APRA Prudential Standard CPS 230 Operational Risk Management compliance software
APRA's operational resilience standard, re-made in 2026 and in force from 1 July 2026 — 86 obligations across critical operations, tolerance levels, business continuity and material service providers, with every APRA clock tracked.
- RegulatorAPRA — Australian Prudential Regulation Authority
- InstrumentF2026L00475, in force 1 July 2026 (first commenced 1 July 2025)
- Structure7 domains, paragraphs 11–61; 86 assessable controls
- Notifications72 h incidents · 24 h tolerance breach · 20 business days agreements · annual register
What AU APRA CPS 230 requires
Who it applies to
- Authorised deposit-taking institutions, including foreign ADIs and banking NOHCs
- General insurers, life companies and friendly societies, and private health insurers
- RSE licensees (superannuation trustees) across their business operations
- Heads of groups, on a group basis, including non-APRA-regulated group entities
Prudential Standard CPS 230 Operational Risk Management replaced CPS 231 and SPS 231 Outsourcing, CPS 232 and SPS 232 Business Continuity Management and HPS 231 from 1 July 2025. APRA revoked and re-made it as F2026L00475 with effect from 1 July 2026, adding a limited exemption for non-traditional service providers such as central banks, exchanges, clearing and settlement facilities and payment schemes. The transition for pre-existing contracts and for smaller entities' business continuity requirements ended on the same date, so from July 2026 every obligation applies to every APRA-regulated entity.
The standard has three pillars: operational risk management (risk profile, controls, incidents), business continuity (a register of critical operations, Board-approved tolerance levels for disruption, data loss and minimum service, a credible BCP tested annually against severe but plausible scenarios) and the management of service providers (a policy, a register of material service providers submitted to APRA annually, a mandatory clause set for every material agreement, monitoring and exit). GRCLens carries 86 assessable controls following APRA's own paragraph and lettered-item structure, with guidance from CPG 230.
Sector matters for two paragraphs: the deemed critical operations (payments and deposits for ADIs, claims for insurers, investment management and fund administration for superannuation trustees) and the deemed material service providers. The tenant's sector selects them; everything else binds every entity. Four notifications run to APRA — 72 hours for a material operational risk incident, 24 hours for a critical operation outside tolerance, 20 business days after a critical-operation agreement is signed or changed, and prior notice of offshoring — plus the annual register.
How GRCLens supports AU APRA CPS 230
AU APRA CPS 230 runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Critical operations and tolerance levels
The register of critical operations, the deemed list for the tenant's sector and the three tolerance levels per operation are controls with their own indicator, so 'within tolerance' is measurable before a disruption, not after.
Material service provider register
The register, the deemed categories, the ten contract clauses in paragraphs 53 and 54, exit plans and the 2026 exempt-category flag are assessed per arrangement, with the third-party risk module feeding the evidence.
Every APRA clock as an indicator
The 72-hour, 24-hour and 20-business-day notifications, prior offshoring notice and the annual register submission are one key risk indicator; a missed duty is amber, two are red.
Board approvals traced
Paragraph 21's three Board approvals — the BCP, tolerance levels and the service provider policy — are controls with evidence, so accountability under the Financial Accountability Regime can be shown.
AU APRA CPS 230 frequently asked questions
What changed on 1 July 2026?
Three things: the re-made standard with the non-traditional service provider exemption took effect; the deadline for bringing pre-existing material agreements into line passed; and the deferral of BCP requirements for non-significant financial institutions ended. GRCLens carries the 2026 paragraph numbering.
Which operations and providers are deemed material?
Critical operations: payments, deposit-taking, custody and settlements for ADIs; claims processing for insurers; investment management and fund administration for RSE licensees; customer enquiries and supporting systems for everyone. Material service providers: credit assessment, funding and liquidity and mortgage brokerage for ADIs; underwriting, claims, brokerage and reinsurance for insurers; fund administration, custody, investment management, promoters and financial planners for RSE licensees; risk management, core technology and internal audit for everyone. Excluding one needs a documented justification.
Should we run CPS 230 and CPS 234 as one framework?
No. They are separate instruments with different owners and clocks. GRCLens keeps them as two catalogues under Australia and cross-references where they touch — CPS 230 requires CPS 234 to be met, and a CPS 234 incident notification satisfies CPS 230's.
One platform, many obligations
Talk to us about AU APRA CPS 230
Security Solution Consultants provides APRA operational resilience advisory alongside the platform, so you can combine tooling with hands-on expertise.