Compliance reference · APRA CPS 230
APRA Prudential Standard CPS 230 took effect on 1 July 2025. Every APRA-regulated entity now needs an operational risk regime that an external review can survive. Most teams are running it in Excel. This page is the plain-English version of what the standard asks, where teams hit the wall, and how a continuously monitored audit chain changes the work.
What it actually requires
CPS 230 collapses what used to live across CPS 231 (Outsourcing) and CPS 232 (Business Continuity Management) into a single integrated standard. The three pillars are not optional and they are not independent.
Pillar 1
Identify, assess, and manage operational risks across the full business — people, processes, technology, and information. Maintain a documented control library with clear ownership and a tested view of effectiveness. The Board must understand the operational risk profile and be able to defend it under review.
Pillar 2
Identify the critical operations that must keep running through disruption, set tolerances for how long they can be impaired, and prove the business can recover within those tolerances. Tabletop exercises and full simulations need to be regular, evidence-bearing, and lessons-learned closed-out.
Pillar 3
Maintain a register of material service providers, evidence the due diligence behind each engagement, monitor performance against contractual obligations, and have an exit plan you could actually execute. Concentration risk and fourth-party exposure are now in scope.
Four problems we hear in every CPS 230 readiness conversation.
Material service providers multiply with every new SaaS contract. Without continuous monitoring, the register lags reality. Auditors find vendors operating on contracts that expired six months ago.
Your evidence is older than your exposure.
Critical operations were mapped during the readiness program. Two years later the architecture has changed, dependencies have moved, and the tolerances were never re-tested against the new shape of the business.
You cannot defend the tolerances you have on file.
Control evidence lives in GRC, ticket trails live in Jira, BCP test outputs live in OneDrive, vendor reviews live in email. Pulling a coherent evidence package for an external review takes weeks.
Audit prep replaces real risk work for a quarter.
Annual scenarios run, lessons are noted, and nothing closes. The test report makes it to the Board pack, but six months later the same gap shows up in the next exercise.
You are testing for compliance, not for resilience.
How BackPro maps to CPS 230
The aim is not to replace your GRC platform — it is to keep your evidence current and defensible without a quarter of heroics every audit cycle. Each row below maps a CPS 230 obligation to the part of BackPro that does the work.
CPS 230 obligation
The Control Monitor agent runs continuously inside your tenant, flagging failing controls, stale evidence, and overdue reviews. Findings carry severity, dedup keys, and source attribution. The platform produces an audit-grade view of operational risk that is current by construction, not by quarterly heroics.
CPS 230 obligation
Critical-operation registers, dependency maps, and tolerance documentation are versioned in the platform with full edit history. The Risk Correlator agent surfaces architectural drift that puts a tolerance at risk. Tabletop exercise outputs and lessons-learned are linked to the affected operation.
CPS 230 obligation
The Vendor Risk agent watches contract expiries, due-diligence cadence, and policy review dates. Concentration risk and fourth-party exposure surface as findings, not spreadsheet rows. The register is queryable; the evidence is chained.
CPS 230 obligation
Test plans, exercise records, debriefs, and remediation actions live in a single chain. Each lesson links to a control and a closure deadline. Findings stay open until evidence shows resolution.
CPS 230 obligation
Every audit entry is signed with HMAC-SHA256 and chained to the previous entry. Daily integrity verification catches tampering. Audit packages export to your SIEM as CEF, JSON Lines, or Syslog (RFC 5424). Board packs are generated from the source of record, not assembled from screenshots.
CPS 230 lands on three desks more than any other.
What APRA-regulated teams ask before bringing AI inside the CPS 230 perimeter.
One walkthrough covers architecture, audit chain, deployment model, and how the platform maps to each CPS 230 pillar.