Meet APRA CPS 230 with operational resilience you can evidence

CPS 230 is the Australian Prudential Regulation Authority's prudential standard on operational risk management. It requires APRA-regulated entities to manage operational risk with effective controls, keep critical operations within tolerance levels through severe disruptions using a credible business continuity plan, and manage the risks of using service providers. It commenced on 1 July 2025 and replaced the earlier outsourcing and business continuity standards, including CPS 231 and CPS 232.

All APRA-regulated entities must comply with CPS 230. That covers authorised deposit-taking institutions such as banks, building societies and credit unions, general insurers, life companies and friendly societies, private health insurers, registrable superannuation entity licensees, and authorised or registered non-operating holding companies. Suppliers are not directly regulated, but material service providers will see CPS 230 terms flow into their contracts, due diligence and ongoing monitoring.

CPS 230 commenced on 1 July 2025. For contracts with service providers that were already in place, the requirements apply from the earlier of the next contract renewal date or 1 July 2026. APRA also finalised targeted amendments, effective 1 July 2026, that give limited exemptions from some contractual requirements for certain non-traditional service providers such as central banks and clearing and settlement facilities.

APRA can take supervisory action where an entity's operational risk management has material weaknesses. Under paragraph 19 of CPS 230, APRA may require an independent review, require a remediation program, require the entity to hold additional capital where relevant, impose conditions on the entity's licence, and take other supervisory actions. Breaching a prudential standard can also lead to wider enforcement under the legislation that APRA administers.

CPS 230 sets three main notification timeframes. Entities must notify APRA within 72 hours of becoming aware of an operational risk incident likely to have a material financial impact or a material impact on critical operations, and within 24 hours of a disruption to a critical operation outside tolerance. They must also notify APRA within 20 business days of entering into or materially changing an agreement for a service relied on for a critical operation.

CPS 230 works alongside CPS 234, APRA's information security standard. Paragraph 25 requires entities managing technology risk to meet CPS 234, and an information security incident already reported under CPS 234 does not need separate notification under CPS 230. ISO 27001 is not required by either standard, but its controls for risk assessment, supplier management, incident management and continuity provide useful evidence towards CPS 230.

Compliance starts with a register of critical operations and tolerance levels for each one, covering maximum disruption time, data loss and minimum service levels. Entities then need an operational risk profile with tested controls, an incident process, a credible business continuity plan tested annually, a service provider management policy, a register of material service providers, compliant contracts and internal audit assurance reported to the Board.

Yes. CPS 230 is available in OneClickComply today. The platform maps its requirements to a single control set, collects evidence automatically from connected tools, monitors controls continuously and supports the service provider register, vendor risk reviews and risk register that CPS 230 expects. Our in-house audit team and Ask an Auditor help with interpretation, but compliance remains a matter between your entity and APRA.