APRA Prudential Standard CPS 230 requires APRA-regulated entities to manage operational risk effectively, maintain critical operations through severe disruptions and manage risks arising from service providers.
The standard applies directly to APRA-regulated banks, insurers and registrable superannuation entity licensees. It can also affect other financial services businesses that provide services to those entities, operate within an APRA-regulated group or participate in the delivery of a critical operation.
For AFSL licensees, CPS 230 does not generally replace or directly extend the obligations imposed by the Corporations Act 2001. It does, however, provide a useful operational resilience benchmark and can materially affect outsourcing agreements, due diligence, incident reporting, continuity testing and service-provider oversight.
The central principle is straightforward: A financial services business should understand which operations matter most, how they could fail and how services will continue when disruption occurs.
Does this apply to my business?
- Are you APRA regulated?
- Do you provide services to APRA-regulated clients?
- Do clients require operational resilience evidence?
- Are you heavily dependent on outsourced providers?
What is APRA CPS 230?
CPS 230 is APRA’s cross-industry prudential standard for operational risk management.
It requires an APRA-regulated entity to:
- identify, assess and manage its operational risks;
- maintain effective internal controls;
- monitor and remediate control weaknesses;
- identify its critical operations;
- establish tolerance levels for disruption;
- maintain credible business continuity arrangements;
- test its ability to continue critical operations;
- identify material service providers;
- manage risks arising from service-provider arrangements; and
- maintain appropriate governance and board oversight.
APRA describes the three principal outcomes as effective operational risk management, continuity of critical operations through severe disruptions and effective management of service-provider risk.
CPS 230 commenced on 1 July 2025. Transitional arrangements allowed existing material service-provider agreements to be brought into compliance by the earlier of their next renewal date or 1 July 2026. From 1 July 2026, APRA’s amended standard also provides limited relief from specified contractual requirements for certain non-traditional service-provider arrangements. The remaining operational risk, business continuity and service-provider risk requirements continue to apply.
APRA has also published Prudential Practice Guide CPG 230. Unlike CPS 230, CPG 230 is guidance rather than a prudential standard. It explains APRA’s supervisory expectations and provides examples of prudent practices that may assist entities in demonstrating compliance with CPS 230.
Who must comply with CPS 230?
CPS 230 applies directly to APRA-regulated entities, including:
- authorised deposit-taking institutions;
- general insurers;
- life insurers;
- private health insurers;
- registrable superannuation entity licensees; and
- APRA-regulated groups where the relevant group requirements apply.
The standard is prudential regulation. It does not automatically apply to every AFSL or Australian Credit Licence holder.
A financial advice licensee, mortgage broker, investment manager, administrator or technology provider is not directly subject to CPS 230 merely because it operates in financial services.
However, a non-APRA-regulated business may be affected where it:
- provides a material service to an APRA-regulated entity;
- supports delivery of a critical operation;
- operates within an APRA-regulated group;
- provides outsourced administration, technology or claims services;
- handles critical or sensitive information;
- participates in business continuity testing;
- depends on an APRA-regulated entity for an important service; or
- is contractually required to comply with CPS 230-aligned controls.
The practical reach of CPS 230 therefore extends beyond the entities formally regulated by APRA.
Why does CPS 230 matter to other financial services businesses?
APRA-regulated entities must understand and manage the risks arising from their service-provider arrangements.
They cannot meet that obligation without obtaining information, commitments and evidence from the businesses on which they rely.
A service provider may therefore be required to demonstrate:
- reliable service delivery;
- incident-management capability;
- business continuity arrangements;
- recovery objectives;
- information-security controls;
- subcontractor oversight;
- access to records;
- cooperation with testing;
- timely notification of disruption;
- audit rights; and
- orderly transition or termination arrangements.
These requirements may appear in procurement processes, outsourcing agreements, service-level agreements and ongoing assurance requests.
A business that cannot provide credible evidence of operational resilience may find it harder to win or retain work with APRA-regulated clients.
