FUJ00222364
FUJ00222364
Information Requests 16 May 2018 Page 1 of 4
In relation to Issue 1:
Bal [Request For Information 1.1] Can it be described how an
SPM reports an issue (detailed from the moment that SPM picks up
the phone), how this is recorded, how this is investigated (throughout
the various 1st, 2nd and 3rd lines of support) and if a bug is
determined how the impact is considered and how this is scheduled
into the development cycle and then ultimately the code versioning
system and then when changes are agreed through to release
management, including the release notes for new versions and which
persons these are shared amongst.
1.2, [RFI 1.2]"can it be described how bugs/errors/defects
identified by Fujitsu or PO are processed ifit is the case that this is a
different mechanism to those identified through an SPM issue.
In relation to Issue 2:
1.3 [RFI 2.1] Can it be described how SPMs receive reports of
active bugs or errors regarding the Horizon system. For example,
were SPMs notified about the “Local Suspense Account” problem, or
“Receipts and Payments»mismatch” issues (and any other known issue
within Horizon), if so, how?
1.4 [RFI 2)2] is there a list of error codes that Horizon has (or
that.FJ apply) to identify when an error/issue has occurred and the
potential branch account impact?
In relation to Issue 3:
15 [RFI 3.1] If it is the case that reports such as NB102
ua)
recorded reconciliation exceptions, what other control reports exists
5)
that record how human errors are prevented/detected or recorded:
In relation to Issue 4:
1.6 [RFI 4.1] With regards to the acknowledgement that the
Horizon system is not perfect and there has been deployment of
Prepared by: Jason Coyne
Occupation: Partner :
Specialist Field: IT Systems Zitg rou p
On the Instructions of: Freeths LLP ~
FUJ00222364
FUJ00222364
Page 1 Comments
J1
J2
J3
J4
J5
This request is incredibly broad/unfocused, but could we provide references to
documents which show: (1) the process for how a potential bug is investigated
when reported by a SPMR; and (2) the development cycle process?
JONATHANG, 16/05/2018 07:37 AM
We understand this to be a request for information about the process where Fujitsu
or Post Office detect a bug/error/defect. Can we provide documents on this?
JONATHANG, 16/05/2018 07:38 AM
Is there a list of error codes? Are there multiple lists?
JONATHANG, 16/05/2018 07:40 AM
Can FJ provide form NB102?
JONATHANG, 16/05/2018 07:41 AM
Is there a list of control reports?
JONATHANG, 16/05/2018 07:41 AM
FUJ00222364
FUJ00222364
technical controls to reduce errors, can it be described what these
technical controls are (referred in Defence paragraph 16), when these
technical controls have been triggered and how they have been dealt
with?
In relation to Issue 5:
17 [RFI 5.1] Can it be described which data sources outside of
Horizon (providing transactional data into Horizon) have previously
been implicated as cause/contribution to any discrepancies occurring
within branch accounts?
1.8 [RFI 5.2] Can it be described what the process inputs into
Horizon are following the discovery of a branch difference.
1.9 [RFI 5.3] If it is not the case that report NB102 does not
identify all causes of transaction. errors between Horizon and
transaction data sources outside of it, then what other reports or
sources exist to identify those? S
1.10 [RFI 5.4] Once a discrepancy has been identified between in
and out of Horizon,.what is the,process for determining whether a TC
or balancing trans or should be raised?”
In relation to Issue 6:
1At [RFI 6.1] Can it be described what system level logging and
system events are considered when investigating shortfalls and
Transaction Corrections in order to investigate cause?
1.12 [RF1,6.2] Can it be described how often JSN checks were
performed in the investigation of a discrepancy/shortfall and if so what
are the results or records of differences?
In relation to Issue 7:
LA13 [RFI 7.1] When Fujitsu accessed branch accounts to modify
or insert data, can it be described what the need for that access was
and what modifications were performed? Can it be confirmed how
- . jl
many times this occurred?
FUJ00222364
FUJ00222364
Page 2 Comments
J6
J7
J8
J9
J10
J11
Are there other documents that identify potential causes of transaction errors?
JONATHANG, 16/05/2018 07:43 AM
Does FJ have any documents regarding the Transaction Correction process?
JONATHANG, 16/05/2018 07:44 AM
Can FJ point us to documents that relate to system level logging and system events
when errors/bugs arise? FJ can ignore the reference to shortfalls in this request.
JONATHANG, 16/05/2018 07:45 AM
Is there a log of remote access to review data?
JONATHANG, 16/05/2018 07:46 AM
Is there a log of remote access when data has been modified, added or deleted?
