Risky Business: Data, Technology, and CPS 230

With APRA due to release the final version of Prudential Practice Guide CPG 230 (Operational Risk Management) within the next month or so, it’s time to turn our minds to the data and technology impacts of APRA’s new operational risk management regime. 

We refer below to “regulated entities” but it’s worth noting that all of this is also relevant to third-parties — like us — that work with regulated entities. 

For anyone who needs a refresher, the key objectives of CPS 230 are to (and we quote APRA here): 

• Strengthen operational risk management. 
• Improve business continuity planning. 
• Enhance third-party risk management. 

As a data and technology firm, we divide the responses to these overarching goals into four categories: 

1. Systems and applications. 
2. Business intelligence and data analytics. 
3. Technology process and governance. 
4. Other stuff (not related to data and tech). 

Systems and applications

Organisations subject to CPS 230 will need to ensure that they have systems in place to perform two key functions: risk management and service provider management. Fortunately, many of the solutions available on the market have modules that fulfil both purposes.

Essentially, APRA regulated entities should be looking for an appropriate system that includes the following capabilities: 

• A comprehensive risk register. 
• An asset register, preferably one that integrates with and actively discovers your IT ecosystem. 
• Standard and certification management. 
• Policy lifecycle management. 
• Incident management. 
• Third-party lifecycle management, including: onboarding, risk assessment, risk mitigation, reporting and monitoring, and offboarding. 
• Third-party risk intelligence — i.e. access to databases of existing risk assessments on service providers. 
• Support for business continuity planning.

Such systems are often marketed as risk management information systems, integrated risk management systems, or GRC platforms. As with all system implementations, the configuration and proper integration of these tools into existing ecosystems will be crucial. Appropriate processes will need to be built around them to ensure that they actually serve their stated function and support compliance with CPS 230.

Business intelligence and data analytics

Putting aside our self-consciousness about the number of lists in this article, there are three elements to this:

1. Monitoring and gathering data from a range of sources that may be relevant to operational risk management, business continuity planning, and third-party risk management. CPS 230 refers to people, technology, information, facilities, and service providers — data relating all of these will need to be gathered and refreshed regularly. 
2. Analysing this data to identify, assess, and develop mitigations and controls for operational risks. Organisations subject to CPS 230 will need to be creative and proactive in their approach here. It does not take too much imagination to envision how analysis of data relating to insurance claims, social media sentiment, or employee turnover could uncover operational risks. Analysis of patterns in superannuation contributions could signal risks and issues at any number of points in the contributions process. 
3. Reporting on operational risk management, business continuity planning, and third-party risk management to executive management, boards, and APRA. Under CPS 230, APRA regulated entities will be required to report operational risk incidents that meet a materiality threshold to APRA within 72 hours. APRA will need to be notified within 24 hours if business continuity plans (BCPs) are activated.

Technology process and governance 

CPS 230 necessitates the operation of several frameworks related to technology. In particular, regulated entities will need to take a framework approach to business continuity and third-party management. 

The approach to business continuity planning revolves around the need to maintain a register of critical operations. For each of those critical operations, an organisation’s Board will need to approve tolerance levels relating to downtime, data loss, and service levels. Organisations will need to ensure that they have a systematic testing program in place for their BCP that covers all critical operations and a range of “severe but plausible” scenarios. 

Regulated entities will also need a robust framework in place for the management of third-parties. Ensuring that the risks associated with third-parties are well understood and managed will involve the analysis of technology risks. Service providers and vendors will need to undergo assessments to ensure they are adhering to best practices in cyber security — compliance with CPS 234 is a minimum, but organisations would do well to insist their partners surpass this. A comprehensive technology due diligence process should become part of any technology procurement process. 

Other stuff 

There are, of course, elements of operational risk management that are not directly related to data and technology, that our colleagues with more diverse interests would object to us dismissing as “other stuff”. As is often the case, data and technology will play an important role in CPS 230 compliance but are not the whole story. That said, going beyond mere compliance will hinge on the more creative and proactive measures organisations can take enabled by data analysis. If organisation can get this right, CPS 230 could be a potential opportunity to run safer and stabler operations, rather than simply a box-ticking exercise.

This article was produced as part of The Quarterly – Data and Technology in Superannuation, Q3 FY24

For more information about anything you’ve read here, or if you have a more general inquiry, please contact us.

Key Contributors:

Kevin Fernandez is General Manager, Market Strategy and Propositions at Novigi, and is based in the Melbourne office.

Sophie Bowen-James is an analyst in the Market Strategy and Propositions team at Novigi, and is based in the Sydney office.