POL00031401
POL00031401
Message
From: James, Gareth (UK - Manchester) [gajames¢....-GRO._...,!
Sent: 29/05/2014 19:28:11
To: Chris Aujard [/O=MMS/OU=EXCHANGE ADMINISTRATIVE GROUP
(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=Christopher Aa0452485-80b7-40d2-ade7-6f6feae19cc3f88]
cc: Rodric Williams [/O=MMS/OU=EXCHANGE ADMINISTRATIVE GROUP
(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=Rodric Williamse9c114f4-b03f-4595-b082-ce89be5c79d47b]; Julie George
[/O=MMS/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=Julie
Georgee2337f53-Sbc7-4902-bf28-7f244bd4e4082ce]; Whitton, Andrew J (UK - London) [awhitton
Noon, David A (UK - London) [dnoon: White, lan (UK - Leeds) [iwhite, ; Tantam, Mark
(UK - London) [mtantam:
Subject: RE: Project Zebra
Evening Chris. You are correct, this is indeed primarily a restructuring exercise — we are not proposing more review
work, If there are areas to suggest further work be done, we’d capture those under the third bullet below. Content wise,
we will focus on those matters relevant for the Board below, extracted from the current form of the Assurance Sources
full report (intended more for management’s purposes).
The time needs are reflective of the realistic time we think it will take to take to produce and then respond appropriately
to internal input and review processes that are required on document (from audit, forensic and risk teams in Deloitte).
Best regards
Gareth
From: Chris Aujard [mailto:christopher.aujard
Sent: 29 May 2014 20:07
To: James, Gareth (UK - Manchester)
Cc: Rodric Williams; Julie George; Whitton, Andrew J (UK - London); Noon, David A (UK - London); White, Ian (UK -
Leeds); Tantam, Mark (UK - London)
Subject: Re: Project Zebra
Gareth - thanks for this; I am still awaiting feedback from Rod, but in the meantime, could you let know the logic behind
your Wednesday date? My working assumption was that you would not be doing any more primary review work, and
therefore this exercise was more one of capturing on paper your conclusions thus far. Could you let me know if I have
misunderstood matters? Kind regards Chris
Sent from my iPhone
On 29 May 2014, at 06:36 pm, "James, Gareth (UK - Manchester)" <gajameg
CONFIDENTIAL AND SUBJECT TO LEGAL PRIVILEGE
Chris,
Further to our conversations today, I wanted to confirm the next steps we propose to take regarding
Project Zebra. These seek to create a shorter document for you (intended for Board circulation) which
focusses on certain key (and most relevant) aspects of our wider work to date.
This “Board Briefing” document will focus on the four questions we agreed by phone, being:
1. What comfort can be taken that Horizon only allows complete transactions (baskets) to be
processed?
POL-0028303
POL00031401
POL00031401
2. What comfort can be taken that the transactions completed in Horizon are ‘digitally sealed’, to
protect their integrity and make it evident if they have been tampered with?
3. What comfort can be taken that Horizon’s Audit Store maintains and reports from a complete
and unchanged record of all sealed baskets?
4. What comfort can be taken that Horizon provides visibility to sub-postmasters of all centrally
generated transactions processed to their Branch ledgers?
For each of the above questions, we will:
e List those relevant high level system design and process control features that we identified in
documentation provided to us;
e Describe the facts relating to the extent and nature of the Assurance Work we have seen;
¢ State what additional work could be undertaken to increase the level of comfort.
Our comments will be framed in the context and limitations of our work.
We estimate that this deliverable will take until close of play on Wednesday next week to produce and
issue through our review and signoff activities.
Please confirm that these points of focus are an accurate view of the next steps discussed this
afternoon.
Thanks and regards
Gareth
Gareth James
Partner
http://www. deloitte.co.uklukfutures
IMPORTANT NOTICE
This communication is from Deloitte LLP, a limited liability partnership registered in England and Wales with registered number 0C303675. Its registered
office is 2, New Street Square, London EC4A 38Z, United Kingdom. Deloitte LLP is the United Kingdom member firm of Deloitte Touche Tohmatsu Limited
(OTTL"), a UK private company limited by guarantee, whose member firms are legally separate and independent entities. Please see
www.deloitte.co.uk/about for a detailed description of the legal structure of DTTL and its member firms.
This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipients). If you
are not the intended recipient(s), please (1) notify it.security.uk} forwarding this email and delete all copies from your system and (2)
note that disclosure, distribution, copying or use of this communication is strictly prohibited. Email communications cannot be guaranteed to be secure
or free from error or viruses. All emails sent to or from a Deloitte UK email account are securely archived and stored by an external supplier within the
European Union.
To the extent permitted by law, Deloitte LLP does not accept any liability for use of oF reliance on the contents of this email by any person save by the
intended recipient(s} to the extent agreed in a Deloitte LLP engagement contract.
Opinions, conclusions and other information in this email which have not been delivered by way of the business of Deloitte LLP are neither given nor
endorsed by it.
JOH UII IOI IDO IID BOO III IO SO III ASO IIIA AISA IIIA AIA
This email and any attachments are confidential and intended for the addressee only. If you are not the named recipient,
POL-0028303
POL00031401
POL00031401
you must not use, disclose, reproduce, copy or distribute the contents of this communication. If you have received this in
error, please contact the sender by reply email and then delete this email from your system. Any views or opinions
expressed within this email are solely those of the sender, unless otherwise specifically stated.
POST OFFICE LIMITED is registered in England and Wales no 2154540. Registered Office: 148 OLD STREET,
LONDON EC1V 9HQ.
JOH SOI U I IOUS IO ISO ISI II DISD DI ISO IID ADI I IA
POL-0028303