APRA CPS 230 Operational Risk Management for Australian financial services

Replaces five standards

CPS 230 replaces CPS 231 Outsourcing, CPS 232 Business Continuity Management, SPS 231 Outsourcing, SPS 232 Business Continuity Management, and HPS 231 Outsourcing. One standard for operational risk, business continuity, and third-party arrangements.

1 July 2025 commencement

CPS 230 commenced on 1 July 2025 for most APRA-regulated entities. Smaller superannuation entities and non-significant financial institutions had until 1 July 2026, a date that has now passed. Existing material service provider contracts may transition over a longer window.

April 2026 targeted amendments

On 30 April 2026, APRA finalised targeted amendments to CPS 230, clarifying the material service provider register obligation and tightening expectations around fourth-party concentration risk.

Sits alongside CPS 234

CPS 234 Information Security remains in force as the cyber-specific standard. CPS 230 is broader: it covers operational risk, business continuity, and the third-party arrangements that often carry cyber risk. Boards should expect to evidence both in tandem.

ADIs (banks, credit unions, building societies)

All authorised deposit-taking institutions, regardless of size. The major banks and the smallest mutuals are both in scope, with proportionality applied to the depth of evidence required.

General, life, and private health insurers

All insurers regulated by APRA. Includes friendly societies and reinsurance arrangements.

Superannuation trustees

All RSE licensees, including small APRA funds. Trustees should expect APRA to look closely at administrator and investment manager arrangements as material service providers.

Boards are accountable, not just management

CPS 230 makes the board ultimately accountable for the operational risk management framework. The board must approve the framework, review it at least annually, and ensure tolerance levels are set for critical operations.

Identify critical operations

Every entity must identify its critical operations: the processes that, if disrupted, would materially affect financial or operational viability, or the entity's role in the financial system. Examples for an ADI typically include payments, deposit-taking, lending, customer authentication, and core banking platform availability.

Set tolerance levels for disruption

For each critical operation, the board must approve maximum tolerance levels for disruption. Tolerances typically cover duration of disruption, data loss, and service degradation, and are tested under severe but plausible scenarios.

Test business continuity

Business continuity plans must be tested at least annually for each critical operation. Testing must include scenarios that involve the loss of a material service provider, a cyber incident, and a wider operational failure. Findings must be reported to the board.

Manage material service providers

Entities must maintain a register of all material service providers, perform due diligence at engagement and on an ongoing basis, and have exit and substitution plans. This obligation is the one most often missed by entities transitioning from CPS 231 outsourcing arrangements.

What counts as a material service provider

Hyperscale cloud providers, core banking platforms, payments rails, custodians, administrators, managed IT and security providers, identity providers, and key SaaS platforms typically qualify. Branch hardware, generic office IT, and most professional services usually do not.

Fourth-party risk is in scope

The April 2026 amendments clarified that entities are expected to understand fourth-party arrangements where they introduce concentration risk. A managed IT provider running on a hyperscale cloud creates fourth-party visibility obligations even though the entity does not contract directly with the cloud provider.

Substitution plans must be credible

For each material service provider, the register must record a substitution plan. The expectation is that the plan is operationally credible: identified alternative provider, expected transition timeframe, key dependencies, and any contractual exit assistance terms.

What APRA expects from the contract

Material service provider contracts are expected to include audit and information rights for APRA and the entity, service performance and continuity obligations, sub-contracting controls, exit assistance, and notification of significant incidents.

Incident reporting overlap

A material information security incident is reportable to APRA under CPS 234 within 72 hours of detection. The same incident, if it affects a critical operation, is also a CPS 230 continuity event. Boards should expect one combined post-incident review.

Third-party assurance overlap

Material service provider due diligence under CPS 230 must include cyber security assurance. A SOC 2 Type II report, ISO 27001 certification, or independent CPS 234 attestation from the provider is the typical evidence base.

Board reporting cadence

Boards typically receive CPS 234 reporting quarterly and CPS 230 reporting at least annually. In practice, a combined operational resilience board paper covering both standards is the cleaner approach.

Tested business continuity now includes cyber scenarios

APRA has clarified that business continuity testing must include cyber-driven scenarios. Loss of identity provider, ransomware affecting the core platform, and material data integrity loss are common test scenarios for ADIs and trustees in 2026.

Phase 1 : Critical operations identification

Workshop the executive team. Identify the operations that, if disrupted, materially affect customers, the entity, or the financial system. Document the dependencies of each critical operation on people, processes, technology, and third parties.

Phase 2 : Tolerance levels

For each critical operation, propose tolerance levels for disruption duration, data loss, and service degradation under a severe but plausible scenario. Walk through with the board risk committee. Approve at full board.

Phase 3 : Material service provider register

Build the register from your existing third-party inventory, with cyber assurance evidence and a substitution plan for each entry. Engage your managed IT and security partners; many providers now produce a CPS 230 evidence pack on request.

Phase 4 : Annual continuity testing

Run a tabletop exercise covering at least one material service provider failure, one cyber scenario, and one wider operational failure. Document findings, remediation, and board reporting. Lock the test into the board calendar.

Where Real Bytes fits

If we are your managed IT or security provider, we will sit on your material service provider register and produce the assurance evidence required: SOC reports, control attestations, sub-contracting maps, incident notification commitments, and exit assistance terms. For entities running on multiple managed providers, we can also help build the register and the substitution plans.