The CPS 230 Operational Risk Management (CPS 230) Standard from the Australian Prudential Regulation Authority (APRA) took effect on 1 July 2025 and sets a new baseline for operational resilience across banking, insurance and superannuation. The Standard directs every APRA-regulated entity to manage operational risk, maintain critical operations within Board-approved tolerance levels, and manage the risks that arise from material service providers.
While the priority of regulated entities’ may have been to meet compliance requirements, true value lies in building resilience that is forward looking and well embedded into the organisation.
In a dynamic risk and regulatory environment, organisations must move beyond minimum compliance expectations and build resilience as a strategic capability.
Investing in resilience now not only protects your license to operate but drives measurable business value. Maturing your resilience posture through better data, automation and testing can tangibly reduce the cost of disruption.
Unlocking the value of resilience
Where to from here?
So now that you have met the CPS 230 requirements – you might be wondering, where to from here?
Depending on the maturity of your organisation, we have outlined some key considerations to unlock the value that resilience can bring based on our experience locally and globally. It highlights how organisations can move from foundational compliance to integrated resilience and ultimately, to a technology enabled capability that enhances agility and protects key stakeholders.
We see that in Horizon 1 (building the foundation), organisations should focus on embedding and refining compliance requirements. However, it is the transition to Horizon 2 (scale and simplify) and 3 (intelligent resilience) that delivers meaningful returns. These horizons focus on embedding resilience into the fabric of operations to improve efficiency, predict and prevent disruptions, accelerate response times, and enable smarter decisions under pressure.
By taking a phased, outcomes-driven approach, it helps build the confidence of the Board and key stakeholders by demonstrating clear accountability, improved data driven oversight, and effective service provider governance. As the risk environment becomes more complex and interconnected, resilience must go beyond compliance. It must be integrated into how the organisation operates, prioritises, and invests. The time to shift from meeting minimum standards to achieving operational advantage is now.
Contact us
