APRA CPS 230: the evidence behind every control

43 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Operational Risk Management Framework

CPS 230 para 12Key Principles for Operational Risk, Resilience and Service Providers hard CPS 230 para 13Identification, Assessment and Management of Operational Risk hard CPS 230 para 16Operational Risk Elements of the Risk Management Framework hard CPS 230 para 18Integration with the Risk Management Framework and Recovery Planning hard CPS 230 para 20Board Accountability for Operational Risk Management hard CPS 230 para 21Board Setting of Senior Manager Roles and Responsibilities hard CPS 230 para 22Board Oversight, Approval of the BCP, Tolerance Levels and Service Provider Policy hard CPS 230 para 24Management of the Full Range of Operational Risks hard CPS 230 para 26Assessment of Business and Strategic Decisions on the Risk Profile hard CPS 230 para 27Comprehensive Assessment of the Operational Risk Profile hard CPS 230 para 28Risk Assessment Before Providing a Material Service to Another Party hard CPS 230 para 46Internal Audit Review of the Business Continuity Plan hard

Critical Operations

CPS 230 para 14Prevention, Adaptation and Return to Normal Operations hard CPS 230 para 29Design and Embedding of Internal Controls hard CPS 230 para 36Mandatory Minimum Classification of Critical Operations hard CPS 230 para 38Tolerance Levels for Each Critical Operation hard

Service Provider Management

CPS 230 para 15Precondition for Reliance on a Service Provider hard CPS 230 para 47Service Provider Management Policy hard CPS 230 para 48Required Content of the Service Provider Management Policy hard CPS 230 para 49Register of Material Service Providers hard CPS 230 para 50Mandatory Minimum Classification of Material Service Providers hard CPS 230 para 53Due Diligence Before Entering or Modifying a Material Arrangement hard CPS 230 para 55APRA Access Provisions in Formal Agreements hard CPS 230 para 56Ongoing Risk Management of Each Material Arrangement hard CPS 230 para 58Monitoring and Senior Management Reporting on Material Arrangements hard CPS 230 para 60Internal Audit Review of Proposed Critical Operation Outsourcing hard

Assurance

CPS 230 para 17Review of Operational Risk Management hard

Governance

CPS 230 para 23Senior Management Information to the Board on Resilience Decisions hard

Operations

CPS 230 para 25Information and Technology Capability and Asset Health moderate

Controls

CPS 230 para 30Monitoring, Review and Testing of Control Effectiveness hard CPS 230 para 31Remediation of Material Operational Risk Weaknesses hard

Business Continuity

CPS 230 para 32Identification and Escalation of Incidents and Near Misses hard CPS 230 para 34Critical Operations Register, Continuity Plan and Activation hard CPS 230 para 40Required Content of the Business Continuity Plan hard CPS 230 para 41BCP Execution Capability and Tolerance Breach Reporting moderate CPS 230 para 43Systematic BCP Testing Program hard CPS 230 para 44Tailoring of the Testing Program hard CPS 230 para 45Annual Update of the Business Continuity Plan hard

Regulatory

CPS 230 para 33APRA Notification of Operational Risk Incidents within 72 Hours hard CPS 230 para 42APRA Notification of Disruption Outside Tolerance within 24 Hours hard CPS 230 para 51Annual Submission of the Material Service Provider Register to APRA hard CPS 230 para 59APRA Notification of Service Agreements and Offshoring hard

Third Party

CPS 230 para 54Formal Agreement Content for Material Arrangements hard