APRA seeks feedback on new operational resilience standard

The prudential regulator is proposing a new standard to strengthen operational resilience in the insurance, banking and superannuation industries, and has launched a discussion paper seeking submissions.

CPS 230 Operational Risk Management will set out minimum standards for managing operational risk, including updated requirements for business continuity and service provider management, the Australian Prudential Regulation Authority (APRA) says.

Operational risk is the potential for financial loss or material disruption as a result of inadequate or failed internal processes or systems, the actions of people or external drivers and events, such as a pandemic or natural disaster.

APRA Chairman Wayne Byres says the regulator is moving to strengthen standards of operational risk management in response to changing business models, lessons from recent years and developments in global good practice.

“Disruptions to financial services – even temporarily – can have a major detrimental impact on the community,” he said.

“In strengthening the ability of APRA-regulated entities to identify, manage and respond to operational risk events, APRA is seeking to enhance operational and financial resilience, as well as financial stability.”

He says the proposed CPS 230 will also help ensure APRA-regulated entities meet the challenges posed by ongoing innovation and technological change in the financial services industry.

The new standard will incorporate updated requirements for service provider management (currently outsourcing) and business continuity management that are currently contained in prudential standards CPS 231 Outsourcing and CPS 232 Business Continuity Management (and the corresponding superannuation standards SPS 231 and SPS 232 and private health insurance standard HPS 231).

These five standards will be replaced by the new CPS 230.

APRA expects to release the final CPS 230 early next year, before the new standard comes into force from January 1 2024 after reviewing industry feedback in response to the consultation.

Closing date for submissions is October 21.

Click here for the discussion paper.