POL00028066 - Deloitte Project Spire Supplementary Information May 2012

Evidence on official site

POL00028066
POL00028066

Deloitte.

Project Spire

Supplementary Information

May 2012

POL-0023069
Contents

1. Our Approach
2. Further credentials

3. Team Bios

Our Approach

Our suggested approach is shown again below. We would like to take this opportunity to highlight for you that every Phase of our approach is coordinated closely
and interactively with both yourselves and your legal team. Our extensive experience in working under legal privilege will not impair this pragmatic and constructive
approach in forming factually accurate conclusions. All of our draft observations from Phase 3 and 4 will be shared with you, for validation and debate as
appropriate, and you will kept regularly informed of the status of any key conclusions which we draw as part of our Phase 5 activities. Our goal is to reach a
factually accurate conclusion, and our approach to this is both robust, transparent and iterative where needed.

Key Deloitte Activities

POL inputs

Phase 1
Mobilisation

Phase 2
Data Flows & Key Controls
Understanding

Phase 3
Governance and Controls
Testing

Phase 4
Testing of Data &
Transactional Detail

POL00028066

POL00028066

Phase 5
Refinement and
Reporting

+ Deloitte / POL project team
mobilisation and introduction to
key stakeholders.

+ Desktop review of prior, relevant
work performed.

+ Perform detailed workshops to
determine key system and
process areas to be tested, refine
testing boundaries and define
characteristics that would
represent ‘issues’ if identified.

+ Confirm how our review will be
positioned with interviewee
stakeholders

+ Finalise field work plan and
milestones

+ Identify and obtain additional key
items required for the review.

+ Agree data handling protocols.

+ For the “in-scope” financial close
policies and procedures perform
full end-to-end walkthrough.

+ Implementation testing of key

manual and IT controls, including

automated preventative/detective
controls; change management
procedures; and functional
security access.

For the ‘in-scope” transactions,

perform end to end data flow

walkthrough.

Review of incident management

processes and of historical

incident logs.

Review error logging and

monitoring activities in key

systems.

+ Review of existing policies and
procedures around system use,
training and other related
governance principles.

+ Determine the adequacy of
training for existing staff and the
on-boarding process for new staff
and how this is managed.

+ Review the processes used to
communicate policies to sub-
postmasters and how changes
are implemented.

+ Understand support available to
postmasters in the financial close
procedures. including complaint
and whistle-blowing procedures
and how frequently these are
used.

+ Perform field interviews

+ Work with POL to develop and

finalise the scope of the

substantive testing and analytics

to test for existence of key risks

identified in Phases 2 and 3.

Obtain full record and data needs

and perform reconciliation

Execute agreed scope of tests,

this may include, for example:

+ Potential surveys with
postmasters

+ Potential processing dummy
transactions and tracing
through the systems

+ Potential analytics over data
previously recorded

Validate the output with POL

+ Discuss and validate findings and
produce draft report summarising
key conclusions.

+ Workshop/Meetings with key
stakeholders to discuss draft
report and validate findings

+ Further exploration or validation
activity to refine the report

+ Close out meeting with key
executive stakeholders and issue
of final report.

+ Work with management, where
required, to provide technical
input and lay foundation for next
steps.

+ Allocation of a POL “point of
contact”.

+ Attendance at workshops.

+ Supply of existing documentation
and historic reviews:

+ Agree data handling protocols.

+ Agree detailed timetable.

Timely access to key POL staff.
Timely provision of supporting
information, such as reports from
systems, and existing
documentation.

+ Validation of accuracy of initial
findings.

+ Timely access to key POL staff.

+ Timely provision of supporting
information, such as reports from
systems, and existing
documentation.

+ Validation of accuracy of initial
findings.

Contribute to detailed tests
scope.

Provision of required data.
Support reconciliation

Input into validation / follow-up of
analytic outputs to identify higher
tisk items and root causes.

