Guide to APRA CPS 230: Operational Risk Management

Understanding APRA and its role

An independent statutory authority, the Australian Prudential Regulation Authority (APRA) supervises financial and related institutions across the banking, insurance, and superannuation sectors.

APRA, accountable to the Australian Parliament, has been tasked with the duty to maintain the safety and soundness of the financial industry and is, therefore, responsible for protecting the interests of depositors, policyholders, and superannuation fund members.

To promote the stability of the financial system, APRA works in tandem with other regulatory bodies, including the Australian Treasury, the Reserve Bank of Australia, and the Australian Securities and Investments Commission.

Entities APRA oversees 

• Authorised deposit-taking institutions (such as banks, building societies, and credit unions)
• General insurers
• Life insurers
• Friendly societies
• Private health insurers
• Reinsurance companies
• Superannuation funds (other than self-managed funds)

Why is APRA interested in operational risk management

The failure of just one regulated institution can undermine the stability of the financial system. For that reason, APRA is obliged to maintain a low incidence of failure among the entities it regulates.

Of course, APRA can only do so much. Instead, it must compel the management and directors of those entities to ensure that their own institutions remain sound.

APRA primarily does so through the imposition of prudential standards. These standards largely focus on enterprise risk management.

The reason they are put into place is to increase resilience to business disruptions that could arise from internal and external events, by complying entities are better able to reduce any impacts on business operations, reputation, profitability, depositors, policyholders, and other stakeholders.

To this end, key standards have been imposed to address capital adequacy, liquidity, and governance to ensure that systemic risks (i.e., risks that would endanger the system as a whole) are properly managed. 

For long, operational risk management had not been directly tackled, only indirectly through the imposition of standards dealing with risk management and business continuity management.

That has changed.

On 28 July 2022, APRA released for consultation a new prudential standard designed to strengthen the management of operational risk in the banking, insurance, and superannuation industries.

Since then, the standard has gone into force, set to officially commence 1 July 2025, expect for where an APRA-regulated entity has pre-existing contractual arrangements in place with a service provider. In that case, requirements will apply in relation to those arrangements from the earlier of the next renewal date of the contract with the service provider or 1 July 2026.

As a result, APRA will now be setting out minimum standards for managing operational risk, including updated requirements for business continuity and service provider management.

About Prudential Standard CPS 230 Operational Risk Management

Prudential Standard CPS 230 derives its statutory authority from subsections in existing banking, insurance, and life insurance legislation. However, the standard is tailored to operational risk.

Its purpose is to ensure that regulated entities remain resilient to operational risks and disruptions, to maintain critical operations through disruptions, and manage risks arising from service providers.

Relevant threats, here, include the full range of operational risks, including but not limited to legal risk, regulatory risk, compliance risk, conduct risk, technology risk, data risk, reputational risk, and change management risk.

To avoid such risks, APRA mandates regulated entities to maintain appropriate and sound information and information-technology infrastructure to meet current and projected business requirements and support critical operations and risk management.

How will APRA compel entities?
APRA’s requirements include:

• Identify, assess, and manage its operational risks, with effective internal controls, monitoring and remediation
• Be able to continue to deliver its critical operations within tolerance levels through severe disruptions, with a credible business continuity plan (BCP)
• Effectively manage the risks associated with service providers, with a comprehensive service provider management policy, formal agreements, and robust monitoring

Developing and maintaining an appropriate risk management framework

APRA also mandates entities develop and maintain a risk management framework.

Per APRA, this framework will only be deemed appropriate, though, if it’s suitable to the size, business mix, and complexity of the regulated entity.

Essential components of such a framework include:

• Governance arrangements for the oversight of operational risk
• An assessment of its operational risk profile, with a defined risk appetite supported by indicators, limits, and tolerance levels 
• Internal controls that are designed and operating effectively for the management of operational risks
• Appropriate monitoring, analysis, and reporting of operational risks and escalation processes for operational incidents and events
• Business continuity plan(s) (BCPs) that set out how the entity would identify, manage, and respond to a disruption within tolerance levels and are regularly tested with severe but plausible scenarios
• Processes for the management of service provider arrangements. 

What happens if the framework and related risk management processes are considered inadequate? Here, APRA is alerting entities that it reserves the right
to intervene.

Interventions run the gamut. They might include a request for an independent review of the entity’s operational risk management. Regulated entities might also be required to develop a remediation program or hold additional capital, as relevant.

Interventions would also be imposed on condition of the entity’s license. What’s more, APRA is signalling that it reserves the right to take further action in supervising compliance with the standard. 

