Operational Risk Management Policy

Document control

1. Purpose

This Policy sets the minimum requirements for managing operational risk at [Organisation]: the risk of loss from inadequate or failed internal processes or systems, the actions or inactions of people, or external drivers and events (drawn from CPS 230 para 12). It ensures that [Organisation]:

2. Scope and application

This Policy applies to all employees, contractors, directors and officers of [Organisation] and its subsidiaries; to all business units, products, services, processes, systems, data and locations; and to operational risks that arise at service providers and the parties they rely on. Operational risk is inherent in all products, activities, processes and systems (CPS 230 para 12).

3. Key definitions

4. Principles

1. Start with critical operations. Identify the critical operations, set their tolerance levels and map the processes and resources that deliver them; use this as the starting point for the operational risk profile (CPG 230 paras 2–3).
2. Manage the full range. Every operational risk, including legal, regulatory, compliance, conduct, technology, data and change management risk, has an owner and is managed end to end across the process (CPS 230 para 23).
3. Controls must work. Controls are designed, implemented and embedded in line with risk appetite, and tested for design and operating effectiveness at a frequency that matches the materiality of the risk (paras 28–29).
4. Fix the cause. Control gaps, weaknesses and failures stay in the risk profile until remediated, with clear accountability, assurance and root cause fixes (para 30).
5. Plan for severe disruption. Assume that severe but plausible events will happen, and be able to stay within tolerance levels when they do (paras 13, 42–43).
6. Outsource the work, not the responsibility. [Organisation] does not rely on a service provider unless it can still meet its obligations in full and manage the risks (para 14; RG 104.34).
7. Proportionate. The approach is appropriate to [Organisation]'s size, business mix and complexity (CPS 230 objectives).

5. Governance and the three lines of accountability

The Board is ultimately accountable for oversight of operational risk management, including business continuity and the management of service provider arrangements (CPS 230 para 19). [Organisation] applies the three lines of accountability set out in the RiskFA Risk Management Framework section 5.

6. Roles and responsibilities

7. Operational risk taxonomy

Operational risk is a Level 1 category in the RiskFA Risk Management Framework section 8. [Organisation] uses the Level 2 risk types below for every operational risk, control, incident and issue. Each incident is also tagged with a loss event type, using the seven Basel II event types, so that loss data can be compared across the industry.

8. Operational risk appetite

CPS 230 para 15(b) requires an assessment of the operational risk profile with a defined risk appetite supported by indicators, limits and tolerance levels. The Board sets operational risk appetite in the RiskFA Risk Appetite Statement. As a minimum, it includes:

9. The operational risk profile and risk assessment

[Organisation] maintains a comprehensive assessment of its operational risk profile (CPS 230 para 26). It is regularly updated to reflect changes in strategy, the risk environment and business mix, and is informed by scenario analysis (CPG 230 paras 21–22).

9.1 Required elements

9.2 Risk and control self-assessment (RCSA)

Each business unit and each critical operation completes an RCSA using the RiskFA Risk Management Framework sections 10–13 and the steps in CPG 230 Table 2:

10. Controls: design, implementation and testing

10.1 Design and implementation

[Organisation] designs, implements and embeds internal controls to mitigate its operational risks in line with its risk appetite and to meet its compliance obligations (CPS 230 para 28). To the extent possible, controls minimise the likelihood and impact of disruptions, particularly to critical operations (CPG 230 para 23). The control library should have a mix of preventive, detective and corrective controls and of automated and manual controls, and capture all controls, including those owned by related parties and service providers (CPG 230 para 24). Every Critical or High inherent risk has identified key controls (RiskFA Risk Management Framework section 12.2).

10.2 Monitoring and testing

Controls are regularly monitored, reviewed and tested for design and operating effectiveness, at a frequency commensurate with the materiality of the risks being controlled (CPS 230 para 29). Testing is conducted by staff independent of those with operational responsibility for the control (CPG 230 para 23).

11. Key risk indicators (KRIs)

KRIs support the risk appetite with indicators, limits and tolerance levels (CPS 230 para 15(b)) and give early warning of changes in risk or control effectiveness. They follow the RiskFA Risk Management Framework section 14: each KRI has an owner, a data source, a frequency, an early warning trigger (Amber) and a limit (Red) set in line with the Risk Appetite Statement. As a minimum there is at least [one] KRI for each Level 2 risk type in section 7, for each critical operation and for each material service provider. Appendix D lists common operational risk KRIs.

12. Scenario analysis

[Organisation] undertakes scenario analysis to identify and assess the potential impact of severe operational risk events, test its operational resilience and identify the need for new or amended controls and other mitigation strategies (CPS 230 para 26(c)).