+ Validation and discussion of draft
findings.

* Detailed Project Plan and
communication protocols.

* Change Order relating to any
changes to original scope

+ Meeting plan for future phases

+ Agreed data handling plan.

+ Schedule of key risks identified
(including characteristics of
transactional error)

+ High level data flow diagram for in
‘scope transaction and summary
of financial close process.

+ Draft data request for phase 4.

+ Draft of key observations
identified

+ Finalised data request for phase
4.

Draft of key observations
identified.

Output for each of the
tests/analytics for POL
investigation and root cause
analysis

+ Final Deliverable:

> Executive Summary providing
key ‘themes’ from the review

» Detailed observations and
recommendations

> Appendix containing key
dataflow and process maps and
an Excel workbook of
underlying analytic schedules.

© 2012 Deloitte LLP. Private and confidential

POL-0023069
Our Experience

Processing integrity review at a large UK Corporate

Deloitte led a review at a large UK corporate business to confirm the
validity and accuracy of transactional outcomes through their complex
technology and process landscape, after a small number of high
profile issues were publically reported. Despite the number of issues
being a small % of total transactional activity, the accusation was that
the processing environment was systemically “flawed”.

In anticipation of defensive legal actions around key contracts, the
client appointed Deloitte to perform a legally privileged, independent
‘end to end’ review of the integrity of the processing environment to
report the extent and detail of any issues identified, including:

+ all key aspects of governance and control, relating to data flow
integrity, people, process and technology

«detailed substantive testing of a large, statistically based, sample of
transactions.

Our work not only gave the client confidence to make statements on

the integrity of their systems, but also identified a number of areas of
improvement at a very detailed level, leading to both compliance and
efficiency improvements in the client’s business when remediated.

"High
"Medium

"low

POL00028066
POL00028066

Sanctions reviews at large global financial institutions

Deloitte is a Global leader in the provision of processing integrity
services relating to sanctions compliance and has led reviews, under
legal privilege, at several global financial institutions over the past four
years.

The institutions were required to perform retrospective reviews to
confirm the integrity of processing of transactions and to determine if
payments had been made in violation of sanctions legislation.
Deloitte assisted the institutions with a global end to end review of
relevant transactions, touching on all types of error risks, whether
manual or technological at their root cause. Deloitte performed:

* detailed reviews of customer and correspondent banking
relationships to identify potential violations of US sanctions;

* mapping and visualisation of the payment systems, data flows, key
applications and hubs from source into the payment network;

* analytic interrogation of the transactional population for
characteristics of violation; and

* reporting into external legal counsels who conducted investigations,
including root cause identification and remediation..

Ss fi es
‘ant ins 7
Bae a lel
z az

© 2012 Deloitte LLP. Private and confidential
POL-0023069
Our Experience

Mobile Operator and the Home Office

The EU Data Retention Directive obliges member states to store
citizens’ telecommunications data in order to support criminal
prosecutions. In practice, member states require access to IP
addresses and time and use of email, phone calls and text messages
sent or received. The UK Home Office sets out quality standards that
all operators must satisfy to fulfil this obligation.

Increasingly, telecommunications data is being used to associate
criminals to a specific location as part of a prosecution case.
Defending lawyers commonly call into question the veracity of the
data used, in order to challenge the prosecution.

Mobile operators must therefore demonstrate strict adherence to data
governance, data quality and processing integrity standards set out by
this directive. Failure to do so not only undermines private and public
prosecutions, but is a failure to meet the Home Office’s expectations.

The mobile operators and the Home Office look for support to both
meet the standards and perform testing against them. Deloitte has
worked with both the operators and government alike to design,
implement and assure against robust data governance, quality and
processing integrity standards so that the integrity of the facts that the
data represents stands up to the challenge of questioning in court.

