§25 · Lane 7 — Australian Regulatory Primary Instruments
APRA CPS 230 / CPG 230 — Operational Risk Management
APRA (2023, amended 2026) · CPS 230 / CPG 230
Bibliographic data
- Title
- APRA Prudential Standard CPS 230 (effective 1 July 2025; targeted amendments 30 April 2026) — Operational Risk Management; and Prudential Practice Guide CPG 230
- Authors / Issuing body
- Australian Prudential Regulation Authority (APRA)
- Venue / Publisher
- Australian Prudential Regulation Authority
- Year
- 2023
- Designation
- Regulatory
- Licence
- Stable URL — refer to publisher for full licence terms.
- Canonical link
- https://www.apra.gov.au/operational-risk-management
How to cite
APRA (2023, amended 2026). APRA Prudential Standard CPS 230 (effective 1 July 2025; targeted amendments 30 April 2026) — Operational Risk Management; and Prudential Practice Guide CPG 230. Australian Prudential Regulation Authority. https://www.apra.gov.au/operational-risk-management.
Cross-industry prudential standard for operational risk management applying to all APRA-regulated entities (ADIs, insurers, superannuation trustees). Requires boards to maintain operational risk management capability, business continuity, and service-provider management — including a register of material service providers and notification of operational risk incidents. CPG 230 sets out APRA's stated implementation expectations.
Why it matters for NETEVO
APRA Prudential Standard CPS 230 is the cross-industry operational risk standard that binds every APRA-regulated board — ADIs, insurers, superannuation trustees — and is the load-bearing prudential anchor for the forthcoming CPS 230 executable-edge-controls insight. Three consequences for NETEVO follow.
Three-Lines-of-Defence shape, paired with the AU Three Lines academic substrate. CPS 230 is architecturally Three-Lines-of-Defence-shaped: operational risk management at the front line, risk oversight in the middle, internal audit assurance at the back. The paragraphs on incident notification (para 33), critical-operation tolerance breach (para 42), and material-arrangement notification (para 59) are the regulator-readable form of the runtime telemetry the executable-edge-controls thesis argues for. Cedar is the policy language; CPS 230 is the regulator surface the policy delivers against.
Latest-version citation discipline after the 30 April 2026 targeted amendments. APRA released targeted amendments to CPS 230 on 30 April 2026 that narrow specific contractual requirements for material arrangements with non-traditional service providers and clarify CPG 230 expectations. The updated standard and practice guide commence 1 July 2026. Any NETEVO drafting against CPS 230 cites the latest version unless the citation refers expressly to a pre-amendment moment in time.
Board cascade into ISO/IEC 38507 and the director-duty academic substrate. CPS 230's board obligations cascade directly into ISO/IEC 38507:2022 governance scope and into the Directors' Duties and AI Regulation academic substrate. CPS 230 is the prudential-regulation expression of what those framework-level and academic-level artefacts frame at higher altitudes — the standard against which APRA-regulated boards are scored on operational competence.
Where NETEVO applies this
- AI Governance in ANZ Whitepaper — central prudential citation
- Listed Leaders ICP — APRA-regulated boards — CPS 230 vocabulary