APRA’s Prudential Standard CPS 230 Operational Risk update

On 13 June 2024, APRA formally released its final Prudential Practice Guide CPG 230 Operational Risk Management.

In response to consultation feedback received from 16 entities and industry bodies, APRA recognised the requirement for greater clarity to avoid the creation of unintentional practical difficulties during implementation. The guidance has been simplified to be shorter, sharper and focused on effective baseline compliance. Whilst maintaining strong expectations around achieving resilience, APRA has effectively given regulated entities more flexibility around how they achieve stronger resilience outcomes by applying more of a risk-based lens to their approaches. Key changes include:

• Day One checklist – Entities should consider the summary of requirements and suggested order of implementation in their plans.
• Non-Significant Financial Institutions have an additional 12 months to comply with certain requirements in CPS 230 relating to business continuity and scenario analysis.
• A 3-year forward plan has been provided on APRA’s intended approach to supervising CPS 230 to assist industry with implementation and planning.
  

In consideration of the timeframe for implementation, APRA regulated entities should have a robust implementation plan, identifying the uplifts required to be compliant with the standard. The standard and accompanying Prudential Practice Guide reflect many aspects of better practice across Operational Risk Management and Resilience globally.

APRA has introduced a proactive transition period where they would see entities have identified Material service providers and critical operations by mid-2024, with entities setting tolerance levels by the end of 2024. This supports the heightened expectations on maturity before the July 2025 effective date.

Key themes of CPS 230 to consider include:

• Be prepared for risk events – Entities must ensure effective process to support the management and response to risk events, effectively reducing their impact.
• Know your customer and market impacting Critical Operations – Entities must have an end-to-end understanding of critical operations and the associated resources which are critical to the operation to ensure appropriate mitigating controls are in place to prevent disruption and manage risk within appetite.
• Be resilient – Entities must be able to continue to operate through the ever-increasing breadth of disruption, providing critical services to their customers and the market.
• Protect the entity and the community – Business Continuity Planning and exercising will be critical to ensure that the impact of disruptions is minimised to an acceptable/tolerable level.
• Effectively manage service provider risk – Entities must ensure they have processes in place to identify, assess, manage, and govern service providers that are critical to service delivery or pose a material risk.