CPS 230
Operational Risk Management.
APRA's prudential standard for managing operational risk. Sets requirements for critical operations, third-party arrangements, and business continuity, and consolidates parts of CPS 220, CPS 231, and CPS 232 into a single, sharper standard.
What CPS 230 requires.
How BackPro handles each obligation.
Critical operations register
Identify and maintain a register of critical operations, services, processes, and resources whose failure would have a material impact on customers or the financial system. The register must be kept current and approved by the board.
Operational risk framework
Identify, assess, monitor, and manage operational risks across the firm. Maintain a risk register with controls, ownership, review cadence, and tolerance thresholds.
Business continuity
Maintain business continuity plans covering each critical operation. Plans must be tested annually and updated when material changes occur. Recovery time and recovery point objectives are set per operation.
Service provider arrangements
Assess and manage risks from material service providers. Risks must be re-assessed on changes or at a minimum annually. Concentration risk and substitutability are explicit factors.
Tolerance levels for disruption
Establish maximum tolerable disruption periods for each critical operation. Test against them. Report against them.
Notifiable events to APRA
Notify APRA when an event materially disrupts a critical operation, breaches information security, or otherwise constitutes a notifiable operational risk event. Timing is prescribed; sitting on the decision is not an option.
What BackPro produces for CPS 230.
The artifacts your auditor expects. Hashed, signed, timestamped, exportable. Generated continuously while you work, not assembled in the week before the audit.
Living document with dependency graph, board approval evidence, and version history. Exportable as PDF on request.
Risks linked to controls, controls to evidence, evidence to owners. Attestation cadence enforced automatically.
Per-operation continuity plan with annual drill schedule, RTO/RPO test results, and drift indicators.
Completed third-party assessments with concentration analysis and exit-plan documentation.
Trends in tolerance breaches over time, including ones that did not result in a §36 notification.
Pre-formatted to APRA's expected structure with classification, timeline, root cause, and remediation. Awaits compliance officer signature.
CPS 230, in plain words.
See CPS 230 mapped to your own controls.
Forty‑five minutes with our team. We take your existing control register, map it against CPS 230 obligations, and show you which gaps BackPro closes automatically. The mapping is yours to keep whether you proceed with us or not.