Description

A focused course, tailored for you

The CPS 230 Internal Audit Playbook

Build audit evidence that satisfies APRA examiners across every CPS 230 workstream.

Your existing audit methodology was built before CPS 230 applied. The standard changed the perimeter, the evidence standard, and the testing obligation for every material service provider and critical operation. When the audit committee asks for the evidence package, the gaps are visible.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

CPS 230 created nine distinct new audit obligations that did not exist under the prior operational risk framework: critical operations designation and review, material service provider tiering and direct testing, BCP scenario design and evidence standard, exit strategy verification, operational resilience scenario analysis, findings remediation validation, third-party concentration risk audit, regulator examination coordination, and the annual audit opinion on operational resilience. Most internal audit functions inherited templates from CPS 220 and CPS 231 that cover perhaps three of those nine. The shortfall is not a resource problem. It is a methodology problem. The working papers were not designed to capture this evidence and the finding structure was not calibrated to APRA's examination expectations.

What you walk away with

Build a critical operations audit program that covers designation, testing, and evidence standards.
Produce a material service provider audit approach with tiered verification and working paper standards.
Design a BCP test audit that generates APRA-satisfying evidence for all tested scenarios.
Construct audit findings and working papers that meet examination expectations for closure and root cause.
Deliver an audit committee report on CPS 230 assurance that positions findings without regulatory escalation risk.
Draft an annual audit opinion on operational resilience that can be referenced in APRA examination responses.

The 12 modules

Module 1. Understanding CPS 230's Audit Scope

What CPS 230 requires auditors to cover beyond legacy operational risk frameworks. Covers the standard's definition of material service provider, critical operations, and the distinction between operational resilience and continuity. Learners build a scope mapping document that identifies where their existing audit universe needs extension, which audit cycles need new evidence standards, and which third-party categories now require direct testing rather than reliance on provider attestations.

Module 2. Mapping Your Critical Operations Register

How to build and audit the critical operations register that APRA expects regulated entities to maintain. Covers designation criteria including customer impact, financial impact, and operational dependency, the audit testing approach for completeness, the documentation standard APRA examiners expect, and how to challenge management's self-assessment of criticality. Learners produce an audit program for the critical operations register that ties to the board-approved tolerance levels.

Module 3. Third-Party Material Service Provider Audit Framework

CPS 230 expanded the audit perimeter to include material service providers in ways the prior CPS 231 regime did not. Covers how to scope the third-party audit program, what evidence is required from providers versus what must be independently verified, how to structure working papers for fourth-party dependencies, and how to document residual risk when provider evidence is incomplete. Learners build a tiered audit approach for the MSP register.

Module 4. Business Continuity Testing Evidence Standards

Designing BCP tests that satisfy the APRA evidence standard and auditing them rigorously. Covers acceptable test evidence for each critical operation tier, how to audit test design versus test execution, the gap between RTO documentation and observed test outcomes, and how to communicate testing shortfalls in findings. Learners produce a BCP test audit program with the specific evidence matrix APRA examiners look for in examination files.

Module 5. Operational Resilience Scenario Review

Auditing the scenario analysis program CPS 230 requires for each critical operation. Covers what APRA considers an adequate severe but plausible scenario, how to audit the assumption set behind each scenario, testing whether management has genuinely stress-tested against supply chain and technology disruptions, and how to document findings where scenario coverage is superficial. Learners build the audit testing steps for the annual scenario review cycle.

Module 6. Third-Party Exit Strategy Audit

CPS 230 requires documented and tested exit strategies for material service providers. Covers how to audit exit strategy completeness and realism, what evidence demonstrates genuine exit capability versus a theoretical plan, how to test concentration risk in the provider portfolio, and how to frame findings where exit would require multi-year transition timelines. Learners produce an exit strategy audit work program with findings documentation templates calibrated to APRA expectations.

Module 7. Findings Documentation and APRA-Ready Working Papers

Building audit findings and working papers that meet APRA's examination expectations. Covers the difference between findings-quality language and observational language, how to structure root cause analysis in CPS 230 findings, the remediation tracking format APRA expects for Matters Requiring Attention, and how to document management action plans with measurable criteria. Learners produce a findings template calibrated to APRA examination standards and audit committee presentation requirements.

Module 8. Audit Committee Reporting for Operational Resilience

How to package CPS 230 audit results for board and audit committee consumption. Covers the metrics and KRIs the committee expects to see, how to present progress against the CPS 230 implementation program, how to communicate assurance gaps without creating regulatory escalation risk, and how to structure the annual audit opinion on operational resilience. Learners build an audit committee report template calibrated to a major APRA-regulated entity.

Module 9. Managing Audit Findings Through to Closure

The remediation tracking problem: how to audit management's closure of CPS 230 findings without accepting paper compliance. Covers verification standards for each finding category, how to test whether root cause remediation is genuine or superficial, how to escalate repeatedly-deferred items to the audit committee, and how to document the audit's re-performance work. Learners produce a findings lifecycle management process that satisfies APRA expectations for independent validation of closure.