Roles and responsibilities

Who, then, is tasked with ensuring compliance? That would be the entity’s Board. For purposes of compliance, the Board will be considered accountable for the oversight of operational risk management, as well as business continuity, and the management of service provider arrangements.

And the Board has its work cut out. Per the Standard, the Board will have to ensure that the entity sets clear roles and responsibilities for senior managers as it relates to operational risk management.

Those senior managers, in turn, will be responsible for operational risk management on a day-to-day basis, across end-to-end processes for all business operations. Nevertheless, senior managers will have to provide information to the Board on the expected impacts on the entity’s critical operations when the Board must make decisions affecting the resilience of said operations.

Further Board responsibilities include:

• Oversee operational risk management and the effectiveness of key internal controls in maintaining the entity’s operational risk profile within risk appetite. The Board must be provided with regular updates on the APRA-regulated entity’s operational risk profile and ensure senior management takes action as required to address any areas of concern 
• Approve the BCP and tolerance levels for disruptions to critical operations, review the results of testing and oversee the execution of any findings
• Approve the service provider management policy, and review risk and performance reporting on material service providers. 

Further requirements for operational risk management

Requirements for business continuity management

And when it comes to business continuity management, regulated entities are likely to have to define, identify, and maintain a register of their critical operations.

From there, entities will have to take reasonable steps to minimise the likelihood and impact of disruptions to critical operations. They will also have to maintain a credible business continuity plan, setting out how precisely they will maintain critical operations within tolerance levels through disruptions. This plan should include disaster recovery provisions for critical information assets.

On the critical event response end, entities are likely to be obligated to activate the BCP in the event of disruption as well as return to normal operations promptly after the disruption is over.

Further requirements include:

Requirements for the management of service provider arrangements

Regulated entities are likely to have to maintain a comprehensive service provider management policy, as well.

That policy must cover how the entity will identify material service providers and manage service provider arrangements, including the management of material risks associated with the arrangements

The relevant policy must include:

• The entity’s approach to entering into, monitoring, substituting and exiting agreements with material service providers
• The entity’s approach to managing the risks associated with material service providers
• The entity’s approach to managing the risks associated with any fourth parties that material service providers rely on to deliver a critical operation to the APRA regulated entity

Further requirements include:

Role of digital technology in APRA compliance

For APRA-regulated entities, the standard might seem like a lot. However, adhering to best practices in risk management and business continuity is beneficial in and of itself.

Furthermore, digital technology can help. Platforms, like Noggin Continuity, enable APRA-regulated entities to automate the key business continuity management functions that support compliance with most CPS 230 and CPS 232 Business Continuity Management requirements.

Relevant functions to help ensure compliance include:

• Define domains, critical business activities, assets, and sites, as well as record inter-dependencies
• Assess the risk and impact of outages across activities, assets, and sites, and implement risk treatment plans and actions to mitigate risks, and reduce the likelihood or impact of incidents
• Assign and track business impact assessment and risk management activities for organisational unit owners
• Set recovery targets for business activities and report on progress against those targets as incidents occur
• Visualise and report on the risk profile of business and the impact on critical services
• Digitise business continuity, crisis, and incident response plans, including strategies and considerations, roles and responsibilities, and pre-assigned checklists ready to deploy when incidents occur
• Activate crisis and incident management teams including structures, roles, capabilities required, and on-call resources
• Record and manage incidents and response tasks, log and share updates, decisions, facts, and assumptions, and produce situation reports and briefings
• Initiate and track investigations, capture evidence and related actions
• Conduct exercises, post-incident reviews, and lessons learned
• Visualise locations of incidents, risks, people, and assets using the fully integrated mapping features
• Communicate alerts, notifications and updates via email, SMS, voice, or the Noggin app
• Manage key details of staff, contractors, customers, suppliers, regulators, and external parties
• Display key information where it is needed using flexible dashboards, analytics, and reporting that caters for all stakeholders
• Automate and lead people through procedures, with fully-configurable workflows

Finally, as laid out, APRA has officially released its new cross-industry Prudential Standard CPS 230 Operational Risk Management, setting out minimum standards for managing operational risk, with which entities have until 2025 to comply. It also plans to update requirements for business continuity.

Get ahead of the 2025 compliance date while enhancing your resilience bona fides. 

Not sure how? Noggin’s business continuity software and resilience management software can help. Not only will they help you comply with whatever standard comes down the pike, but they will let you run every aspect of operational risk management (including business continuity) seamlessly, making it easier for everyone at the firm to engage and contribute. 

Request a demonstration to see Noggin in action for yourself.