Standards · CPS 230

APRA CPS 230 Operational Risk Management

Rendered when "APRA CPS 230" is ticked and the customer reaches it. The register cites 6 of its 43 clauses, behind 4 findings: breach-notice clocks that disagree, financial-entity customer with no dora or cps 230 terms shown, audit rights granted, liability cap unstated or uncapped, and on the rows it reaches.

Clause text from The Art of Service standards library at compliance.theartofservice.com, read against the held text of each standard and cited to its clause: our close statement of each clause, not the instrument verbatim. Where the UK text is held only as a summary, the EU GDPR article of the same number is quoted and the page says so. Source framework: APRA CPS 230 Operational Risk Management. What it expects of an agreement: the CPS 230 regime page.

Clauses cited

6 of 43

CPS 230 para 40 Mandatory Minimum Classification of Material Service Providers

Unless it can justify otherwise the entity must classify as material service providers at least those supplying credit assessment, funding and liquidity management and mortgage brokerage for an ADI, underwriting, claims management, insurance brokerage and reinsurance for an insurer, fund administration, custodial services, investment management and arrangements with promoters and financial planners for an RSE licensee, and for all entities risk management, core technology services and internal audit.

Evidence an auditor accepts: Classification decisions against the mandatory minimum list; Documented justification for any exclusion; Entity type specific coverage evidence
Where it usually falls short: Internal audit or risk management providers not classified as material
APRA CPS 230 Operational Risk Management in The Art of Service standards library

CPS 230 para 45 APRA Access Provisions in Formal Agreements

Formal agreements must also give APRA access to documentation, data and other information relating to the service, give APRA the right to conduct an on site visit to the provider, and secure the provider agreement not to impede APRA in performing its duties as prudential regulator.

Evidence an auditor accepts: Contract clauses granting APRA access, on site visit rights and non impedance; Clause coverage review across all material arrangements; Remediation plans for legacy agreements lacking the clauses
Where it usually falls short: Legacy contracts never uplifted
APRA CPS 230 Operational Risk Management in The Art of Service standards library

CPS 230 para 50 Formal Agreement Content for Material Arrangements

Every material arrangement must be covered by a formal legally binding agreement specifying the services and service levels, the rights, responsibilities and expectations of each party including asset ownership, data ownership and control, dispute resolution, audit access, liability and indemnity, provisions securing the entity legal and compliance obligations, notification of the provider reliance on other material service providers, provider liability for sub contractor failure, a force majeure provision, and termination rights.

Evidence an auditor accepts: Executed agreements for every material arrangement; Clause mapping against the required minimum content; Sub contractor notification and liability clauses
Where it usually falls short: Verbal or intra group arrangements with no formal agreement
APRA CPS 230 Operational Risk Management in The Art of Service standards library

CPS 230 P33 APRA Notification of Operational Risk Incidents within 72 Hours

The entity must notify APRA as soon as possible and no later than 72 hours after becoming aware of an operational risk incident it determines is likely to have a material financial impact or a material impact on its ability to maintain critical operations.

Evidence an auditor accepts: Notification records with awareness and submission timestamps; Materiality determination criteria and decision records; Escalation path from the incident register to the notification decision
Where it usually falls short: Clock started at incident classification rather than awareness
APRA CPS 230 Operational Risk Management in The Art of Service standards library

CPS 230 P42 APRA Notification of Disruption Outside Tolerance within 24 Hours

The entity must notify APRA as soon as possible and no later than 24 hours after suffering a disruption to a critical operation outside tolerance, covering the nature of the disruption, the action taken, the likely impact on business operations and the timeframe for returning to normal operations.

Evidence an auditor accepts: Notification records with disruption and submission timestamps; Evidence the notification covered all four required content elements; Tolerance breach detection records feeding the notification
Where it usually falls short: Tolerance breach detected late so the 24 hour clock is missed
APRA CPS 230 Operational Risk Management in The Art of Service standards library

CPS 230 P59 APRA Notification of Service Agreements and Offshoring

The entity must notify APRA as soon as possible and no more than 20 business days after entering into or materially changing an agreement for a service it relies on to undertake a critical operation, and must notify APRA before entering into any material offshoring arrangement or when a significant change to such an arrangement is proposed, including where data or personnel relevant to the service will be located offshore.

Evidence an auditor accepts: Notification records with execution and submission dates; Offshoring notifications evidencing they preceded execution; Identification of arrangements where data or personnel move offshore
Where it usually falls short: Offshoring notified after signature instead of before
APRA CPS 230 Operational Risk Management in The Art of Service standards library

See which clauses your list engages

Paste the list of customer agreements and every row names the clauses behind it. Eight agreements free, no account.

Check my contract list