urn: urn:intuitem:risk:library:cps-230
locale: en
ref_id: cps-230
name: Prudential Standard CPS 230
description: 'The aim of this Prudential Standard is to ensure that an APRA-regulated
  entity is

  resilient to operational risks and disruptions. An APRA-regulated entity must

  effectively manage its operational risks, maintain its critical operations through

  disruptions, and manage the risks arising from service providers.

  https://www.apra.gov.au/sites/default/files/2023-07/Prudential%20Standard%20CPS%20230%20Operational%20Risk%20Management%20-%20clean.pdf'
copyright: APRA
version: 1
publication_date: 2023-07-01
provider: APRA
packager: intuitem
objects:
  framework:
    urn: urn:intuitem:risk:framework:cps-230
    ref_id: cps-230
    name: Prudential Standard CPS 230
    description: 'The aim of this Prudential Standard is to ensure that an APRA-regulated
      entity is

      resilient to operational risks and disruptions. An APRA-regulated entity must

      effectively manage its operational risks, maintain its critical operations through

      disruptions, and manage the risks arising from service providers.

      https://www.apra.gov.au/sites/default/files/2023-07/Prudential%20Standard%20CPS%20230%20Operational%20Risk%20Management%20-%20clean.pdf'
    requirement_nodes:
    - urn: urn:intuitem:risk:req_node:cps-230:node2
      assessable: false
      depth: 1
      name: Key principles
    - urn: urn:intuitem:risk:req_node:cps-230:12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node2
      ref_id: '12'
      description: 'An APRA-regulated entity must:

        (a) effectively manage its operational risks, and set and maintain appropriate
        standards for conduct and compliance;

        (b) maintain its critical operations within tolerance levels through severe
        disruptions; and

        (c) manage the risks associated with the use of service providers.'
    - urn: urn:intuitem:risk:req_node:cps-230:13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node2
      ref_id: '13'
      description: An APRA-regulated entity must identify, assess and manage operational
        risks that may result from inadequate or failed internal processes or systems,
        the actions or inactions of people or external drivers and events. Operational
        risk is inherent in all products, activities, processes and systems.
    - urn: urn:intuitem:risk:req_node:cps-230:14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node2
      ref_id: '14'
      description: An APRA-regulated entity must, to the extent practicable, prevent
        disruption to critical operations, adapt processes and systems to continue
        to operate within tolerance levels in the event of a disruption and return
        to normal operations promptly once a disruption is over.
    - urn: urn:intuitem:risk:req_node:cps-230:15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node2
      ref_id: '15'
      description: An APRA-regulated entity must not rely on a service provider unless
        it can ensure that in doing so it can continue to meet its prudential obligations
        in full and effectively manage the associated risks.
    - urn: urn:intuitem:risk:req_node:cps-230:node7
      assessable: false
      depth: 1
      name: Risk management framework
    - urn: urn:intuitem:risk:req_node:cps-230:16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node7
      ref_id: '16'
      description: "As part of its risk management framework required under Prudential\
        \ Standard CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220\
        \ Risk Management (SPS 220), an APRA-regulated entity must develop and maintain:\
        \ \n(a) governance arrangements for the oversight of operational risk;\n(b)\
        \ an assessment of its operational risk profile, with a defined risk appetite\
        \ supported by indicators, limits and tolerance levels;\n(c) internal controls\
        \ that are designed and operating effectively for the management of operational\
        \ risks;\n(d) appropriate monitoring, analysis and reporting of operational\
        \ risks and escalation processes for operational incidents and events;\n(e)\
        \ business continuity plan(s) (BCPs) that set out how the entity would identify,\
        \ manage and respond to a disruption within tolerance levels and are regularly\
        \ tested with severe but plausible scenarios; and\n(f) processes for the management\
        \ of service provider arrangements."
    - urn: urn:intuitem:risk:req_node:cps-230:17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node7
      ref_id: '17'
      description: As part of the required reviews of the risk management framework
        under CPS 220 and SPS 220, an APRA-regulated entity must review its operational
        risk management. The reviews must cover those aspects of operational risk
        management set out in paragraph 16.
    - urn: urn:intuitem:risk:req_node:cps-230:18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node7
      ref_id: '18'
      description: Operational risk management must be integrated into an APRA-regulated
        entity's overall risk management framework and processes. Business continuity
        planning must be consistent with, and not conflict or undermine, an APRA-regulated
        entity's recovery and exit planning.
    - urn: urn:intuitem:risk:req_node:cps-230:19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node7
      ref_id: '19'
      description: 'Where APRA considers that an APRA-regulated entity''s operational
        risk management has material weaknesses, APRA may:

        (a) require an independent review of the entity''s operational risk management;

        (b) require the entity to develop a remediation program;

        (c) require the entity to hold additional capital, as relevant;

        (d) impose conditions on the entity''s licence; and

        (e) take other actions required in the supervision of this Prudential Standard.'
    - urn: urn:intuitem:risk:req_node:cps-230:node12
      assessable: false
      depth: 1
      name: Roles and responsibilities
    - urn: urn:intuitem:risk:req_node:cps-230:20
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node12
      ref_id: '20'
      description: The Board of an APRA-regulated entity is ultimately accountable
        for oversight of an entity's operational risk management. This includes business
        continuity and the management of service provider arrangements.
    - urn: urn:intuitem:risk:req_node:cps-230:21
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node12
      ref_id: '21'
      description: The Board must ensure that the APRA-regulated entity sets clear
        roles and responsibilities for senior managers for operational risk management,
        including business continuity and the management of service provider arrangements.
    - urn: urn:intuitem:risk:req_node:cps-230:22
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node12
      ref_id: '22'
      description: 'The Board must:

        (a) oversee operational risk management and the effectiveness of key internal
        controls in maintaining the entity''s operational risk profile within risk
        appetite. The Board must be provided with regular updates on the APRA-regulated
        entity''s operational risk profile and ensure senior management takes action
        as required to address any areas of concern;

        (b) approve the BCP and tolerance levels for disruptions to critical operations,
        review the results of testing and oversee the execution of any findings; and

        (c) approve the service provider management policy, and review risk and performance
        reporting on material service providers.'
    - urn: urn:intuitem:risk:req_node:cps-230:23
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node12
      ref_id: '23'
      description: Senior management of an APRA-regulated entity must provide clear
        and comprehensive information to the Board on the expected impacts on the
        entity's critical operations when the Board is making decisions that could
        affect the resilience of critical operations.
    - urn: urn:intuitem:risk:req_node:cps-230:node17
      assessable: false
      depth: 1
      name: Operational risk management
    - urn: urn:intuitem:risk:req_node:cps-230:24
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node17
      ref_id: '24'
      description: An APRA-regulated entity must manage its full range of operational
        risks, including but not limited to legal risk, regulatory risk, compliance
        risk, conduct risk, technology risk, data risk and change management risk.
        Senior management are responsible for operational risk management across the
        end-to-end process for all business operations.
    - urn: urn:intuitem:risk:req_node:cps-230:25
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node17
      ref_id: '25'
      description: An APRA-regulated entity must maintain appropriate and sound information
        and information technology (IT) capability to meet its current and projected
        business requirements and to support its critical operations and risk management.
        In managing technology risks, an APRA-regulated entity must monitor the age
        and health of its information assets and meet the requirements for information
        security in Prudential Standard CPS 234 Information Security (CPS 234).
    - urn: urn:intuitem:risk:req_node:cps-230:node20
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node17
      name: Operational risk profile and assessment
    - urn: urn:intuitem:risk:req_node:cps-230:26
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node20
      ref_id: '26'
      description: An APRA-regulated entity must assess the impact of its business
        and strategic decisions on its operational risk profile and operational resilience,
        as part of its business and strategic planning processes. This must include
        an assessment of the impact of new products, services, geographies and technologies
        on its operational risk profile.
    - urn: urn:intuitem:risk:req_node:cps-230:27
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node20
      ref_id: '27'
      description: 'An APRA-regulated entity must maintain a comprehensive assessment
        of its operational risk profile. As part of this, an APRA-regulated entity
        must:

        (a) maintain appropriate and effective information systems to monitor operational
        risk, compile and analyse operational risk data and facilitate reporting to
        the Board and senior management;

        (b) identify and document the processes and resources needed to deliver critical
        operations, including people, technology, information, facilities and service
        providers, the interdependencies across them, and the associated risks, obligations,
        key data and controls; and

        (c) undertake scenario analysis to identify and assess the potential impact
        of severe operational risk events, test its operational resilience and identify
        the need for new or amended controls and other mitigation strategies.'
    - urn: urn:intuitem:risk:req_node:cps-230:28
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node20
      ref_id: '28'
      description: An APRA-regulated entity must conduct a comprehensive risk assessment
        before providing a material service to another party, to ensure that the APRA-regulated
        entity is able to continue to meet its prudential obligations after entering
        into the arrangement. APRA may require an APRA-regulated entity to review
        and strengthen internal controls or processes where APRA considers there to
        be heightened prudential risks in such circumstances.
    - urn: urn:intuitem:risk:req_node:cps-230:node24
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node17
      name: Operational risk controls
    - urn: urn:intuitem:risk:req_node:cps-230:29
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node24
      ref_id: '29'
      description: An APRA-regulated entity must design, implement and embed internal
        controls to mitigate its operational risks in line with its risk appetite
        and meet its compliance obligations.
    - urn: urn:intuitem:risk:req_node:cps-230:30
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node24
      ref_id: '30'
      description: An APRA-regulated entity must regularly monitor, review and test
        controls for design and operating effectiveness, the frequency of which must
        be commensurate with the materiality of the risks being controlled. The results
        of testing must be reported to senior management and any gaps or deficiencies
        in the control environment must be rectified in a timely manner.
    - urn: urn:intuitem:risk:req_node:cps-230:31
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node24
      ref_id: '31'
      description: An APRA-regulated entity must remediate material weaknesses in
        its operational risk management, including control gaps, weaknesses and failures.
        This remediation must be supported by clear accountabilities and assurance
        and address the root causes of weaknesses in a timely manner. An APRA-regulated
        entity must include identified control gaps, weaknesses and failures in its
        operational risk profile until such matters are remediated.
    - urn: urn:intuitem:risk:req_node:cps-230:node28
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node17
      name: Operational risk incidents
    - urn: urn:intuitem:risk:req_node:cps-230:32
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node28
      ref_id: '32'
      description: An APRA-regulated entity must ensure that operational risk incidents
        and near misses are identified, escalated, recorded and addressed in a timely
        manner. An APRA-regulated entity must take incidents and near misses into
        account in its assessment of its operational risk profile and control effectiveness
        in a timely manner.
    - urn: urn:intuitem:risk:req_node:cps-230:33
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node28
      ref_id: '33'
      description: An APRA-regulated entity must notify APRA as soon as possible,
        and not later than 72 hours, after becoming aware of an operational risk incident
        that it determines to be likely to have a material financial impact or a material
        impact on the ability of the entity to maintain its critical operations.
    - urn: urn:intuitem:risk:req_node:cps-230:node31
      assessable: false
      depth: 1
      name: Business continuity
    - urn: urn:intuitem:risk:req_node:cps-230:34
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node31
      ref_id: '34'
      description: 'An APRA-regulated entity must:

        (a) define, identify and maintain a register of its critical operations;

        (b) take reasonable steps to minimise the likelihood and impact of disruptions
        to its critical operations;

        (c) maintain a credible BCP that sets out how it would maintain its critical
        operations within tolerance levels through disruptions, including disaster
        recovery planning for critical information assets;