JONATHANG, 16/05/2018 07:47 AM
Is there a log of this?
JONATHANG, 16/05/2018 07:47 AM
FUJ00222364
FUJ00222364
]
1.14 [RFI 7.2] tan it be described what privileges and capabilities
Administrators had in relation to Branch remote access and the
relevant processes and procedures?
1.15 [RFI 7.3] Biease describe how Transaction amendments
(including reversals and balancing transactions)’ can be identified for
those which were not carried out by the SPM in the audit/transaction
data/logs (i.e, is it flagged in some specific way)?
1.16 [RFI 7.4] B6L-0032939.doc references a tool that allows
transaction data to be modified outside of branch.. Gan it be described
how such modification was audited, and how the audit files are
updated? Further, how often such a tool was used?
In relation to Issue 8:
1.17 [RFI 8.1] Please describe what reports set out the causes of
identified shortfalls and discrepancies arising from bugs/defects and
how often they were issued ‘to senior management and/or provide
such reports that statistical metrics may. be derived from.
1.18 RFI [8.2] Biease describe what dictates when BIM and MER
reports are produced and how often BIF and PTF meetings were held
and whether meeting minutes are available for those.
In relation to Issue 9:
149 [RFI 9.1] Please describe how often counter error logs were
reviewed in the event of a reported issue and if they were available to
the SPM for investigating issues?
1.20 [RFI 9.2] Biease describe if Discrepancy Reports have ever
been provided to SPMs and if so, what was their purpose, what
replaced them and when? Further, what receipts were SPMs advised
NOT to be retained?
In relation to Issue 10:
1221 [RFI 10.1] Biease describe how often branch account
transactions rebuilds took place and if so, how often was this with the
knowledge of the SPM or PO?
FUJ00222364
FUJ00222364
Page 3 Comments
J12
J13
J14
J15
J16
J17
J18
Is there a standard document or documents about this?
JONATHANG, 16/05/2018 07:47 AM
Is there a standard document or documents containing this information?
JONATHANG, 16/05/2018 07:48 AM
We understand this to be about balancing transactions and privileged user access
JONATHANG, 16/05/2018 07:48 AM
We think this covers the same ground as the previous two requests i.e. balancing
transactions and privileged user access.
JONATHANG, 16/05/2018 07:49 AM
Does FJ know what these reports are?
JONATHANG, 16/05/2018 07:50 AM
Does FJ know what Discrepancy Reports were and what replaced them?
JONATHANG, 16/05/2018 07:51 AM
Is there standard process documentation about such rebuilds?
JONATHANG, 16/05/2018 07:51 AM
FUJ00222364
FUJ00222364
In relation to Issue 11:
1.22 [RFI 11.1] For the One Balancing Transaction that PO are
aware of (Defence 57(3)) please describe how PO were made aware?
1.23 [RFI 11.2] Blease describe whether the Post Office or Fujitsu
have a log of issues that were reported where the discrepancy cause
could not be determined and what further action was
performed/planned to identify a cause.
1.24 [RFI 11.3] Please describe what would determine whether a
branch was informed or not of Fujitsu carrying’ out a fix to branch
data.
1:25 [RFI 11.4] Please describe how often branches were told to
Pause usage of any equipment whilst remote access occurred.
In relation to Issue 12:
1.26 [RFI 12.1] KEL cardci655P states as a solution “If a counter
is stuck in a ‘recovery loop’, with the user not being able to use the
counter due to not being able to,complete recovery then it may be
necessary to delete. the affected recovery records from the
brdb_rx_recovery_transactions table on the branch database.
However, this can ONLY \bescarried out after being given express
authorityesto. do so. by POL.” Please describe how often such
permissions were typically given. Please describe whether this solution
was, the remedy for any other KELs/issues?
In relation to Issue 45:
1.27 [RFI 15.1] Please describe what evidence/reports are
provided to a SPM with the Transaction Correction. Are they informed
of what the specific transaction was, or combination of transactions in
the event of there being multiple causes?
1.28 [RFI 15.2] Please describe the average duration of resolution
for Transaction Corrections and where other statistical information
might be found in relation to causes of TCs.
FUJ00222364
FUJ00222364
Page 4 Comments
J19 How did FJ make Post Office aware of this?
JONATHANG, 16/05/2018 07:52 AM
J20 Does FJ have such a log?
JONATHANG, 16/05/2018 07:53 AM
J21 Is there standard process documentation about this?
JONATHANG, 16/05/2018 07:53 AM
J22 Is there standard process documentation about whether a branch would be told not
to use equipment while remote access occurred?
JONATHANG, 16/05/2018 07:54 AM