What evidence do auditors commonly ask for on CPS 234 para 35 Notify APRA of material incidents within 72 hours?

Notification procedure stating the 72-hour clock, who decides materiality and who submits to APRA; Materiality assessment criteria and completed assessments per incident; Copies of APRA notifications with timestamps of awareness and submission; Register of notifications to other regulators that triggers APRA notification; Incident timeline records evidencing when the entity became aware.

What is the most common gap auditors find on CPS 234 para 35?

Clock started at confirmation of the incident instead of awareness

APRA CPS 234 · APRA notification (paras 35 to 36)

`CPS 234 para 35` Notify APRA of material incidents within 72 hours

The entity must tell APRA promptly, and at the latest within 72 hours of becoming aware, of any information security incident that either (a) had, or could have had, a material financial or non-financial effect on the entity itself or on the interests of its depositors, policyholders, beneficiaries or other customers (the impact limb), or (b) has already been notified to another regulator in Australia or overseas. A footnote covers incidents not already reported under CPS 231, SPS 231, CPS 232 or SPS 232, and counts domestic government agencies and international regulators as other regulators.

Source: APRA CPS 234, CPS 234 para 35. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open APRA CPS 234 in the compliance library.

Applies to APRA-regulated entities.

artefacts

held by a system

at each review

hard

to go live

Regulator portal / correspondence

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Incident timeline records evidencing when the entity became aware · Regulator portal / correspondence

periodic reviewEvidence produced at each review

Materiality assessment criteria and completed assessments per incident · Regulator portal / correspondence
Register of notifications to other regulators that triggers APRA notification · Regulator portal / correspondence

governing documentDocuments that govern the control

Notification procedure stating the 72-hour clock, who decides materiality and who submits to APRA · Policy repository / GRC workspace
Copies of APRA notifications with timestamps of awareness and submission · Policy repository / GRC workspace

First move

Mostly documents and reviews. Pull the 1 system-held artefact from your Regulator portal / correspondence on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Common gaps auditors find

Clock started at confirmation of the incident instead of awareness
Incidents reported to another regulator (for example the OAIC) but not to APRA
Potential impact ignored because no actual harm occurred

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

CPS 234 para 34 Internal audit assessment of third-party assurance · CPS 234 para 36 Notify APRA of material control weaknesses within 10 business days