For APRA-regulated entities, CPS 230 is a prudential requirement. For affected service providers and other financial services businesses, its influence will usually arise through procurement, contracting, assurance and broader commercial expectations.
How does CPS 230 relate to AFSL obligations?
AFSL holders are generally required to maintain adequate risk management systems under section 912A of the Corporations Act, subject to the statutory position for certain APRA-regulated bodies.
They must also maintain adequate resources, comply with financial services laws, supervise representatives and ensure that financial services are provided efficiently, honestly and fairly.
ASIC’s RG 104 explains that the measures adopted by a licensee should reflect the nature, scale and complexity of its business. It also confirms that a licensee may outsource functions but cannot outsource its regulatory responsibility.
CPS 230 and the AFSL obligations are not identical.
CPS 230 is more prescriptive in areas such as:
- critical operations;
- tolerance levels;
- operational resilience testing;
- material service-provider registers;
- formal service-provider management policies;
- board approval and oversight;
- disruption notification; and
- business continuity exercises.
An AFSL holder that is not APRA-regulated is not ordinarily required to reproduce CPS 230 in full.
However, the standard provides a useful framework for considering whether an AFSL licensee’s risk management, outsourcing and continuity arrangements are adequate.
This is particularly relevant where the licensee:
- provides essential client services;
- administers investments or claims;
- holds significant client information;
- relies heavily on technology;
- has concentrated service-provider dependencies;
- operates a large representative network;
- provides services to APRA-regulated entities; or
- could cause substantial client harm if operations fail.
Many organisations mistakenly attempt to ‘implement CPS 230’ by producing policies before identifying their critical customer services. In practice, resilience improves most when organisations begin with customer outcomes and work backwards through operational dependencies.
What is operational risk?
Operational risk under CPS 230 includes failures arising from people, processes, systems, and external events, extending well beyond cybersecurity or technology outages.
Specifically, CPS 230 requires entities to identify, assess and manage operational risks arising from inadequate or failed internal processes or systems, the actions or inactions of people, or external drivers and events.
Operational risk can arise from:
- human error;
- misconduct;
- inadequate procedures;
- technology failure;
- cyber incidents;
- fraud;
- data loss;
- outsourcing;
- poor change management;
- failed controls;
- regulatory non-compliance;
- natural disasters;
- telecommunications failure;
- service-provider disruption; or
- concentration in a small number of people or systems.
Operational risk is not limited to dramatic outages.
It can include routine weaknesses that gradually reduce the reliability of the business.
Examples include:
- complaints not being identified;
- advice reviews remaining incomplete;
- incidents not being escalated;
- customer records being inaccessible;
- regulatory reports relying on unreliable data;
- manual workarounds becoming permanent;
- access rights not being removed;
- key controls depending on one employee;
- service-provider performance not being tested; or
- remediation actions remaining overdue.
These weaknesses may not immediately stop the business. They can still create client harm, regulatory breaches and operational fragility.
What operational risk framework does CPS 230 require?
An APRA-regulated entity must maintain an operational risk management framework that supports the identification, assessment, management and monitoring of operational risk.
The framework should include:
- clearly defined roles and responsibilities;
- risk appetite and tolerances;
- operational risk profiles;
- internal controls;
- monitoring and assurance;
- incident management;
- remediation;
- change management;
- business continuity;
- service-provider management; and
- governance reporting.
The framework should connect operational risks to the controls intended to manage them.
A risk register alone is unlikely to satisfy prudent governance because it records risks rather than demonstrating how controls operate, are tested and are improved.
A defensible framework should allow the entity to explain:
- what could fail;
- what the consequences would be;
- which controls reduce the risk;
- who owns those controls;
- how control effectiveness is tested;
- what incidents have occurred;
- what weaknesses remain unresolved; and
- whether the residual risk remains acceptable.
For AFSL licensees, this approach is equally useful.
Operational risk management should not be isolated from compliance. Failed systems and processes frequently produce compliance failures.
What are critical operations?
Critical operations are processes undertaken by an APRA-regulated entity or its service provider which, if disrupted beyond the entity’s tolerance levels, would have a material adverse impact on customers or on the entity’s role in the financial system.
