APRA expects entities subject to Prudential Standard CPS 230 to retain governance records demonstrating that operational risks are identified, monitored and managed effectively. The records should evidence board oversight, operational risk decisions, management of critical operations, oversight of material service providers and business continuity arrangements. Policies alone are insufficient without evidence that governance activities are operating in practice.
Expanded Answer
CPS 230 requires APRA-regulated entities to maintain evidence that their operational risk management framework is effective and embedded throughout the organisation. Governance records should demonstrate how the board and senior management oversee operational risks, monitor critical operations, make risk-based decisions and ensure operational resilience. Documentation should be sufficiently detailed to support APRA’s ongoing supervision and demonstrate that governance responsibilities are being discharged.
Relevant records commonly include board and committee papers, meeting minutes, operational risk reports, risk appetite statements, operational risk assessments, critical operations registers, control testing results, incident reports, root cause analyses, business continuity plans and testing results, material service provider assessments, due diligence records, outsourcing agreements, service performance reports, internal audit findings, remediation plans and evidence that corrective actions have been completed. Entities should also retain records demonstrating periodic review of the operational risk management framework and governance over material service providers.
Key records:
- Retain evidence of board oversight, operational risk reporting and governance decisions.
- Retain documentation supporting the identification, monitoring and review of critical operations and material service providers.
- Retain evidence that incidents, control weaknesses and remediation actions are tracked, reviewed and completed.
Why it matters
Governance records provide objective evidence that operational risk management is active rather than merely documented. They enable an APRA-regulated entity to demonstrate effective oversight, operational resilience and prudent management of critical operations and outsourcing arrangements during supervisory reviews.
Unsure how this applies to you?
Get a clear answer in a 15-minute call with a compliance specialist. Book your call
Practical guidance
- Maintain contemporaneous records of board decisions, operational risk reporting and governance oversight activities.
- Document assessments, monitoring and performance reviews for critical operations and all material service providers.
- Review governance records regularly to verify that remediation actions are completed and operational risk controls remain effective.
Further reading
APRA CPS 230 explained for financial services businesses