The Australian Prudential Regulation Authority (APRA) has published the final version of its Prudential Practice Guide [to] Operational Risk Management (CPG 230).
CPG 230 is designed to assist in the implementation of Prudential Standard CPS 230 Operational Risk Management, which was finalised in July last year and takes effect from 1 July 2025.
CPS 230 in a nutshell
CPS 230 aims to ensure that APRA-regulated entities are resilient to operational risks and disruptions, seeing operational risk management as the route to operational resilience.
APRA says that operational resilience is ‘the outcome of prudent operational risk management’ and it expects regulated entities to achieve operational resilience by identifying its critical operations, setting tolerance levels for disruption for these, and then identifying the processes and resources needed to deliver these critical operations, including taking material service providers into account. The entity would ‘then use this information as the starting point for an assessment of its operational risk profile’.
CPG 230
The final version of CPG 230 has been developed after a consultation process. According to APRA, changes to the draft version include:
- The guidance has been shortened and is more tightly focused on how to meet expectations set by the CPS 230 standard.
- Entities that are classified as Non-Significant Financial Institutions have an additional 12 months to comply with certain requirements in CPS 230 relating to business continuity and scenario analysis.
- A ‘day one’ checklist has been included for entities to assist in their implementation of CPS 230; and
- APRA has provided a three-year forward plan of its intended approach to supervising CPS 230 to assist with implementation and planning.
CPS 230 is designed to ensure entities safeguard the resilience of their operations and are well prepared to respond to disruptions. By amending the accompanying guidance, we aim to keep industry standards high while also being mindful of the compliance burden on smaller entities so they can remain competitive.
APRA Chair John Lonsdale
More details:
- Guidance: CPG 230 Operational Risk Management
- Prudential standard: CPS 230 Operational Risk Management