CPS 230 specifies minimum critical operations for particular industries.
Depending on the entity, they can include matters such as:
- deposit-taking and account services;
- payments;
- claims processing;
- investment option management;
- member beneficiary payments;
- insurance coverage;
- customer enquiries;
- hardship support; and
- other services essential to customers.
An entity may identify additional critical operations based on its business model and risk profile.
How should a critical operation be identified?
The analysis should begin with the service delivered to the customer, not with the internal department or system.
For example, “claims payment” is a customer-facing operation.
Its delivery may depend on:
- claims staff;
- policy administration systems;
- payment systems;
- identity verification;
- outsourced assessors;
- cloud infrastructure;
- telecommunications;
- data providers; and
- banking arrangements.
Mapping the complete operation reveals dependencies that may not be visible when each team assesses risk separately.
What should non-APRA-regulated businesses do?
A non-APRA-regulated business can apply the same approach by identifying its essential services.
These may include:
- responding to clients;
- producing advice;
- implementing transactions;
- handling complaints;
- assessing breaches;
- paying claims;
- processing applications;
- maintaining client records;
- supervising representatives;
- meeting regulatory deadlines; or
- providing access to client platforms.
The business should then determine how long each service can be disrupted before client harm or regulatory failure becomes unacceptable.
What are tolerance levels?
A tolerance level defines the maximum disruption an entity is prepared to accept for a critical operation.
Under CPS 230, tolerance levels generally address:
- the maximum period of disruption;
- the maximum extent of data loss; and
- minimum service levels during a disruption.
Tolerance levels should be specific and measurable.
Statements such as “services should be restored promptly” or “minimal disruption is acceptable” do not provide an effective basis for planning or testing.
A more useful tolerance might specify:
- the operation must be restored within four hours;
- no more than 30 minutes of transaction data may be lost; and
- priority clients must retain access to emergency support during the disruption.
Tolerance levels should reflect customer impact and prudential risk, not merely what existing systems can achieve.
That distinction matters.
If the current recovery capability is slower than the acceptable tolerance, the gap should be identified and addressed. The tolerance should not simply be adjusted to conceal the weakness.
How should business continuity be managed?
CPS 230 requires an APRA-regulated entity to maintain credible business continuity arrangements that enable it to continue critical operations within approved tolerance levels during severe but plausible disruptions.
A business continuity plan should address more than office evacuation or system recovery.
It should explain how the entity will:
- activate its response;
- make decisions;
- communicate internally;
- communicate with customers;
- maintain critical operations;
- access essential records;
- manage service providers;
- use alternative processes;
- restore systems;
- reconcile affected transactions;
- assess regulatory implications; and
- return to normal operations.
The plan should address foreseeable disruption scenarios, including:
- technology failure;
- cyberattack;
- data corruption;
- loss of premises;
- loss of telecommunications;
- service-provider failure;
- workforce unavailability;
- natural disaster;
- fraud;
- loss of a critical person; and
- simultaneous failures.
A continuity plan that relies on the same people, systems and premises affected by the disruption may not be credible.
The board must approve the BCP, tolerance levels for critical operations and the service-provider management policy. It must also review BCP testing results and material service-provider risk and performance reporting.
What does CPS 230 require for service providers?
Service-provider management is one of the most significant elements of CPS 230.
An APRA-regulated entity must identify its material service providers and manage the risks associated with material arrangements.
A material service provider is a provider on which the entity relies to undertake a critical operation or that exposes the entity to material operational risk.
Depending on the business, material providers may include:
- cloud providers;
- information technology providers;
- fund administrators;
- custodians;
- claims administrators;
- call centres;
- payroll providers;
- data providers;
- payment processors;
- investment managers;
- reinsurers;
- underwriting agencies;
- professional service firms;
- distribution partners; or
- related entities.
APRA-regulated entities must maintain a service-provider management policy and a register of material service providers.
What should service-provider due diligence cover?
