements of the ARQ
e The detail of the retrieval has been recorded on the ARQ form
Open the CD, the following checks should be made:-
© The transaction and event files cover the timeframe requirements of the ARQ
¢ Open the transaction spreadsheet and check the timeframes match the requirements and that the
first and last day of the request are present
¢ Check Group, at the top of the spreadsheet, and FAD number on ARQ form are the same
¢ Select sheet 2 and check the FAD number listed in column I is correct
¢ She files used cover the timeframe plus 2 days
© ‘Size of Gaps’ equals ‘None’
© Close transaction spreadsheet and open events spreadsheet
¢ Again, check FAD number and timeframe(s)
¢ Logon is present at the top of the data retrieved for the first day of the ARQ timeframe requirement
(be aware some reports are produced automatically and can be present prior to log on)
¢ Log off is present at the bottom of the data retrieved for the last day of the ARQ timeframe
requirement — if a day(s) is missing check whether day(s) falls on a Sunday or Bank holiday
¢ Duplicate audit details to those recorded on sheet 2 of the transaction spreadsheet are also held on
the events spreadsheet, select sheet 2 and perform a similar check
* Close events spreadsheet
© Retrieval data is held in both 95 and 97 formats
¢ Open Readme first file and check correct ARQ number has been entered and that personal details
and anti-virus information is correct
© Close all spreadsheets and open Access database
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 33 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
e Ensure all data has been recorded and select own name from the drop down ‘Checked by’ list
e Initial ARQ form as checked and pass back to originator
13.0 Despatch of Audit Data
The audit data is despatched to POLIA contact using Royal Mail Special Delivery. This
ensures that a receipt is provided to Post Office Account confirming delivery.
The Prosecution Support Database must be updated to record the date that the extraction
activity was started, completed and posted
14.0 Appendix
Appendix 1 ARQ Form
Appendix 2 Example audit log
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 34 of 1
FUJ00176265
FUJ00176265
Fujitsu Services AUDIT DATA EXTRACTION PROCESS Ref: TA/PRO/004
Version: 2.1
COMMERCIAL IN-CONFIDENCE Date: 15/09/04
Appendix 1
AUDIT RECORD QUERY
Originator: I Post Office Ltd Security Date: I dd/mm/ccyy
Casework Manager
PO Box I
Croydon CR9 1WN
Telephone: I “GRO;
Witness Statement I YES/NO REF NO. eo
(delete as applicable)
Information Requested
Date range: Post Office I Name and FAD
GENERAL
DESCRIPTION /
FORMAT
REQUIREMENTS:
Specific Details: (PAN or equivalent identifier)
Signed Date I dd/mm/ccyy
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE Page: 35 of 1
Fujitsu Services AUDIT DATA EXTRACTION PROCESS
COMMERCIAL IN-CONFIDENCE
Ref:
Version:
Date:
FUJ00176265
FUJ00176265
TA/PRO/004
21
15/09/04
Appendix 2
Log for closed ARQ: POIA149W
ARQ created by: jhass01
ARQ Closed: 09/01/03 15:01:44
Actions:
Instance: 5
CommandUsed: Get cluster ID
ErrorCode: -12
Error message: Failed to open the CLUSTER ID file.
StateID: ProcessNOK
Started At: 06/01/03 16:07:54
Ended At: 06/01/03 16:08:41
Generated by: rlaki01
Instance: 4
CommandUsed: Get cluster ID
ErrorCode: -12
Error message: Failed to open the CLUSTER ID file.
StateID: ProcessNOK
Started At: 06/01/03 10:27:07
Ended At: 06/01/03 10:27:23
Generated by: jhass01
Instance: 2
CommandUsed: Get cluster ID
ErrorCode: -12
Error message: Failed to open the CLUSTER ID file.
StateID: ProcessNOK
Started At: 06/01/03 09:55:49
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE
Page: 36 of 1
Fujitsu Services AUDIT DATA EXTRACTION PROCESS
COMMERCIAL IN-CONFIDENCE
Ref:
Version:
Date:
FUJ00176265
FUJ00176265
TA/PRO/004
21
15/09/04
Ended At: 06/01/03 09:56:04
Generated by: jhass01
Instance: I
CommandUsed: Get cluster ID
ErrorCode: -12
Error message: Failed to open the CLUSTER ID file.
StateID: ProcessNOK
Started At: 06/01/03 09:49:37
Ended At: 06/01/03 09:50:23
Generated by: jhass01
Instance: 0
CommandUsed: Create directory structure
ErrorCode: 0
Error message: No error message held.
StateID: ProcessOK
Started At: 06/01/03 09:48:48
Ended At: 06/01/03 09:48:59
Generated by: jhass01
Files and status of files used by: POIA149W
This ARQ did not utilise any files.
Total number of files utilised: 0
14.1.1
14.1.1.1 Heading 4 Style
14.1.1.1.1 Heading 5 Style
© 2003 Fujitsu Services COMMERCIAL IN-CONFIDENCE
Page: 37 of 1