Business Continuity Under CPS 230: From Plan on the Shelf to Tested Resilience

The Standard Raises the Bar Beyond Traditional BCP

Business continuity planning has long been a fixture of financial sector risk management, but CPS 230 treats it as a live operational capability rather than a documented artefact. The standard requires an APRA-regulated entity to be able to continue delivering its critical operations within tolerance levels through severe disruptions, supported by a credible business continuity plan. The emphasis on “credible” is deliberate: APRA expects evidence that the plan has been tested against severe but plausible scenarios and that the entity understands the resources—people, technology, data, premises and third-party services—on which each critical operation depends.

For non-significant financial institutions, the business continuity and scenario analysis requirements were deferred until 1 July 2026, giving smaller entities additional time to prepare. That deferral has now expired. From the 2026 deadline onward, the supervisory expectation is that even smaller insurers, credit unions and superannuation funds can demonstrate tested continuity arrangements, not merely a plan that exists in a document repository.

Scenario Libraries and Severe but Plausible Disruption

APRA’s Prudential Practice Guide CPG 230 points entities toward a library of severe but plausible scenarios and a comprehensive testing strategy and plan. The scenario set is not limited to cyber incidents, although cyber remains a central concern. It extends to technology outages, third-party failures, loss of key premises, data corruption, payment system disruption and extreme weather events—disruptions that may occur simultaneously or cascade across dependencies.

The testing obligation is where CPS 230 departs most sharply from older continuity regimes. Entities are expected to conduct regular stress testing and scenario analysis to evaluate preparedness for operational risks, and to use the results to identify vulnerabilities and adjust tolerance levels. A test that does not challenge assumptions or surface weaknesses is unlikely to satisfy the supervisory expectation. The plan must be exercised, reviewed and improved, with board oversight of the outcomes.

Connecting Continuity to Service Provider Risk

CPS 230 deliberately integrates business continuity with service provider management. An entity cannot credibly claim continuity for a critical operation if a material service provider’s failure would exhaust its tolerance before workarounds can be activated. That is why the standard requires entities to understand the end-to-end resources behind critical operations and to ensure that material arrangements include business continuity obligations, audit and access rights, and subcontracting controls.

The 2026 amendments for non-traditional service providers do not switch off this expectation. Even where contractual relief applies, regulated entities are still required to actively manage the operational risks arising from reliance on those providers. In practice, that may mean developing alternative access arrangements, maintaining contingency liquidity or operational workarounds, and documenting why the residual risk is acceptable within the entity’s tolerance levels.

The Assurance Test: Can You Prove It?

Deloitte Australia’s analysis frames the post-implementation phase as a shift from design to assurance: boards and senior management need confidence that CPS 230 obligations are being met on an ongoing and sustainable basis, supported by independent assurance over the effectiveness of operational risk management, business continuity management and service provider management. For business continuity specifically, that means internal audit and risk functions must be able to test whether the plan works under realistic conditions, whether recovery times are achievable, and whether dependencies on material providers are properly reflected in continuity assumptions.