Deloitte

Communications D: etention

POL00028066

POL00028066

Have Confidence in Deloitte —- Key points

Deloitte regularly works with clients under legal privilege where the
client is seen through external counsel. Our entire team identified for
this engagement are familiar with the obligations of working under
privilege and what needs to be done for this to be maintained.

We are frequently asked to support our clients when they are subject
to actual or anticipated criminal prosecutions, regulator examination
or contract challenges. We understand the importance of reporting
our findings in a format that is in our clients’ best interests which
often means sharing preliminary findings for validation and full
discussion ahead of final documentation.

Our data analytic and controls assurance teams are market leading,
both in terms of their size and experience. These teams routinely
deliver some of the UK’s most complex challenges and
engagements, and we pride ourselves in our ability to achieve this.

Our clients include all market sectors, government bodies and
national and supra-national regulators. We welcome the chance of
bringing this experience to bear in support of this engagement.

© 2012 Deloitte LLP. Private and confidential
POL-0023069

Our Experience

London-based Higher Education Institution

Deloitte were engaged by a University, following very high profile
issues, relating to processing integrity which lead to a £36 million
funding claw back by HEFCE, the University regulator.

Our team performed an independent ‘end to end’ review over key
matters such as governance arrangement, end to end data flows and
processing integrity through their system, key controls testing and
data accuracy testing, in order to determine the factual basis for
issues which had arisen and been alleged.

Working closely with both our client and their regulator, the project
included:

. Data analysis specialists to interrogate key systems data at
various stages of its processing lifecycle, highlighting potential
exceptions, concerns and insights; and support the identification
of root causes of issues and symptoms of key control failure
leading to the errors in regulatory submissions.

. Mapping of key data flows and corresponding manual processes
and controls involved in the collection of data, the reporting of
information and the compilation of external returns,

. Interviewing key stake holders to assess governance
arrangements and determine their role in key processes and
understand their views on system functionality and areas for
improvement

. Reviewing policies, procedures and the validation and sign off
processes of both key reports and summary documents for
those with the ultimate responsibility of delivering the return and
for maintaining good governance over processing integrity.

POL00028066
POL00028066

Large outsourcing company

Deloitte are currently working with an outsourcing company which
manage portfolios of financial assets for their clients. The company
had been challenged on the processing integrity and accuracy which
underpinned some of the key calculations which could potentially lead
to specific charges applied to products being erroneous.

Due to extreme complexity of the client systems, and the subject
matter in hand, Deloitte were engaged to perform an end-to-end
processing integrity review, focussing on error risks in this specific
calculation area. Our work included:

* Mapping key data flows, to a granular data asset level, through
systems to determine origin and nature of data assets

* Independently building models to reperform the high risk
calculations, and performing detailed client system code assessments
to investigate sources of variance

+ Interviews with staff to understand the level and frequency of human
interaction and intervention with the calculation.

*Review of system audit logs to understand and document important
changes in the system code, functionality and user base.

© 2012 Deloitte LLP. Private and confidential
POL-0023069
Your Team

Gareth James

Engagement Partner

Quality Partner

Andrew Manning

Work stream Lead

Laura
Schmuttermeier

Manager Senior consultant

Michael Jones

Work stream Lead

Dan Andrew

Charlotte Desourdy

Manager Manager

Governance and Control

Systems and Data

POL00028066
POL00028066

POL-0023069
POL00028066
POL00028066

Engagement Partner

Gareth

Background Gareth, a chartered accountant, is a Partner in our Enterprise Risk Services practice specialising in system controls and data
analytics. He has over 15 years experience in delivering risk related assurance and advisory engagements to clients across
multiple industry sectors, and leads our Audit and Finance Analytic team in the UK. Gareth has lead a number of engagements
relating to processing integrity assessments. His experience and skills provide him with a unique ability to join up ‘top down’
governance, control and technology matters in an organisation, with real world insight derived from ‘bottom up’ data analytics.
This enables Gareth to provide his clients with unique and insightful perspectives on their organisation's true state of
compliance and performance, along with commercially prioritised suggestions for improvement.

