Procedure to handle a security incident | Template for FCA authorised firms

Procedure to monitor, handle and follow up on a security incident and customer complaints

• Any actual or suspected incident must be immediately reported (and in any event within 4 hours) after becoming aware of the incident
• Any incidents involving lost or stolen equipment or a network security issue will be reported to the ICT Service Desk immediately (07833 64449).
• Final report should be completed and submitted to FCA within two weeks.

Complaints procedure checklist

• Definition/examples of what constitutes a complaint – oral or written.
• Confirmation of who in the firm is assigned to deal with complaints and how complaints are passed to them (must be a competent person, and may include an outsourced service).

A summary of key steps to take in order to investigate the complaint:

• Review file/facts
• Speak to relevant individual
• Record outcome/recommendation in writing
• If changes/improvements to procedures required flag for action
• Confirmation of requirement to respond to complaints in line with FCA rules (all deadlines apply from the date the original complaint was received):
• A prompt written acknowledgment – to include a written summary of your internal complaints procedure (may double up as final response)
• Further holding letter or final response within four weeks
• Final or other response within eight weeks
• Requirement to inform customers of their right to refer the complaint to the Financial Ombudsman Scheme (FOS) if they’re unhappy with the final response or if they don’t get a response within eight weeks
• The need to inform customers of the six month deadline for contacting the FCA from the date of the final response
• Encouragement also to use the phone to keep customers informed of progress/delays – and, where possible, to record the conversations
• Confirmation that copies of correspondence and notes from telephone conversations must be kept on file for each complaint.
• Outline procedure for systematic logging of complaints by date, nature, name, whether or not considered justified and confirmation of response dates/outcome.
• Confirmation of how/when/to whom the complaint handler should report complaints internally and make recommendations for revised practice where appropriate.
• Confirmation that customers are made aware in writing of the availability of the internal complaint handling procedures at or immediately after the point of sale (this may be in the initial disclosure document or the offer document).
• Also confirmation that the details of the internal complaint handling procedures are published, and that a copy is supplied to a customer on request, or in response to a complaint not resolved by the end of the next business day of being received.
• Confirmation of the requirement to report complaints to the FCA twice a year for the six month periods preceding and following the firm’s accounting reference date.
• Confirmation of the requirement to use the FCA’s standard Complaints Form and electronic reporting procedure via the Firms Online service.