CPS 230 Operational Risk Management

Article tabs

On this page

About this standard

This standard requires an entity to effectively manage its operational risks. Entities must be able to maintain critical operations through disruptions and manage the risks arising from service providers.

Objectives and key requirements of this Prudential Standard The aim of this Prudential Standard is to ensure that an APRA-regulated entity is resilient to operational risks and disruptions. An APRA-regulated entity must effectively manage its operational risks, maintain its critical operations through disruptions, and manage the risks arising from service providers. An APRA-regulated entity’s approach to operational risk must be appropriate to its size, business mix and complexity. The key requirements of this Prudential Standard are that an APRA-regulated entity must:
identify, assess and manage its operational risks, with effective internal controls, monitoring and remediation; be able to continue to deliver its critical operations within tolerance levels through severe disruptions, with a credible business continuity plan (BCP); and effectively manage the risks associated with service providers, with a comprehensive service provider management policy, formal agreements and robust monitoring.

Preamble

Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 2 of 2023 made under subsections 11AF(3) of the Banking Act 1959 , 32(4) of the Insurance Act 1973 , 230A(5) of the Life Insurance Act 1995 , 92(5) of the Private Health Insurance (Prudential Supervision) Act 2015 and 34C(6) of the Superannuation Industry (Supervision) Act 1993 Compilation No.1 Compilation date:
1 July 2025
Includes amendments:
Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) variation No.1 of 2024 Registered:
About this compilation
This compilation
This is a compilation of the
Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No.2 of 2023 that shows the text of the law as amended and in force on 1 July 2025 (the compilation date ). The notes at the end of this compilation (the endnotes ) include information about amending laws and the amendment history of provisions of the compiled law. Uncommenced amendments The effect of uncommenced amendments is not shown in the text of the compiled law. Any uncommenced amendments affecting the law are accessible on the Register (www.legislation.gov.au). The details of amendments made up to, but not commenced at, the compilation date are underlined in the endnotes. For more information on any uncommenced amendments, see the Register for the compiled law. Application, saving and transitional provisions for provisions and amendments If the operation of a provision or amendment of the compiled law is affected by an application, saving or transitional provision that is not included in this compilation, details are included in the endnotes. Modifications If the compiled law is modified by another law, the compiled law operates as modified but the modification does not amend the text of the law. Accordingly, this compilation does not show the text of the compiled law as modified. For more information on any modifications, see the Register for the compiled law. Self‑repealing provisions If a provision of the compiled law has been repealed in accordance with a provision of the law, details are included in the endnotes. Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 2 of 2023 Prudential Standard CPS 230 Operational Risk Management Banking Act 1959 Insurance Act 1973 Life Insurance Act 1995 Private Health Insurance (Prudential Supervision) Act 2015 Superannuation Industry (Supervision) Act 1993 I, John Lonsdale, a delegate of APRA:
under subsections 11AF(3) of the Banking Act, 32(4) of the Insurance Act, and 230A(5) of the Life Insurance Act, REVOKE Banking, Insurance and Life Insurance (prudential standard ) determination No. 6 of 2016 including Prudential Standard CPS 231 Outsourcing made under that determination; under subsections 11AF(3) of the Banking Act, 32(4) of the Insurance Act, and 230A(5) of the Life Insurance Act, REVOKE Banking, Insurance and Life Insurance (prudential standard) determination No. 7 of 2016 including Prudential Standard CPS 232 Business Continuity Management made under that determination; under subsection 92(5) of the PHIPS Act, REVOKE Health Insurance (prudential standard) determination No. 4 of 2015 , including Prudential Standard HPS 231 Outsourcing made under that determination; under subsection 34C(6) of the SIS Act, REVOKE Superannuation (prudential standard) determination No. 3 of 2012 including, Prudential Standard SPS 231 Outsourcing made under that determination, and Superannuation (prudential standard) determination No. 4 of 2012 including Prudential Standard SPS 232 Business Continuity Management made under that determination; under subsection 