POL00028148
POL00028148
2 _ RESTRICTED CONTRACTS
Bringing Technology to Post Offices and Benefit Payments
CURRENT ASSESSMENT OF SERVICE PROVIDERS
Author: Derek Selwood
Authority: — Derek Selwood
Reference: © PWKP4-7
Version. Issue 1.0
27 Noveniber 1995
Contents
1. PURPOSE...
2. STATUS AGAINST THE PRE-ITT HURDLES
2.1. Minimum Service Requirements...
2.2. Partnership...
2.3. Risk Transfer. i
2.4. Funding/ Financial Structure...
3. SERVICE PROVIDER RISK REGISTER ..
4. CONCLUSION
ANNEX A - THE ITT ISSUE DECISION
ANNEX B - DEMONSTRATOR RISKS.
PURPOSE
1.1. This paper provides a brief assessment of service providers’ standing against the pre-
ITT issue hurdles identified in PWKP4-3 (relevant page reproduced as Annex A} and
a summary of the Risk Register for each service provider.
1.2. The information contained in the Paper should be read in the context of the stare of
play in the two streams of Stage 3 work that have provided input:
(a) the Demonstrator and Requirements Sueams, where work has been concentrated
on the clarification of service provider proposals and sponsor requirements
rather than clearance of risk entries;
(b) the Contracts Stream - where little or no negotiation has yet taken place
27 November 1995 Page 1 of 9 Issue 1.0
POL00028148
POL00028148
7 RESTRICTED CONTRACTS
2. STATUS AGAINST THE PRE-ITT HURDLES
2.1, Minimum Service Requirements
2.1.1. The information in this area comes primarily from the Demonswator and
Requirements Streams: their views on the most significant issues are discussed in
Section 3 and attached as Annex B. All three service providers have a reasonable
chance of clearing this hurdle.
2.2. Partnership
2.2.1. The first meetings with all three service providers structured specifically around this
topic have taken place. Al! three are acceptable t¢ POCL Heads of Market. Further
meetings will be taking place with the aim of establishing whether there is any
significant difference between the three.
2.3, Risk Transfer
2.3.1. Much work remains to be done in this area during the contract negotiations. Pathway
will need to address a severity “A” risk register entry raised by the Proposal evaluation
relating fraud transfer. At this carly stage there is nothing else apparent to distinguish
between the service providers,
2.4. Funding/ Financial Structure
2.4.1. Charterhouse are conducting the research on funding and financial structtres. Whilst
Cardlink and IBM have been cleared on the funding side, Charterhouse have concems
about insufficient availability of fimds in respect of Pathway.
2.4.2. The CNT is progressing work to address the Programme concerns about the tence
of limited liability companies heading the Cardlink and Pathway consortia with the
aim of establishing appropriate parent company guarantees. The Programme has also
j raised concerns with Cardlink and Pathway on their risk registers with respect io the
, size of specific key subcontractors (Datafit and Escher Tespectively) in order to further
I assess these risks and the counter-measures the prime is putting in place.
E
I
27 November 1995 Page 2 of 9 Issue 1.0
POL00028148
POL00028148
_ PWKP4-7 RESTRICTED CONTRACTS
SERVICE PROVIDER RISK REGISTER
The current state of the SPRR is summarised for each service provider in the three
tables below. In considering this members need have regard to the early state of
proceedings as summarised in Paragraph 1.2. (Note: Severity A = Critical, B =
Significant, C = Minor, Q = Query, X = cleared),
Table - Cardlink
Risk Category / Severity
BPS
CNT
End to End
Implementation
Infrastructure
I Security
Grand Total
Total A & B’s
BL So] —l opr} —I pe
con fon a
fol tafoj nf] of
NSN) BLO} Hf ole)
Risk Category / Severity
BPS
CNT
End to End
Implementation
Infrastructure & Appl'ns
Security
Grand Total
&
zi
nlo
tele
oI-l-jofol>
t
I
oo
B]HlolHlo
=a 2
wBlop—i-p—lofo
ahs
nlo
xfola
Table 3 - Pathway
I_B3
ow,
=
Sf eof ro} tof tof ua!
