CPS 230 Compliance

APRA CPS 230: What it requires and how we can help

CPS 230 (Operational Risk Management) is APRA's prudential standard for operational resilience. It became effective on 1 July 2025 and applies to all APRA-regulated entities, including authorised deposit-taking institutions (ADIs), general insurers, life insurers, superannuation funds, and friendly societies.

If your organisation is regulated by APRA and hasn't yet addressed CPS 230, you're already behind. Here's what the standard requires and how Continuity Matters can help you meet it.

Common gaps we find

When we review CPS 230 readiness with regulated entities, these are the issues that come up most often:

• Business Continuity Plans that list all activities rather than identifying the time critical ones.

• IT Disaster Recovery Plans where systems cannot actually be recovered within the required timeframes.

• Third-party contracts that don't address operational risk, notification obligations, or exit arrangements.

• No documented tolerance levels for Critical Operations.

• Board reporting that doesn't adequately address operational risk

How we help

We work with APRA-regulated entities at any stage of CPS 230 readiness: from initial gap assessment through to full program delivery.

• Gap assessment
  We review your existing plans, framework and governance arrangements against CPS 230 requirements and produce a clear gap analysis with prioritised recommendations.

• Critical Operations identification
  We facilitate workshops with your leadership team to identify and document your Critical Operations, set tolerance levels and establish the link between business processes and IT systems.

• Business Continuity Plan development and review
  We develop or review your BCP’s to ensure they meet CPS 230 requirements, including recovery strategies, documented RTO’s, and tested procedures.

• IT Disaster Recovery review
  We assess whether your critical IT systems can actually be recovered within your required timeframes. This is often where the most significant gaps are found.

• Third-party risk assessment
  We help you identify which Service Providers support Critical Operations, assess their risk and review contractual arrangements against CPS 230 requirements.

• Exercising
  We design and facilitate scenario-based exercises that test your ability to maintain critical operations through realistic disruption scenarios, meeting the CPS 230 requirement for annual testing.

Case Study

APRA CPS 230 Gap Assessment for a Mid-Tier Australian Financial Institution

Continuity Matters successfully delivered a comprehensive CPS 230 gap assessment and compliance framework for a mid-tier lender, achieving 100% regulatory alignment and reducing projected operational recovery timelines by 35%.