Halden reportsRisk
Halden report · RiskWhat has gone wrong this year?
Eight incidents at Halden in 2026; 4 are still open, and third parties caused 3 of those.
CoVi · Risk incidentsFictitious
Incident log
Halden's incident log, built by Context Visualised. Incidents in 2026.
- 4Open incidents
- 2High severity, open
- 3Notified to a regulator
- 22 daysAverage age of open incidents, at 30 Sep
4 incidents shown. Select one to see what happened and what we did.
Root causes this year
Third parties cause three of the eight incidents, and all three are still open: the coverholder and fronting partner oversight theme seen across the other boards.
Each card shows the incident, where it happened and its status. Open one to see the risk, control, policy and actions behind it.
Source: incident log, risk register and control library at 30 Sep 2026.
INC-031 · High severity · Open
Coverholder bound 23 risks outside its agreed territory
High severityOpen
Ridgeway Underwriting bound risks in two territories outside its binding authority. Found in the annual audit, which was four months late.
Impact
£1.8m exposure written outside authority
Root cause
Third party
Risk
OR-06.1 Coverholder binding outside authority
Control
C-137 Coverholder audits ✕ Failed
Where in the business
Distribution › DA oversight
Policy
Delegated authority policy
Regulator
Lloyd's notified 19 Sep
Actions
ACT-038, ACT-035
Raised
12 Sep 2026 · 18 days open at 30 Sep
INC-026 · High severity · Open
Sanctions alert cleared without supporting evidence
High severityOpen
An analyst cleared a name-match alert at claim stage without recording evidence. Caught in second-line QA before payment.
Impact
No payment made; potential breach averted
Root cause
People
Risk
OR-07.1 Sanctions breach
Control
C-147 Sanctions screening
Where in the business
Compliance › Sanctions screening
Policy
Financial crime & sanctions policy
Regulator
Assessed: not reportable
Actions
ACT-026
Raised
3 Sep 2026 · 27 days open at 30 Sep
INC-033 · Medium severity · Open
Binder bordereaux received six weeks late
Medium severityOpen
Two coverholders missed bordereaux deadlines, so Q3 reserving and the QMA used estimates.
Impact
Q3 reserving used estimated data for 2 binders
Root cause
Third party
Risk
IR-02.2 Reserving data quality
Control
C-015 Bordereaux data validation
Where in the business
Policy servicing › Bordereaux
Policy
Delegated authority policy
Regulator
None
Actions
ACT-036
Raised
19 Sep 2026 · 11 days open at 30 Sep
INC-028 · Medium severity · Under investigation
UAE fronted claims settled outside agreed timescales
Medium severityUnder investigation
The UAE fronting partner's claims team fell behind after staff turnover; 37 claims passed 60 days unpaid.
Impact
37 policyholders waited over 60 days
Root cause
Third party
Risk
OR-06.2 Fronting partner claims handling failure
Control
C-140 Quarterly claims file audits
Where in the business
Claims › Reserving
Policy
Claims management policy
Regulator
FCA and DFSA informed
Actions
ACT-029, ACT-031
Raised
28 Aug 2026 · 33 days open at 30 Sep
INC-030 · Low severity · Closed
Q2 QMA resubmitted after a currency mapping error
Low severityClosed
AED premiums mapped to USD in one form. Found by Lloyd's validation; corrected in two days.
Impact
Return resubmitted, no fine
Root cause
Process
Risk
OR-04.5 Lloyd's and Solvency II reporting errors
Control
C-128 Four-eyes review of returns
Where in the business
Finance & FP&A › Regulatory returns
Policy
Risk management policy
Regulator
Lloyd's informed
Actions
None outstanding
Raised
6 Aug 2026 · 6 days to close
INC-029 · Medium severity · Closed
Policy system outage, five hours
Medium severityClosed
A failed database patch took the policy system down. Restored within the four-hour impact tolerance plus one hour.
Impact
Binding paused for five hours
Root cause
Systems
Risk
OR-01.1 Prolonged system outage
Control
C-105 Disaster recovery testing
Where in the business
IT & data › Policy admin system
Policy
Information security policy
Regulator
None
Actions
None outstanding
Raised
8 Sep 2026 · 7 days to close
INC-024 · Low severity · Closed
Targeted phishing at finance team blocked
Low severityClosed
A spoofed broker email asked to change bank details. Blocked and reported by staff.
Impact
None
Root cause
External
Risk
OR-02.1 Ransomware attack
Control
C-109 Endpoint detection and response
Where in the business
IT & data › Cyber security
Policy
Information security policy
Regulator
None
Actions
None outstanding
Raised
22 Jul 2026 · 2 days to close
INC-021 · Low severity · Closed
Return premium paid to the wrong broker
Low severityClosed
Payment keyed to a similarly named broker. Recovered in nine days.
Impact
£120k, fully recovered
Root cause
People
Risk
OR-05.2 Payment fraud or error
Control
C-132 Bank detail change verification
Where in the business
Finance & FP&A › Credit control
Policy
Risk management policy
Regulator
None
Actions
None outstanding
Raised
30 Jun 2026 · 9 days to close
What it tells us
What it tells us this quarter
- 23
In incident INC-031, a coverholder bound 23 risks outside its territory, £1.8m of exposure, found in an audit four months late.
- 37
In INC-028, 37 policyholders of the UAE fronting partner waited over 60 days for their claims.
- 3
Three incidents went to a regulator: two to Lloyd's, and one to the FCA and the DFSA.
What we did
What we did about it
Actions on the open incidents, from Halden's action log.
- ACT-038
Remediate Ridgeway Underwriting breaches (INC-031)
- Owner
- Head of Delegated Authority
- Policy (approved by)
- Delegated authority · Underwriting committee
- Due
- 31 Oct 2026
- ACT-029
Agree claims service levels with the UAE fronting partner (INC-028)
- Owner
- Head of Claims
- Policy (approved by)
- Claims management · Underwriting committee
- Due
- 31 Oct 2026
- ACT-026
Re-review sanctions alerts cleared without evidence (INC-026)
- Owner
- Money Laundering Reporting Officer
- Policy (approved by)
- Financial crime & sanctions · Board
- Due
- 10 Oct 2026
Actions are listed under the policy they sit in. The action log does not record a deciding committee.
Sources
Where the numbers come from
Incidents are logged as they happen and linked to the risk, control and policy behind them. From 18 March 2027, the PRA's PS7/26 asks firms, managing agents included, for one operational incident report updated in stages.
- Board dataincident log, risk register and control library at 30 Sep 2026
Follow the data
Related reports
One email a month: "This month at Halden". Email address only.
Halden is fictitious. Its numbers are illustrative.