Prudential Standard CPS 230 Operational Risk Management
The Shift from Implementation to Assurance
Now that APRA’s Prudential Standard CPS 230 is live, regulated entities must transition from implementation to embedding assurance in business-as-usual.
Authors: Kerrie-Ann Rodrigues Barrett, Puneet Gulati, Aneliese Algie, Tarah Unn
APRA’s Prudential Standard CPS 230 – Operational Risk Management (CPS 230 or Standard) commenced in July 2025, marking a pivotal transition in the regulatory landscape.
After years of preparation and implementation, regulated entities are now operating under the applicable requirements of the standard. The implementation phase involved identifying Critical Operations and Material Service Providers (MSPs), setting tolerance levels and uplifting business continuity plans and operational risk frameworks.
With operations shifting to business-as-usual (BAU), APRA expects regulated entities to focus on sustained and independent assurance over the effectiveness of their framework across operational risk management (ORM), business continuity management (BCM) and service provider management (SPM).
In turn, MSPs to APRA regulated entities must establish assurance programs to validate the robustness of processes and controls underpinning their services that support clients’ Critical Operations.
Achieving this requires targeted assurance programs that validate control effectiveness, uplift maturity and align with the Financial Accountability Regime (FAR) expectations. This provides senior management and Boards with confidence that CPS 230 obligations are being met on an ongoing and sustainable basis.
Drawing on Deloitte’s experience, this publication outlines key considerations for Internal Audit to provide robust and insightful assurance to financial service institutions (FSIs), while also highlighting the implications for MSPs in ensuring services are underpinned by strong controls and assurance, in line with APRA expectations.
