Want your incidents linked to the business?
Tell us how you log incidents today. We will show you how they would look linked to your processes and controls, using Halden as the starting point.
What went wrong, why, and everywhere it shows up.
From 18 March 2027, the PRA and FCA expect operational incidents reported through one process. The PRA wants the initial report within 24 hours of a firm deciding an incident meets the threshold. That report starts from your incident record. CoVi Analytics records each incident with its root cause, the control that failed, the risk it touches and the process where it happened. The same incident then appears on the process map, the controls board and the risk register.
Halden is a fictitious Lloyd's managing agent. We run it in CoVi Analytics and publish its reports one at a time.
The problem
The incident is logged. Nobody sees where else it reaches.
Most incident logs are a list. Each row has a date, a description and a status. The control that failed is in a different system. The process it happened in is in a Word document. So the same root cause turns up three times before anyone links the incidents together.
Under PS7/26 and PS26/2, that one report moves through initial, intermediate and final stages. Each stage needs the cause, the control and the actions. A list with a status column does not hold them.
What you get today
- A list of incidents with a status column
- Failed controls tracked somewhere else
- Root causes you only spot at year end
- Partner incidents that surface months late
What you need
- Each incident with its cause, control, risk and process
- The same incident showing everywhere it reaches
- Root causes counted as they happen
- A record ready when a report has to start
How we solve it
Every incident, linked to the control and the process behind it.
This is the incident log of Halden, our fictitious managing agent. Open incidents come first. Open one to see what happened, why, and where in the business it sits.
- First you see
- Then you drill into
- Behind it
First you see open incidents, how many are high severity, and the root causes this year.
Then you drill into an incident. Its type, severity, the process it happened in and whether a control failed.
Behind it the full record, in a detail sheet. The story, impact, root cause, risk, control, policy, regulator status and actions.
Halden · Incidents · 30 Sep 2026
What has gone wrong this year, and who did we tell?
- Open incidents48 raised in 2026 · 4 closed
- High severity, open2Coverholder binding and sanctions
- Notified to a regulator3Lloyd's, the FCA and the DFSA
- Average age22 daysOpen incidents at 30 Sep 2026
ClickTap to explore Click an incident to see its full record.
Showing all 8 incidents
Root causes this year
Third parties cause three of the eight incidents, and all three are still open. Coverholder and fronting partner oversight is the theme across the other boards too.
Halden is fictitious. Source: incident log, action log at 30 Sep 2026; ages restated at 30 Sep
INC-031 · Breach
Coverholder bound 23 risks outside its agreed territory
High severityOpenBreach✕ Control failed
Ridgeway Underwriting bound risks in two territories outside its binding authority. Found in the annual audit, which was four months late.
- Exposure and impact
- £1.8m exposure written outside authority
- Root cause
- Third party
- Risk
- OR-06.1 · Coverholder binding outside authority
- Control
- C-137 · Coverholder audits ✕ control failed
- Where in the business
- Distribution › DA oversight
- Policy
- Delegated authority policy
- Lloyd's and regulators
- Lloyd's notified 19 Sep
- Raised
- 12 Sep 2026 · 18 days open
Actions
- ACT-038Remediate Ridgeway Underwriting breaches (INC-031)Head of Delegated Authority · due 31 Oct 2026Open
- ACT-035Clear the coverholder audit backlog (6 overdue)Head of Delegated Authority · due 30 Sep 2026Overdue
Source: incident log, action log at 30 Sep 2026
INC-026 · Control failure
Sanctions alert cleared without supporting evidence
High severityOpenControl failure
An analyst cleared a name-match alert at claim stage without recording evidence. Caught in second-line QA before payment.
- Exposure and impact
- No payment made; potential breach averted
- Root cause
- People
- Risk
- OR-07.1 · Sanctions breach
- Control
- C-147 · Sanctions screening
- Where in the business
- Compliance › Sanctions screening
- Policy
- Financial crime & sanctions policy
- Lloyd's and regulators
- Assessed: not reportable
- Raised
- 3 Sep 2026 · 27 days open
Actions
- ACT-026Re-review sanctions alerts cleared without evidence (INC-026)Money Laundering Reporting Officer · due 10 Oct 2026Open
Source: incident log, action log at 30 Sep 2026
INC-033 · Process failure
Binder bordereaux received six weeks late
Medium severityOpenProcess failure
Two coverholders missed bordereaux deadlines, so Q3 reserving and the QMA used estimates.
