Part 1 – Detailed Analysis of CPS 230 and comparison with existing standards

Issue

What's new?

Outcomes-based requirements

CPS 230 contains a number of overarching key principles that require APRA-regulated entities to manage operational risks, and that will be assessed from an outcomes perspective. For example, an APRA-regulated entity must:

• maintain its critical operations within tolerance levels through severe disruptions;
• to the extent possible, prevent disruption to critical operations; and
• not rely on a service provider unless it can ensure that in doing so it can continue to meet its prudential obligations in full.

Supplementing these principles are a number of other new requirements, including requirements to understand its operational risk profile, to conduct comprehensive risk assessments before providing material services to other parties (which Draft CPG 230 says is intended to apply to intra-group arrangements and services to non-APRA-regulated parties), and to design and embed internal operational risk controls in all of its products, activities, processes and systems.

Draft CPG 230 emphasises that an APRA-regulated entity’s approach to operational risk must be appropriate to its size, business mix and complexity. It notes that not all of the practices outlined in the guidance will be relevant for every entity – eg, certain guidance may be more relevant depending on the size, nature and complexity of a regulated entity’s operations. In particular, for smaller entities, APRA expects a simpler approach to implementing and complying with CPS 230. In draft CPG 230, APRA says that this applies to the level of granularity expected in assessing operational risk profile, including identifying and documenting processes, resources and scenario analysis. Additionally, a smaller entity could identify and document its processes and resources for critical operations only at a high level. However, APRA has not identified what it considers to be 'smaller entities' and it has stayed clear of using terminology in other recent prudential standards, such as 'significant financial institutions' (or SFIs) and 'non-significant financial institutions' (or non-SFIs), based on industry feedback that such distinctions were not appropriate.

Draft CPG 230 also refers to a spectrum of standards – ranging from baseline obligations that regulated entities must comply with under CPS 230, to 'typical', 'better practice' and 'best practice' standards. It is not clear how a failure to meet 'better practice' or 'best practice' would be viewed by APRA (for example, whether these are APRA's expectations of larger and more complex entities – or just a high-water mark for entities to consider).

Board and senior management accountability

CPS 230 provides that the board will be accountable for operational risk management (including business continuity and service provider arrangements). Until now, APRA has required the board to be ultimately responsible for certain matters in its prudential standards. The language shift to accountable is subtle but important in terms of APRA's expectation for boards, and sits hand-in-hand with APRA's outcomes-focussed supervision.

As part of this, APRA expects the board to set clear roles and responsibilities for senior managers and to oversee operational risk management.

APRA has stated that the intent is not for the board to play a role in day-to-day operational risk management; rather, that it expects a prudent board would have a clear understanding of who is accountable within the entity for which aspect of operational risk management, including business continuity and the management of service provider arrangements, and be confident that there are no gaps in accountabilities.

In return, senior management must provide clear and comprehensive information to the board on the entity's operational risk profile and the expected impact to critical operations when the board is making decisions. In draft CPG 230, APRA says that it expects senior management would typically define roles and responsibilities regarding operational risk management for senior management across the entity, through a combination of processes, including role statements, reporting lines and charters of governing bodies. APRA also suggests that this might involve end-to-end business process mapping conducted across all business operations, including those performed by service providers. 

The onus is firmly placed on business-line management to take responsibility for operational risk, as opposed to relying on risk management functions. In draft CPG 230, APRA says that it is best practice for business line management to be responsible for embedding operational risk management practices, and, as a result, to also be the owners of the risk within the entity. Further, APRA expects that there would typically be established processes for delegations, and escalation of risks and issues to the board and senior management, and defined reporting requirements.

APRA's powers

APRA has given itself a raft of new powers in relation to the supervision of operational risk management (including powers to require entities to take specific actions where material weaknesses are identified, to adjust tolerance levels, to classify a business operation as a critical operation, and to classify service providers as material, amongst other things). See Part 2 – Practical Implementation Guide (PDF) for more detail.

APRA reporting

APRA-regulated entities are currently required to report information security incidents to APRA as soon as possible and no later than 72 hours after becoming aware of the incident under Prudential Standard CPS 234 (Information Security). APRA proposes that it must be notified of operational risk incidents in the same timeframe (where the incident is likely to have a material financial impact or a material impact on the ability of the entity to maintain its critical operations). APRA has clarified that a notification of an information security incident reported under CPS 234 does not need to be separately reported under the notification requirements of CPS 230.

Issue

What's new?

How is this different (to CPS and SPS 232)?

Business continuity plan (BCP)

CPS 230 requires APRA-regulated entities to maintain a credible BCP that sets out how the entity would maintain its 'critical operations' within 'tolerance' levels through disruptions, including disaster recovery planning for critical information assets. The BCP must be approved by the board.

