Shield
Start free trialFree trial
Menu
For your teamFrameworksHow it worksPricingSecurityQuestionsCompareSign in

Frameworks · CPS 230

CPS 230 Operational Risk Management, paragraph by paragraph.

For APRA-regulated entities: the standard's requirements for the risk management framework, controls, incidents, business continuity and service providers, each with its paragraph and effective dates.

Start a 14-day free trialHow a programme works

The framework

NameAPRA CPS 230 Operational Risk Management
Who it applies toAPRA-regulated entities: authorised deposit-taking institutions (including foreign ADIs) and authorised banking non-operating holding companies; general insurers (including Category C insurers), authorised insurance non-operating holding companies and parent entities of Level 2 insurance groups; life companies (including friendly societies and eligible foreign life insurance companies) and registered non-operating holding companies; private health insurers; and RSE licensees in respect of their business operations. For a foreign ADI, Category C insurer or eligible foreign life insurance company, only the Australian branch operations are covered. A Head of a group must also apply the standard throughout the group.
Schedule, paras 2–5, Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 1 of 2026 (F2026L00475), as made; dated 23 April 2026, registered 29 April 2026; standard commences 1 July 2026, read 10 November 2026
RegulatorAustralian Prudential Regulation Authority
In force on 11 November 2026CPS 230 Operational Risk Management, remade from 1 July 2026
Schedule (Prudential Standard CPS 230), paras 1–61 and Attachment, Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 1 of 2026 (F2026L00475), as made; dated 23 April 2026, registered 29 April 2026; standard commences 1 July 2026, read 10 November 2026

What a CPS 230 programme does

Paragraphs as controls

Each requirement is a control citing its paragraph, including the remade standard where it applies.

Service providers and continuity

Link your material service provider register, business continuity plans and testing records to the paragraphs they evidence.

Board-ready reporting

Draft posture reports with figures from the register, issued and certified by a named person.

Versions

VersionFromUntilSource
CPS 230 Operational Risk Management, from 1 July 2025 (with transitional arrangements)1 July 202530 June 2026Schedule (Prudential Standard CPS 230), paras 1–60
CPS 230 Operational Risk Management, remade from 1 July 20261 July 2026CurrentSchedule (Prudential Standard CPS 230), paras 1–61 and Attachment

Controls (38)

CPS 230 Operational Risk Management, remade from 1 July 2026. Each control cites its source; your programme holds made.'s plain-English summary of each obligation beside it.

Application

RefControlCitation
Para 4Apply the standard throughout the groupPrudential Standard CPS 230 para 4

Key principles

RefControlCitation
Paras 11, 12, 13, 14Key principles of operational resiliencePrudential Standard CPS 230 paras 11, 12, 13, 14

Risk management framework

RefControlCitation
Para 15Build operational risk into the risk management frameworkPrudential Standard CPS 230 para 15
Para 16Review operational risk managementPrudential Standard CPS 230 para 16
Para 17Integrate operational risk and continuity planningPrudential Standard CPS 230 para 17

Roles and responsibilities

RefControlCitation
Paras 19, 20Board accountability for operational riskPrudential Standard CPS 230 paras 19, 20
Para 21Board oversight, approvals and reportingPrudential Standard CPS 230 para 21
Para 22Inform the Board on impacts to critical operationsPrudential Standard CPS 230 para 22

Operational risk management

RefControlCitation
Para 23Manage the full range of operational risksPrudential Standard CPS 230 para 23
Para 24Maintain sound IT capabilityPrudential Standard CPS 230 para 24
Para 25Assess the operational risk of business decisionsPrudential Standard CPS 230 para 25
Para 26Maintain a comprehensive operational risk profilePrudential Standard CPS 230 para 26
Para 27Assess risk before providing a material servicePrudential Standard CPS 230 para 27

Operational risk controls

RefControlCitation
Para 28Design and embed operational risk controlsPrudential Standard CPS 230 para 28
Para 29Monitor and test controlsPrudential Standard CPS 230 para 29
Para 30Remediate material weaknessesPrudential Standard CPS 230 para 30

Operational risk incidents

RefControlCitation
Para 31Identify, escalate and record incidents and near missesPrudential Standard CPS 230 para 31
Para 32Notify APRA of material incidents within 72 hoursPrudential Standard CPS 230 para 32

Business continuity

RefControlCitation
Para 33Business continuity obligationsPrudential Standard CPS 230 para 33
Paras 34, 35Classify critical operationsPrudential Standard CPS 230 paras 34, 35
Para 37Set tolerance levels for each critical operationPrudential Standard CPS 230 para 37
Para 39Business continuity plan contentsPrudential Standard CPS 230 para 39
Para 40Maintain capabilities and monitor tolerancePrudential Standard CPS 230 para 40
Para 41Notify APRA within 24 hours of a disruption outside tolerancePrudential Standard CPS 230 para 41
Paras 42, 43Test the business continuity planPrudential Standard CPS 230 paras 42, 43
Para 44Update the plan every yearPrudential Standard CPS 230 para 44
Para 45Internal audit assurance over the planPrudential Standard CPS 230 para 45

Management of service provider arrangements

RefControlCitation
Paras 46, 47Service provider management policyPrudential Standard CPS 230 paras 46, 47
Paras 48, 49Register of material service providersPrudential Standard CPS 230 paras 48, 49
Para 50Submit the register to APRA every yearPrudential Standard CPS 230 para 50
Para 52Due diligence before a material arrangementPrudential Standard CPS 230 para 52
Para 53Formal agreements for material arrangementsPrudential Standard CPS 230 para 53
Para 54APRA access termsPrudential Standard CPS 230 para 54
Para 55Manage each material arrangement's risks and exitPrudential Standard CPS 230 para 55
Paras 57, 58Contract exemptions for listed service provider categoriesPrudential Standard CPS 230 paras 57, 58
Para 59Monitor material arrangementsPrudential Standard CPS 230 para 59
Para 60Notify APRA of critical-operation agreements and offshoringPrudential Standard CPS 230 para 60
Para 61Internal audit review of outsourcing critical operationsPrudential Standard CPS 230 para 61

Other frameworks

Facts are as shipped in made. Shield, read from each primary source on the date shown. They describe the law; they aren't legal advice, and your organisation decides how they apply to it.