Module 10. Coordinating with APRA on Examination Requests

How to manage APRA examination requests that touch internal audit's work. Covers what APRA can and cannot request from the audit function, how to protect working papers appropriately, how to coordinate between internal audit, risk, and legal when regulators request documentation, and how to frame the audit function's independence position in examination responses. Learners build a regulator interaction protocol addressing document-handling, escalation, and the communication chain.

Module 11. Integrating CPS 230 with the Broader Audit Universe

How to align the CPS 230 audit program with existing credit, market, and technology audit coverage without duplicating work. Covers the coverage model across three lines, how to map overlapping requirements between CPS 230, CPS 234, and CPS 220, how to coordinate with the second line on shared testing work, and how to present an integrated risk picture to the audit committee. Learners produce an integrated audit planning template that positions CPS 230 inside the full audit universe.

Module 12. Building the Annual CPS 230 Audit Opinion

How to synthesise the year's testing into a defensible annual opinion on the entity's operational resilience posture. Covers what an APRA-satisfying audit opinion requires including scope, basis, findings, limitations, and overall conclusion, how to calibrate the opinion against peer benchmarks, how to handle situations where evidence is incomplete, and how to present the opinion to the board. Learners produce an annual audit opinion structure referenceable in APRA examination responses.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Modules 1-3 map the new audit perimeter: what CPS 230 requires you to cover that your current program does not.

Modules 4-6 cover the three workstreams with the highest APRA examination intensity: BCP testing evidence, scenario review, and exit strategy audit.

Modules 7-9 address the findings lifecycle: how to write, track, and close CPS 230 findings to APRA's standard.

Modules 10-12 deal with the external-facing dimension: managing APRA examinations, integrating across audit domains, and drafting the annual opinion.

What you get with this course

12 written modules covering the full CPS 230 audit scope
Downloadable working paper templates for BCP test evidence, MSP audit, findings documentation, and the annual audit opinion
Audit program templates for each of the nine new CPS 230 workstreams
Findings language library calibrated to APRA examination expectations
Hand-built implementation playbook tailored to your organisation's audit context, delivered alongside course access

What you will have in hand by Day 1, Week 1, Month 1

Course access and the hand-built implementation playbook are both provisioned within 24 hours of purchase.

Before and after

Before

Audit universe covers the legacy operational risk framework. BCP tests are audited against RTO documentation. Third-party audit relies on provider attestations. Findings are written in general risk language. APRA examination responses require significant preparation time from the audit function.

After

Full CPS 230 audit coverage with evidence standards for every workstream. BCP test audit produces a scenario-by-scenario evidence matrix. Material service provider direct testing is scoped and tiered. Findings documentation maps to APRA's Matters Requiring Attention format. Audit committee reporting positions the operational resilience opinion clearly.

What happens if you do not address this

The first APRA examination cycle under CPS 230 will test whether internal audit covered the new perimeter or remained on the legacy framework. Gaps in audit coverage are not a management problem: they are an audit function problem. An audit opinion that cannot demonstrate coverage of critical operations, third-party direct testing, and the BCP evidence standard will require remediation that cannot be completed during an examination.

Who it is for

Audit Managers and Senior Auditors at APRA-regulated financial services institutions who are responsible for one or more CPS 230 audit workstreams. You are not new to financial services audit but you are new to the expanded scope this standard created. You have existing audit cycles to maintain and a new regulatory perimeter to cover at the same time. You are accountable to an audit committee that wants to see genuine assurance and to APRA examiners who will test that assurance.

Who this is NOT for. Audit professionals outside APRA-regulated entities, or those working in organisations where a separate risk function owns the CPS 230 implementation program entirely without audit involvement. Also not for consultants building remediation programs rather than audit functions.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. 12 modules at approximately 45 minutes each. Most learners complete the full course in 3-4 working days. The implementation playbook and working paper templates are designed for immediate use in the next audit planning cycle.

Why $199 is the right number

APRA guidance and the CPS 230 prudential standard itself describe requirements but not methodology. External consultants can build the program for you at a cost that is at least 20x this course and takes 8-12 weeks. This course gives you the methodology to build it yourself, with templates calibrated to a major regulated entity rather than a generic framework.

FAQ

Does this course cover CPS 234 information security audit as well?

Module 11 covers the overlap between CPS 230 and CPS 234 in the integrated audit universe context. A separate CPS 234 audit playbook course covers the information security audit workstreams in depth.

Is this relevant for second-line risk functions as well as internal audit?

The course is written for the internal audit perspective. Second-line professionals will find modules 2, 4, and 5 directly applicable to the risk management program, but the findings documentation and working paper modules are written for audit function deliverables specifically.

How current is the content given when CPS 230 became effective?

The course reflects the final standard and APRA's supporting guidance materials. The working paper templates and evidence standards are calibrated to the examination expectations that apply to the first full audit cycle under the standard.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.