13. Change management, new products and strategic decisions

• [Organisation] assesses the impact of its business and strategic decisions on its operational risk profile and operational resilience as part of business and strategic planning, including the impact of new products, services, geographies and technologies (CPS 230 para 25).
• Before the Board makes a decision that could affect the resilience of critical operations, senior management gives it clear and comprehensive information on the expected impacts (para 22).
• Before providing a material service to another party (for example to a related entity or a client), [Organisation] conducts a comprehensive risk assessment to ensure it can continue to meet its prudential obligations after entering into the arrangement (para 27).
• New products, material changes to products, processes or systems, new or materially changed material arrangements, outsourcing, offshoring and acquisitions follow the [New Product and Change Approval Policy]: an operational risk assessment using this Policy, review of the effect on critical operations, tolerance levels, BCPs and material service providers, second line review, and approval at the right level before launch.
• Technology changes follow the [Change Management Standard]: risk-based approval, testing, segregation between development and production, a back-out plan, and post-implementation review. Failed changes are recorded as incidents.

14. Managing specific operational risks

14.1 People

• Capacity and capability are planned for each critical operation, with key person dependencies identified and covered by succession plans and cross-training.
• Pre-employment screening, segregation of duties, mandatory leave or rotation for high-risk roles, and conflicts of interest declarations are key controls for people and fraud risk.
• Workplace health and safety, employment practices and remuneration consequences are managed under the relevant policies; risk and control outcomes are considered in performance and remuneration (CPS 511 where it applies).

14.2 Process

• Processes supporting critical operations and material risks are documented, owned and reviewed at least every [2] years.
• Manual workarounds, end-user computing tools (for example spreadsheets) used in key processes, and reconciliations are inventoried and controlled.

14.3 Technology and information security

• [Organisation] maintains appropriate and sound information and IT capability to meet current and projected business requirements and to support critical operations and risk management (CPS 230 para 24).
• The age and health of information assets are monitored (para 24): technology owners report end-of-support assets, technical debt, capacity and resilience gaps for systems that support critical operations.
• Information security meets CPS 234 (para 24) and is managed under the RiskFA Cyber Security Policy and the RiskFA Cyber Incident Response Plan.
• Disaster recovery plans for critical information assets are part of the BCP (para 33(c)), and recovery time and recovery point objectives support the tolerance levels (section 17).

14.4 Data

• Data risk is managed as part of operational risk (CPS 230 para 23). The key data needed for each critical operation is identified (para 26(b)).
• [Organisation] applies a systematic approach to data quality, validation, life-cycle management and data quality assurance, using APRA CPG 235 Managing Data Risk as guidance.
• Personal information is handled under the [Privacy Policy] and the RiskFA Data Breach Response Plan.

14.5 Legal, regulatory and compliance

• Legal, regulatory and compliance risk are managed as operational risks (CPS 230 para 23), supported by an obligations register that maps each obligation to its owner and controls.
• Breaches are assessed and notified under the RiskFA Incident & Issues Management Standard. Contracts are reviewed by [Legal] before signing, using standard terms where possible.

14.6 Conduct

• [Organisation] sets and maintains appropriate standards for conduct and compliance (CPS 230 para 11(a)). Conduct risks are assessed in the RCSA and monitored through complaints, product reviews and quality assurance, under the [Conduct Risk Policy].

14.7 Fraud

• Internal and external fraud are assessed in the RCSA and through a [biennial] fraud risk assessment. Key controls include segregation of duties, approval limits, verification of payment and account changes, transaction monitoring, and access reviews.
• Suspected fraud is recorded and handled under the RiskFA Incident & Issues Management Standard and the [Fraud and Corruption Control Policy]. Suspicious matters are reported under the AML/CTF program.
• Fund operators should treat fraud risk as part of their risk management systems (RG 259.129–RG 259.132).

14.8 Artificial intelligence and models

• The use of AI and models is assessed and controlled under the RiskFA AI Risk Management Policy, using the existing controls for models, data, change, service providers and information security. AI used in or for a critical operation is included in the critical operation's process and resource map.

14.9 External events and physical security

• Sites, facilities and utilities supporting critical operations are assessed for natural hazards and other external events, and covered by the BCP and physical security controls.
• Insurance (for example property, business interruption, crime and professional indemnity) is reviewed [annually] as a risk transfer measure, but does not replace controls.

15. Operational risk incidents

Operational risk incidents and near misses are identified, escalated, recorded and addressed in a timely manner, and are taken into account in the operational risk profile and the assessment of control effectiveness (CPS 230 para 31). All of this is done under the RiskFA Incident & Issues Management Standard, which sets the lifecycle (detect, escalate, contain, respond, review, as in CPG 230 Table 3), rating, timeframes, root cause analysis and closure rules.