11AF(1) of the Banking Act, DETERMINE the prudential standard which applies to all ADIs and authorised banking NOHCs; under subsection 32(1) of the Insurance Act, DETERMINE the prudential standard which applies to all general insurers and authorised insurance NOHCs and subsidiaries of general insurers and authorised insurance NOHCs; under subsection 230A(1) of the Life Insurance Act, DETERMINE the prudential standard which applies to all life companies, including friendly societies, and registered NOHCs; under subsection 92(1) of the PHIPS Act, DETERMINE the prudential standard which applies to all private health insurers; and under subsection 34C(1) of the SIS Act, DETERMINE the prudential standard which applies to all RSE licensees. This instrument commences on 1 July 2025. Date: 11 September 2023 John Lonsdale Chair APRA Interpretation In this Determination:
ADI has the meaning given in section 5 of the Banking Act.
APRA means the Australian Prudential Regulation Authority. authorised banking NOHC has the meaning given to the expression authorised NOHC in section 5 of the Banking Act. authorised insurance NOHC has the meaning given to the expression authorised NOHC in subsection 3(1) of the Insurance Act. friendly society has the meaning given in section 16C of the Life Insurance Act. general insurer has the meaning given in section 11 of the Insurance Act. life company has the meaning given in the Schedule to the Life Insurance Act. private health insurer has the meaning given in section 4 of the PHIPS Act . registered NOHC has the meaning given in the Schedule to the Life Insurance Act. RSE licensee has the meaning given in subsection 10(1) of the SIS Act. the Banking Act means the Banking Act 1959. the Insurance Act means the Insurance Act 1973 . the Life Insurance Act means the Life Insurance Act 1995 . the PHIPS Act means the Private Health Insurance (Prudential Supervision) Act 2015 . the prudential standard means Prudential Standard CPS 230 Operational Risk Management in the form set out in the Schedule . the SIS Act means the Superannuation Industry (Supervision) Act 1993 .
Schedule
Prudential Standard CPS 230 Operational Risk Management comprises the document commencing on the following page.
Prudential Standard CPS 230
Operational Risk Management
Authority
This Prudential Standard is made under:
section 11AF of the
Banking Act 1959
(Banking Act);
section 32 of the
Insurance Act 1973
(Insurance Act);
section 230A of the
Life Insurance Act 1995
(Life Insurance Act);
section 92 of the
Private Health Insurance (Prudential Supervision) Act 2015 (PHIPS Act); and
section 34C of the
Superannuation Industry (Supervision) Act 1993 (SIS Act).
Application
This Prudential Standard applies to all APRA-regulated entities defined as:
authorised deposit-taking institutions
(ADIs), including foreign ADIs
, and non-operating holding companies authorised under the Banking Act (authorised banking NOHCs); general insurers , including Category C insurers , non-operating holding companies authorised under the Insurance Act (authorised insurance NOHCs) and parent entities of Level 2 insurance groups ; life companies , including friendly societies , eligible foreign life insurance companies (EFLICs) and registered NOHCs ; private health insurers registered under the PHIPS Act; and registrable superannuation entity licensees ( RSE licensees ) under the SIS Act in respect of their business operations. [1] The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer and an EFLIC apply only in relation to the Australian branch operations of that entity. Where an APRA-regulated entity is the Head of a group, [2] it must comply with a requirement of this Prudential Standard:
in its capacity as an APRA-regulated entity; by ensuring that the requirement is applied appropriately throughout the group, [3] including in relation to entities that are not APRA-regulated; and on a group basis. In applying the requirements of this Prudential Standard on a group basis, references to an APRA-regulated entity are to be read as ‘Head of a group’ and references to entity are to be read as ‘group’. [1] RSE licensee has the meaning given in subsection 10(1) of the SIS Act. For the purposes of this Prudential Standard, an RSE licensee’s business operations includes all activities of an RSE licensee, including the activities of each RSE of which it is the licensee, and all other activities of the RSE licensee to the extent that they are relevant to, or may impact on, its activities as an RSE licensee.

Transitional Arrangements

Where an APRA-regulated entity has pre-existing contractual arrangements in place with a service provider, the requirements in this Prudential Standard will apply in relation to those arrangements from the earlier of the next renewal date of the contract with the service provider or 1 July 2026.

