Critical operations
Identify operations whose disruption would have a material adverse impact on beneficiaries, members, policyholders or the financial system.
Australia · Australian Prudential Regulation Authority (APRA) · CPS 230
APRA Prudential Standard CPS 230
APRA's operational-risk standard, covering business continuity and service-provider obligations.
What it is
CPS 230 strengthens and consolidates APRA's operational-risk rules. It covers resilience of critical operations, service-provider arrangements and severe-but-plausible scenario testing. Cyber incidents count as operational risk. You must identify critical operations and document, measure and test their disruption tolerances. Boards approve tolerances; internal audit gives independent assurance.
Who it applies to
All APRA-regulated entities - ADIs, insurers, superannuation trustees and RSE licensees. Non-significant financial institutions got an extra 12-month transition window.
Requirements
Tolerance for disruption
Set tolerance levels for each critical operation - maximum period and extent of disruption - with Board approval.
Scenario testing
Test regularly whether you can stay within tolerance under severe-but-plausible scenarios.
Service provider management
Keep a register, run due diligence, manage service-provider risk and notify APRA of material arrangements.
Business continuity plan
Keep a Board-approved plan that matches critical operations and tolerances.
Operational risk incidents
Notify APRA of operational-risk incidents likely to have a material impact, and keep an incident register.
Sources
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.