16. Remediating control weaknesses

[Organisation] remediates material weaknesses in its operational risk management, including control gaps, weaknesses and failures, with clear accountability and assurance, addressing root causes in a timely manner (CPS 230 para 30).

17. Business continuity

This section sets the minimum CPS 230 requirements. The RiskFA Business Continuity Policy sets out how they are met (business impact analysis, plans, crisis management, testing and recovery). [Organisation] must (CPS 230 para 33):

17.1 Identifying critical operations

• Critical operations focus on outward-facing services to depositors, policyholders, beneficiaries and other customers, and the entity's role in the financial system (CPG 230 para 15). Consider operations whose disruption would have a direct or indirect material adverse impact on customers, or could affect the broader financial system (CPG 230 para 16).
• As a minimum, unless [Organisation] can justify otherwise, the following are critical operations (CPS 230 para 35): ADIs: payments, deposit-taking and management, custody, settlements and clearing; insurers: claims processing; RSE licensees: investment management and fund administration; all entities: customer enquiries and the systems and infrastructure needed to support critical operations.
• Critical functions determined under CPS 900 Resolution Planning are also classified as critical operations (CPG 230 para 17). APRA may require an operation to be classified as critical (CPS 230 para 36).
• Where an operation on the minimum list is not classified as critical, the reasons are documented, approved by an accountable person and reviewed at least annually (CPG 230 para 18).
• The register of critical operations holds at least the fields in Appendix B.

17.2 Tolerance levels

For each critical operation [Organisation] sets tolerance levels for (CPS 230 para 37): (a) the maximum period of time it would tolerate a disruption; (b) the maximum extent of data loss it would accept; and (c) the minimum service levels it would maintain under alternative arrangements. CPG 230 Table 4 links these to the maximum allowable disruption and recovery time objective, the recovery point objective and the recovery level objective.

17.3 The business continuity plan

The BCP must include (CPS 230 para 39): the register of critical operations and tolerance levels; triggers to identify a disruption and prompt activation, and arrangements to direct resources; actions to maintain critical operations within tolerance levels; an assessment of execution risks, required resources and preparatory measures, including key internal and external dependencies; and a communications strategy. [Organisation] maintains the capabilities to execute the BCP, including access to people, resources and technology; capabilities provided by another party must meet the service provider requirements in section 18 (para 40 and footnote 13). The BCP is linked to the disaster recovery, liquidity management, information security incident and crisis management plans (CPG 230 para 36).

17.4 Testing, review and assurance

• A systematic testing program covers all critical operations and includes an annual business continuity exercise, testing the BCP's effectiveness and the ability to meet tolerance levels in a range of severe but plausible scenarios (CPS 230 para 42). All critical operations would typically be considered over a multi-year cycle, for example three years (CPG 230 para 37).
• The program is tailored to [Organisation]'s material risks and includes disruptions to services provided by material service providers and scenarios where contingency arrangements are required (CPS 230 para 43). APRA may require an APRA-determined scenario.
• Test reports state the scope (including critical operations and tolerance levels tested), what was demonstrated (including whether tolerance levels were met), and issues, root causes and remediation (CPG 230 para 38). The Board reviews testing results and oversees the execution of findings (CPS 230 para 21(b)).
• The BCP is updated as necessary on an annual basis for changes in legal or organisational structure, business mix, strategy or risk profile, or for shortcomings found in review and testing (para 44).
• Internal Audit periodically reviews the BCP and gives the Board assurance that it is a credible plan and that testing is adequate and has been conducted satisfactorily (para 45).

17.5 Disruption outside tolerance

If a critical operation is disrupted outside tolerance, [Organisation] must notify APRA as soon as possible and not later than 24 hours after, covering the nature of the disruption, the action taken, the likely impact on business operations and the timeframe for returning to normal operations (CPS 230 para 41). The failure is also reported to the Board with a remediation plan (para 40) and recorded as a Critical incident.

18. Management of service provider arrangements

[Organisation] does not rely on a service provider unless it can ensure that it can continue to meet its prudential obligations in full and effectively manage the associated risks (CPS 230 para 14). Where it uses a service provider, it still owns and is responsible for managing the risk (CPG 230 para 44). The detailed requirements are in the [Service Provider Management Policy], which the Board approves (para 21(c)).

