Bug Fixes in IRIS Firm Management
The following bugs have been fixed:
August 2026|Bug Fixes in 2025|Bug Fixes in 2024
Latest update: August 2026
August 2026
Potential issue with Billing Statement
What happened?
On 12 August 2026, the monthly e-statement automation for a customer ran. The process retrieves the customer’s list of clients via API, generates statement PDFs, excludes clients without a valid statement email address and excludes PDFs below a file-size threshold. That threshold was used to identify statements which produced a PDF containing only a header and footer. A recent change to the statement template, which added a new logo, increased the file size of those blank statements so that the exclusion checks no longer distinguished them. As a result, 2,672 emails were sent with a PDF attached that did not contain a statement body.
The list of impacted clients was provided to the customer as soon as the issue was identified. This incident concerns incorrect document delivery. No cross-client or unauthorised data exposure occurred. Recipients received incomplete copies of their own statements, not another party's data.
What went wrong, and why?
The process relied on a file-size heuristic rather than the business rule that a statement should only be issued where there is an outstanding balance. A subsequent change to the statement template altered the meaning of that heuristic and dependent automation was not included in the change-impact assessment.
The statement template was updated (including a new logo) without an impact assessment of the e-statement automation. The process did not check outstanding balance, or equivalent statement content, before generating or sending PDFs. The file-size exclusion threshold was not revalidated after the template change.
What are we doing to ensure this issue does not occur again?
File size alone is not a reliable control for whether a statement is valid. The process should gate on outstanding balance and/or actual PDF content. An outstanding balance check was implemented to run before statement PDF generation and email.
Changes to statement templates and related reports can alter downstream automation behaviour. Dependent processes must be included in the change-impact assessment.