Description

A focused course, tailored for you

Building a CPS 230 Operational Resilience Programme for Australian Banks (Critical Operations + Third-Party + Tolerances + Testing)

Build the CPS 230 operational resilience programme from scratch in 12 weeks. Critical operations + tolerance levels + third-party risk + testing programme + APRA engagement.

APRA CPS 230 Operational Risk Management took effect 1 July 2025. Australian banks, insurers, and superannuation funds are now in active supervision. Engineering managers who can build the programme that satisfies APRA take the senior work. Here is the 12-week build.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

APRA Prudential Standard CPS 230 took effect 1 July 2025 across banks, insurers, and superannuation funds. The standard requires regulated entities to: identify critical operations; set tolerance levels for maximum tolerable downtime; manage operational risk including third-party arrangements with comprehensive registers; test resilience scenarios; report material incidents to APRA. The transition period for legacy third-party arrangements runs to 1 July 2026.

APRA is now in active supervision of CPS 230 implementation. Entities that have not built integrated programmes face enforceable undertakings, capital add-ons, and operational restrictions.

This course teaches the 12-week build of an integrated CPS 230 programme: critical operations identification, tolerance level setting, third-party risk register, scenario testing programme, incident reporting workflow, board accountability framework, and the APRA supervisory engagement protocol. Twelve modules with deliverables. Plus a hand-built implementation playbook for your specific firm.

What you walk away with

A documented critical operations register.
A tolerance level framework (maximum tolerable downtime per operation).
A third-party risk register (in-scope third-parties documented per CPS 230 standard).
A scenario testing programme.
An incident reporting workflow aligned to APRA expectations.
A board accountability framework.
An APRA supervisory engagement protocol.
A 12-week build plan.

The 12 modules

Module 1. CPS 230 regulatory landscape

Detailed walkthrough of CPS 230 (Operational Risk Management), the supporting CPG 230 (Operational Risk Management Practice Guide), CPS 234 (Information Security) integration, CPS 232 (Business Continuity Management) replacement, the transition period to 1 July 2026 for legacy third-party arrangements, and the relationship to APRA's broader prudential framework (CPS 220, CPS 510, CPS 511). What APRA expects in active supervision now.

Module 2. Critical operations identification

Build the critical operations identification: operation-by-operation assessment, threshold criteria (customer impact, financial impact, regulatory impact, market integrity), business-line-level vs entity-level criticality, operations-aggregation model, and the documentation framework. Three identification patterns from peer Australian banks.

Module 3. Tolerance level framework

Build the tolerance level framework: maximum tolerable downtime per critical operation, recovery point objective alignment, recovery time objective alignment, customer-impact framework, financial-impact framework, regulator-engagement scenarios, and the board-approval workflow. The tolerance levels APRA examines.

Module 4. Critical-operations mapping

Build the critical-operations end-to-end mapping: process maps, system dependencies, data flows, people dependencies, third-party dependencies, and the impact-analysis methodology. The mapping that supports tolerance-level setting and scenario testing.

Module 5. Third-party risk register

Build the third-party risk register per CPS 230 standard: in-scope determination (any service used in critical operations), risk assessment criteria, contract clause requirements (data protection, audit rights, incident notification, exit assistance), concentration risk assessment, sub-outsourcing transparency, and the transition plan for legacy arrangements ending 1 July 2026.

Module 6. Scenario testing programme

Build the scenario testing programme: scenario design (cyber, third-party failure, severe operational disruption, climate event, pandemic), testing cadence (annual minimum), participation requirements (executive participation, board observation), test-execution workflow, finding-tracking, and the lessons-learned cadence. The testing programme APRA expects.

Module 7. Incident reporting workflow

Build the incident reporting workflow per CPS 230 expectations: incident classification (material vs non-material), 72-hour material incident notification to APRA, RB1 form completion, root-cause-analysis cadence, customer-notification considerations, and the integration with broader incident management. The reporting workflow that satisfies APRA timelines.

Module 8. Board and senior management accountability

Build the board accountability framework: board approval of operational risk management framework, board approval of risk appetite, board review of critical operations and tolerance levels, board awareness of material incidents, senior management responsibilities, and the three-lines-of-defence integration. APRA expects clear board-level accountability.

Module 9. Integration with CPS 234 information security

Build the integration with CPS 234 (Information Security): information assets register integration, security incident reporting alignment, third-party security assessment integration, vulnerability management integration, and the joint board-reporting cadence. The integration that prevents duplicate reporting and uncovered gaps.