+ Gareth is the Risk Services lead partner for Post Office, and he has delivered engagements over the past 3 years
relating to IT controls, data analytics and security. Of particular note, Gareth lead the team that designed, built
and implemented a number of ACL based analytic systems for POL’s finance teams in Chesterfield, which
delivered significant improvements in the management and performance of various financial processes, including

Relevant Experience stock adjustments, automated payment systems and retail stock management.

+ Gareth led a review, under legal privilege, at a large UK corporate business to confirm the validity and accuracy
of transactional outcomes through their complex technology and process landscape, after a small number of high
profile issues were publically reported. Despite the number of issues being a small % of total transactional
activity, the accusation was that the processing environment was systemically “flawed”.

The client appointed Deloitte to perform an independent ‘end to end’ review of the processing environment to
report the extent and detail of any issues identified, including:
+ all key aspects of governance and control, relating to data flow integrity, people, process and technology
+ detailed substantive testing of a large, statistically based, sample of transactions.
+ Our work not only gave the client confidence to make statements on the integrity of their systems, but also
identified a number of areas of improvement at a very detailed level, leading to both compliance and
efficiency improvements in the client’s business when remediated.

POL-0023069
POL00028066
POL00028066

Quality Partner

Tom Scampion, Partner

Background
Tom leads the Data Analytics practice in the UK, specialising in delivering solutions to address the challenges of financial
crime. He has worked for over 16 years in the fields of data management, data quality and information integrity, supporting
clients in the delivery of risk, customer and regulatory compliance engagements.

Before joining Deloitte, Tom worked for a number of UK and US technology and services companies, developing a wide
selection of business propositions and then ensuring their effective implementation. Before joining Deloitte he led the European
division of the largest data quality vendor in the market, responsible for over 100 clients. He has spoken frequently on the
challenges of data quality at industry events and, more recently, the technical challenges of achieving financial crime
compliance.

Typical projects he has managed include:

+ The implementation of technology and business processes to deliver sanctions screening solutions to ensure regulatory
compliance. This included the evaluation, selection and configuration of AML/sanctions technology to filter and review
payment messages.

Relevant Experience + Major retrospective sanctions payment reviews to establish historical compliance to OFAC, HMT and other regulatory
authorities’ stipulations. These involved processing multiple millions of payment messages, complex data matching/linking
and significant data analysis to categorise potential breaches.

* Creation of operational single customer views across multiple channels to ensure the creation of a consolidated picture of
customer activity. These typically involved significant business rule development and technology configuration/integration.

+ Information Quality Assessments to understand the value of enterprise data. These involved business level workshops to
define data ownership, policy and practice as well as the use of a variety of market leading data profiling technologies.

+ Data governance assessments and policy formulation across multiple international locations.

+ Data quality work stream project management as part of broader technology implementations such as within CRM, ERP
and regulatory compliance.

+ Project management of data migrations including source data assessment in relation to business objectives at the target.
Definition and roll-out of a top-down, target driven approaches to reduce overall risk.

+ IT and Business reviews of data-related initiatives to ensure that the business objectives will be realised.

POL-0023069
POL00028066
POL00028066

Governance and control workstream

Andrew Manning, Director

Background As a Director in Enterprise Risk Services practice, Andrew has over 20 years experience in the field of governance, controls
r " transformation, risk, and counter fraud working in the public and private sectors.

From working with regulators such as the Civil Aviation Authority, The Pensions Regulator and UK Anti-doping to leading large
investigations and lessons learned exercises at Environment Agency, FirstGroup and QinetiQ, Andrew comes with extensive
experience of working with organisations to develop and improve their control environment. In addition, Andrew has led
complex end to end process reviews to evaluate the adequacy of the control environment and has designed testing strategies

to assess the effectiveness with which the controls are being applied.