- Exposure and impact
- Q3 reserving used estimated data for 2 binders
- Root cause
- Third party
- Risk
- IR-02.2 · Reserving data quality
- Control
- C-015 · Bordereaux data validation
- Where in the business
- Policy servicing › Bordereaux
- Policy
- Delegated authority policy
- Lloyd's and regulators
- Not notified
- Raised
- 19 Sep 2026 · 11 days open
Actions
- ACT-036Chase late binder bordereaux (INC-033)Head of Delegated Authority · due 15 Oct 2026Open
Source: incident log, action log at 30 Sep 2026
INC-028 · Conduct
UAE fronted claims settled outside agreed timescales
Medium severityUnder investigationConduct
The UAE fronting partner's claims team fell behind after staff turnover; 37 claims passed 60 days unpaid.
- Exposure and impact
- 37 policyholders waited over 60 days
- Root cause
- Third party
- Risk
- OR-06.2 · Fronting partner claims handling failure
- Control
- C-140 · Quarterly claims file audits
- Where in the business
- Claims › Reserving
- Policy
- Claims management policy
- Lloyd's and regulators
- FCA and DFSA informed
- Raised
- 28 Aug 2026 · 33 days open
Actions
- ACT-029Agree claims service levels with the UAE fronting partner (INC-028)Head of Claims · due 31 Oct 2026Open
- ACT-031Exit plan for the UAE fronting partnerChief Operating Officer · due 30 Sep 2026Overdue
Source: incident log, action log at 30 Sep 2026
INC-030 · Process failure
Q2 QMA resubmitted after a currency mapping error
Low severityClosedProcess failure
AED premiums mapped to USD in one form. Found by Lloyd's validation; corrected in two days.
- Exposure and impact
- Return resubmitted, no fine
- Root cause
- Process
- Risk
- OR-04.5 · Lloyd's and Solvency II reporting errors
- Control
- C-128 · Four-eyes review of returns
- Where in the business
- Finance & FP&A › Regulatory returns
- Policy
- Risk management policy
- Lloyd's and regulators
- Lloyd's informed
- Raised
- 6 Aug 2026 · 6 days to close
Actions
No open actions in the action log.
Source: incident log, action log at 30 Sep 2026
INC-029 · Loss event
Policy system outage, five hours
Medium severityClosedLoss event
A failed database patch took the policy system down. Restored within the four-hour impact tolerance plus one hour.
- Exposure and impact
- Binding paused for five hours
- Root cause
- Systems
- Risk
- OR-01.1 · Prolonged system outage
- Control
- C-105 · Disaster recovery testing
- Where in the business
- IT & data › Policy admin system
- Policy
- Information security policy
- Lloyd's and regulators
- Not notified
- Raised
- 8 Sep 2026 · 7 days to close
Actions
No open actions in the action log.
Source: incident log, action log at 30 Sep 2026
INC-024 · Near miss
Targeted phishing at finance team blocked
Low severityClosedNear miss
A spoofed broker email asked to change bank details. Blocked and reported by staff.
- Exposure and impact
- None
- Root cause
- External
- Risk
- OR-02.1 · Ransomware attack
- Control
- C-109 · Endpoint detection and response
- Where in the business
- IT & data › Cyber security
- Policy
- Information security policy
- Lloyd's and regulators
- Not notified
- Raised
- 22 Jul 2026 · 2 days to close
Actions
No open actions in the action log.
Source: incident log, action log at 30 Sep 2026
INC-021 · Loss event
Return premium paid to the wrong broker
Low severityClosedLoss event
Payment keyed to a similarly named broker. Recovered in nine days.
- Exposure and impact
- £120k, fully recovered
- Root cause
- People
- Risk
- OR-05.2 · Payment fraud or error
- Control
- C-132 · Bank detail change verification
- Where in the business
- Finance & FP&A › Credit control
- Policy
- Risk management policy
- Lloyd's and regulators
- Not notified
- Raised
- 30 Jun 2026 · 9 days to close
Actions
No open actions in the action log.