Deferred requirements apply to an APRA-regulated entity that is a non-significant financial institution (non-SFI) from 1 July 2026. Despite the revocation of Prudential Standard CPS 232 Business Continuity Management ( CPS 232 ) and Prudential Standard SPS 232 Business Continuity Management ( SPS 232 ), existing requirements continue to apply to the relevant non-SFIs until 30 June 2026, as if that revocation had not happened. For the purposes of this paragraph:

deferred requirements means the requirements in paragraphs 40, 41 and 43 to 46 of this Prudential Standard ;

existing requirements means the following requirements:

paragraphs 30 to 35 of CPS 232
;

paragraphs 21 to 26 of SPS 232
; and

in relation to RSE licensees
[4]
:
[4]

Prudential Standard APS 001 Definitions
,
Prudential Standard GPS 001 Definitions
,
Prudential Standard LPS 001 Definitions and
Prudential Standard HPS 001 Definitions define these terms in relation to other APRA-regulated entities.

non-significant financial institution (non-SFI) means an RSE licensee that is not an SFI; and

significant financial institution (SFI) means an RSE licensee that either:

has total assets in excess of AUD $30 billion in the case of a single RSE operated by an RSE licensee, or if the RSE licensee operates more than one RSE where the combined total assets of all RSEs exceed this amount; or

is determined as such by APRA, having regard to matters such as complexity in its operations or its membership of a group.

Interpretation

Terms that are defined in
Prudential Standard APS 001 Definitions
,
Prudential Standard GPS 001 Definitions
,
Prudential Standard LPS 001 Definitions
,
Prudential Standard HPS 001 Definitions or
Prudential Standard 3PS 001 Definitions appear in bold the first time they are used in this Prudential Standard.

In this Prudential Standard, unless the contrary intention appears, a reference to an Act, Regulation or Prudential Standard is a reference to the Act, Regulation or Prudential Standard as in force from time to time.

Where this Prudential Standard provides for APRA to exercise a power or discretion, the power or discretion is to be exercised in writing.

Adjustments and exclusions

APRA may adjust or exclude a specific prudential requirement in this Prudential Standard in relation to an APRA-regulated entity.
[5]
[5]
Refer to subsection 11AF(2) of the Banking Act, subsection 32(3D) of the Insurance Act, subsection 230A(4) of the Life Insurance Act, subsection 92(4) of the PHIPS Act and subsection 34C(5) of the SIS Act.

Key principles

An APRA-regulated entity must:

effectively manage its operational risks, and set and maintain appropriate standards for conduct and compliance;

maintain its critical operations within tolerance levels through severe disruptions; and

manage the risks associated with the use of service providers.

An APRA-regulated entity must identify, assess and manage operational risks that may result from inadequate or failed internal processes or systems, the actions or inactions of people or external drivers and events. Operational risk is inherent in all products, activities, processes and systems.

An APRA-regulated entity must, to the extent practicable, prevent disruption to critical operations, adapt processes and systems to continue to operate within tolerance levels in the event of a disruption and return to normal operations promptly once a disruption is over.

An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can continue to meet its prudential obligations in full and effectively manage the associated risks.

Risk management framework

As part of its risk management framework required under Prudential Standard CPS 220 Risk Management ( CPS 220 ) and Prudential Standard SPS 220 Risk Management ( SPS 220 ), an APRA-regulated entity must develop and maintain:

governance arrangements for the oversight of operational risk;

an assessment of its operational risk profile, with a defined risk appetite supported by indicators, limits and tolerance levels;

internal controls that are designed and operating effectively for the management of operational risks;

appropriate monitoring, analysis and reporting of operational risks and escalation processes for operational incidents and events;

business continuity plan(s) (BCPs) that set out how the entity would identify, manage and respond to a disruption within tolerance levels and are regularly tested with severe but plausible scenarios; and

processes for the management of service provider arrangements.

As part of the required reviews of the risk management framework under CPS 220 and SPS 220 , an APRA-regulated entity must review its operational risk management. [6] The reviews must cover those aspects of operational risk management set out in paragraph 16. [6] Refer to CPS 220 and SPS 220 for the requirement to undertake a review of the risk management framework.

Operational risk management must be integrated into an APRA-regulated entity’s overall risk management framework and processes. Business continuity planning must be consistent with, and not conflict or undermine, an APRA-regulated entity’s recovery and exit planning. [7] [7] Refer to Prudential Standard CPS 190 Recovery and Exit Planning .

Where APRA considers that an APRA-regulated entity’s operational risk management has material weaknesses, APRA may:

require an independent review of the entity’s operational risk management;

require the entity to develop a remediation program;

require the entity to hold additional capital, as relevant; [8] [8] For an RSE licensee, APRA may require an RSE licensee to meet an ORFR target amount determined by APRA under Prudential Standard SPS 114 Operational Risk Financial Requirement .

impose conditions on the entity’s licence; and

take other actions required in the supervision of this Prudential Standard.

