The Deadline Has Moved the Goalposts—Not Removed Them
With CPS 230 fully in force for all APRA-regulated entities from 1 July 2026, the temptation is to treat compliance as a project that has been completed. Industry analysis suggests the opposite: the post-deadline phase is where the real test begins. Deloitte Australia describes the shift as a transition from implementation to embedding assurance in business-as-usual, with sustained and independent assurance over the effectiveness of operational risk management, business continuity management and service provider management. The framework must now perform, not merely exist.
That reframing matters because CPS 230’s obligations are ongoing. The register of material service providers must be maintained and submitted annually. Business continuity plans must be tested against severe but plausible scenarios. Service provider arrangements must be brought into line with contractual requirements by the earlier of the next renewal or 1 July 2026, and then kept compliant as contracts roll over. Compliance is a cycle, not a milestone.
Assurance as the New Supervisory Lens
APRA has signalled that it will monitor how CPS 230 operates over the next few years before considering further changes. In practical terms, that means supervised entities should expect scrutiny of evidence: can the entity demonstrate that controls are effective, that tolerance levels are calibrated to real operational capacity, and that material service providers are managed in substance rather than form?
The assurance expectation extends to material service providers themselves. Deloitte notes that MSPs to APRA-regulated entities must establish assurance programmes to validate the robustness of the processes and controls underpinning their services that support clients’ critical operations. This creates a two-way accountability: the regulated entity remains responsible for its own resilience, but it can also expect its material providers to evidence the controls that make the arrangement dependable.
Aligning CPS 230 With FAR and Board Accountability
CPS 230 does not operate in isolation. The Financial Accountability Regime sharpens individual accountability for prudential outcomes, and Deloitte explicitly links CPS 230 assurance programmes to FAR expectations. For boards and senior executives, that means resilience is no longer delegable to a risk function without active oversight. The board-approved business continuity plan, the tolerance levels for critical operations and the service provider management policy are all governance instruments that carry accountability consequences.
The 2026 amendments also reinforce the need for disciplined classification and review. APRA has said it will periodically review the operation of the exemptions for non-traditional service providers to ensure they remain appropriate and aligned with prudential objectives, and it expects the scope of exemptions to narrow rather than expand over time. Entities that treat exempt arrangements as permanently outside the risk framework may find themselves revisiting that assumption sooner than expected.
What “Good” Looks Like in Business-as-Usual
In practical terms, mature CPS 230 compliance looks like a continuous cycle: identify critical operations and material dependencies, set and recalibrate tolerance levels, test continuity against severe but plausible scenarios, contract and monitor service providers, and assure the board that the framework is effective. Internal audit has a central role, providing robust and insightful assurance to financial service institutions while also highlighting the implications for MSPs in ensuring services are underpinned by strong controls.