Call us now:
From 1st July 2025 The Australian Prudential Regulatory Authority (APRA) APRA requires regulated entities to manage continuity of critical services, through a prudential standard on Operational Risk Management (CPS 230).
CPS 230 aims to ensure that APRA regulated entities are resilience to operational risks and disruptions. Ensuring that they effectively manage their operational risks, maintain critical operations through disruptions, and manage the risks arising from service providers.
Like Basel III regulation that focuses on systemically important banks, CPS 230 applies to Financial Institutions further down the hierarchy. Including ADIs, General Insurers, life companies, private health insurers and superannuation licensees. It includes the Australian branch operations of foreign entities.
CPS 230 requires entities demonstrate governance over operational risk, adopt a Risk Management Framework (RMF) and RCSA process, with defined risk appetite, indicators and limits. For covered entities to demonstrate control effectiveness, effective risk mitigation, and processes for the management of operational risks associated with their service providers.
CPS 230 make clear the responsibilities of boards of covered entities to demonstrate oversight and assurance of operational risk. Setting our clear roles and responsibilities for the management of operational risks and business continuity. With cyber being the predominant operational risk that FIs face, one looks forward to understanding how Australian FI will incorporate Cyber risk into their risk management frameworks and processes and developing suitable solutions to evaluate control effectiveness and business continuity.
Tom McLeod Faisal Khan
Veritas GRC Australian Prudential Regulation Authority
#operationalrisk #cyberrisk
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7347966138061905920