https://wiki.shibboleth.net/confluence/display/IDP4/AuditLoggingConfiguration
Lower case "I" is the assertion ID.
Capital "I" is the inbound message ID.
Two capitals ("II") is the InResponseTo value.
Three capitals ("III") is the outbound message ID.
-- Scott