Andrew currently leads on our business process delivery to central government organisations and is a chartered internal
auditor and an accredited counter fraud specialist. He come with extensive experience of working with many organisations in
the design, implementation and evaluation of business processes.

+ Leading on a control transformation project looking at the structure and delivery of the Single Payment Scheme (SPS) at the
Rural Payments Agency. This involved a detailed examination of the end to end processing of all claims made under the
SPS which accounted for £1.8 billion of payments each year, from claims receipt through to payment and accounting
(including the month end close process)

Relevant Experience + As interim Head of Internal Audit for the British Council, Andrew undertook a post implementation review/lessons learned
assessment of their global SAP implementation at their regional finance hub in South Africa. This work led to a restructure of
the implementation programme and a new strategy to their global SAP platform.

+ At the Department for Transport, Andrew led a high profile assessment of their Management Development programme
looking critically at the six work streams of the programme and how they were contributing to the overall objective of
developing leaders for the future.

+ Andrew has led on number of fraud investigations with an extensive number of clients from NHS institutions to large
Government departments. These have often involved liaising direct with Police to ensure that the investigations lead to a
successful criminal conviction.

POL-0023069
POL00028066
POL00028066

Governance and control workstream

Laura Schmuttermeier, Manager

Background Laura is a Manager within our Enterprise Risk Services practice in London with more than five years of experience. She is a
qualified chartered accountant. Laura has participated in many national and international assignments and has gained
significant experience in the private and public sectors, delivering internal audit and risk management services as well as
fraud related assignments. These include fraud awareness training sessions, fraud risk assessments and the assessment of
anti-fraud control environments. As a result of this, she frequently works with the Data Analytics team, Deloitte's Forensics and
Dispute Services as well as external law firms and gained experience in working under legal privilege.

Laura has gained an in-depth knowledge in various processes such as Financial Controls, Financial Close, Cash & Bank,
Accounts Payables and Receivables, Procurement, Tendering & Receipting, Treasury Management, Sales and Marketing and
Management of business relationships, such as Joint Venture s.

Recently Laura was responsible for the development of an anti-fraud control framework for the travel and expense claims
process of an international law firm. This included the identification of relevant fraud risks within the process, the development
of appropriate anti-fraud control objectives, documentation of existing mitigating controls, and the assessment and prioritization
of gaps in the existing framework. Going forward she will assist the client with the design and implementation of control
activities which address the gaps identified.

Relevant Experience On an ongoing basis Laura delivers fraud training to companies across a variety of industries as well as within Deloitte. These
training sessions assist employees and management to gain an understanding as to what constitutes fraud, the regulatory
landscape, the roles and responsibilities of individuals for the detection and prevention of fraud and the specific internal control
framework in regards to the prevention and detection.

Laura worked on an investigation into allegations of public bribery and corruption at a European communications and
technology conglomerate. Retained by external US counsel, our work focussed on a number of high-risk country operations
across a range of segments of the business. As part of our work we liaised with both the U.S. Department of Justice and the
Securities and Exchange Commission, as well as a number of local European country prosecutors.

Laura was involved in a Controls Transformation Project for a large European manufacturing company. In her role she was
responsible for the design of an improved monitoring framework of internal controls. This required her to consider the global
presence and multi divisional structure of the client to ensure the designed framework fits with the current structure.

POL-0023069
POL00028066
POL00028066

Governance and control workstream

Sam Feek, Senior Consultant

Background Sam is a Senior Consultant within our Enterprise Risk Services practice with over three and half years of experience and is a
qualified certified chartered accountant.

Sam has significant experience in the private , public and third sectors, delivering internal audit, risk management, controls
advisory services as well as fraud related assignments. These include fraud risk assessments and the assessment of anti-
fraud control environments as well as reviews completed upon request from the US Department of Justice.

GRO

Sam has worked on individual business cycle internal audits including AP/AR, treasury management, budgeting, payroll, cash
& banking, recruitment and others) for a number of clients in the public and private sector in the UK and abroad.