        (d) activate its BCP if needed in the event of a disruption; and

        (e) return to normal operations promptly after a disruption is over.'
    - urn: urn:intuitem:risk:req_node:cps-230:node33
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node31
      name: Critical operations and tolerance levels
    - urn: urn:intuitem:risk:req_node:cps-230:35
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node33
      ref_id: '35'
      description: Critical operations are processes undertaken by an APRA-regulated
        entity or its service provider which, if disrupted beyond tolerance levels,
        would have a material adverse impact on its depositors, policyholders, beneficiaries
        or other customers, or its role in the financial system.
    - urn: urn:intuitem:risk:req_node:cps-230:36
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node33
      ref_id: '36'
      description: "An APRA-regulated entity must, at a minimum, classify the following\
        \ business operations as critical operations, unless it can justify otherwise:\n\
        (a) for an ADI: payments, deposit-taking and management, custody, settlements\
        \ and clearing;\n(b) for an insurer (general, life, private health): claims\
        \ processing;\n(c) for an RSE licensee: investment management and fund administration;\
        \ and \n(d) for all APRA-regulated entities: customer enquiries and the systems\
        \ and infrastructure needed to support critical operations."
    - urn: urn:intuitem:risk:req_node:cps-230:37
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node33
      ref_id: '37'
      description: APRA may require an APRA-regulated entity, or a class of APRA-regulated
        entities, to classify a business operation as a critical operation.
    - urn: urn:intuitem:risk:req_node:cps-230:38
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node33
      ref_id: '38'
      description: 'For each critical operation, an APRA-regulated entity must establish
        tolerance levels for:

        (a) the maximum period of time the entity would tolerate a disruption to the
        operation;

        (b) the maximum extent of data loss the entity would accept as a result of
        a disruption; and

        (c) minimum service levels the entity would maintain while operating under
        alternative arrangements during a disruption.'
    - urn: urn:intuitem:risk:req_node:cps-230:39
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node33
      ref_id: '39'
      description: APRA may require an APRA-regulated entity to review and change
        its tolerance levels for a critical operation. APRA may set tolerance levels
        for an APRA-regulated entity, or a class of APRA-regulated entities, where
        it identifies a heightened risk or material weakness.
    - urn: urn:intuitem:risk:req_node:cps-230:node39
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node31
      name: Business continuity plan
    - urn: urn:intuitem:risk:req_node:cps-230:40
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node39
      ref_id: '40'
      description: 'An APRA-regulated entity''s BCP must include:

        (a) the register of critical operations and associated tolerance levels;

        (b) triggers to identify a disruption and prompt activation of the plan, and
        arrangements to direct resources in the event of activation;

        (c) actions it would take to maintain its critical operations within tolerance
        levels through disruptions;

        (d) an assessment of the execution risks, required resources, preparatory
        measures, including key internal and external dependencies needed to support
        the effective implementation of the BCP actions; and

        (e) a communications strategy to support execution of the plan.'
    - urn: urn:intuitem:risk:req_node:cps-230:41
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node39
      ref_id: '41'
      description: An APRA-regulated entity must maintain the capabilities required
        to execute the BCP, including access to people, resources and technology.
        An APRA-regulated entity must monitor compliance with its tolerance levels
        and report any failure to meet tolerance levels, together with a remediation
        plan, to the Board.
    - urn: urn:intuitem:risk:req_node:cps-230:42
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node39
      ref_id: '42'
      description: An APRA-regulated entity must notify APRA as soon as possible,
        and not later than 24 hours after, if it has suffered a disruption to a critical
        operation outside tolerance. The notification must cover the nature of the
        disruption, the action taken, the likely impact on the entity's business operations
        and the timeframe for returning to normal operations.
    - urn: urn:intuitem:risk:req_node:cps-230:node43
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node31
      name: Testing and review
    - urn: urn:intuitem:risk:req_node:cps-230:43
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node43
      ref_id: '43'
      description: An APRA-regulated entity must have a systematic testing program
        for its BCP that covers all critical operations and includes an annual business
        continuity exercise. The program must test the effectiveness of the entity's
        BCP and its ability to meet tolerance levels in a range of severe but plausible
        scenarios.
    - urn: urn:intuitem:risk:req_node:cps-230:44
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node43
      ref_id: '44'
      description: The testing program must be tailored to the material risks of the
        APRA-regulated entity and include a range of severe but plausible scenarios,
        including disruptions to services provided by material service providers and
        scenarios where contingency arrangements are required. APRA may require the
        inclusion of an APRA-determined scenario in a business continuity exercise
        for an APRA-regulated entity, or a class of APRA-regulated entities.
    - urn: urn:intuitem:risk:req_node:cps-230:45
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node43
      ref_id: '45'
      description: An APRA-regulated entity must update, as necessary, its BCP on
        an annual basis to reflect any changes in legal or organisational structure,
        business mix, strategy or risk profile or for shortcomings identified as a
        result of the review and testing of the BCP.
    - urn: urn:intuitem:risk:req_node:cps-230:46
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node43
      ref_id: '46'
      description: An APRA-regulated entity's internal audit function must periodically
        review the entity's BCP and provide assurance to the Board that the BCP sets
        out a credible plan for how the entity would maintain its critical operations
        within tolerance levels through severe disruptions and that testing procedures
        are adequate and have been conducted satisfactorily.
    - urn: urn:intuitem:risk:req_node:cps-230:node48
      assessable: false
      depth: 1
      name: Management of service provider arrangements
    - urn: urn:intuitem:risk:req_node:cps-230:47
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node48
      ref_id: '47'
      description: An APRA-regulated entity must maintain a comprehensive service
        provider management policy. The policy must cover how the entity will identify
        material service providers and manage service provider arrangements, including
        the management of material risks associated with the arrangements.
    - urn: urn:intuitem:risk:req_node:cps-230:48
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node48
      ref_id: '48'
      description: 'The policy must include:

        (a) the entity''s approach to entering into, monitoring, substituting and
        exiting agreements with material service providers;

        (b) the entity''s approach to managing the risks associated with material
        service providers; and

        (c) the entity''s approach to managing the risks associated with any fourth
        parties that material service providers rely on to deliver a critical operation
        to the APRA-regulated entity.'
    - urn: urn:intuitem:risk:req_node:cps-230:node51
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node48
      name: Material service providers
    - urn: urn:intuitem:risk:req_node:cps-230:49
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node51
      ref_id: '49'
      description: An APRA-regulated entity must identify and maintain a register
        of its material service providers and manage the material risks associated
        with using these providers. Material service providers are those on which
        the entity relies to undertake a critical operation or that expose it to material
        operational risk. Material arrangements are those on which the entity relies
        to undertake a critical operation or that expose it to material operational
        risk.
    - urn: urn:intuitem:risk:req_node:cps-230:50
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node51
      ref_id: '50'
      description: 'An APRA-regulated entity must, at a minimum, classify a provider
        of the following services as a material service provider, unless it can justify
        otherwise:

        (a) for an ADI: credit assessment, funding and liquidity management and mortgage
        brokerage;

        (b) for an insurer (general, life, private health): underwriting, claims management,
        insurance brokerage and reinsurance;

        (c) for an RSE licensee: fund administration, custodial services, investment
        management and arrangements with promoters and financial planners; and

        (d) for all APRA-regulated entities: risk management, core technology services
        and internal audit.'
    - urn: urn:intuitem:risk:req_node:cps-230:51
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node51
      ref_id: '51'
      description: An APRA-regulated entity must submit its register of material service
        providers to APRA on an annual basis.
    - urn: urn:intuitem:risk:req_node:cps-230:52
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node51
      ref_id: '52'
      description: APRA may require an APRA-regulated entity, or a class of APRA-regulated
        entities, to classify a service provider, type of service provider or service
        provider arrangement as material.
    - urn: urn:intuitem:risk:req_node:cps-230:node56
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node48
      name: Service provider agreements
    - urn: urn:intuitem:risk:req_node:cps-230:53
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node56
      ref_id: '53'
      description: 'Before entering into or materially modifying a material arrangement,
        an APRA-regulated entity must:

        (a) undertake appropriate due diligence, including an appropriate selection
        process and an assessment of the ability of the service provider to provide
        the service on an ongoing basis; and