Module 10. Climate-related operational resilience

Build the climate-related operational resilience overlay: physical climate risk to critical operations (data centre flooding, wildfire impact, severe weather), transition risk to operations (carbon-intensive technology dependencies), climate-scenario testing, and the integration with APRA SPG 530 climate financial risk. The climate overlay that APRA expects in operational resilience reporting.

Module 11. APRA supervisory engagement protocol

Build the APRA supervisory engagement protocol: pre-engagement posture (documentation organisation), supervisor-meeting cadence, finding-response workflow, remediation-tracking, and the integration with broader APRA engagement (CFR, CPS 220 risk management framework). The engagement that protects supervisory relationship.

Module 12. Your 12-week build plan

Week-by-week plan with weekly deliverables. Weeks 1-2: regulatory mapping + critical operations identification. Weeks 3-4: tolerance level framework + critical-operations end-to-end mapping. Weeks 5-6: third-party risk register + scenario testing programme. Weeks 7-8: incident reporting workflow + board accountability framework. Weeks 9-10: CPS 234 integration + climate-related operational resilience. Weeks 11-12: APRA supervisory engagement protocol + first programme review. Deliverable: full CPS 230 programme.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Module 1 covers the regulatory landscape.

Modules 2 to 6 produce critical operations identification, tolerance framework, mapping, third-party register, and scenario testing.

Modules 7 to 10 cover incident reporting, board accountability, CPS 234 integration, and climate overlay.

Module 11 covers APRA supervisory engagement.

Module 12 covers the 12-week build plan.

What you get with this course

The 12-module course delivered as text plus downloadable templates.
Templates for critical operations register, tolerance level framework, critical-operations end-to-end mapping, third-party risk register, scenario testing programme, incident reporting workflow, board accountability framework, CPS 234 integration, climate overlay, APRA supervisory engagement playbook.
A hand-built implementation playbook generated for your specific firm.
Three worked examples of CPS 230 programmes at peer Australian banks.
Scripted talking points for the APRA supervisory engagement.

What you will have in hand by Day 1, Week 1, Month 1

Day 1: Regulatory mapping scaffold drafted.

Week 4: Critical operations identified + tolerance levels drafted.

Week 8: Third-party register + scenario testing programme operational.

Week 12: Full CPS 230 programme in active operation.

Before and after

Before

Your firm is in active CPS 230 supervision. The critical operations register exists in fragments. Tolerance levels are not formally board-approved. The third-party register is incomplete. Scenario testing is ad-hoc.

After

An integrated CPS 230 programme is operating. Critical operations are formally identified and board-approved. Tolerance levels are documented and tested. Third-party risk register is complete with transition plan running to 1 July 2026. Scenario testing programme is annual. Incident reporting workflow meets APRA timelines. Board accountability is documented.

What happens if you do not address this

APRA is in active CPS 230 supervision. Entities without integrated programmes face enforceable undertakings, capital add-ons, and operational restrictions.

Who it is for

For engineering managers, technology risk managers, operational resilience leaders, and CRO offices at APRA-regulated entities (banks, insurers, superannuation funds).

Who this is NOT for. Pure research roles. Firms with no APRA regulatory exposure. Pure technology firms.

How it arrives

Text-based course via LMS, plus downloadable templates and the hand-built implementation playbook.

Time investment. Roughly 22 hours of reading and 200 to 400 hours of team effort across the 12-week build for a full CPS 230 programme.

Why $199 is the right number

External CPS 230 consultants charge $500K-$3M for programme builds. Big4 risk advisory engagement runs $1M-$5M. Specialist operational resilience consultants charge $200K-$1M. $199 buys the focused playbook plus the implementation document for your specific firm.

FAQ

Will this replace hiring a CPS 230 consultant?

Partially. It teaches the programme build. You may still want specialist input for novel third-party concentration risk patterns.

What if my firm is RSE licensee (superannuation fund)?

Module 1 covers RSE-specific CPS 230 application.

Does this cover SPS 230 (the equivalent for superannuation)?

Module 1 covers SPS 230 alignment.

What about CPS 511 remuneration overlap?

Module 8 covers CPS 511 alignment with operational risk.

What is in the implementation playbook for me specifically?

Critical operations identification tailored to your firm's business mix; tolerance levels matched to your customer base; a 12-week build plan.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.