Requirements & evidence
APRA CPS 230
Australia's cross-industry prudential standard for operational risk, continuity of critical operations, and material service-provider risk at APRA-regulated entities. It is a binding supervisory standard, not a certification.
- Edition on record
- 2026 determination (effective 2026-07-01)
- Issuing authority
- Australian Prudential Regulation Authority (opens in a new tab)
- Edition published
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for banking, insurance, superannuation, financial services, across AU. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Operational risk management
- Critical operations and tolerance levels
- Business continuity
- Material service providers
- Board oversight and reporting
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Source access and licensing
APRA publishes the in-force prudential standard and implementation guidance. Pin the 2026 clean determination before normalization.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
APRA CPS 230 is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Metadata only; CPS 230 obligations, service-provider register requirements, and supervisory evidence expectations are not ingested or modeled.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked August 30, 2026. Confirm the applicable edition with the authority before beginning an assessment.
- 2026 determination (effective 2026-07-01)Current edition on record · Replaces 2023 determination (effective 2025-07-01)
- 2023 determination (effective 2025-07-01)Superseded edition
Recorded change history
· APRA CPS 230 2026 determination (effective 2026-07-01) supersedes 2023 determination (effective 2025-07-01) and is the current edition.
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on August 30, 2026.
- Australian Prudential Regulation Authority (opens in a new tab)
Issuing authority and framework publication.
Catalog provenance and record details
Framework record: apra-cps-230-2026.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Operational risk management · Critical operations and tolerance levels · Business continuity · Material service providers · Board oversight and reporting.
Record last updated: August 30, 2026.
Common questions
A closer look.
What is APRA CPS 230?
Australia's cross-industry prudential standard for operational risk, continuity of critical operations, and material service-provider risk at APRA-regulated entities. It is a binding supervisory standard, not a certification.
Who does APRA CPS 230 apply to?
APRA CPS 230 applies to banking, insurance, superannuation, financial services, AU, per Australian Prudential Regulation Authority.
What is the current version of APRA CPS 230?
The current edition is 2026 determination (effective 2026-07-01), issued by Australian Prudential Regulation Authority and published 2026-04-30. Source: https://www.apra.gov.au/standards/cps-230.
What does an assessment under APRA CPS 230 require?
No control catalog has been ingested for APRA CPS 230 yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
APRA CPS 230
2026 determination (effective 2026-07-01)
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize APRA CPS 230 requirements, evidence preparation, and review for your assessment scope.