CPS 230 Business Continuity: A Practical Guide

What is CPS 230 and who does it apply to?

CPS 230 is APRA’s cross-industry prudential standard on operational risk. It applies to authorised deposit-taking institutions, general insurers, life companies including friendly societies, private health insurers and RSE licensees, and to the relevant holding companies.¹ It brings three disciplines into one standard: operational risk management, business continuity and the management of service providers. The board is ultimately accountable for oversight of the entity’s operational risk management.

The standard commenced on 01/07/2025. It replaced five earlier standards, including the business continuity standards CPS 232 and SPS 232 and the outsourcing standards CPS 231, SPS 231 and HPS 231.² On 30/04/2026 APRA finalised targeted amendments that give narrow exemptions from some contract requirements for certain non-traditional service providers, such as central banks and clearing and settlement facilities. The updated standard applies from 01/07/2026.³

For a business continuity manager, the important change is one of emphasis. The older standards asked for a plan. CPS 230 asks the entity to show that its critical operations will stay within limits the board has set, and to prove it through testing.

What are critical operations under CPS 230?

Critical operations are processes, carried out by the entity or by a service provider, which would have a material adverse impact on depositors, policyholders, beneficiaries or other customers, or on the entity’s role in the financial system, if they were disrupted beyond tolerance. APRA sets a minimum list for each industry:¹

• authorised deposit-taking institutions: payments, deposit-taking and management, custody, settlements and clearing;
• general, life and private health insurers: claims processing;
• RSE licensees: investment management and fund administration;
• all entities: customer enquiries, and the systems and infrastructure needed to support critical operations.

The list is a floor, not a ceiling. Most entities add operations that are critical to their own customers, and APRA may require others to be treated as critical. In practice the hardest part is not naming the operation but drawing its boundary: which people, sites, systems, data and suppliers it depends on end to end. That mapping is what makes the rest of the plan credible.

How should CPS 230 tolerance levels be set?

For each critical operation, the entity must set tolerance levels for:¹

• the maximum period of time it would tolerate a disruption to the operation;
• the maximum extent of data loss it would accept as a result of a disruption; and
• the minimum service levels it would maintain while operating under alternative arrangements.

The board approves the tolerance levels. A common mistake is to set them from current recovery capability, for example by adopting the recovery time that the IT team can already achieve. Tolerances should start from the impact on customers and the entity: how long customers can be without the service before the harm becomes material. Where current capability falls short of that tolerance, the gap becomes a funded remediation item rather than a reason to loosen the tolerance.

A business impact analysis is still the right tool for this work. The maximum tolerable period of disruption and recovery objectives it produces map closely to the CPS 230 tolerances, provided the analysis is anchored on customer and financial system impact rather than internal convenience.

What must a CPS 230 business continuity plan contain?

CPS 230 requires a credible business continuity plan that sets out how the entity would maintain its critical operations within tolerance levels through severe disruptions. The plan must include:¹

• the register of critical operations and their tolerance levels;
• the triggers that identify a disruption and prompt activation of the plan;
• the actions the entity would take to maintain its critical operations within tolerance levels; and
• a communications strategy to support execution of the plan.

It must also deal with the resources needed to execute the plan, the risks to its execution and the key dependencies, including service providers. The plan is approved by the board.

Activation triggers deserve particular care. A plan that waits for a declared crisis will often be activated too late, because many disruptions start as a slow degradation, such as a supplier outage that grows over a morning. Triggers written in terms of the tolerance levels, for example time elapsed or service levels breached, give operational managers a clear point at which to act and to escalate to the crisis management team.

How must the plan be tested and reviewed?

The entity must have a systematic testing program for its business continuity plan that covers all critical operations and includes an annual business continuity exercise. Testing must use a range of severe but plausible scenarios. The plan must be updated as necessary each year, internal audit must periodically review it and provide assurance to the board, and the board reviews the results of testing and oversees the response to the findings.¹

An annual exercise that satisfies the standard and also improves capability usually has these features:

• a scenario that is genuinely severe, such as the loss of a core system, a site or a material service provider, rather than a comfortable rehearsal;
• the decision makers who would actually lead the response, including executives where the scenario warrants it;
• measurement against the tolerance levels, so the exercise shows whether the operation would stay within them;
• a short written report with findings, owners and dates that the board can track.

Many entities build a rolling program of two to four exercises a year, so that every critical operation is tested over the cycle and each exercise builds on the last. The tabletop exercise guide explains how to design one.

If a disruption to a critical operation takes it outside tolerance, the entity must notify APRA as soon as possible and no later than 24 hours after the disruption, describing its nature, the action taken, the likely impact and the expected time to return to normal operations.¹

Where do service providers fit into CPS 230 business continuity?

A material service provider is one the entity relies on to undertake a critical operation, or one that exposes it to material operational risk. The entity must keep a register of its material service providers and submit it to APRA each year.¹ APRA sets minimum categories, including risk management, core technology services and internal audit for all entities.

For continuity planning, the practical consequence is that a critical operation is only as resilient as the providers it depends on. The plan should show what happens if each material provider fails, how quickly an alternative can be brought in, and whether the provider’s own continuity arrangements have been tested against the entity’s tolerance levels. Supplier failure is one of the most useful scenarios for the annual exercise, because it tests contracts, communications and decision making together.

How does CPS 230 relate to ISO 22301?

ISO 22301:2019 is the international management system standard for business continuity. CPS 230 is a mandatory prudential standard. They are compatible but not the same. ISO 22301 provides a proven structure for policy, business impact analysis, strategies, plans, exercising and continual improvement, and a business continuity management system aligned with it gives an entity a strong base for CPS 230.

CPS 230 then adds specific requirements that ISO 22301 does not prescribe: the APRA minimum list of critical operations, board-approved tolerance levels, the annual exercise, internal audit assurance, the register of material service providers and the 24-hour notification. An entity that already runs an ISO 22301-aligned program should map its existing artefacts to these requirements rather than starting again.

How Agilient supports CPS 230 business continuity

Agilient’s business continuity consultants help APRA-regulated entities build and test the continuity arrangements that CPS 230 expects. Agilient works alongside the entity’s risk, resilience and operations teams and does not replace internal audit or legal advice.

Agilient also designs crisis management arrangements that connect to the plan, so the executive response and the operational recovery work from the same picture.