Recently Sam worked as part of a controls transformation for a global FTSE 100 technology company in response to bribery
allegations. This work included an assessment of the supply chain and corresponding financial controls in place to mitigate
specific bribery and ethical compliance risks.

Sam assisted in the development of an anti-fraud control framework for a shared services centre of a large construction firm in
response to internal fraud allegations. This included the identification of fraud risks within the process, the development of
Relevant Experience appropriate anti-fraud control objectives, documentation of existing mitigating controls, and the development of remediating
actions in order to strengthen the existing control framework. .

Sam has also gained significant experience in assessing third party risks and carrying out contract compliance reviews
including stress testing anti-bribery controls in relation to Joint Ventures. Most recently this includes an ABC readiness review
for an international property development, investment and fund management group.

Sam worked on a financial controls project in relation to a franchising operation for a FTSE 250 beverage manufacturer. This
involved reviewing compliance with the franchise agreement, testing of key financial controls to provide assurance over
figures submitted over financial close process as well as revenue recognition and franchise fee calculations.

POL-0023069
POL00028066
POL00028066

Systems and data workstream

Michael Jones, Director

Background
Michael is a Director in the Data Analytics group within Deloitte's Enterprise Risk Services (ERS) practice. He leads the
Financial Crime data team in Deloitte with a focus on the use of data and data analytics to enhance client's abilities to detect
and prevent criminal activity.

The Financial Crime team has a wide range of experience and has used multiple tools and technologies including SQL,
Trillium, DataFlux, SAS, Actimize, Informatica, Teradata, FircoSoft and Datanomic.

He is a qualified Chartered Accountant with more than 15 years experience assessing and improving processes, systems,
controls and data across multiple industries.

*Seconded to the Group Audit function of a major UK bank as Head of Audit for Financial Crime. He was responsible for
identifying, planning and delivering audits of sanctions, Anti Money Laundering and Fraud across all banking divisions. He
was the audit representative on the Group Financial Crime steering committee and the Group Risk Sanctions, AML and
Fraud steering committees. He liaised regularly with Group Financial Crime and key business stakeholders in the financial
crime space.

Relevant Experience -Establishing and leading a data team of c.20 consultants in support of a sanctions retrospective review. This was a major
analysis of business transactions for a global financial services organization with operations in over 74 countries, operating
69 payment systems and 81 customer repositories across multiple business clusters. The review looked at payment and
transactional data over a 7-year period. Initial scoping focused on determining the relevant systems and therefore the
relevant transactions. In-scope transactions totalled over 100 million records spanning 8 systems across 3 continents. Each
dataset had specific data protection rules, business processes and data models to consider.

«Assessing key controls in a financial spread betting business through the use of data analytic tools and techniques.

12
POL-0023069
POL00028066
POL00028066

Systems and data workstream

Daniel is a Manager in our ERS Data practice and joined Deloitte in 2006 and has over 10 years experience working in the
field of data quality, data analysis and audit data assurance support. Daniel has a well developed expertise in complex data
management solutions with clients of all industry sectors.

Daniel is a member of the ERS Financial Services and Consumer Business industry group teams and with a focus on
Financial Crime and Anti Bribery and Corruption

+Daniel was the project manager on an international retrospective trade sanctions review for a global bank. The review
spanned the Bank's corporate and retail arms in six global jurisdictions. Over 50 back-office and payment systems were
analysed to identify potential US dollar transactions to one of six sanctioned countries. Daniel has lead various work streams,
including:
+ System mapping — understanding the flow of payment data through back office systems to the SWIFT network and
Relevant Experience identifying points of possible manual intervention.
+ Management Information — Implementing an automated solution, using SSRS to map the flow of review cases
through the transaction review and support the investigation team with ad hoc MI requests.
+ Payment filtering - mapping the Bank's historic message monitoring and filtering solutions over the period of the
review

*Delivered an end-to-end shrink and point of sales review at a major High street retailer to identify data trends, exceptions and
risk patterns in procurement, Inventory and point of sales data which indicate areas of potential shrinkage and fraud.