Roles and responsibilities

The
Board of an APRA-regulated entity is ultimately accountable for oversight of an entity’s operational risk management. This includes business continuity and the management of service provider arrangements. [9] [9] For an RSE licensee, a reference to the Board is to be read as a reference to the Board of directors or group of individual trustees of an RSE licensee, as applicable. ‘Group of individual trustees’ has the meaning given in subsection 10(1) of the SIS Act. A reference to the Board in the case of a foreign ADI is a reference to the senior officer outside Australia.

The Board must ensure that the APRA-regulated entity sets clear roles and responsibilities for senior managers [10] for operational risk management, including business continuity and the management of service provider arrangements. [10] Senior manager in relation to life insurers has the meaning given in the Life Insurance Act, `and in relation to RSE licensees has the meaning given in Prudential Standard SPS 520 Fit and Proper .

The Board must:

oversee operational risk management and the effectiveness of key internal controls in maintaining the entity’s operational risk profile within risk appetite. The Board must be provided with regular updates on the APRA-regulated entity’s operational risk profile and ensure senior management takes action as required to address any areas of concern;

approve the BCP and tolerance levels for disruptions to critical operations, review the results of testing and oversee the execution of any findings; and

approve the service provider management policy, and review risk and performance reporting on material service providers.

Senior management of an APRA-regulated entity must provide clear and comprehensive information to the Board on the expected impacts on the entity’s critical operations when the Board is making decisions that could affect the resilience of critical operations.

Operational risk management

An APRA-regulated entity must manage its full range of operational risks, including but not limited to legal risk, regulatory risk, compliance risk, conduct risk, technology risk, data risk and change management risk. Senior management are responsible for operational risk management across the end-to-end process for all business operations.

An APRA-regulated entity must maintain appropriate and sound information and information technology (IT) capability to meet its current and projected business requirements and to support its critical operations and risk management. In managing technology risks, an APRA-regulated entity must monitor the age and health of its information assets and meet the requirements for information security in Prudential Standard CPS 234 Information Security ( CPS 234 ) .

Operational risk profile and assessment

An APRA-regulated entity must assess the impact of its business and strategic decisions on its operational risk profile and operational resilience, as part of its business and strategic planning processes. [11] This must include an assessment of the impact of new products, services, geographies and technologies on its operational risk profile. [11] Refer to Prudential Standard SPS 515 Strategic Planning and Member Outcomes for requirements applying to an RSE licensee with respect to strategic objectives and business planning.

An APRA-regulated entity must maintain a comprehensive assessment of its operational risk profile. As part of this, an APRA-regulated entity must:

maintain appropriate and effective information systems to monitor operational risk, compile and analyse operational risk data and facilitate reporting to the Board and senior management;

identify and document the processes and resources needed to deliver critical operations, including people, technology, information, facilities and service providers, the interdependencies across them, and the associated risks, obligations, key data and controls; and

undertake scenario analysis to identify and assess the potential impact of severe operational risk events, test its operational resilience and identify the need for new or amended controls and other mitigation strategies.

An APRA-regulated entity must conduct a comprehensive risk assessment before providing a material service to another party, to ensure that the APRA-regulated entity is able to continue to meet its prudential obligations after entering into the arrangement. APRA may require an APRA-regulated entity to review and strengthen internal controls or processes where APRA considers there to be heightened prudential risks in such circumstances.

Operational risk controls

An APRA-regulated entity must design, implement and embed internal controls to mitigate its operational risks in line with its risk appetite and meet its compliance obligations.

An APRA-regulated entity must regularly monitor, review and test controls for design and operating effectiveness, the frequency of which must be commensurate with the materiality of the risks being controlled. The results of testing must be reported to senior management and any gaps or deficiencies in the control environment must be rectified in a timely manner.

An APRA-regulated entity must remediate material weaknesses in its operational risk management, including control gaps, weaknesses and failures. This remediation must be supported by clear accountabilities and assurance and address the root causes of weaknesses in a timely manner. An APRA-regulated entity must include identified control gaps, weaknesses and failures in its operational risk profile until such matters are remediated.

