2.18 The PRA recognises the need to balance the objectives of the PRA receiving timely operational incident information to understand potential risks to its statutory objectives and firms taking actions to resolve the incident. Therefore, rather than setting a minimum time the PRA proposes to require firms to submit an initial report as soon as practicable after the operational incident has met the threshold. The new draft SS sets out expectations regarding the timing of the initial report submission, in which a firm would be expected to submit a report within 24 hours of determining an incident has meeting a threshold.

2.19 To limit the burden posed to the firm at a time when it should be focussed on managing the operational incident, firms would be required to submit limited information to allow the PRA to gain an understanding of the incident and assess potential risk to its objectives.