Source: incident log, action log at 30 Sep 2026
Halden has 4 open incidents, 2 of them high severity. Third parties caused 3 of its 8 incidents this year, and all three are still open.
Callout 1: At Halden, INC-031 is a coverholder that bound 23 risks outside its agreed territory.Incident log
Callout 2: Halden's annual coverholder audit found it, four months late, and that audit control is rated ineffective.Incident log; Controls by team
Callout 3: The same incident shows on the DA oversight stop, the controls board and the register entry for coverholder binding.Process tube map; Controls by team; Risk register
Three of Halden's four open incidents sit in operational risk, which is 9% of the SCR. The capital split alone would not point you there.
What we think
An incident is a signal, not a row.
- Record the cause, not just the event
Every incident carries a root cause. Count them as they happen, and patterns show in weeks, not at year end.
- Show it where it happened
An incident raised against a control appears on every process step where that control is mapped.
- Partners are part of your incidents
When a coverholder or fronting partner fails, the incident is still yours. Tag the third party, and you see how much of your trouble sits outside your building.
The FCA says it plainly. If a third party fails to stay within impact tolerance, "the failure to remain within impact tolerance is your responsibility."
What's in it
What each incident record holds.
For every incident:
- What happened: title, the story in plain words, and when it was raised;
- Type and severity: breach, control failure, process failure, conduct, loss event or near miss;
- Impact: what it cost or could have cost;
- Root cause: third party, people, process, systems or external;
- Risk and control: the register entry it touches and the control involved, with a flag if that control failed;
- Where in the business: the process and step it happened in;
- Policy: the policy it falls under;
- Regulator: whether it was notified, and to whom;
- Actions: the actions raised, each with an owner.
How it works
- Raise the incident where it happens.
The team that finds it records it, with the process and control involved.
- Link and assess.
The risk team confirms the root cause, the risk and whether a regulator needs to know.
- Track the actions to close.
Each action has an owner, and the incident closes when they are done.
Questions
Questions risk teams ask
What are the new UK operational incident reporting rules?
From 18 March 2027, the PRA (PS7/26, SS1/26) and FCA (PS26/2) bring operational incident reporting into one process. A firm sends one report, updated through initial, intermediate and final stages. The PRA expects the initial report within 24 hours of the firm deciding the threshold is met. Managing agents are in scope.
What should an insurer's incident log hold before the 2027 rules start?
It should hold what happened, the impact, the root cause, the control involved and the process it happened in. It should also record third parties, regulator status and actions with owners. Then, when an incident meets the threshold, the facts for the initial report are already in one place.
Who uses this view
Incidents start in every team.
- For operationsOutages and process failures against your important services and their impact tolerances.
- For delegated authorityCoverholder breaches and late bordereaux, with the audit control behind them.
- For claimsFronting partner claims delays, linked to the complaints they cause.
- For financeReturn errors and payment mistakes, with the control that missed them.
- For underwritingBinding breaches and the wording exceptions behind them.
- For the boardOpen incidents, regulator notifications and the actions that close them.
Proof
Follow one incident across Halden.
Halden is our fictitious managing agent. INC-031 starts in its incident log and shows up on the process map, the controls board and the risk register.
Not ready to talk?
One email a month, plus an alert for each new report.
Check your inbox and confirm to start following Halden.You're following Halden.
The first "This month at Halden" arrives on the first Tuesday of the month.
Built by Context Visualised, in London since 2016, Lloyd's Lab Cohort 2. Founded by Waleed Sarwar, former interim Head of Risk at Liberty Mutual, Markel and Bupa, who worked on Solvency II policy at the Bank of England.
Sources (3)
- PRA PS7/26 "Operational incident and third-party reporting" (new SS1/26), 18 March 2026, applies from 18 March 2027. One report, updated through initial, intermediate and final stages. Initial report within 24 hours of determining the threshold is met. Scope includes the Society of Lloyd's and managing agents. www.bankofengland.co.uk www.bankofengland.co.uk
- FCA PS26/2 "Operational incident and third party reporting" (FG26/3, FG26/4), March 2026, applies from 18 March 2027. FCA side of the single regime; the incident rules apply to all Part 4A firms. www.fca.org.uk
- FCA "Operational resilience: insights and observations for firms", 28 May 2024. "the failure to remain within impact tolerance is your responsibility". www.fca.org.uk