Operational risk incidents

An APRA-regulated entity must ensure that operational risk incidents and near misses are identified, escalated, recorded and addressed in a timely manner. An APRA-regulated entity must take incidents and near misses into account in its assessment of its operational risk profile and control effectiveness in a timely manner.

An APRA-regulated entity must notify APRA as soon as possible, and not later than 72 hours, after becoming aware of an operational risk incident that it determines to be likely to have a material financial impact or a material impact on the ability of the entity to maintain its critical operations. [12] [12] A notification of an information security incident reported under CPS 234 does not need to be separately reported under the notification requirements of this Prudential Standard.

Business continuity

An APRA-regulated entity must:

define, identify and maintain a register of its critical operations;

take reasonable steps to minimise the likelihood and impact of disruptions to its critical operations;

maintain a credible BCP that sets out how it would maintain its critical operations within tolerance levels through disruptions, including disaster recovery planning for critical information assets; [13] [13] An entity may have a number of BCPs. A BCP may include separate crisis management plans and disaster recovery plans.

activate its BCP if needed in the event of a disruption; and

return to normal operations promptly after a disruption is over.

Critical operations and tolerance levels

Critical operations are processes undertaken by an APRA-regulated entity or its service provider which, if disrupted beyond tolerance levels, would have a material adverse impact on its depositors, policyholders, beneficiaries or other customers, or its role in the financial system.

An APRA-regulated entity must, at a minimum, classify the following business operations as critical operations, unless it can justify otherwise:

for an ADI: payments, deposit-taking and management, custody, settlements and clearing;

for an insurer (general, life, private health): claims processing;

for an RSE licensee: investment management and fund administration; and

for all APRA-regulated entities: customer enquiries and the systems and infrastructure needed to support critical operations.

APRA may require an APRA-regulated entity, or a class of APRA-regulated entities, to classify a business operation as a critical operation.

For each critical operation, an APRA-regulated entity must establish tolerance levels for:

the maximum period of time the entity would tolerate a disruption to the operation;

the maximum extent of data loss the entity would accept as a result of a disruption; and

minimum service levels the entity would maintain while operating under alternative arrangements during a disruption.

APRA may require an APRA-regulated entity to review and change its tolerance levels for a critical operation. APRA may set tolerance levels for an APRA-regulated entity, or a class of APRA-regulated entities, where it identifies a heightened risk or material weakness.

Business continuity plan

An APRA-regulated entity’s BCP must include:

the register of critical operations and associated tolerance levels;

triggers to identify a disruption and prompt activation of the plan, and arrangements to direct resources in the event of activation;

actions it would take to maintain its critical operations within tolerance levels through disruptions;

an assessment of the execution risks, required resources, preparatory measures, including key internal and external dependencies needed to support the effective implementation of the BCP actions; and

a communications strategy to support execution of the plan.

An APRA-regulated entity must maintain the capabilities required to execute the BCP, including access to people, resources and technology.
[14]
An APRA-regulated entity must monitor compliance with its tolerance levels and report any failure to meet tolerance levels, together with a remediation plan, to the Board. [14] Capabilities required to execute the BCP may be maintained within the APRA-regulated entity or via an agreement with another party. For the avoidance of doubt, such agreements with other parties must meet the requirements for management of service providers arrangements in this Prudential Standard.

An APRA-regulated entity must notify APRA as soon as possible, and not later than 24 hours after, if it has suffered a disruption to a critical operation outside tolerance. The notification must cover the nature of the disruption, the action taken, the likely impact on the entity’s business operations and the timeframe for returning to normal operations.

Testing and review

An APRA-regulated entity must have a systematic testing program for its BCP that covers all critical operations and includes an annual business continuity exercise. The program must test the effectiveness of the entity’s BCP and its ability to meet tolerance levels in a range of severe but plausible scenarios.

The testing program must be tailored to the material risks of the APRA-regulated entity and include a range of severe but plausible scenarios, including disruptions to services provided by material service providers and scenarios where contingency arrangements are required. APRA may require the inclusion of an APRA-determined scenario in a business continuity exercise for an APRA-regulated entity, or a class of APRA-regulated entities.

An APRA-regulated entity must update, as necessary, its BCP on an annual basis to reflect any changes in legal or organisational structure, business mix, strategy or risk profile or for shortcomings identified as a result of the review and testing of the BCP.

