APRA CPS 230 · Operational Risk Management · Evidence & Implementation Kit
Meet APRA's operational risk standard by its 1 July 2025 start, with the evidence a prudential review asks for.
Every CPS 230 requirement handed to you as an adopt-ready control, with the APRA-specific nuance, the exact evidence APRA and internal audit examine, and the finding they most often raise.
Review-ready in a weekend, not a quarter.
Here is the honest situation. CPS 230 is mandatory for APRA-regulated banks, insurers and superannuation funds from 1 July 2025, and it raises the bar on operational risk, business continuity and service provider management. The hard part is the evidence: identifying critical operations and setting tolerance levels, a register of material service providers with compliant agreements, scenario testing, and prompt notification to APRA. Building all of that, in the form a prudential review expects, is months of work.
This Kit removes the build. It is every CPS 230 requirement as a control you personalize in a weekend, grounded in the standard and APRA's practice guide.
What you get, the moment you buy
36
Requirements as adopt-ready controls. Every CPS 230 requirement across roles, operational risk, business continuity, service providers and APRA notification. Personalize and you are done.
36
Evidence-they-examine checklists. For each requirement, exactly what APRA or internal audit examines, plus the finding they most often raise, and the APRA-specific nuance including the notification timeframes.
1
CPS 230 Control Matrix, pre-built. Every requirement in a working spreadsheet, ready to record your implementation, status and evidence location.
1
Gap & Readiness Assessment. Score each requirement and the workbook tells you your readiness as a single percentage, and exactly what to fix next.
Grounded in CPS 230 and CPG 230, with critical operations, tolerance levels, the material service provider register, scenario testing and the APRA notification timeframes called out. Editable Word and Excel files.
Critical operations and tolerance levels
CPS 230 makes business continuity measurable: you identify your critical operations and set tolerance levels for maximum disruption, data loss and minimum service, then test against them. This Kit builds that in, along with the material service provider register, which are the two areas a review probes hardest.
What one control looks like
This is the requirement to define and maintain a register of critical operations, the foundation of the standard. All 36 are built to this depth.
CPS230-17 Define and maintain a register of critical operations BUSINESS CONTINUITY
Adopt this requirement
[Regulated entity] defines, identifies and maintains a register of its critical operations, being processes that would have a material adverse impact on customers or its role in the financial system if disrupted beyond tolerance levels. The register classifies, at a minimum, the operations prescribed for the entity type unless a documented justification for exclusion exists, and is reviewed as the business changes.
Evidence APRA or internal audit examines
- Register of critical operations with classification rationale
- Documented justification for any prescribed operation not classified as critical
- Methodology for identifying critical operations
- Review records showing the register updated for business change
Common finding they raise: The critical operations register omits customer enquiries or supporting systems and infrastructure, which paragraph 36 requires all entities to classify as critical.
Why this is not another template pack
- The evidence is the point. Generic risk templates ignore the prudential lens. This tells you exactly what APRA or internal audit examines and the finding they raise, for every requirement. That is what withstands a review.
- Written to the standard. Critical operations, tolerance levels, the service provider register, scenario testing and the notification timeframes are built in, not bolted on.
- Built on a mapped compliance corpus, not one person's opinion, from a graph of thousands of controls across standards.
- It compounds. CPS 230 works with CPS 234 and the other APRA standards, so your operational risk and security programs share the same evidence base.
Who buys this
APRA-regulated banks, insurers and superannuation funds and their teams, the operational risk, continuity and audit leads who own CPS 230, and consultants preparing entities for the 1 July 2025 start. Whether it is a first uplift or an assurance review, you save weeks and walk in with the register, tolerance levels and testing ready.
By the end of the weekend you will have
✓ A control for every CPS 230 requirement
✓ A completed CPS 230 control matrix
✓ The evidence APRA and internal audit examine
✓ Your critical operations and tolerance levels anchored
✓ A readiness percentage and a fix list
✓ The common findings closed before a review
Common questions
Is it really editable? Yes. Word and Excel files you own and adapt. No portal, no subscription.
When does CPS 230 apply? It is effective from 1 July 2025 for APRA-regulated entities. The Kit gets you ready ahead of that.
Does it cover service providers? Yes. The material service provider policy, register, agreements and monitoring, and the notification obligations, are covered as their own theme.
Does it cover tolerance levels? Yes. Identifying critical operations and setting and testing tolerance levels is built in as the core of the continuity requirements.
What if it is not for me? A 30-day money-back guarantee.
Do not reach the CPS 230 start date without the evidence in hand.
A consultant is tens of thousands and months. The Kit is instant, and it is guaranteed.
Add it to your cart and be review-ready this weekend.
Instant digital download · 30-day money-back guarantee · The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001 · support@theartofservice.com
