CPS 230 Operational Risk Management is a prudential standard issued by the Australian Prudential Regulation Authority. It applies to APRA-regulated entities — banks and other ADIs, insurers, and RSE licensees in superannuation — and it took effect on 1 July 2025, replacing and consolidating several older standards including CPS 231 on outsourcing and CPS 232 on business continuity.
It turns on three linked ideas. Critical operations are the processes whose failure would materially affect depositors, policyholders, members or financial stability — and entities must identify them and set tolerance levels for disruption to each. Material service providers are the third parties those critical operations depend on, or who handle sensitive data, and they must be recorded in a register, contracted with specified terms, and managed under a documented policy. And business continuity has to be tested, at least annually, against those tolerances rather than assumed.
The change in posture is what matters most. CPS 231 asked whether outsourcing was governed; CPS 230 asks whether the operation would survive the provider failing, holds the board accountable for that answer, and requires notification to APRA of material service provider arrangements and of operational risk incidents that hit tolerance.
CPS 230 raised the bar on operational risk for the entire APRA-regulated sector. Material service provider registers, critical-operations mapping, and continuous attestation — measured by APRA, not by your audit calendar.
Three of The Agency's leads cover the full CPS 230 loop: critical-operations mapping, material service provider attestation, and the continuous monitoring that keeps APRA's bar within reach.
Critical operations and material service providers, mapped continuously. TARA classifies vendors against your critical-operations definitions and tracks the remediation actions APRA expects you to be doing between attestations.
APRA-formatted reports composed from current evidence. VANCE generates CPS 230 attestations, material service provider registers and board-pack summaries — formatted for APRA, evidence linked.
Continuous attestation, not annual scrambles. REX continuously monitors the security posture of every material service provider — APRA's bar for continuous risk management has actual evidence behind it.
CPS 230 stops being a binder of slides and becomes a continuous evidence stream APRA can drop in on at any time.
The MSP register reflects today's contracts, today's tiering and today's posture — not last attestation cycle's.
Every critical operation linked to the third-party arrangements that support it. Concentration risk visible at a glance.
You stop assembling the attestation. VANCE generates it from live evidence — your team reviews and signs, not authors.
When APRA asks, the report is generated against current data — not last quarter's.
CPS 230 went from a binder of slides to a continuous evidence stream. Our material service provider register is finally something I would show APRA without a quarter of prep.
Who it covers, what a material service provider is, and how it differs from the standards it replaced.
Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.