CPS 230 in detail

APRA CPS 230: What it requires and how we can help

CPS 230 (Operational Risk Management) is APRA's prudential standard for operational resilience. It became effective on 1 July 2025 and applies to all APRA-regulated entities, including authorised deposit-taking institutions (ADIs), general insurers, life insurers, superannuation funds, and friendly societies.

If your organisation is regulated by APRA and hasn't yet addressed CPS 230, you're already behind. Here's what the standard requires and how Continuity Matters can help you meet it.

What CPS 230 requires

CPS 230 has three core obligations:

1. Manage operational risks effectively
Your organisation must identify, assess, and manage material operational risks, including people, processes, systems and external events. The Board is accountable for this. Risk appetites must be set, documented and reviewed annually.

2. Maintain Critical Operations through disruptions
You must identify your Critical Operations that if disrupted, would cause material harm to your customers, the financial system, or your organisation. For each critical operation, you need documented recovery plans and validated recovery time objectives (RTOs).

3. Manage risks from service providers
This is where CPS 230 goes further than its predecessors. If you rely on Third Party providers (including cloud services) for Critical Operations, you must assess their operational risk, ensure contractual protections are in place and maintain the ability to recover if a provider fails or exits. APRA expects you to have visibility over your entire service provider chain, including subcontractors.

What's changed from CPS 232

CPS 230 replaces CPS 232 (Business Continuity Management) and significantly raises the bar in several areas:

• Board accountability is explicit. The Board must approve the operational risk management framework and review it annually.

• Critical Operations are defined more precisely. The standard requires you to identify which operations are truly critical, not just list all your processes.

• Third-party risk is now central. CPS 232 touched on outsourcing; CPS 230 makes service provider risk management a core compliance obligation.

• Scenario testing is required. You must test your ability to maintain critical operations through severe but plausible disruption scenarios, not just standard annual BCP exercises.

• Tolerance levels must be set and documented. For each critical operation, you must define the Maximum Tolerable of Disruption.

Who CPS 230 applies to

• Authorised Deposit-Taking Institutions (ADIs): banks, credit unions, building societies

• General insurers

• Life insurers

• Superannuation funds (RSE licensees)

• Friendly societies

• Private health insurers (via equivalent PHIAC requirements)

If you're unsure whether CPS 230 applies to your organisation, get in touch and we can clarify.