APRA’s new prudential standard on operational risk management comes into force

Banks, insurers and superannuation funds will need to meet higher standards of operational risk management from today as new requirements from the Australian Prudential Regulation Authority (APRA) come into force.

Cross-industry Prudential Standard (CPS) 230 Operational Risk Management requires APRA-regulated entities to be well-prepared to ensure continuity of critical services to the community and respond to business disruptions by:

• identifying important business services and determining the extent to which these services can continue during severe disruptions; 
   
• testing their business continuity planning to identify vulnerabilities to ensure they are positioned to overcome severe disruptions; and 
   
• enhancing third-party risk management by ensuring risks from material service providers are identified and appropriately managed.  

The issue of operational resilience has taken on greater importance over recent years as the financial system has become more interconnected and more dependent on digital technologies and service providers. Recent geopolitical turmoil also increases risks such as cyber attacks and personnel risks associated with bad actors.

APRA Member Therese McCarthy Hockey said CPS 230 will play an important role in financially protecting the community. 

“Australians depend on banking to pay for goods and services, insurance helps us rebuild after a flood or fire and pay for vital medical treatments, while superannuation supports us to maintain a dignified lifestyle in retirement. In an environment where one crashed server or ransomware attack could leave millions without access to these essential services, effective operational risk management is vital for financial stability and community wellbeing.

“As well as identifying their own operational vulnerabilities and have plans to mitigate them, CPS 230 requires entities to have a detailed level of understanding and mitigation planning in relation to their most critical third-party service providers. This will require an entirely new mindset about where the boundaries of responsibility sit.”

Over the past two years, APRA has worked closely with industry to enable regulated entities to be ready to comply with the new standard, although APRA has granted smaller, less complex entities an extra 12 months to meet some requirements. APRA also requires each entity to provide a list of its most material service providers, which will help APRA identify concentration risks across the financial services sector.