BPS
CNT
End to End
Implementation
Infrastructure & Appl'ns
Security
Grand Total
/ Risk Category / Severity
f
,
ty
Blof —IrjofHlof>
I par i]
wl elolo co 4
WO! WI o}—-lofolo
sf =I rfof ojo} x
= ee
ny
3.2, The current position may be summarised as follows
(a) CardLink have two ‘A’ risks {relating to transaction times and develop:
tmeframe) that the Demonstrator strands are progressing and hope to c
downgrade. They have two commercial ‘A’ nisks on contract transfer wh
to be addressed during contract negotiations. They have no Significant
concentrations of ‘B1" risks but there are a number of other concerns.
27 November 1995 Page 3 of 9 Issue 10
POL00028148
POL00028148
_ PWKP4-7 RESTRICTED CONTRACTS
(b) IBM have two ‘A’ risks relating to roll-out timescales and disaster recovery
Papers addressing these should be available by the end of November They have
a ‘significant’ concentration of “B1’ risks in the POCL Infrastructure strand,
Firm plans to address these are in train;
Pathway have three ‘A’ risks currently being addressed by the Demonstrator
strands, of which one is Particularly significant (regarding Riposte). They have
one commercial “A” risk relating to risk transfer of card fraud, which is to be
handled during contract negotiations. Of the three ‘B1" risks in the BPS strand,
two are in the process of clearance.
Annex B provides further details of the outstanding risks.
CONCLUSION
There remain concems, as there did at the end of shortlisting, about the service
providers and their offerings. However, actions to address these concerns are in hand
as part of what was always envisaged as the normal Stage 3 process, and there is
nothing over and above those that the Programme wishes the Board or the sponsors to
do at this stage.
I
E
27 November 1995 Page 4 of 9 Issue 10
POL00028148
POL00028148
PWKP4-7 RESTRICTED CONTRACTS
ANNEX A - THE ITT ISSUE DECISION
The following text is taken from PWKP4-3 “From Demonstrator 10 Selection”
The ITT Issue Decision
Any service provider invited to submit a best tender must have cleared a number of
“hurdles”, The Stage 3 work and the commercial assessments will assess whether each
service provider meets or exceeds:
(a) the minimum service requirements acceptable to the sponsors:
(b) the minimum requirements for partnership with POCL and the development of
new business opportunities (as described in the Prospectus and the SSR):
(c) sufficient transfer of risk for an acceptable risk profile, in particular for the fraud
tisks but also the general service development and business volume risks:
(d) an acceptable funding method and financial structure,
The mechanisms by which failure to clear the hurdles will be detected are the SPRR
and agreement to final draft contracts. A service provider will not be invited to tender
if:
(a) he has any “Critical” (category A) risks or an unacceptable profile of other risks
outstanding at the time the SPRR is finalised; and/or
(b) it has proved impossible to agree with him a contract acceptable to BA and
POCL.
3.4.3. The final SPRR from Stage 3 will analysed to identify the impact (both financial and
non-financial) of the outstanding risks. This analysis and the outcome of the contract
negotiations will be put to the Evaluation Board to decide if any service provider
should not be invited to tender
27 November 1995 Page 5 of 9 Issue 1.0
POL00028148
POL00028148
PWKP4-7 RESTRICTED CONTRACTS
:
ANNEX B - DEMONSTRATOR RISKS
This note represents the Demonstrator’s perception of the three service providers as at
23 November 1995. It addresses “hurdle” (a) of PWKP4-3 (minimum service
requirements acceptable to sponsors). Each assessment covers:
. the current status on ‘A’ risks;
. significant concentrations of ‘B1’ tisks, where ‘significant’ is defined as “three
or more’ in a single Demonstrator strand;
. other relevant issues which are either covered by lower level risks or could well
emerge as new risks.
i. CardLink
‘A’ Risks
Authentication Times:
. this risk reflects concerns about network Tesponse time and the counter process
for benefit encashment;
. network response now seems acceptable (subject to some more investi gation):
. Cardlink are tuning their solution to reduce the transaction time for normal
encashments;
. Counter process time for agent encashments is linked to the level of security
measures required - the balance of cost/risk'time is subject to the risk transfer
negotiations;
. the severity of this risk is thus currently being reviewed.
No details of (Pilot Programme) development times:
. this risk is a hangover’ from the Rugby evaluation:
. it is currently being downgraded to a ‘Q’ (query) as details are being made
available and is likely to be cleared shortly.
