APRA Prudential Standard CPS 230 establishes operational risk management requirements for APRA-regulated entities. It applies to authorised deposit-taking institutions, insurers and registrable superannuation entity (RSE) licensees regulated by APRA, not to all Australian Financial Services Licensees or Australian Credit Licensees. The standard requires entities to manage operational risk, maintain resilient critical operations and oversee material service providers.
Expanded Answer
CPS 230 is APRA’s prudential standard for operational risk management. It requires APRA-regulated entities to maintain a documented operational risk management framework that identifies, assesses, manages and monitors operational risks across the organisation. The framework must support operational resilience, business continuity and effective governance over critical operations and material service providers.
The standard places accountability on the regulated entity’s board and senior management to ensure operational risks are understood and appropriately managed. Entities must identify their critical operations, establish appropriate controls, maintain business continuity capabilities, oversee material service providers and monitor whether operational risk controls remain effective over time. Outsourcing does not transfer accountability under CPS 230, and regulated entities remain responsible for the operational resilience of critical business functions.
Applies to:
Authorised deposit-taking institutions (ADIs), general insurers, life insurers, private health insurers and registrable superannuation entity (RSE) licensees regulated by APRA.
Does not apply to:
Australian Financial Services Licensees or Australian Credit Licensees that are regulated solely by ASIC, although many adopt CPS 230 principles to strengthen governance and operational resilience.
Why it matters
CPS 230 establishes a consistent prudential framework for managing operational risk and resilience across APRA-regulated entities. Understanding its scope helps organisations distinguish mandatory prudential obligations from better-practice governance measures that may also strengthen ASIC compliance frameworks.
Unsure how this applies to you?
Get a clear answer in a 15-minute call with a compliance specialist. Book your call
Practical guidance
- Determine whether your organisation is regulated by APRA before assessing CPS 230 obligations.
- Document operational risks, critical operations and governance arrangements appropriate to your regulatory status.
- Review outsourcing, business continuity and operational resilience arrangements against CPS 230 where the standard applies.
Further reading
APRA CPS 230 explained for financial services businesses