APRA CPS 230 Operational Risk Management
Reaches every ICT service agreement with an APRA-regulated customer in Australia (banks, credit unions, insurers, reinsurers, superannuation funds, private health insurers): the formal agreement content of para 50, APRA's access in para 45, core technology services as material by default (para 40), notification of material arrangements and offshoring (P59), and the customer's own 72-hour incident and 24-hour disruption clocks to APRA (P33, P42).
On the register, tick "APRA CPS 230" (every regime is ticked by default) and these rows attach where the customer's sector and country reach it. Source framework: APRA CPS 230 Operational Risk Management.
What it expects, term by term
| CPS 230 terms | para 50 · para 45 · para 40 · P59On an ICT service arrangement |
|---|---|
| audit right | para 45On an ICT service arrangement, or where processor terms are expected |
| breach clock | P33 · P42On an ICT service arrangement |
Para 50 and the two clocks to APRA
The formal agreement for a material arrangement carries the content para 50 lists (services and levels, rights and responsibilities, data ownership, audit access, liability, sub-contractor notice and liability, force majeure, termination), with APRA's access under para 45. The customer's own clocks to APRA (72 hours for a material incident under P33, 24 hours for a disruption outside tolerance under P42) sit beside the clock the row promises in the clock table.
The clauses, quoted
6Clause text from The Art of Service standards library at compliance.theartofservice.com, read against the held text of each standard and cited to its clause: our close statement of each clause, not the instrument verbatim. Where the UK text is held only as a summary, the EU GDPR article of the same number is quoted and the page says so.
CPS 230 para 40 Mandatory Minimum Classification of Material Service ProvidersUnless it can justify otherwise the entity must classify as material service providers at least those supplying credit assessment, funding and liquidity management and mortgage brokerage for an ADI, underwriting, claims management, insurance brokerage and reinsurance for an insurer, fund administration, custodial services, investment management and arrangements with promoters and financial planners for an RSE licensee, and for all entities risk management, core technology services and internal audit.
Where it usually falls short: Internal audit or risk management providers not classified as material
APRA CPS 230 Operational Risk Management in The Art of Service standards library
CPS 230 para 45 APRA Access Provisions in Formal AgreementsFormal agreements must also give APRA access to documentation, data and other information relating to the service, give APRA the right to conduct an on site visit to the provider, and secure the provider agreement not to impede APRA in performing its duties as prudential regulator.
Where it usually falls short: Legacy contracts never uplifted
APRA CPS 230 Operational Risk Management in The Art of Service standards library
CPS 230 para 50 Formal Agreement Content for Material ArrangementsEvery material arrangement must be covered by a formal legally binding agreement specifying the services and service levels, the rights, responsibilities and expectations of each party including asset ownership, data ownership and control, dispute resolution, audit access, liability and indemnity, provisions securing the entity legal and compliance obligations, notification of the provider reliance on other material service providers, provider liability for sub contractor failure, a force majeure provision, and termination rights.
Where it usually falls short: Verbal or intra group arrangements with no formal agreement
APRA CPS 230 Operational Risk Management in The Art of Service standards library
CPS 230 P33 APRA Notification of Operational Risk Incidents within 72 HoursThe entity must notify APRA as soon as possible and no later than 72 hours after becoming aware of an operational risk incident it determines is likely to have a material financial impact or a material impact on its ability to maintain critical operations.
Where it usually falls short: Clock started at incident classification rather than awareness
APRA CPS 230 Operational Risk Management in The Art of Service standards library
CPS 230 P42 APRA Notification of Disruption Outside Tolerance within 24 HoursThe entity must notify APRA as soon as possible and no later than 24 hours after suffering a disruption to a critical operation outside tolerance, covering the nature of the disruption, the action taken, the likely impact on business operations and the timeframe for returning to normal operations.
Where it usually falls short: Tolerance breach detected late so the 24 hour clock is missed
APRA CPS 230 Operational Risk Management in The Art of Service standards library
CPS 230 P59 APRA Notification of Service Agreements and OffshoringThe entity must notify APRA as soon as possible and no more than 20 business days after entering into or materially changing an agreement for a service it relies on to undertake a critical operation, and must notify APRA before entering into any material offshoring arrangement or when a significant change to such an arrangement is proposed, including where data or personnel relevant to the service will be located offshore.
Where it usually falls short: Offshoring notified after signature instead of before
APRA CPS 230 Operational Risk Management in The Art of Service standards library
See what it expects of your list
Paste the list of customer agreements and every row this regime reaches carries these terms, ticked or open. Eight agreements free, no account.
Check my contract list