Appropriate due diligence and risk assessment should be tailored to the nature, materiality and risk profile of the arrangement.
Before entering into a material arrangement, the entity should consider matters including:
- the provider’s capability;
- financial position;
- operational resilience;
- security controls;
- business continuity arrangements;
- location;
- subcontracting;
- concentration risk;
- data management;
- regulatory history;
- conflicts;
- staffing;
- insurance; and
- capacity to comply with contractual obligations.
Due diligence should be proportionate to the importance of the service.
A business supporting a critical operation requires more scrutiny than a provider performing a low-risk administrative task.
What should the agreement contain?
Unless an exemption applies, an APRA-regulated entity must maintain a formal, legally binding agreement for each material arrangement. CPS 230 prescribes minimum contractual terms, including:
- the services covered by the agreement and the associated service levels;
- the rights, responsibilities and expectations of each party;
- ownership of relevant assets;
- ownership and control of data;
- dispute-resolution arrangements;
- audit and access rights;
- liability and indemnity arrangements;
- provisions enabling the APRA-regulated entity to meet its legal and compliance obligations;
- notification by the service provider of any subcontractor or other material service provider on which it materially relies to deliver the service;
- responsibility of the service provider for any failure by its subcontractors;
- force majeure provisions identifying which parts of the agreement will continue to operate during a force majeure event;
- rights to terminate the entire arrangement or relevant parts of it;
- for an RSE licensee, a right to terminate where continuing the arrangement would be inconsistent with its duty to act in the best financial interests of beneficiaries;
- APRA’s access to documentation, data and other information relating to the service;
- APRA’s right to conduct an on-site visit to the service provider; and
- an undertaking that the service provider will not impede APRA in performing its functions as prudential regulator.
The agreement must support the entity’s ability to execute its business continuity plan and conduct an orderly exit from the arrangement. The contract should support operational control but contractual rights are not a substitute for operational oversight. The entity must monitor the arrangement, assess the effectiveness of relevant controls and ensure both parties comply with the agreement.
The current CPS 230 provides limited relief from specified requirements for a material arrangement where the provider falls within a category listed in the standard and the arrangement uses standardised terms or is not documented in a formal agreement. The relief does not remove the entity’s obligation to assess and manage the operational risks arising from the arrangement.
The relief is narrow and doesn’t remove the broader obligation to manage operational risk.
Why does this matter to AFSL service providers?
Businesses supplying services to APRA-regulated entities may be asked to accept:
- more detailed service levels;
- shorter incident-notification timeframes;
- enhanced audit rights;
- continuity testing;
- access obligations;
- subcontractor restrictions;
- data-location requirements;
- transition assistance;
- resilience attestations; and
- evidence of control effectiveness.
Service providers should assess whether they can comply before accepting these obligations.
A contractual promise unsupported by operational capability creates significant legal and commercial risk.
What testing does CPS 230 require?
CPS 230 requires a systematic BCP testing program covering all critical operations and including an annual business continuity exercise. The program must test the effectiveness of the BCP and the entity’s ability to meet its tolerance levels across a range of severe but plausible scenarios, including disruption involving material service providers and the use of contingency arrangements.
Testing should be severe enough to reveal weaknesses.
A desktop review of the plan may confirm that the document is current. It does not demonstrate that the organisation can continue operating during disruption.
Testing may include:
- scenario exercises;
- system recovery tests;
- failover tests;
- staff call-tree exercises;
- service-provider participation;
- data restoration;
- alternative-site activation;
- manual processing;
- crisis simulations;
- customer communication exercises; and
- simultaneous disruption scenarios.
What should a test demonstrate?
A useful test should establish:
- whether escalation occurred promptly;
- whether decision-makers were available;
- whether responsibilities were understood;
- whether critical records were accessible;
- whether alternative processes worked;
- whether service providers responded;
- whether communications were effective;
- whether tolerance levels were met;
- whether data was reconciled; and
- whether identified weaknesses were remediated.
The test result should not simply state that the exercise was successful.