POL-0023069
POL00028066
POL00028066

Systems and data workstream

Charlotte Desourdy, Manager

Background

GRO

Charlotte is a manager in our Enterprise Risk Services practice, specialising in data analytics. She has over five years
experience of performing and enhancing reviews at organisations, using sophisticated data analytics tools to quickly and
efficiently profile, analyse and report upon large volumes of data. Charlotte also has a vast experience of performing mapping
exercises to document and understand key data flows in a business including underlying processes and supporting controls.

Charlotte is a qualified chartered accountant and has SC security clearance.

«Supporting the design, build and implementation of analytic systems to improve the management and performance of various
financial processes, including stock adjustments, automated payment systems and retail stock management. at Post Office
Ltd.

Working alongside the security and fraud team at Post Office Ltd to help demonstrate the value of data analytics by leading
the design and build of bespoke fraud data analytics pilot , focussing on two key areas of fraud in the Credence and SAP HR
Relevant Experience systems.

-Leading a work stream to identify errors and processes weaknesses at a large stock broker. This involved mapping complex
data flows and transactions and tracing them through relevant systems to understand key areas of risk and potential for error.

+Leading the design and development of an automated matching and reconciliation tool for a funding platform to identify and
quantify FSA related breaches within a large UK savings and investments company, over a period of three years, in
preparation for a FSA review. The tool allowed the efficient and effective quantification of breaches alongside observations
and recommendations to improve the process and control environment. This required a high level of knowledge around the
operation of the funding platform and the practical application of relevant FSA rules.

-Using sophisticated data analytics to review a complex provision calculation for a large retail bank to provide assurance over
the completeness and accuracy of the calculation. This led to the bank releasing over £1.3m from the provision.

14
POL-0023069
POL00028066
POL00028066

Deloitte.

Important notice

This document has been prepared by Deloitte LLP (as defined below) for the sole purpose of providing a proposal to the parties to whom it is addressed in order that they may
evaluate the capabilities of Deloitte LLP to supply the proposed services.

The information contained in this document has been compiled by Deloitte LLP and includes material which may have been obtained from information provided by various sources
and discussions with management but has not been verified or audited. This document also contains confidential material proprietary to Deloitte LLP. Except in the general context
of evaluating our capabilities, no reliance may be placed for any purposes whatsoever on the contents of this document or on its completeness. No representation or warranty,
‘express or implied, is given and no responsibility or liability is or will be accepted by or on behalf of Deloitte LLP or by any of its partners, members, employees, agents or any other
person as to the accuracy, completeness or correctness of the information contained in this document or any other oral information made available and any such liability is

expressly disclaimed.

This document and its contents are confidential and may not be reproduced, redistributed or passed on, directly or indirectly, to any other person in whole or in part without our prior
written consent.

This document is not an offer and is not intended to be contractually binding. Should this proposal be acceptable to you, and following the conclusion of our internal acceptance
procedures, we would be pleased to discuss terms and conditions with you prior to our appointment,

In this document references to Deloitte are references to Deloitte LLP. Deloitte LLP is the United Kingdom member firm of Deloitte Touche Tohmatsu Limited ("DTTL"), a UK private
company limited by guarantee, whose member firms are legally separate and independent entities. Please see www.deloitte.co.uk/about for a detailed description of the legal
structure of DTTL and its member firms,

© 2012 Deloitte LLP. All rights reserved.

Deloitte LLP is a limited liability partnership registered in England and Wales with registered number ©C303675 and its registered office at 2 New Street Square, London EC4A
3BZ, United Kingdom.

Member of Deloitte Touche Tohmatsu Limited

POL-0023069