How do the operational incident reporting thresholds relate to the operational resilience rules for important business services and impact tolerances?
Firstly, important business services (IBS) and their associated impact tolerances define the firm’s operational resilience standard. They articulate the level of disruption a firm is willing and able to withstand before causing intolerable harm to customers, the firm’s safety and soundness, or broader market stability.
By contrast, operational incident reporting thresholds serve a different function. They are intended to ensure that the PRA receives timely visibility of significant operational incidents as they arise. These thresholds are therefore reactive and supervisory in nature, focusing on when an incident becomes sufficiently serious to warrant regulatory notification.
The key question is how these two frameworks interact in practice, specifically, whether a breach (or potential breach) of an impact tolerance should determine when an incident is reported. A pragmatic interpretation to this question is that a breach of an impact tolerance (ITOL) should be viewed as a strong indicator that an incident is likely to be reportable, given that it signals disruption at a level the firm has already defined as intolerable. However, it should not be treated as the sole or definitive trigger. Firms should avoid an overly mechanistic linkage between ITOL breaches and reporting decisions. For example, an incident may still be reportable even where:
- it does not affect a defined important business service; or
- it has not yet breached an established impact tolerance.
Instead, the decision to notify the regulator should be grounded in a broader judgement from the firm’s prior experience/learnings, namely whether it reasonably believes that the incident poses a risk of:
- intolerable harm to consumers,
- a threat to the safety and soundness of the firm, or
- adverse impacts on market integrity or financial stability.
In summary, while breaches of impact tolerances are highly relevant and should form an important part of the assessment, they should be treated as a consideration rather than a determinative trigger for incident reporting. Firms should maintain a holistic, risk-based approach that aligns with the overarching purpose of regulatory notification, ensuring prompt supervisory awareness of potentially significant operational disruptions.
What sort of quantitative reporting thresholds have you seen firms set or are planning to set for operational incidents?
During the consultation, there was call for the regulators to set clear metrics or quantitative thresholds to help firms decide whether to report an incident. The FCA did not agree and explained that such metrics would need to apply across lots of different types of firms, so could become too complicated. They said that firms could instead set their own internal thresholds as part of operational risk management procedures.
Interestingly in the FCA webinar, it was stated that “harm can’t be reduced down to numbers”. However, firms will need to quantify the impact to understand whether an incident is isolated versus a wider systemic issue.
We have seen firms seek to quantify the impact of incidents based on customer impact (the number of customers affected, vulnerable customers affected, the financial detriment to customers, spikes in complaint volumes), then also the financial impact (or likely remediation costs), duration of the outage, transaction failure rates, to name a few.
The key thing to remember is that you can’t solely base the decision on numbers, but these factors can (and probably should) be part of the assessment.
How do you see the 24-hour reporting working over weekends etc. For example, if it is determined the threshold is met on a Friday?
It is worth remembering that the reporting thresholds for operational incidents are intentionally high. This restricts reporting to only capture incidents with a significant impact on the Regulators’ objectives. In their webinar, the FCA stated that they received about a thousand reports of incidents a year; of these, we anticipate that only a fraction will meet the threshold conditions.
For incidents that do satisfy the thresholds, we suspect that the Regulators will expect firms to commit the necessary resource, irrespective of when it has been determined to meet threshold conditions.
Therefore, if a firm identifies an incident on a Friday, it will likely be expected to submit their standard/initial report on Saturday at the latest. Following submission, they would be expected to allocate the appropriate resource to enable response and recovery. This may mean bringing in resource over the weekend where there is a significant impact.
Firm’s may receive some comfort in a reminder that following consultation, the Regulators have reduced the reporting detail at the standard/initial phase. The final publications also reflect that reporting at this phase should not be exceptionally burdensome:
“As we have reduced the information required at the initial stages of an incident, firms should be able to report promptly.” (FCA FG26/3)
“The initial phase has been designed to gather only essential information, which can be updated with additional information during the intermediate and final phases” (PRA PS7/26)
FCA rules on ops incident & third-party reporting
Almost a year on from the operational resilience implementation deadline, the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) continue to add to the framework with more structured oversight.