It should record:
- the scenario;
- assumptions;
- participants;
- actual response times;
- observed failures;
- tolerance breaches;
- decisions;
- remediation actions;
- responsible owners; and
- required retesting.
Should service providers participate?
Where a critical operation depends on a service provider, testing without that provider may produce false assurance.
The entity should consider:
- joint exercises;
- evidence of the provider’s own tests;
- review of independent assurance reports;
- recovery demonstrations;
- subcontractor testing; and
- testing of transition arrangements.
A provider’s statement that it has a business continuity plan is not evidence that the plan will support the regulated entity’s critical operation.
What governance does CPS 230 require?
The board is ultimately accountable for oversight of operational risk management.
The board must approve key elements of the framework, including tolerance levels for critical operations and the service-provider management policy.
Senior management is responsible for implementing the framework, managing operational risk and providing the board with accurate and timely information.
Governance arrangements should establish:
- operational risk ownership;
- control ownership;
- responsibility for critical operations;
- approval authorities;
- escalation thresholds;
- incident-management responsibilities;
- service-provider oversight;
- testing responsibilities;
- remediation governance; and
- reporting requirements.
Operational resilience should not be owned solely by the risk, compliance or information technology team.
Business owners are responsible for understanding how their operations are delivered and what is required to maintain them.
Risk and compliance functions should provide oversight and challenge. They should not become substitutes for operational ownership.
What should boards receive in CPS 230 reporting?
Boards need a reliable view of whether critical operations can remain within tolerance during severe disruption.
Board reporting should address:
- the entity’s operational risk profile;
- critical operations;
- tolerance levels;
- material dependencies;
- significant incidents;
- tolerance breaches;
- control weaknesses;
- testing results;
- material service providers;
- concentration risk;
- overdue remediation;
- emerging risks; and
- management’s assessment of resilience.
Boards should not receive only activity metrics.
For example, reporting that all continuity plans were reviewed tells the board little about whether those plans worked.
More useful reporting would explain:
- which operations failed testing;
- which recovery times exceeded tolerance;
- which providers did not participate;
- which data could not be restored;
- which actions remain overdue;
- which risks have been accepted; and
- whether further investment is required.
What should the board ask?
Directors should ask:
- Are all critical operations identified?
- Are tolerance levels based on customer impact?
- Can current systems meet those tolerances?
- Which providers are essential to service delivery?
- Where do we have concentration risk?
- Have we tested severe but plausible scenarios?
- Did the tests include service providers?
- What weaknesses were identified?
- Are remediation actions being completed?
- Could management demonstrate resilience to APRA today?
These questions shift reporting from compliance activity to operational capability.
How should incidents be managed?
An operational incident should be captured, assessed, escalated and resolved through a structured process.
The incident framework should identify:
- what constitutes an operational incident;
- notification requirements;
- severity criteria;
- decision-making authority;
- immediate containment;
- customer impact;
- regulatory impact;
- root-cause analysis;
- remediation;
- communication;
- closure; and
- lessons for other operations.
CPS 230 imposes mandatory APRA notification requirements. An operational risk incident that is likely to have a material financial impact or a material impact on the entity’s ability to maintain critical operations must be notified as soon as possible and no later than 72 hours after the entity becomes aware of it. A disruption to a critical operation outside tolerance must be notified as soon as possible and no later than 24 hours after the disruption.
The entity should also consider whether the incident creates obligations under other regimes, including:
- ASIC reportable situations;
- privacy notification;
- cyber reporting;
- market disclosure;
- complaints handling;
- trustee obligations;
- insurance requirements; or
- contractual notification obligations.
One event can engage several regulatory frameworks.
The incident process should connect those assessments rather than relying on separate teams to identify the same event independently.
How does CPS 230 interact with CPS 234?
CPS 230 addresses operational risk and resilience.
CPS 234 addresses information security.
The standards overlap where critical operations depend on information assets, technology platforms or cyber controls.
A cyber incident may:
- compromise critical information;
- interrupt a critical operation;
- trigger business continuity arrangements;
- involve a material service provider;
- breach tolerance levels; and
- require regulatory notification.
