APRA CPS 230 Example Evidence

The table below lists commonly evidenced control areas for CPS 230 and the artifacts that typically satisfy them; attach these to your controls as evidence.

Control Area	Example Evidence
Board accountability	Board charter establishing the board's responsibility for operational risk, business continuity, and service provider oversight
Board oversight in practice	Board meeting minutes showing regular operational risk reporting and approval of tolerance levels, the business continuity plan, and the service provider management policy
Risk management framework	Framework documentation covering governance arrangements, the operational risk profile, control effectiveness, monitoring, business continuity, and service provider management
Risk assessment policy	Policy defining the assessment process and explicitly covering legal, regulatory, compliance, conduct, technology, data, and change management risks
Periodic risk assessment	Completed risk assessment or risk register spanning the full range of operational risks, with documentation of how new products, services, and technologies change the risk profile
Risk treatment	Remediation plans with named owners, actions, and target dates, plus tracking records showing material weaknesses stay on the risk profile until closed
Scenario and incident response testing	Test reports covering severe operational risk scenarios, with outcomes identifying new or amended controls
Business impact analysis	Analysis identifying critical operations under the CPS 230 definition, with written justification for any APRA-prescribed operation not classified as critical
Tolerance levels	Board-approved tolerance documentation per critical operation covering maximum tolerable outage, maximum data loss, and minimum service levels, plus monitoring reports against those tolerances
Business continuity plan	Approved plan containing the critical operations register, tolerance levels, activation triggers, resource arrangements, execution risks, dependencies, and a communications strategy
Business continuity and disaster recovery testing	Annual exercise report showing the scenarios tested, including service provider disruption, with recovery performance measured against tolerance levels
Australian Prudential Regulation Authority (APRA) notifications	Documented procedures for the 72-hour incident, 24-hour tolerance breach, and 20-business-day arrangement notifications, plus redacted copies of notifications actually sent
Service provider management policy	Approved policy covering identification of material service providers, entering, monitoring, and exiting arrangements, and fourth-party risk
Material service provider register	Register identifying material service providers, with executed agreements containing service levels, data ownership, audit and APRA access, liability, and termination provisions
Vendor due diligence	Completed due diligence for recently engaged or materially changed providers covering selection, ongoing capability, financial and non-financial risks, geographic concentration, and exit planning
Service provider changes	Change records and reassessments for material modifications to provider arrangements, with updated risk assessments and reporting to senior management
Independent assessment	Internal audit reports covering operational risk management, business continuity plan reviews, and outsourced critical operations, with reporting to the board