What evidence do auditors commonly ask for on CPS 234 para 18 Maintain an information security policy framework?

Information security policy approved at the right level, with version and review history; Policy hierarchy showing supporting standards, guidelines and procedures; Policy review schedule and evidence of the last review; Mapping of policy coverage to the entity's risk assessment or threat profile; Exception and waiver register under the policy framework.

What is the most common gap auditors find on CPS 234 para 18?

Policy set copied from a template and not tied to the entity's own exposures

APRA CPS 234 · Policy framework (paras 18 to 19)

`CPS 234 para 18` Maintain an information security policy framework

The entity keeps a body of information security policies, standards, guidelines and procedures whose coverage and depth match its exposure to vulnerabilities and threats.

Source: APRA CPS 234, CPS 234 para 18. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open APRA CPS 234 in the compliance library.

Applies to APRA-regulated entities.

artefacts

held by a system

at each review

hard

to go live

Policy repository / GRC workspace

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Policy review schedule and evidence of the last review · Policy repository / GRC workspace

governing documentDocuments that govern the control

Information security policy approved at the right level, with version and review history · Policy repository / GRC workspace
Policy hierarchy showing supporting standards, guidelines and procedures · Policy repository / GRC workspace
Mapping of policy coverage to the entity's risk assessment or threat profile · Policy repository / GRC workspace
Exception and waiver register under the policy framework · Policy repository / GRC workspace

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

Policy set copied from a template and not tied to the entity's own exposures
Standards and procedures missing beneath a high-level policy
Reviews overdue or signed off without any change after a material shift in threats

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

CPS 234 para 17 Keep capability current as threats and assets change · CPS 234 para 19 Policy direction to everyone with a security obligation