        (b) assess the financial and non-financial risks from reliance on the service
        provider, including risks associated with geographic location or concentration
        of the service provider(s) or parties the service provider relies on in providing
        the service.'
    - urn: urn:intuitem:risk:req_node:cps-230:54
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node56
      ref_id: '54'
      description: 'For all material arrangements, an APRA-regulated entity must maintain
        a formal legally binding agreement (formal agreement). The formal agreement
        must, at a minimum:

        (a) specify the services covered by the agreement and associated service levels;

        (b) set out the rights, responsibilities and expectations of each party to
        the agreement, including in relation to the ownership of assets, ownership
        and control of data, dispute resolution, audit access, liability and indemnity;

        (c) include provisions to ensure the ability of the entity to meet its legal
        and compliance obligations;

        (d) require notification by the service provider of its use of other material
        service providers that it materially relies upon in providing the service
        to the APRA-regulated entity through sub-contracting or other arrangements;

        (e) require the liability for any failure on the part of any sub-contractor
        to be the responsibility of the service provider;

        (f) include a force majeure provision indicating those parts of the contract
        that would continue in the case of a force majeure event; and

        (g) termination provisions including, but not limited to, the right to terminate
        both the arrangement in its entirety or parts of the arrangement. For an RSE
        licensee, termination provisions must include the ability for the RSE licensee
        to terminate the arrangement where to continue the arrangement would be inconsistent
        with the RSE licensee''s duty to act in the best financial interests of beneficiaries
        (refer to subsection 52(2)(c) of the SIS Act).'
    - urn: urn:intuitem:risk:req_node:cps-230:55
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node56
      ref_id: '55'
      description: 'The formal agreement must also include provisions that:

        (a) allow APRA access to documentation, data and any other information related
        to the provision of the service;

        (b) allow APRA the right to conduct an on-site visit to the service provider;
        and

        (c) ensure the service provider agrees not to impede APRA in fulfilling its
        duties as prudential regulator.'
    - urn: urn:intuitem:risk:req_node:cps-230:56
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node56
      ref_id: '56'
      description: 'For each material arrangement an APRA-regulated entity must:

        (a) identify and manage risks that could affect the ability of the service
        provider to provide the service on an ongoing basis;

        (b) identify and manage risks to the APRA-regulated entity that could result
        from the arrangement, such as step-in risk or contagion risk;

        (c) ensure it can execute its BCP if needed; and

        (d) ensure it can conduct an orderly exit from the arrangement if needed.'
    - urn: urn:intuitem:risk:req_node:cps-230:57
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node56
      ref_id: '57'
      description: APRA may require an APRA-regulated entity to review and make changes
        to a service provider arrangement where it identifies heightened prudential
        concerns.
    - urn: urn:intuitem:risk:req_node:cps-230:node62
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:cps-230:node48
      name: Monitoring, notifications and review
    - urn: urn:intuitem:risk:req_node:cps-230:58
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node62
      ref_id: '58'
      description: 'An APRA-regulated entity must monitor and ensure that senior management
        receive reporting on material arrangements commensurate with the nature and
        usage of the service. This monitoring must include a regular assessment of:

        (a) performance under the service agreement with reference to agreed service
        levels;

        (b) the effectiveness of controls to manage the risks associated with the
        use of the service provider; and

        (c) compliance of both parties with the service provider agreement.'
    - urn: urn:intuitem:risk:req_node:cps-230:59
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node62
      ref_id: '59'
      description: 'An APRA-regulated entity must notify APRA:

        (a) as soon as possible and not more than 20 business days after entering
        into or materially changing an agreement for the provision of a service on
        which the entity relies to undertake a critical operation; and

        (b) prior to entering into any material offshoring arrangement, or when there
        is a significant change proposed to the arrangement, including in circumstances
        where data or personnel relevant to the service being provided will be located
        offshore.'
    - urn: urn:intuitem:risk:req_node:cps-230:60
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:cps-230:node62
      ref_id: '60'
      description: An APRA-regulated entity's internal audit function must review
        any proposed material arrangement involving the outsourcing of a critical
        operation. The internal audit function must regularly report to the Board
        or Board Audit Committee on compliance of such arrangements with the entity's
        service provider management policy.