The entity should therefore align:
- information-asset classification;
- cyber incident response;
- operational incident management;
- business continuity;
- service-provider oversight;
- testing; and
- board reporting.
Separate frameworks that use inconsistent definitions, owners and escalation pathways can delay the response to a serious incident.
What commonly goes wrong with CPS 230 implementation?
Treating CPS 230 as a documentation project
Policies and registers are produced without changing operational ownership, testing or decision-making.
Starting with systems rather than services
The entity identifies technology platforms but does not map the customer operations those systems support.
Setting tolerances around current capability
Tolerance levels are designed to match existing recovery times instead of reflecting acceptable customer impact.
Identifying too many critical operations
Every process is labelled critical, making prioritisation impossible.
Identifying too few critical operations
The entity focuses only on obvious payment or technology functions and overlooks complaints, claims, member services or other customer-critical processes.
Relying on service-provider assurances
Providers confirm that continuity plans exist, but the entity does not test whether those plans support its own tolerances.
Ignoring fourth-party risk
A material provider depends on subcontractors or cloud infrastructure that the regulated entity has not assessed.
Treating contracts as controls
Detailed contractual rights exist, but no one monitors provider performance or exercises those rights.
Conducting easy tests
Testing confirms familiar scenarios and avoids severe disruptions likely to expose weaknesses.
Closing actions without verifying effectiveness
A remediation task is marked complete because a document was updated, without testing whether operational capability improved.
Reporting activity instead of resilience
The board receives counts of plans, tests and providers without being told whether critical operations can remain within tolerance.
What is a practical CPS 230 implementation framework?
A practical implementation can be organised into ten stages.
1. Confirm the scope
Identify:
- regulated entities;
- group entities;
- legal responsibilities;
- material business units;
- applicable transition arrangements;
- existing prudential frameworks; and
- current outsourcing and continuity requirements.
Non-APRA-regulated businesses should identify how CPS 230 affects their client contracts and group responsibilities.
2. Identify essential services
Start with the services delivered to customers.
Determine which services could create material customer or financial-system impact if disrupted.
3. Map the operations
For each critical operation, identify:
- people;
- processes;
- technology;
- information;
- premises;
- service providers;
- subcontractors;
- decision-makers; and
- regulatory dependencies.
4. Set tolerance levels
Define:
- maximum disruption time;
- maximum data loss;
- minimum service levels; and
- any other relevant tolerance measures.
Document the rationale and board approval.
5. Assess operational risks
Identify failure scenarios and assess:
- likelihood;
- customer impact;
- financial impact;
- regulatory impact;
- dependencies;
- existing controls; and
- residual risk.
6. Assess service providers
Identify material providers and evaluate:
- criticality;
- substitutability;
- concentration;
- location;
- subcontracting;
- security;
- continuity;
- financial viability; and
- exit difficulty.
7. Strengthen agreements and oversight
Update contracts, monitoring, reporting, incident notification, access, audit and transition arrangements.
Do not rely on contract changes alone.
8. Develop continuity strategies
Establish practical alternatives for maintaining critical operations during disruption.
These may include:
- alternative systems;
- manual workarounds;
- secondary providers;
- remote operations;
- additional staffing;
- data backups;
- alternative communication channels; and
- service prioritisation.
9. Test and remediate
Test severe scenarios against tolerance levels.
Record weaknesses, assign actions and retest material changes.
10. Integrate governance reporting
Provide the board and senior management with a consolidated view of:
- critical operations;
- tolerance performance;
- incidents;
- testing;
- service providers;
- control weaknesses;
- remediation; and
- emerging operational risk.
What should AFSL licensees do in practice?
An AFSL holder that is not APRA-regulated should generally avoid an unqualified claim that it is “CPS 230 compliant”. CPS 230 does not directly apply merely because an entity holds an AFSL.
A more precise statement would identify the relevant scope, such as that the organisation has adopted CPS 230-aligned operational resilience controls or satisfies specified contractual requirements imposed by an APRA-regulated client.
