APRA CPS 230 explained: requirements, critical operations and a compliance checklist

CPS 230 brought operational risk, business continuity and service provider management into one APRA standard. Here is what it requires in plain English, the deadlines that matter, and how to evidence compliance.

Updated 28 October 2026 · 10 min read

Who CPS 230 applies to

CPS 230 applies to all APRA-regulated entities:

• authorised deposit-taking institutions — banks, building societies and credit unions;
• general insurers, life insurers and private health insurers;
• registrable superannuation entity (RSE) licensees.

It also reaches further than the regulated entities themselves. Service providers that support critical operations — technology vendors, cloud providers, outsourced administrators, claims handlers — will find CPS 230 requirements written into their contracts.

The standard replaced the previous outsourcing standards (CPS 231, SPS 231, HPS 231) and business continuity standards (CPS 232, SPS 232). Information security remains in a separate standard, CPS 234.

Key dates

By now every requirement should be in effect for every entity. In practice APRA’s focus has moved from “do you have a framework?” to “show us it works” — evidence of testing, monitoring and board challenge.

The three pillars of CPS 230

1. Operational risk management

Entities must identify, assess and manage operational risks across the business, maintain effective controls, and monitor them. In practice this means:

• a complete and current operational risk register, linked to the processes and systems it relates to;
• controls that are designed, documented and tested — not just listed;
• incident and near-miss management with root-cause analysis;
• regular reporting to senior management and the board against risk appetite.

2. Business continuity and critical operations

Entities must identify their critical operations — those whose disruption could have a material adverse impact on depositors, policyholders, beneficiaries or other customers, or on the entity’s role in the financial system. APRA’s examples include payments, deposit-taking and management, investment management, claims processing and customer enquiries, along with the systems and infrastructure they depend on.

For each critical operation, the board approves tolerance levels covering three things:

• the maximum period of time the operation can be disrupted;
• the maximum extent of data loss that is acceptable;
• the minimum service levels to be maintained during disruption.

Entities then maintain a credible business continuity plan (BCP) and test it through a systematic programme — including an annual business continuity exercise — using severe but plausible scenarios. The plan should be reviewed at least annually and its results reported to the board.

3. Management of service providers

Entities need a board-approved service provider management policy and must identify their material service providers (MSPs): those on which they rely to undertake a critical operation or which expose them to material operational risk. For each MSP the requirements include:

• due diligence before entering the arrangement;
• a formal legally binding agreement covering the matters CPS 230 lists — services and service levels, rights of access for the entity and APRA, business continuity, notification of incidents, sub-contracting and termination;
• ongoing monitoring of the provider’s performance and risk, including its own key subcontractors (fourth parties);
• a register of material service providers, submitted to APRA annually.

When you must notify APRA

These deadlines are where many entities find their tooling inadequate: you cannot notify within 24 hours of breaching a tolerance you are not monitoring.

What the board is accountable for

The board is ultimately accountable for operational risk management, business continuity and service provider arrangements. It approves the BCP, the tolerance levels and the service provider management policy, reviews testing results, and is expected to challenge management — not just note the papers. Senior management is responsible for implementing the framework and reporting on it.

Building a CPS 230 operational risk register

A register that supports CPS 230 needs more than a list of risks and scores. Typical additional fields:

Score risks consistently on a calibrated 5×5 risk matrix, recording inherent, residual and target ratings. If you are starting from scratch, our free risk register template gives you the core columns to extend.

CPS 230 compliance checklist

1. Operational risk management framework documented and approved; risk appetite covers operational risk.
2. Operational risk register complete, owned and reviewed on a set cycle.
3. Key controls identified, documented and tested, with results recorded.
4. Incident and near-miss process in place, with root-cause analysis and escalation paths that meet the 24- and 72-hour deadlines.
5. Critical operations identified and mapped to the processes, people, technology, data and providers they depend on.
6. Tolerance levels (time, data, service) approved by the board for each critical operation.
7. Business continuity plan in place, reviewed at least annually, with a testing programme including an annual exercise against severe but plausible scenarios.
8. Service provider management policy approved; material service providers identified; MSP register maintained and submitted to APRA annually.
9. MSP agreements contain the required terms — and legacy contracts have been updated.
10. Board reporting shows risk profile, appetite, incidents, testing results and provider performance, and records board challenge.