When to notify us
You must notify us in writing of this event as soon as reasonably practicable. This should be within one working day of you becoming aware of the failure.
What you need to do
- We anticipate the initial notification should be from the scheme’s trustees.
- Examples of a failure of the systems that you should notify us of include the following:
- Failure to process payments or transactions into and out of the scheme correctly. This should not be restricted to major failures but also to a series of less significant failures that may be indicative of systematic failures in processes.
- Material adverse effect on member outcomes or your business plan as indicated by performance against any service level agreements or key performance indicators.
- Corruption of member records or other incidents causing member data loss or Data Protection Act breaches.
- Material breaches of cyber security or a pattern of repeated breaches, for example:
- an incident that results in significant loss of data, or the availability or control of your IT systems
- an incident that affects a large number of scheme members
- an incident that results in unauthorised access to, or malicious software present on, your information and communication systems
- Incorrect member communications that cause detriment to a material number of members or a pattern of repeated communication failures.
- Indications of material control failures identified by assurance reports from any source, eg internal audit reports, assurance framework reports, compliance reviews or external audits.
- Systems or processes for managing the risks and issues associated with investment decisions for both within the master trust and external service providers:
- Failures in controls resulting in members funds being invested outside of the range of permitted investments.
- Failures in systems and processes requiring an investment fund to recalculate its unit price, restate/calculate its net asset value or recalculate restate its performance.
- You should prioritise notifying us even if you don’t have the complete information of the event. If you are uncertain of whether you should submit a notification, you should contact your scheme supervisor at TPR.
Completing the notification form
- You should provide details of the failure in section 3 of the form.
If there is more than one significant event and they are related, you should use one form to notify us. If the events are not related, you should use separate forms. Check what other significant events to notify us about.