What evidence do auditors commonly ask for on CPS 230 para 26 Maintain a comprehensive operational risk profile assessment?

Operational risk profile document or dashboard with date of last refresh; Operational risk data system (GRC tool) with incident, risk and control data and Board reporting extracts; Critical operation resource and interdependency maps (people, technology, information, facilities, providers); Scenario analysis workbook with severe scenarios, impact estimates and resulting control actions.

What is the most common gap auditors find on CPS 230 para 26?

Interdependency maps stop at internal systems and omit service providers

APRA CPS 230 · Operational risk management, controls and incidents (paras 23 to 32)

`CPS 230 para 26` Maintain a comprehensive operational risk profile assessment

The entity must keep a complete, current assessment of its operational risk profile. To support that it must: (a) run adequate information systems that monitor operational risk, gather and analyse risk data and support reporting upward to senior management and the Board; (b) record, for each critical operation, the processes and resources it depends on (staff, facilities, technology, information and service providers), how they depend on each other, and the risks, obligations, controls and key data attached; and (c) use scenario analysis to gauge how badly severe operational risk events could hit, test resilience and find where controls or other mitigations need to be added or changed.

Source: APRA CPS 230, CPS 230 para 26. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open APRA CPS 230 in the compliance library.

Applies to APRA-regulated entities.

artefacts

held by a system

at each review

moderate

to go live

Cloud console / configuration management

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Operational risk profile document or dashboard with date of last refresh · Cloud console / configuration management

periodic reviewEvidence produced at each review

none for this control

governing documentDocuments that govern the control

Operational risk data system (GRC tool) with incident, risk and control data and Board reporting extracts · Policy repository / GRC workspace
Critical operation resource and interdependency maps (people, technology, information, facilities, providers) · Policy repository / GRC workspace
Scenario analysis workbook with severe scenarios, impact estimates and resulting control actions · Document repository

First move

Start with the 1 of 4 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Interdependency maps stop at internal systems and omit service providers
Scenario analysis run once with no resulting control changes recorded

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

CPS 230 para 25 Assess the operational risk impact of business and strategic decisions · CPS 230 para 27 Risk assessment before providing a material service to another party