CPS 230 Is Now in Force | Your Questions Answered

CPS 230, Risk

5 minute read

CPS 230 Is Now in Force: Rethinking Resilience Through Understanding, Responding, and Monitoring.

As of 1 July 2025, APRA’s Prudential Standard CPS 230 on Operational Risk Management is officially in force. For APRA-regulated entities, this marks a pivotal moment—not just in compliance, but in how organisations understand themselves, respond to disruption, and monitor resilience. The standard demands more than documentation; it calls for a mindset shift.

In this Q&A, we address the three critical questions every organisation should be asking under CPS 230:

What have you learned?
How will you respond?
How will you monitor?

Read on as we unpack what CPS 230 means in practice and how your organisation can meet its new obligations by rethinking resilience from the ground up.

Understanding

What have you learned about your organisation?

CPS 230 has forced entities to take a hard look at their operations. The requirement to identify and document Critical Operations—those essential to customer outcomes and financial system stability—has revealed dependencies, gaps, and strengths that were previously obscured.

Organisations should now understand:
– Which operations truly matter to customers.
– How those operations are supported by people, technology, data, and service providers.
– Where vulnerabilities lie in the chain of delivery.

This process has not only clarified operational priorities but also surfaced cultural and structural insights. Entities that embraced CPS 230 as a strategic opportunity—not just a compliance exercise—gained deeper understanding of how they serve their customers.

How will you ensure the dots remain connected when you make process, technology and organisational change?

CPS 230 demands that resilience be embedded—not bolted on. This means that any change to process, technology, or structure must be assessed for its impact on Critical Operations. The challenge is not just to connect the dots once, but to keep them connected.

To do this, entities must:
– Maintain a living map of dependencies across operations.
– Integrate resilience considerations into change management processes.
– Ensure that risk assessments are updated in real time as changes occur.

How will you continue to break down silos between customer, product, operations and technology teams?

CPS 230 has exposed the limitations of siloed thinking. Critical Operations often span multiple functions, and resilience depends on collaboration. Breaking down silos requires:
– Cross-functional ownership of Critical Operations.
– Shared accountability for resilience outcomes.
– Integrated reporting and decision-making structures.

This is not just about structure—it’s about culture.

How will accountability for critical operations connect with and reinforce FAR and directors’ duties?

CPS 230 intersects with the Financial Accountability Regime (FAR), creating a powerful alignment between operational resilience and personal accountability. Directors and accountable persons must now:
– Understand which Critical Operations they are responsible for.
– Ensure that tolerances are defined, documented, and monitored.
– Be able to demonstrate informed decision-making in the face of disruption.

Responding

What different questions will you ask when you are disrupted?

CPS 230 reframes disruption from a reactive event to a test of preparedness. When disruption occurs, entities must ask:
– Are we within our tolerance levels?
– Which Critical Operations are impacted?
– What manual workarounds are available?
– Who is accountable for the response?

How will you prioritise and focus on improvements to controls to maintain resilience?

CPS 230 requires a continuous improvement mindset. Entities must:
– Monitor control effectiveness through testing and incident analysis.
– Prioritise remediation based on impact to Critical Operations.
– Align control improvements with risk appetite and tolerances.

Do you have the capabilities to monitor and influence service providers?

Material Service Providers (MSPs) are a key focus of CPS 230. Entities must:
– Maintain a register of MSPs with documented rationale.
– Ensure contracts reflect CPS 230 requirements by the next renewal or 1 July 2026.
– Monitor performance and risk exposure.

Entities must build capability—not just to monitor, but to influence.

How will you not only make, but demonstrate you have made, decisions that are informed by resilience?

Boards and executives must be able to show that resilience considerations inform decisions. This means:
– Documenting the rationale for decisions affecting Critical Operations.
– Using scenario testing to validate assumptions.
– Aligning decisions with defined tolerances and risk appetite.

It’s not enough to be resilient—you must be able to prove it.

Monitoring

How will you report differently to those who govern your organisation?

CPS 230 elevates the role of reporting. Boards and committees need:
– Dashboards that track performance against tolerances.
– Insights into emerging risks and incidents.
– Assurance over control effectiveness and remediation.

Reporting is no longer a compliance task—it’s a strategic enabler.

What information will you look at to help you understand if your critical operations are healthy or not?

Entities must develop new metrics and indicators to assess the health of Critical Operations.

This includes:
– Incident frequency and severity.
– Control performance and test results.
– Service provider performance.
– Customer impact metrics.

How will the risk team provide the insight, oversight and foresight needed to support resilient operations?

Risk teams must evolve from gatekeepers to enablers. This means:
– Providing real-time insights into operational risk.
– Supporting scenario planning and stress testing.
– Advising on control design and remediation.

Can you move the needle from ‘what and when’ to ‘how and why’?

CPS 230 challenges entities to go beyond surface-level reporting. The goal is to understand:
– How operations are delivered.
– Why disruptions occur.
– What can be done to prevent them.

CPS 230 is more than a regulatory requirement—it’s a catalyst for transformation.

By reframing resilience through the lenses of Understanding, Responding, and Monitoring, entities can build not just compliance, but capability.

The organisations that succeed will be those that:

Know themselves deeply.
Respond with agility and clarity.
Monitor with insight and purpose.

And most importantly, they will be able to demonstrate that resilience is not just a principle—but a practice.

Got an unanswered question?

If you’re looking to strengthen your organisation’s approach to CPS 230 or want tailored advice on operational resilience, our CPS 230 experts are here to help.

Ask it below and we’ll get back to you with expert insights.

We’re ready to help you navigate the new standard with confidence.

If you’d like to discuss your unique challenges in more detail, book an appointment with our CPS 230 specialist below.