Change under
the regulator's eye

APRA CPS 230 is the prudential standard on operational risk management that applies to APRA-regulated banks, insurers and superannuation trustees, and it came into force on 1 July 2025. It requires regulated entities to manage operational risk, maintain critical operations within defined tolerance levels through severe disruption, and manage the risks of their material service providers. It pulls the old outsourcing and business continuity expectations into one integrated standard.

To comply with CPS 230 you must identify your critical operations, set tolerance levels for disruption, and map the people, processes, technology, facilities and third parties each one depends on. You then need tested business continuity plans, a managed register of material service providers, and clear board and management accountability. It is an end-to-end resilience obligation rather than a document exercise, and it has to be demonstrable.

We help by treating CPS 230 as a delivery programme rather than an advisory paper. We can establish the governance, map critical operations and dependencies, set and test tolerance levels, sort out material service provider arrangements, and drive the uplift to completion with proper programme discipline. Where you want assurance instead, we independently test whether your CPS 230 programme will genuinely stand up.

Critical operations under CPS 230 are the functions that, if disrupted, would materially affect clients, financial markets or the broader financial system. Examples include payments, claims processing, member transactions and the systems behind them. Each regulated entity must identify its own critical operations, set tolerance levels for how much disruption is acceptable, and be able to keep them running within those tolerances during severe but plausible events.

CPS 230 took effect on 1 July 2025. Arrangements with existing material service providers must be brought into line by the earlier of the next renewal date or 1 July 2026. Regulated entities have also had to provide APRA with a register of material service providers. Boards should treat CPS 230 as an ongoing obligation to maintain and test, rather than a one-off project with an end date.

If you are behind on CPS 230, start with an honest assessment of where the real gaps are against the standard, then prioritise critical operations and material service provider arrangements, because those carry the most exposure. We can run that assessment quickly, give you a defensible remediation plan, and then help deliver it. Regulators respond better to a credible, well-run uplift than to a rushed paper trail.

CPS 230 connects directly to your technology and transformation programmes, because resilience depends on the systems and suppliers those programmes are changing. Operational risk, business continuity and service provider management should be built into how change is delivered, not bolted on afterwards. We can align your CPS 230 obligations with your delivery portfolio so resilience is designed in, and assured, as the organisation changes.