How long before system timeout should a warning appear?

On a service which includes a lot of sensitive info in digital input forms, how long before timeout should you display a warning message?

Someone proposed a 15 minute session with a timeout warning at five minutes, but I suspect (but can't justify why) that that will be annoying and there's a reason warnings usually come at one or two minutes from timeout.

Is there a best practice guide for this, or particular reason that warnings are usually shortly before timeout?

Cheers