CPS 230 (Operational Risk Management)

APRA prudential standard for operational risk + third-party management.

In force from 1 July 2025 (transitional through 30 June 2026), CPS 230 replaces CPS 231 (outsourcing) and CPS 232 (business continuity). APRA-regulated entities must identify critical operations, set tolerance levels, maintain a register of material service providers, manage concentration risk, and conduct testing.