APRA CPS-230 Compliance

Overview

APRA CPS 230 represents a significant modernisation of the prudential framework for operational risk management. By consolidating outsourcing, business continuity, and operational risk into a single standard, it provides a more coherent and holistic approach to operational resilience in financial services.

The standard introduces the concept of critical operations with defined tolerance levels for disruption. Entities must identify which operations are critical to their customers, the financial system, and their own viability, then set measurable thresholds for acceptable disruption and test their ability to stay within those thresholds.

Material service provider management is a core pillar of CPS 230. Entities must conduct thorough due diligence, maintain contractual provisions that ensure ongoing oversight and audit rights, and manage concentration risk across their service provider portfolio, including fourth-party dependencies.

Board accountability is central to the standard. The board must approve the operational risk management framework, set the entity's risk appetite for operational risk, and receive regular reporting on operational risk exposures, incidents, and the status of critical operations and material service provider arrangements.

Key Areas

• Operational risk management framework approved by the board
• Identification and management of critical operations
• Tolerance levels for disruption to critical operations
• Business continuity planning and testing against severe but plausible scenarios
• Material service provider identification and due diligence
• Contractual arrangements with material service providers
• Fourth-party and supply chain risk management
• Scenario analysis and stress testing
• Board accountability and oversight of operational risk

Who It's For

• Australian banks, insurers, and superannuation funds regulated by APRA
• Material service providers to APRA-regulated entities
• Operational risk and business continuity teams in Australian financial services
• Boards and senior management of APRA-regulated entities

Core Requirements

Policies and Governance

The board must approve an operational risk management framework that sets out the entity's approach to managing operational risks. Clear accountability must be assigned, and the board must receive regular reporting on operational risk exposures, incidents, and the status of critical operations.

Risk Management

Entities must identify, assess, manage, and monitor operational risks across their business. This includes identifying critical operations, setting tolerance levels for disruption, and conducting scenario analysis to test resilience against severe but plausible scenarios.

Security Controls

Controls must be proportionate to the operational risks faced and cover people, processes, technology, and information. This includes ensuring that material service provider arrangements do not introduce unacceptable operational risk.

Incident Response

Entities must maintain business continuity plans that enable critical operations to continue within tolerance levels during disruptions. Plans must be regularly tested, and the entity must demonstrate the ability to recover critical operations within defined timeframes.

Evidence and Reporting

Entities must document their operational risk framework, critical operations register, tolerance assessments, testing results, and service provider due diligence. Regular reporting to the board and APRA on operational risk posture is required.

Implementation Steps

1. Scope and objectives - Establish the scope of the operational risk management framework. Identify critical operations across the entity, including those dependent on material service providers. Define tolerance levels for disruption and set compliance milestones.
2. Gap assessment - Assess current operational risk management, business continuity, and third-party management practices against CPS 230 requirements. Identify gaps in governance, critical operations identification, tolerance setting, and service provider oversight.
3. Control implementation - Implement or enhance the operational risk management framework, business continuity plans, and material service provider management processes. Update contractual arrangements with material service providers to include required provisions.
4. Evidence and documentation - Document the operational risk framework, critical operations register, tolerance levels, scenario analysis results, business continuity test outcomes, and service provider assessments. Build an evidence base for regulatory review.
5. Review and continuous improvement - Regularly test business continuity plans against severe but plausible scenarios. Review and update the critical operations register and tolerance levels. Conduct ongoing due diligence on material service providers and report outcomes to the board.

Frequently Asked Questions

When does CPS 230 take effect?

CPS 230 is effective from 1 July 2025 for most APRA-regulated entities. Pre-existing material service provider arrangements have a transitional period until 1 July 2026.

What standards does CPS 230 replace?

CPS 230 replaces CPS 231 (Outsourcing), CPS 232 (Business Continuity Management), and consolidates related operational risk requirements.

What are critical operations?

Critical operations are processes, activities, or services that, if disrupted, could have a material adverse impact on the entity's depositors, policyholders, beneficiaries, or the financial system.

What is a tolerance level?

A tolerance level defines the maximum disruption an entity is willing to accept for a critical operation, expressed in terms of time, volume, or other measurable metrics.

Who is a material service provider?

A service provider to whom the entity outsources a material business activity, or whose failure would have a material impact on the entity's ability to maintain critical operations.

How does CPS 230 interact with CPS 234?

CPS 234 continues to apply for information security requirements. CPS 230 provides the broader operational risk and business continuity framework within which information security sits.

What testing is required?

Entities must test their business continuity plans at least annually, including scenario-based testing against severe but plausible disruption events. Testing results must be reported to the board.

Why It Matters

• The financial services sector faces an increasingly complex operational risk landscape driven by digital transformation, interconnected supply chains, cyber threats, and geopolitical uncertainty. CPS 230 addresses this by requiring entities to take an integrated approach to operational risk that encompasses technology, people, processes, and third-party dependencies.
• By consolidating multiple standards into one, CPS 230 eliminates fragmentation and ensures that operational risk, business continuity, and third-party management are governed under a cohesive framework. This reduces the risk of gaps between related but previously separate compliance obligations.
• The standard's focus on critical operations and tolerance levels for disruption represents a shift toward outcome-based regulation. Entities must demonstrate not just that they have controls, but that they can continue to serve customers and meet obligations during and after significant disruptions.

Common Challenges

• Identifying and mapping all critical operations across complex, interconnected business processes
• Setting meaningful tolerance levels that balance regulatory expectations with operational reality
• Renegotiating existing contracts with material service providers to meet CPS 230 requirements
• Managing fourth-party risk where material service providers rely on their own sub-contractors
• Designing and executing realistic scenario tests that cover severe but plausible disruption events
• Integrating CPS 230 requirements with existing CPS 234 information security obligations
• Allocating sufficient resources and expertise to manage the transition from legacy standards