CPS 230’s Transition Period Is Over. Every Material Service Provider Contract Is Now in Scope, and Here Is What APRA Expects You to Show

APRA’s Prudential Standard CPS 230 Operational Risk Management came into force on 1 July 2025. The part most boards relaxed about was the transition: contracts with service providers that already existed on that date did not have to comply until the earlier of their next renewal or 1 July 2026. That date has passed. Every material service provider arrangement at every APRA-regulated bank, insurer and superannuation trustee is now inside the standard, and so is everything the standard says about operational risk, critical operations and business continuity. If you are not certain your organisation could evidence that today, CISO Advisory can review it independently before APRA asks.

What the standard actually requires

APRA’s own summary, from its announcement finalising the standard, is short. CPS 230 exists so that regulated entities can strengthen operational risk management “through new requirements to address identified weaknesses”, improve business continuity planning “to ensure they are positioned to respond to severe disruptions”, and enhance third-party risk management “by ensuring risks from material service providers are appropriately managed”.

In practice, as Norton Rose Fulbright’s summary of the standard now in force sets out, that resolves into three obligations an entity has to be able to demonstrate:

• Operational risk: identify, assess and manage operational risks, with effective internal controls, monitoring and remediation.
• Business continuity: be able to continue delivering critical operations within tolerance levels through severe disruptions, with a credible business continuity plan.
• Service providers: effectively manage the risks associated with service providers, with a comprehensive service provider management policy, formal agreements and robust monitoring.

Each of those has a document behind it, and each document has evidence behind it. The board is accountable for all three.

The dates that matter now

APRA’s operational risk management page records the sequence:

• 1 July 2025: CPS 230 in effect for all APRA-regulated entities across banking, superannuation, general, life and private health insurance.
• 1 October 2025: deadline for entities to submit their completed Material Service Provider register to APRA, using the template released in October 2024.
• 1 July 2026: the transition for pre-existing service provider contracts ended, for any contract not already renewed before that date. Targeted amendments APRA released on 30 April 2026, introducing limited exemptions from specific contractual requirements for certain categories of provider, also commenced on 1 July 2026.

So as of today an entity has had the standard for more than a year, has already told APRA who its material service providers are, and can no longer point to a legacy contract as the reason a required clause is missing. The supervisory conversation has moved from “are you ready” to “show us”.

What “show us” looks like in practice

From the standard’s own structure, these are the things a supervisor, an auditor or an incoming director will ask to see, and what a weak answer sounds like.

The critical operations list and the tolerance levels. Which operations, if disrupted, would cause material harm to depositors, policyholders, members or the system, and how long each can be down, how much data can be lost and what level of degraded service is acceptable. A weak answer is a list with no tolerances, or tolerances nobody has tested.

The business continuity plan, exercised. Not the document; the evidence that it was run against a severe but plausible scenario and that the tolerances held or the gaps were fixed. A weak answer is a plan last tested before CPS 230 existed.

The material service provider register, reconciled. The list submitted to APRA in October 2025 should match the contracts, the risk assessments and the monitoring actually in place. A weak answer is a register maintained by procurement that risk has never reviewed, or fourth parties nobody has mapped.

The contracts themselves. Every material arrangement needs the provisions the standard requires, and since 1 July 2026 that includes the arrangements that were grandfathered. A weak answer is a spreadsheet that says “to be addressed at renewal”.

The operational risk profile and the controls. Identified risks, assessed, with named controls and evidence that the controls are monitored and that remediation of known weaknesses is tracked to closure. A weak answer is a risk register that has not changed since it was written.

Board oversight. Minutes and papers showing the board approved the tolerances, received reporting on incidents and breaches, and challenged management on service provider risk. A weak answer is a single annual paper.

Why this is different from CPS 234

Most APRA-regulated entities have a mature CPS 234 program by now: information security capability, asset classification, control testing, incident notification. CPS 230 sits above it and is broader. Cyber is one source of operational disruption among several; a payroll provider failing, a cloud region outage, a data centre fire or a key vendor’s insolvency are others. An entity with a good CPS 234 story can still fail CPS 230 on continuity tolerances and third-party contracts. The two standards share evidence, and the efficient approach is to review them together, which is how CISO Advisory structures its APRA CPS 234 and CPS 230 review.

For suppliers to APRA-regulated entities

If you are a technology, data, processing or outsourcing provider to a bank, insurer or super fund, CPS 230 reached you through your customer’s contract. Expect renewal negotiations to insist on notification obligations, audit and access rights, sub-contracting controls, business continuity commitments and exit assistance. Providers who can show their own continuity testing and security posture win those negotiations; providers who cannot become the material risk their customer has to explain.

What an independent CPS 230 review involves

A review is not a re-write of your risk framework. It is an evidence-based read of whether what you have would satisfy a supervisor, delivered by someone with no product to sell you afterwards. CISO Advisory’s approach:

1. Scope in a short call. Which entity, which critical operations, how many material providers, and what has changed since the register was lodged.
2. Document and evidence review. Risk framework, critical operations and tolerances, continuity plans and test results, service provider policy, register, a sample of contracts, board papers.
3. Gap register, ranked. What is missing or weak against each obligation, ranked by regulatory exposure and by how quickly it can be closed.
4. Board-ready report. Written for directors and the audit and risk committee, not for the IT team, with a costed and sequenced remediation plan.
5. Optional retained oversight. A virtual CISO to run the remediation, report to the board monthly and represent the entity with auditors and the regulator.

Our APRA CPS 234 and CPS 230 review is a fixed-fee engagement, listed at $18,500 excluding GST on our pricing page, with the final fee confirmed in writing after the scoping call. Ongoing virtual CISO retainers start at $3,500 a month. We are independent and vendor-neutral, so the findings are the findings.

The transition period gave every entity a year to prepare. It is over. If your board would struggle to answer the six “show us” questions above from the evidence on file, talk to an independent CISO this week, or call 07 2112 8502 any time.