APRA CPS 230 Operational Risk Management
What is APRA CPS 230 Operational Risk Management?
APRA Prudential Standard CPS 230 Operational Risk Management sets out how APRA-regulated banks, insurers, private health insurers and RSE licensees manage operational risk, keep critical operations within tolerance through severe disruption, and manage the risk of material service providers. The current issue commenced on 1 July 2026 and renumbered the standard; it also lets an arrangement with a listed provider on standardised terms skip some contract requirements (paragraph 57). It comprises 44 controls organised across 5 domains, and applies in Australia.
How APRA CPS 230 Operational Risk Management maps to other frameworks
All 44 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 5 domains APRA CPS 230 Operational Risk Management groups its controls into
Frameworks that share controls with APRA CPS 230 Operational Risk Management
Each of these has at least one control mapped to a control in APRA CPS 230 Operational Risk Management. The number is how many APRA CPS 230 Operational Risk Management controls are shared, counted from the mapping graph.
Implementation guides for frameworks that overlap APRA CPS 230 Operational Risk Management
Where APRA CPS 230 Operational Risk Management overlaps with the standards you already hold
Where to get trained on APRA CPS 230 Operational Risk Management
4 courses in the catalogue cover APRA CPS 230 Operational Risk Management directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.
Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.
What an auditor will ask you for
All 43 APRA CPS 230 Operational Risk Management controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the APRA CPS 230 Operational Risk Management evidence request listWhat APRA CPS 230 Operational Risk Management means in your sector
What APRA CPS 230 Operational Risk Management means for your job
Questions people ask about APRA CPS 230 Operational Risk Management
What is APRA CPS 230 Operational Risk Management?
How many controls does APRA CPS 230 Operational Risk Management have?
Where does APRA CPS 230 Operational Risk Management apply?
What frameworks does APRA CPS 230 Operational Risk Management map to?
How do I get started with APRA CPS 230 Operational Risk Management compliance?
Query APRA CPS 230 Operational Risk Management programmatically
APRA CPS 230 Operational Risk Management, its 44 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
APRA CPS 230 Operational Risk Management API reference and MCP config →What APRA CPS 230 Operational Risk Management requires, control by control
Each page carries the requirement text for one APRA CPS 230 Operational Risk Management control and what an assessor expects to see as evidence.
- CPS-230-PARA-12 Key Principles for Operational Risk, Resilience and Service Providers
- CPS-230-PARA-13 Identification, Assessment and Management of Operational Risk
- CPS-230-PARA-14 Prevention, Adaptation and Return to Normal Operations
- CPS-230-PARA-15 Precondition for Reliance on a Service Provider
- CPS-230-PARA-16 Operational Risk Elements of the Risk Management Framework
- CPS-230-PARA-17 Review of Operational Risk Management
- CPS-230-PARA-18 Integration with the Risk Management Framework and Recovery Planning
- CPS-230-PARA-20 Board Accountability for Operational Risk Management
- CPS-230-PARA-21 Board Setting of Senior Manager Roles and Responsibilities
- CPS-230-PARA-22 Board Oversight, Approval of the BCP, Tolerance Levels and Service Provider Policy
How much of another standard APRA CPS 230 Operational Risk Management already covers
Each crosswalk is judged control by control, and the mappings that were rejected are kept alongside the ones that held.
- APRA CPS 234 to APRA CPS 230 Operational Risk Management crosswalk
- C5 (Germany) to APRA CPS 230 Operational Risk Management crosswalk
- APRA CPS 230 Operational Risk Management to Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 crosswalk
- DORA to APRA CPS 230 Operational Risk Management crosswalk
- APRA CPS 230 Operational Risk Management to FedRAMP Moderate crosswalk
- APRA CPS 230 Operational Risk Management to HIPAA Security Rule crosswalk
- APRA CPS 230 Operational Risk Management to ISO 22301:2019 crosswalk
- APRA CPS 230 Operational Risk Management to ISO 27001:2022 crosswalk
How ready are you for APRA CPS 230 Operational Risk Management?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.