From Disruption to Disclosure: Operational Incident and Third-Party Reporting
When disruption strikes, the incident rarely respects the boundaries of a department, system, or supplier contract. Understanding what happened, which services and customers are affected, and how third-party dependencies contribute requires a connected view of the business. Producing a timely, defensible regulatory report depends on having that understanding before the reporting clock starts.
The FCA’s PS26/2 and PRA’s PS7/26 introduce new operational incident and material third-party reporting requirements from 18 March 2027. For firms in scope, preparation involves understanding the applicable thresholds, identifying material arrangements, maintaining reliable information, and establishing clear ownership across risk, compliance, operations, technology, and third-party management.
Join Michael Rasmussen as he explores how firms can turn these requirements into a practical programme for stronger operational resilience and Third-Party GRC. The session will examine how to connect business services, third-party relationships, incidents, controls, and evidence so firms can identify reportable events, make informed decisions, and explain their actions with confidence. It will also address the distinct requirements for material third-party notifications and registers, and the steps firms can take now to prepare for March 2027.
Key takeaways
- Understand the requirements and their boundaries. Distinguish operational incident reporting from material third-party notifications and registers, and understand why applicability and reporting thresholds need to be assessed for the firm concerned.
- Connect disruption to business impact. Map the relationships between services, technology, third parties, and customers to support incident assessment and reporting decisions.
- Make third-party information usable. Develop a reliable view of material outsourcing and non-outsourcing arrangements, with clear ownership of information and processes for new arrangements and significant changes.
- Build a defensible reporting process. Establish escalation, accountability, and evidence that support timely reporting and a clear record of what was known, decided, and done.
- Test readiness before the deadline. Use realistic scenarios to expose gaps in information, coordination, and decision-making, and prioritize improvements that strengthen resilience as well as reporting readiness.