18.1 The service provider management policy

CPS 230 paras 46–47 require a comprehensive service provider management policy covering how [Organisation] identifies material service providers and manages service provider arrangements, including: the approach to entering into, monitoring, substituting and exiting agreements with material service providers; managing the risks associated with material service providers; and managing the risks of fourth parties that material service providers rely on to deliver a critical operation. CPG 230 para 45 adds that it would usually cover accountable persons' roles, selection and due diligence, materiality methodology, on-boarding and exit, BCP and alternative arrangements, issues and escalation, vetting of key personnel, and oversight of providers and service levels.

18.2 Material service providers and the register

• [Organisation] identifies and maintains a register of material service providers and manages the material risks of using them (CPS 230 para 48). The register holds at least the fields in Appendix C, and is submitted to APRA annually (para 50).
• As a minimum, unless [Organisation] can justify otherwise, providers of these services are material (para 49): ADIs: credit assessment, funding and liquidity management, mortgage brokerage; insurers: underwriting, claims management, insurance brokerage, reinsurance; RSE licensees: fund administration, custodial services, investment management, arrangements with promoters and financial planners; all entities: risk management, core technology services, internal audit.
• Arm's length transactions or intermediation are not automatically material unless they meet the para 48 criteria (CPG 230 para 47). Where a provider on the minimum list is not classified as material, the reasons are documented, approved by an accountable person and reviewed at least annually (CPG 230 para 49).
• Cohorts of providers whose aggregate impact is material, but where no single provider is, have additional processes and controls (CPG 230 para 51). APRA may require a provider or arrangement to be classified as material (CPS 230 para 51).

18.3 Before entering into or materially changing a material arrangement

• Undertake appropriate due diligence, including an appropriate selection process and an assessment of the provider's ability to provide the service on an ongoing basis (CPS 230 para 52(a)).
• Assess the financial and non-financial risks of reliance on the provider, including geographic location and concentration of the provider or the parties it relies on (para 52(b)), against risk appetite: services that must stay in-house, country, supplier, concentration and reputational risk (CPG 230 para 54), and for offshore providers, continuity, information security, control, compliance and APRA access (CPG 230 para 55).
• Have Internal Audit review any proposed material arrangement that outsources a critical operation, before the final decision (CPS 230 para 61; CPG 230 para 56).

18.4 Formal agreements

Every material arrangement has a formal legally binding agreement that, at a minimum (CPS 230 para 53): specifies the services and service levels; sets out the rights, responsibilities and expectations of each party, including ownership of assets, ownership and control of data, dispute resolution, audit access, liability and indemnity; ensures [Organisation] can meet its legal and compliance obligations; requires the provider to notify its use of other material service providers it materially relies on (sub-contracting); makes the provider liable for failures of its sub-contractors; includes a force majeure provision stating which parts continue; and includes termination rights for all or part of the arrangement (for RSE licensees, including where continuing would be inconsistent with the duty to act in beneficiaries' best financial interests). The agreement also allows APRA access to documentation, data and information, gives APRA the right to an on-site visit, and requires the provider not to impede APRA (para 54).

18.5 Managing each material arrangement

• Identify and manage risks to the provider's ability to provide the service on an ongoing basis, and risks to [Organisation] from the arrangement, such as step-in or contagion risk (CPS 230 para 55(a)–(b)).
• Ensure [Organisation] can execute its BCP if needed, and conduct an orderly exit (para 55(c)–(d)). Each material arrangement has a documented [exit plan], tested or reviewed at least [every 2 years].
• Monitor and report to senior management, commensurate with the nature and usage of the service, including regular assessment of performance against service levels, effectiveness of controls over the provider's risks, and compliance of both parties with the agreement (para 59). Periodic reviews also cover incidents, information security and business continuity capability, and strategic changes (CPG 230 para 53).
• Take reasonable steps to list the fourth parties involved in delivering each critical operation (CPG 230 para 48(c)), and satisfy itself that material providers' risk management and BCPs, including BCP testing, are robust (CPG 230 paras 39, 50).
• Report risk and performance on material service providers to the Board (para 21(c)).

18.6 Exempt categories (non-traditional service providers)

For a material arrangement with a provider in a category listed in the Attachment to CPS 230 (government agencies, regulators, central banks, financial market exchanges, operators of clearing and settlement facilities, operators of payment systems and schemes, and financial messaging infrastructures) that uses standardised terms or is not documented in a formal agreement, [Organisation] need not comply with paras 53, 54, 55(d), 59(a) and 59(c) (CPS 230 para 57). APRA may grant other exemptions by written notice (para 58). Exemptions should be applied only to the paragraphs that cannot reasonably be met, and [Organisation] still assesses materiality, performs due diligence where there is a choice, monitors the risks using public information and its own incident data, includes the arrangement in critical operations mapping and BCPs, and lists it on the register (CPG 230 paras 60–61 and Table 5).