This must include a register of critical operations and associated tolerance levels, triggers to identify disruption and prompt activation of the BCP, actions the entity will take to maintain critical operations within tolerance levels where disruptions arise, assessment of the key dependencies needed to support the effective implementation of the BCP and a communications strategy to support the execution of the plan.

For APRA-regulated entities (other than private health insurers)¹ the requirement to maintain a BCP is not new, although some new concepts for its contents have been introduced, including 'critical operations' and 'tolerances' as described.

Some of the other prescriptive requirements for a BCP have been brought across (although reframed) in CPS 230.

'Critical operation' identification

APRA-regulated entities will be required to define, identify and maintain a register of their 'critical operations'. These are processes undertaken by an APRA-regulated entity or its service provider which, if disrupted beyond tolerance levels (see below), would have a material adverse impact on its depositors, policyholders, beneficiaries or other customers, or its role in the financial system.

An APRA-regulated entity must, at a minimum, classify the following business operations as critical operations, unless it can 'justify otherwise':

• for an ADI: payments, deposit taking and management, custody, settlements and clearing;
• for an insurer: claims processing;
• for an RSE licensee: investment management and fund administration; and
• for all APRA-regulated entities: customer inquiries and the systems and infrastructure needed to support critical operations.

APRA may also require an APRA-regulated entity to classify a business operation as a critical operation.

The new concept of 'critical operations' is similar, although arguably wider than the current requirements applicable to APRA-regulated entities.

APRA-regulated entities are currently required to identify their 'critical business functions' – being their critical business functions, resources and infrastructure. This will be broadened in CPS 230 to require identification of the 'processes' of both the APRA-regulated entity and its service providers. APRA has also included specific examples in CPS 230 to ensure baseline critical operations are consistently captured for each industry.

The concept of 'critical operations' also captures service-provider processes, meaning that these must also be specifically addressed in the institution's BCP. The current requirement in relation to service providers is that an APRA-regulated entity must satisfy itself as to the adequacy of the service provider's BCP and any dependencies between the two.

Tolerance setting

APRA-regulated entities will be required to set tolerance levels for each critical operation, being:

• the maximum period of time the entity would tolerate a disruption to the operation;
• the maximum extent of data loss the entity would accept as a result of a disruption; and
• minimum service levels to maintain while operating during a disruption.

APRA may require that tolerance levels for critical operations are changed or may set tolerance levels where it identifies heightened risk or material weaknesses.

The new requirement to set tolerance levels is a further shift towards outcomes-focussed regulation. APRA-regulated entities are currently required to undertake an impact analysis of plausible disruption scenarios and the period of time for which the institution could not operate without each critical business operation. However, the new requirements are intended to focus institutions' risk appetite for disruption in respect of all processes as part of their business continuity plans. Failure to meet tolerance levels must be reported to the board under CPS 230.

In draft CPG 230, APRA says that, while the board approves the entity’s overall tolerance levels, senior management are able to set more granular tolerance levels and indicators that would be consistent with, and not undermine, the board-approved levels.

Testing and review

New testing requirements have been included. APRA-regulated entities must have a systematic testing program for their BCP that covers all critical operations and includes an annual business continuity exercise. The program, which must be tailored to the entity's material risks, must test the effectiveness of the entity’s BCP and its ability to meet tolerance levels in a range of severe but plausible scenarios. APRA may also require the entity to test against an APRA-determined scenario.

The scope of the testing requirements have been expanded from their current form (which only require the institution to 'review and test' the BCP, but without any specific requirements as to the testing criteria). These requirements would apply in addition to the current requirements to review and audit the BCP.

APRA notifications

APRA-regulated entities would be required to notify APRA as soon as possible and not later than 24 hours after a disruption to a critical operation outside tolerance.

APRA may require an APRA-regulated entity to review and change its tolerance levels for a critical operation.

Although the timeframe (maximum 24 hours) is the same as the current requirements, the trigger for notification to APRA is the disruption to a critical operation outside tolerance, as opposed to when the entity 'experiences a major disruption that has the potential to have a material impact on the institution’s risk profile, or affect its financial soundness'. We do not expect much to turn on this change, but it does allow entities to set tolerance levels that are appropriate for their business operations.

Issue

What's new?

How is this different (to CPS, SPS and HPS² 231)?

Material service providers and material arrangements

CPS 230 will introduce the concept of 'material service providers'.

Material service providers are those service providers on which the entity relies to undertake a 'critical operation' (see above) or that expose it to material operational risk. They include third parties and related parties deemed to be material because of one or a number of arrangements with the APRA-regulated entity. APRA has also introduced a new concept of 'material arrangements' – being those arrangements on which the entity relies to undertake a critical operation or expose it to material operational risk.

