From 18 March 2027 the FCA expects operational incidents and material third-party arrangements reported in set formats and timescales. If incidents live in one log, suppliers in another and risks in a third, the reporting becomes a manual exercise under deadline pressure. ERM+ keeps them in one linked register.
14 risks on the register. 9 rated High before controls, 2 after.
Select a cell to see which risks sit there and where their controls move them.
Typically 100 to 1,000 employees, established and regulated, with the risk register, supplier oversight and resilience work still run largely by hand.
What it asks
Important business services identified, impact tolerances set, resources mapped, severe scenarios tested, and a self-assessment you can stand behind.
What ERM+ holds
Services, tolerances and the people, processes, systems and suppliers behind each one, with test results and breaches recorded against them.
What it asks
Operational incidents and material third-party arrangements reported to the FCA in structured templates, from 18 March 2027.
What ERM+ holds
Incident records captured in a structured form as they happen, and a third-party register that shows which arrangements are in scope.
What it asks
Tighter oversight of the suppliers your important services depend on, and evidence of that oversight.
What ERM+ holds
A supplier register linked to the services, risks and incidents each supplier touches, so concentration is visible.
What it asks
Effective systems and controls, with named senior managers accountable for them.
What ERM+ holds
Owners on every risk, control and action, with testing and outcomes kept as an audit trail.
A summary to frame the conversation, not legal advice. The first call establishes exactly which requirements apply to your firm.
The FCA has published the policy statement, final guidance and reporting templates. Documenting a process is quick. Discovering late that the information you need is not captured consistently is not.
164 days until PS26/2 takes effect on 18 March 2027.
Free assessments built requirement by requirement from the FCA and PRA policy statements. Rate each one red, amber or green and get a gap report in about fifteen minutes.
Six free tools and 252 requirements in all, including PRA SS1/23 model risk and the UK cryptoasset regime.See all free tools(opens in a new tab)
17 of 48 requirements in place
| Section | Rating |
|---|---|
| A1Scope and firm classification | In place |
| A2Incident definitions and thresholds | Partly in place |
| A3Reporting process and timelines | Not in place |
| A4Governance and internal controls | Partly in place |
| B1Material third-party scope | In place |
| B2Material third-party register | Not in place |
| B3Third-party notifications | Partly in place |
| B4Oversight and governance | Partly in place |
Supervisory visits increasingly ask to see the control framework working: tests, owners, outcomes. A policy document does not answer that.
Every new outsourcing arrangement adds a row to a vendor list that nobody links back to the services it supports.
Documenting a reporting process is quick. Finding out late that the data behind it is not captured consistently is not.
Head of Risk / CRO
Also: Head of Operational Resilience, Risk Director
Head of Compliance
Also: Chief Compliance Officer, Head of Regulatory Affairs
COO
Also: Head of Operations
CFO
Also: Finance Director
CTO / CIO
Also: Head of IT, Head of Technology Risk
More than 50 years of risk experience between the co-founders and over 500 with our senior associates. Implementation in weeks, not months.
Meet the teamClients we have worked for or with
“ERM PLUS significantly reduced the time and resources for achieving regulatory compliance in risk and prudential management.”
“The expertise and professionalism of the ERM Plus team are unparalleled. Their strategic guidance and hands-on approach have been instrumental in achieving our business goals.”
We look at what you capture today, what your regulator will ask for, and whether there is a gap. If there is nothing there, no need to take it further.
A gap check, not a pitch. No project, no budget conversation, no access to sensitive data.
Not ready for a call?Run the free PS26/2 gap assessment(opens in a new tab)