18.7 Notifications about service providers

• Notify APRA as soon as possible and not more than 20 business days after entering into or materially changing an agreement for a service on which [Organisation] relies to undertake a critical operation (CPS 230 para 60(a)).
• Notify APRA before entering into any material offshoring arrangement, or when a significant change is proposed, including where data or personnel relevant to the service will be located offshore (para 60(b)).

19. Notifications to APRA

Notifications are made electronically using the form on APRA's website (CPG 230 para 14). Where a matter falls into two categories, the shorter timeframe applies (CPG 230 Table 1, note). Decisions to notify or not are recorded with reasons under the RiskFA Incident & Issues Management Standard.

20. Reporting

21. AFS licensees and fund operators not regulated by APRA

If [Organisation] is an AFS licensee that is not a body regulated by APRA, it must have adequate risk management systems (Corporations Act s912A(1)(h)) and adequate financial, technological and human resources (s912A(1)(d)). ASIC's guidance maps to this Policy as follows:

22. Review and assurance

• Operational risk management, covering every element of CPS 230 para 15, is included in the annual and comprehensive reviews of the risk management framework under CPS 220 (paras 44–45) or SPS 220 (paras 27–28) (CPS 230 para 16). AFS licensees review their risk management systems at least annually (RG 104 Table 3; RG 259.89).
• Internal Audit's plan covers operational risk management, including control testing, the BCP (CPS 230 para 45), proposed outsourcing of critical operations and compliance with the service provider management policy (para 61), on a risk-based cycle of no more than [3] years.
• The CRO reports [annually] to the Board Risk Committee on the effectiveness of this Policy, coverage of RCSAs, control testing, scenario analysis and BCP testing, and the CPS 230 requirement map (Appendix A).

23. Accountability and compliance with this Policy

• Every operational risk, key control, critical operation and material arrangement has a named owner. For FAR accountable entities, these responsibilities are consistent with accountability statements and the accountability map.
• Breaches of this Policy (for example a material arrangement entered into without due diligence or a formal agreement, untested key controls, or a missed APRA notification) are recorded as issues and managed under the RiskFA Consequence Management Framework.
• Exemptions need the written approval of the CRO, are time-limited and are reported to the Board Risk Committee. An exemption cannot override a legal or prudential requirement.

24. Related documents

• RiskFA Risk Management Framework and RiskFA Risk Appetite Statement
• RiskFA Incident & Issues Management Standard
• RiskFA Business Continuity Policy and RiskFA Crisis Management Plan
• RiskFA Cyber Security Policy, RiskFA Cyber Incident Response Plan and RiskFA Data Breach Response Plan
• RiskFA AI Risk Management Policy
• [Service Provider Management Policy], [New Product and Change Approval Policy], [Change Management Standard], [Fraud and Corruption Control Policy], [Conduct Risk Policy], [Privacy Policy]
• APRA: CPS 230 Operational Risk Management (determination No. 1 of 2026) and CPG 230 (July 2026); CPS 220 and SPS 220 Risk Management; CPS 234 Information Security; CPS 190 Recovery and Exit Planning; CPS 900 Resolution Planning; SPS 114 Operational Risk Financial Requirement; CPS 511 Remuneration; CPG 235 Managing Data Risk; APRA Material Service Provider Register Template (2026)
• Legislation: Corporations Act 2001 s912A; Financial Accountability Regime Act 2023
• ASIC: RG 104 AFS licensing: Meeting the general obligations; RG 259 Risk management systems of fund operators
• Standards: AS ISO 31000 Risk management, ISO 22301 Business continuity management systems

Appendix A. CPS 230 requirement map

Paragraph numbers are those of CPS 230 as reissued in 2026 (determination No. 1 of 2026, in force 1 July 2026). Use the right-hand column to show where each requirement is met.

Appendix B. Critical operations register: minimum fields

Fields marked † are in CPG 230 para 31 or in APRA's 2026 Material Service Provider Register Template ('COs and Tolerances' and 'CO Exceptions' tabs). The others are good practice.

Appendix C. Material service provider register: minimum fields

Fields marked † are in CPG 230 para 48 or in APRA's 2026 Material Service Provider Register Template ('MSP Details', 'MSP Register', 'MSP Exceptions' and 'Fourth Parties' tabs). APRA prefers its template but accepts another format. The others are good practice.

Appendix D. Operational risk KRIs

Examples of common KRIs. Choose those that fit [Organisation]'s risks, set the Amber and Red thresholds in line with the Risk Appetite Statement, and record an owner and data source for each. These are industry practice, not regulatory requirements.