The Australian Prudential Regulation Authority (APRA) has released a new prudential standard to help insurers, superannuation trustees, and banks improve their operational risk management.

APRA finalised Prudential Standard CPS 230 Operational Risk Management (CPS 230) will commence from 1 July, 2025. It requires APRA-regulated entities to:

• strengthen their operational risk management by addressing identified weaknesses in existing controls;
• improve business continuity planning to better manage severe disruptions; and
• enhance third-party risk management by appropriately managing risks from material service providers.

Strengthening operational risk management

Earlier this year, APRA released an updated timeline for the implementation of CPS 230. In response to industry feedback, the regulator decided to move the new standard's effective date and provide transitional arrangements with service providers.

In a recent statement, APRA Chair John Lonsdale emphasised that disruptions in the financial service industry can result in a major detrimental impact to people relying on financial services providers to pay bills, recover from financial loss, or support themselves financially during retirement.

“The need for APRA's new standard has been demonstrated by a number of recent operational risk control failures and disruptions, including material cyber breaches,” Lonsdale said. “This new standard will ensure that regulated entities set and test controls and maintain robust business continuity plans to respond if disruptions do occur,”

APRA expects insurers, banks, and superannuation trustees to prepare for the implementation of the new prudential standard as soon as possible rather than “waiting until the last minute to get ready and meet the new requirements.”

“There will be a transition phase for existing contractual arrangements with material service providers for entities that need some flexibility,” Lonsdale said.