APRA CPS 230 / CPG 230 — Operational Risk Management operational risk obligations as executable controls

Why it matters for NETEVO

APRA Prudential Standard CPS 230 is the cross-industry operational risk standard that binds every APRA-regulated board — ADIs, insurers, superannuation trustees. It requires boards to maintain operational risk management capability, business continuity, and service-provider management, including a register of material service providers. Three features of the standard bear directly on how those obligations can be engineered rather than merely documented.

Three-Lines-of-Defence shape. CPS 230 is architecturally Three-Lines-of-Defence-shaped: operational risk management at the front line, risk oversight in the middle, internal audit assurance at the back. Its notification obligations — operational risk incidents (paragraph 33), breach of tolerance for a critical operation (paragraph 42), and material service-provider arrangements (paragraph 59) — define the regulator-readable form of the signals an engineered control emits at runtime. Where authorisation policy is expressed in a language such as Cedar, CPS 230 is the prudential surface the resulting controls must report against.

Targeted amendments of 30 April 2026. APRA released targeted amendments to CPS 230 on 30 April 2026 that narrow specific contractual requirements for material arrangements with non-traditional service providers and clarify CPG 230 expectations. The updated standard and practice guide commence on 1 July 2026, so any reading of CPS 230 turns on which version was in force at the relevant date.

Board obligations that connect to the wider governance stack. CPS 230's board obligations cascade directly into the governance scope of ISO/IEC 38507:2022 and into the directors' duties analysis in Directors' Duties and AI Regulation. CPS 230 is the prudential-regulation expression of what those framework-level and academic treatments address at higher altitudes — the standard against which APRA-regulated boards are assessed on operational competence.