An APRA-regulated entity’s internal audit function must periodically review the entity’s BCP and provide assurance to the Board that the BCP sets out a credible plan for how the entity would maintain its critical operations within tolerance levels through severe disruptions and that testing procedures are adequate and have been conducted satisfactorily.

Management of service provider arrangements

An APRA-regulated entity must maintain a comprehensive service provider management policy. The policy must cover how the entity will identify material service providers and manage service provider arrangements, including the management of material risks associated with the arrangements.

The policy must include:

the entity’s approach to entering into, monitoring, substituting and exiting agreements with material service providers;

the entity’s approach to managing the risks associated with material service providers; and

the entity’s approach to managing the risks associated with any fourth parties that material service providers rely on to deliver a critical operation to the APRA-regulated entity. [15] [15] A fourth party is a party that a service provider relies on in delivering services to an APRA-regulated entity.

Material service providers

An APRA-regulated entity must identify and maintain a register of its material service providers and manage the material risks associated with using these providers. Material service providers are those on which the entity relies to undertake a critical operation or that expose it to material operational risk. [16] Material arrangements are those on which the entity relies to undertake a critical operation or that expose it to material operational risk. [16] A material service provider may be a third party, related party or connected entity. A service provider may be identified as material as a result of an individual arrangement or multiple arrangements with an APRA-regulated entity.

An APRA-regulated entity must, at a minimum, classify a provider of the following services as a material service provider, unless it can justify otherwise:

for an ADI: credit assessment, funding and liquidity management and mortgage brokerage;

for an insurer (general, life, private health): underwriting, claims management, insurance brokerage and reinsurance;

for an RSE licensee: fund administration, custodial services, investment management and arrangements with promoters and financial planners; and

for all APRA-regulated entities: risk management, core technology services and internal audit.

An APRA-regulated entity must submit its register of material service providers to APRA on an annual basis.

APRA may require an APRA-regulated entity, or a class of APRA-regulated entities, to classify a service provider, type of service provider or service provider arrangement as material.

Service provider agreements

Before entering into or materially modifying a material arrangement, an APRA-regulated entity must:

undertake appropriate due diligence, including an appropriate selection process and an assessment of the ability of the service provider to provide the service on an ongoing basis; and

assess the financial and non-financial risks from reliance on the service provider, including risks associated with geographic location or concentration of the service provider(s) or parties the service provider relies on in providing the service.

For all material arrangements, an APRA-regulated entity must maintain a formal legally binding agreement (formal agreement). The formal agreement must, at a minimum:

specify the services covered by the agreement and associated service levels;

set out the rights, responsibilities and expectations of each party to the agreement, including in relation to the ownership of assets, ownership and control of data, dispute resolution, audit access, liability and indemnity;

include provisions to ensure the ability of the entity to meet its legal and compliance obligations;

require notification by the service provider of its use of other material service providers that it materially relies upon in providing the service to the APRA-regulated entity through sub-contracting or other arrangements;

require the liability for any failure on the part of any sub-contractor to be the responsibility of the service provider;

include a force majeure provision indicating those parts of the contract that would continue in the case of a force majeure event; and

termination provisions including, but not limited to, the right to terminate both the arrangement in its entirety or parts of the arrangement. For an RSE licensee, termination provisions must include the ability for the RSE licensee to terminate the arrangement where to continue the arrangement would be inconsistent with the RSE licensee’s duty to act in the best financial interests of beneficiaries (refer to subsection 52(2)(c) of the SIS Act).

The formal agreement must also include provisions that:

allow APRA access to documentation, data and any other information related to the provision of the service;

allow APRA the right to conduct an on-site visit to the service provider; and

ensure the service provider agrees not to impede APRA in fulfilling its duties as prudential regulator.

For each material arrangement an APRA-regulated entity must:

identify and manage risks that could affect the ability of the service provider to provide the service on an ongoing basis;

identify and manage risks to the APRA-regulated entity that could result from the arrangement, such as step-in risk or contagion risk;

ensure it can execute its BCP if needed; and

ensure it can conduct an orderly exit from the arrangement if needed.

APRA may require an APRA-regulated entity to review and make changes to a service provider arrangement where it identifies heightened prudential concerns.

Monitoring, notifications and review

An APRA-regulated entity must monitor and ensure that senior management receive reporting on material arrangements commensurate with the nature and usage of the service. This monitoring must include a regular assessment of:

performance under the service agreement with reference to agreed service levels;

the effectiveness of controls to manage the risks associated with the use of the service provider; and

compliance of both parties with the service provider agreement.