Other Issues
ee eerantemenader an
Some key issues at this stage are:
. Cardlink have gone for a lower level of card technology than originally
Proposed i.e. they are no longer Proposing to use Watermark magnetics to
protect the magnetic stripe. The paper on this was Presented recently and the full
implications are yet to be analysed - potentially a risk could be raised:
. the risk on network capacity - highly sensitive to workload assumptions and
f impact on transaction times;
27 November 1995 Page 6 of 9 Issue 1.0
POL00028148
POL00028148
RESTRICTED CONTRACTS
CardLink’s proposal for ‘greenfield’ development of card management facilities
with respect to their ability to have this in place to meet project timescales.
IBM
‘A’ Risks
Computers only 11 Miles Apart:
. this risk relates to FDR’s two sites at Basildon & Southend and problems in the
event of a major disaster in the area;
IBM are proposing a number of options, together with their implications, to
address the risk. These include the use of a third site at IBM Warwick as a
“fairly cold” standby;
. the paper is targeted to be available by 27 November.
Late Roll-out:
IBM’s target date to start roll-out is November 1996, which shows dependency
on contractual aspects;
they are now producing a paper (expected 29 November) which addresses roll-
out in timeframes rather than specific dates;
this will allow meaningful discussion around the plans for roll-out, specific dates
being applied when the definitive timetable for the remainder of the procurement
is announced.
POCL Infrastructure ‘BI’ Risks
. Two ‘scalability of TMS’ risks are likely to be cleared by end-November
a risk on the network (use of ISDN D Channel) being addressed by discussions
with BT;
two risks on Storeplace relating to its state of development and lack of wack
record. These are to be addressed at a visit to IBM's development centre for
Storeplace in two weeks time;
other two risks relate to OS/2; one is being addressed by IBM presenting on its
future: the other is being put on hold pending definition of requirement for using
Microsoft Office (or otherwise).
Other Issues
. IBM are limiting their investment in development of solution, ¢.g. no host
system connect during Stage 3 - Demonstration will be a simulated connection.
This should not cause problems for assessment. even though an end-to-end
transaction cannot be physically demonstrated.
27 November 1995 Page 7 of 9 Issue 1.0
POL00028148
POL00028148
Pathway
‘A’ Risks
Riposte is Unproven:
. there are serious concerns with its scalability - especially the new 32-bit version
Proposed which is still being developed (target date for ‘freezing’ this version is
Spring 96 - this may become a new risk);
. Pathway are performing modelling to try and clear the risk, A key problem is
that ICL do not seem to understand Riposte in sufficient depth to answer
questions;
* an apparent high (or total?) dependency on Escher - a small US based software 1
house responsible for development of Riposte;
. trip planned to visit Escher for detailed discussions and to obtain ‘first hand’
view of the development resource (concer is that there are really only two
people that know Riposte).
Phased Approach to Acceptance of Products & Late Roll-out:
. still on the SPRR as they are dependent on a risk which relates to the change in
Pathway’s proposal for PMS;
. that risk will be cleared once acceptable replies obtained on two issues - fauir
tolerance and scalability of proposed hardware platform:
. clearance of that risk will then Support clearance of these two °A’ risks
BPS ‘BI’ Risks
Cardholder Verification:
. Paper has been produced by Pathway explaining the cardholder verification
process;
. the risk owner has now recommended that the tisk should be cleared (Risk
Assessment Panel to consider on 30 November).
Policy on Foreign Encashments:
. dependent on statistics that Pathway have produced on levels of foreign
encashments and impact on their solution;
. Statistics being passed to Business Case team for validation; if they stand up
then risk will be cleared.
Card Security Technology:
. linked to the ‘A’ risk on Card Fraud;
27 November 1995 Page 8 of 9 Issue 1.0
POL00028148
POL00028148
lack of strong authentication technology may have acceptability problems;
. paper being produced to address risk expected end-November.
Other Issues
. Pathway have been ‘slow to get going’ in supplying information - leaving them
some way behind the other two service providers; the pace has now accelerated
and they are catching up fast.
. A key concem is with Riposte which is fundamental to the Pathway proposition
~ not just the technical aspects, but the nature of Pathway’s relationship with
Escher (this has been flagged as a B1 commercial risk).
. Pathway have the highest number of A & B risks of the three, including 12 at Bl
which are spread across all areas; the pace of clearing them needs to pick up for
there to be an acceptable number left at time of ITT issue.
27 November 1995 Page 9 of 9 Issue 1.0