APRA’s Prudential Standard CPS 230 Operational Risk Management takes effect today for Australian banks, insurers and superannuation trustees.
Key points
- Entities must identify critical operations and set tolerance levels for disruption.
- Business continuity plans must be maintained and tested regularly.
- Material service providers must be identified, with formal agreements and ongoing risk management.
- The board is ultimately accountable for operational risk management.
- CPS 230 replaces several earlier standards on outsourcing and business continuity and complements CPS 234 on information security.
UK technology and service providers supporting Australian financial institutions should expect more detailed due diligence, contractual and testing requirements. CPS 230 closely mirrors UK operational resilience rules and the EU’s DORA.
Source: CPS 230 Operational Risk Management (APRA)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
