APRA CPG 230 is guidance supporting CPS 230. It helps entities understand better-practice approaches for operational risk management, critical operations, material service providers, business continuity, testing, and evidence.
Official sources
What the guidance is trying to do
CPG 230 helps regulated entities interpret and implement CPS 230. The guide should be read as practice guidance rather than the prudential standard itself. It is valuable because it helps teams translate requirements into operating records and evidence.
What teams need to do
- Use CPS 230 as the binding standard and CPG 230 as implementation guidance.
- Map critical operations, tolerance levels, material service providers, and dependencies.
- Maintain continuity plans, scenario tests, provider evidence, issues, and remediation.
- Report operational risk and resilience posture to management and the board.
Evidence to maintain
- CPS 230 / CPG 230 mapping.
- Critical operations, dependency maps, and material service provider records.
- Scenario testing, continuity, remediation, and reporting evidence.
Common gaps
- CPG 230 is treated as optional reading rather than implementation guidance.
- Service provider records are not connected to critical operations.
- Testing results are not linked to remediation.
How Halbarad helps
Halbarad helps connect critical operations, material service providers, dependency maps, incidents, test evidence, issues, and remediation.
Disclaimer
This guide is for general information only and is not legal advice. Review the official regulation, guidance, and supervisory materials, and consult qualified counsel or compliance advisors for your organization's specific obligations.