An APRA-regulated entity must notify APRA:

as soon as possible and not more than 20 business days after entering into or materially changing an agreement for the provision of a service on which the entity relies to undertake a critical operation; and

prior to entering into any material offshoring arrangement, [17] or when there is a significant change proposed to the arrangement, including in circumstances where data or personnel relevant to the service being provided will be located offshore. [17] Material offshoring arrangement means a material arrangement where the service provided is undertaken outside Australia. Offshoring includes arrangements where the service provider is incorporated in Australia, but the physical location of the service being provided is undertaken outside Australia. Offshoring does not include arrangements where the physical location of a service is performed within Australia, but the service provider is not incorporated in Australia.

An APRA-regulated entity’s internal audit function must review any proposed material arrangement involving the outsourcing of a critical operation. The internal audit function must regularly report to the Board or Board Audit Committee on compliance of such arrangements with the entity’s service provider management policy.

Endnotes

Endnote 1—About the endnotes

The endnotes provide information about this compilation and the compiled law.
The following endnotes are included in every compilation:
Endnote 1—About the endnotes
Endnote 2—Abbreviation key
Endnote 3—Legislation history
Endnote 4—Amendment history
Abbreviation key—Endnote 2
The abbreviation key sets out abbreviations that may be used in the endnotes.
Legislation history and amendment history—Endnotes 3 and 4 Amending laws are annotated in the legislation history and amendment history.
The legislation history in endnote 3 provides information about each law that has amended (or will amend) the compiled law. The information includes commencement details for amending laws and details of any application, saving or transitional provisions that are not included in this compilation. The amendment history in endnote 4 provides information about amendments at the provision (generally section or equivalent) level. It also includes information about any provision of the compiled law that has been repealed in accordance with a provision of the law. Misdescribed amendments A misdescribed amendment is an amendment that does not accurately describe how an amendment is to be made. If, despite the misdescription, the amendment can be given effect as intended, then the misdescribed amendment can be incorporated through an editorial change made under section 15V of the Legislation Act 2003 . If a misdescribed amendment cannot be given effect as intended, the amendment is not incorporated and “(md not incorp)” is added to the amendment history.

Endnote 2—Abbreviation key

ad = added or inserted orig = original am = amended par = paragraph(s)/subparagraph(s) amdt = amendment /sub‑subparagraph(s) c = clause(s) pres = present C[x] = Compilation No. x prev = previous Ch = Chapter(s) (prev…) = previously def = definition(s) Pt = Part(s) Dict = Dictionary r = regulation(s)/rule(s) disallowed = disallowed by Parliament reloc = relocated Div = Division(s) renum = renumbered exp = expires/expired or ceases/ceased to have rep = repealed effect rs = repealed and substituted F = Federal Register of Legislation s = section(s)/subsection(s) gaz = gazette Sch = Schedule(s) LA = Legislation Act 2003 Sdiv = Subdivision(s) LIA = Legislative Instruments Act 2003 SLI = Select Legislative Instrument (md not incorp) = misdescribed amendment SR = Statutory Rules cannot be given effect Sub‑Ch = Sub‑Chapter(s) mod = modified/modification SubPt = Subpart(s) No. = Number(s) underlining = whole or part not o = order(s) commenced or to be commenced Ord = Ordinance

Endnote 3—Legislation history

Name
Registration
Commencement
Application, saving and transitional provisions

Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No.2 of 2023 14 September 2023 (see F2023L01242) 1 July 2025 — Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) variation No.1 of 2024

1 July 2025
—

Endnote 4—Amendment history

Provision affected
How affected

Application and commencement (heading) am F2023L01242 Paragraph 6 and 7 am F2023L01242

Related standards, guidance and resources

Practice Guide

CPG 230 Operational Risk Management

CPG 230 Operational Risk Management assists entities with the implementation of, and compliance with, CPS 230

All industries

Current

13 June 2024

Risk Management

Media release

APRA releases minor updates to the prudential framework for ADIs and insurers

APRA is releasing for consultation a set of minor updates to the prudential framework to ensure the framework is updated in the intervening periods between comprehensive reviews of prudential standards.

Banking

General insurance

Life insurance

Private health insurance

Published

4 April 2024

Risk Management