APRA CPS 230: the evidence behind each requirement

44 paragraphs. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Applies to APRA-regulated entities.

Key principles and operational risk management framework (paras 11 to 18)

CPS 230 para 11Key principles: manage operational risk, keep critical operations within tolerance, manage service provider… hard CPS 230 para 12Identify, assess and manage operational risk moderate CPS 230 para 13Prevent disruption, adapt within tolerance and return to normal promptly hard CPS 230 para 14Rely on a service provider only where prudential obligations stay fully met hard CPS 230 para 15Operational risk elements of the risk management framework hard CPS 230 para 16Review operational risk management within the CPS 220 / SPS 220 framework reviews hard CPS 230 para 17Integrate operational risk management; align BCP with recovery and exit planning hard

Roles and responsibilities (paras 19 to 22)

CPS 230 para 19Board ultimate accountability for operational risk oversight hard CPS 230 para 20Board ensures clear senior manager roles for operational risk, continuity and service providers hard CPS 230 para 21Board oversight duties: risk profile, BCP and tolerances, service provider policy hard CPS 230 para 22Senior management informs the Board on impacts to critical operations hard

Operational risk management, controls and incidents (paras 23 to 32)

CPS 230 para 23Manage the full range of operational risks end to end hard CPS 230 para 24Sound information and IT capability; monitor asset age and health; meet CPS 234 hard CPS 230 para 25Assess the operational risk impact of business and strategic decisions hard CPS 230 para 26Maintain a comprehensive operational risk profile assessment moderate CPS 230 para 27Risk assessment before providing a material service to another party hard CPS 230 para 28Design, implement and embed internal controls hard CPS 230 para 29Monitor, review and test controls; report results; rectify gaps promptly moderate CPS 230 para 30Remediate material weaknesses and keep them in the risk profile until fixed moderate CPS 230 para 31Identify, escalate, record and address incidents and near misses hard CPS 230 para 32Notify APRA within 72 hours of a material operational risk incident moderate

Business continuity (paras 33 to 45)

CPS 230 para 33Business continuity duties: critical operations register, minimise disruption, credible BCP, activate, return hard CPS 230 para 35Minimum set of critical operations unless justified hard CPS 230 para 37Tolerance levels for each critical operation hard CPS 230 para 39Required content of the BCP hard CPS 230 para 40Maintain BCP execution capability; monitor tolerances; report breaches to the Board moderate CPS 230 para 41Notify APRA within 24 hours of a disruption outside tolerance hard CPS 230 para 42Systematic BCP testing program with an annual exercise hard CPS 230 para 43Tailored test scenarios including material service provider disruption hard CPS 230 para 44Annual BCP update moderate CPS 230 para 45Internal audit periodic review and assurance on the BCP hard

Management of service provider arrangements (paras 46 to 61)

CPS 230 para 46Comprehensive service provider management policy moderate CPS 230 para 47Required content of the service provider policy, including fourth parties moderate CPS 230 para 48Register of material service providers and management of their risks hard CPS 230 para 49Minimum material service provider classifications unless justified hard CPS 230 para 50Annual submission of the material service provider register to APRA hard CPS 230 para 52Due diligence and risk assessment before entering or materially modifying a material arrangement hard CPS 230 para 53Formal legally binding agreement for each material arrangement and its minimum terms hard CPS 230 para 54APRA access, on-site visit and non-impediment clauses hard CPS 230 para 55Manage the risks of each material arrangement, including BCP execution and orderly exit hard CPS 230 para 57Exemption for Attachment-category providers on standardised terms or no formal agreement hard CPS 230 para 59Monitor material arrangements and report to senior management hard CPS 230 para 60Notify APRA of critical-operation agreements (20 business days) and before material offshoring moderate CPS 230 para 61Internal audit review of critical-operation outsourcing and reporting to the Board hard