They should instead determine whether CPS 230 is relevant because:
- they provide services to an APRA-regulated entity;
- they form part of a regulated group;
- a contract imposes CPS 230-aligned obligations;
- their operations create material customer dependencies; or
- the framework provides an appropriate benchmark for their risk profile.
A practical readiness review should ask:
- What services must continue during disruption?
- How long can each service be unavailable?
- Which people, systems and providers support those services?
- Where are the single points of failure?
- Which providers are difficult to replace?
- What contractual obligations apply?
- When was continuity last tested?
- Did the test measure actual recovery against defined tolerances?
- What weaknesses remain unresolved?
- What information does the board receive?
These questions are useful even where CPS 230 does not directly apply.
How does Assured Support help?
Assured Support helps financial services businesses strengthen operational risk, service-provider governance and resilience arrangements.
Our work includes:
- CPS 230 readiness assessments;
- operational risk frameworks;
- critical-operation mapping;
- tolerance development;
- business continuity reviews;
- service-provider governance;
- outsourcing assessments;
- contract and control mapping;
- incident and escalation frameworks;
- testing programs;
- remediation tracking;
- Responsible Manager reporting;
- board reporting; and
- integration with AFSL compliance arrangements.
CPS 230 is not simply a higher standard for business continuity documentation.
It requires regulated entities to understand how critical services are delivered, test whether those services can survive disruption and maintain evidence that operational risks are being managed.
For other financial services businesses, the same discipline can strengthen compliance, protect clients and improve their ability to work with APRA-regulated organisations.
Talk with an expert about assessing your CPS 230 obligations and strengthening your operational resilience framework.
This article provides general information and professional education. It is not legal advice.
Further reading
Frequently Asked Questions
No. While CPS 230 applies directly to APRA-regulated entities, many non-APRA financial services businesses are affected indirectly through commercial relationships. Service providers supporting banks, insurers or superannuation trustees are increasingly expected to demonstrate business continuity capability, operational resilience, incident management and governance that align with CPS 230 expectations.
The practical consequence is commercial rather than prudential. Procurement questionnaires, outsourcing contracts, audit rights and assurance requests increasingly require evidence—not merely policies—that critical services can continue during disruption. Businesses unable to provide credible evidence may face longer procurement processes or reduced competitiveness.
Generally, no, unless that statement can be accurately substantiated.
Most AFSL holders are regulated under the Corporations Act rather than APRA prudential standards.
While CPS 230 provides an excellent operational resilience benchmark, it does not automatically apply to every licensee.
A more defensible statement is that the organisation has adopted CPS 230 principles or aligned selected operational resilience practices where appropriate. This distinction avoids creating potentially misleading regulatory impressions while still demonstrating mature governance.
Evidence should demonstrate operational capability rather than administrative completion.
Useful board reporting includes:
– recovery performance against tolerance levels
– unresolved control weaknesses
– testing outcomes
– overdue remediation
– provider participation
– incident trends
– concentration risk
– management assurance regarding critical operations.
Conversely, metrics such as “100% of BCPs reviewed” or “all policies updated” demonstrate activity rather than resilience. Boards should seek evidence that severe disruption can be managed within approved tolerances, not simply that documentation has been completed or reviewed.
Begin with customer services rather than organisational structure.
Identify the services whose failure would create unacceptable customer, regulatory or commercial consequences. Then map every dependency supporting those services—people, technology, providers, premises, information and decision-makers.
This approach often exposes hidden single points of failure, provider concentration and undocumented manual workarounds that traditional risk registers overlook. Prioritising resilience around critical services usually produces greater operational value than updating policies alone.
No. Technology is only one component of operational resilience. CPS 230 also requires governance, decision-making, testing, service-provider oversight, documented tolerances and effective incident management.
An organisation with sophisticated infrastructure but poor governance or ineffective testing may remain operationally fragile. Likewise, a well-governed organisation with simpler technology can often demonstrate stronger resilience because responsibilities, controls and contingency arrangements are clearly understood and routinely tested. Technology should therefore support governance rather than replace it.