An APRA-regulated entity must, at a minimum, classify a provider of the following services as a material service provider, unless it can 'justify otherwise':

• for an ADI: credit assessment, funding and liquidity management, and mortgage brokerage;
• for an insurer: underwriting, claims management, insurance brokerage, and reinsurance;
• for an RSE licensee: fund administration, custodial services, investment management and arrangements with promoters and financial planners; and
• for all APRA-regulated entities: risk management, core technology services and internal audit.

APRA may also classify a service provider, type of service provider or service provider arrangement, as material.

CPS 230 introduces various requirements related to an APRA-regulated entity's material arrangements that are described further below.

This change represents a shift from the current focus on outsourcing and the materiality of the service being provided (ie the outsourcing of a 'material business activity'), to the materiality of the operational risk posed by the service provider and the relevant arrangement.

Interestingly, CPS 230 does not define a material arrangement by reference to an arrangement with a material service provider. However, in the Response Paper, APRA says that 'only material arrangements with material service providers' are captured. In draft CPG 230, APRA says that 'CPS 230 requires entities to identify material service providers, and to maintain formal agreements for material arrangements with these providers. Not all arrangements with a material service provider will be material to the entity'.

The new definition of material service providers is likely to capture a much wider range of service providers, which APRA states is to reflect the increased reliance on third parties to provide and undertake critical operations, as well as the fact that a service provider arrangement can expose a regulated organisation to a high degree of risk even where the service it is providing may not be critical. That said, APRA-regulated entities will take comfort from APRA's clarification that only material arrangements with those material service providers will be captured by the more onerous requirements in CPS 230.

As with the new business continuity regime, APRA has included a list of service providers in CPS 230 that will be deemed to be captured, to ensure that these are consistently captured for each industry.

Service provider management policy and 'fourth parties'

Regulated entities will need to maintain a board-approved 'service provider management policy' which sets out how it will identify material service providers and manage arrangements, as well as a number of other specific requirements.

One such requirement is that the policy addresses how the entity would manage risks associated with any 'fourth parties' or subcontractors relied on to deliver a critical operation to the APRA-regulated entity. These are downstream service providers in the supply chain.

Although CPS 231 and SPS 231 currently require a policy, the policy content requirements in CPS 230 are broader, given both the definition of material service providers (see above) and the requirement to address 'fourth party' risk.

In terms of fourth parties, CPS 231 and SPS 231 currently require sub-contracting to be addressed in an outsourcing contract, with an indemnity to the effect that any sub-contracting by a third-party service provider is the responsibility of the third-party service provider (and HPS 231 is silent on this). CPS 230 does away with this slightly confusing drafting and instead requires that service providers assume liability for failure of a sub-contractor, and for each APRA-regulated entity to otherwise set its own approach for the management of fourth-party risk.

In draft CPG 230, APRA notes that fourth-party providers may in turn rely on other service providers, which can result in an entity relying on downstream service providers without direct agreements and can impede the ability of the entity to manage risks in its supply chain.

In this scenario, APRA expects that an entity would be aware of, and manage, the risks associated with fourth-party and other downstream service providers for critical operations, including the correlated risk that arises when several of its service providers are reliant on the same fourth party. APRA says that this would typically include due diligence, appropriate contractual provisions to ensure the entity is informed of material fourth parties and appropriate assurance.

Practically, risk management in this regard may include a combination of enhanced due diligence on service providers and other downstream providers that could materially impact the performance of the service, reporting obligations, the inclusion and exercise of rights to audit and test service provider systems, inclusion of service providers in simulations/tabletop exercises, and the continued requirement that third parties remain liable for any acts or omissions of their subcontractors. Of course, how much can be achieved in this respect will depend on commercial negotiations.

Service provider agreements

For all material arrangements, an APRA-regulated entity must maintain a formal and legally binding agreement.

Notably, agreements relating to material arrangements must require notification by the service provider of its use of other material service providers that it materially relies upon in providing the service to the APRA-regulated entity (through sub-contracting or other arrangements), for the service provider to take responsibility for its sub-contractors, force majeure provisions and termination rights.

Termination provisions for RSE licensees must include the ability for the trustee to terminate the arrangement where to continue it would be inconsistent with the trustee's duty to act in the best financial interests of beneficiaries.

APRA may review and make changes to a service-provider arrangement where it identifies heightened prudential concerns.

CPS 230 is silent as to some of the more prescriptive (but non-contentious) requirements that currently apply under CPS and SPS 231, such as the requirement for the agreement to address pricing, insurance or review provisions.

Instead, APRA's focus has narrowed to the key terms that must be included to address the operational risk brought about by the use of service providers.

APRA notifications

An APRA-regulated entity must submit its register of material service providers to APRA on an annual basis and notify APRA:

• as soon as possible (and not more than 20 business days) after entering into, or materially changing, an agreement for the provision of services for a critical operation; and
• prior to any material offshoring arrangement or when there is a significant change proposed to the arrangement.

Material offshoring arrangement means a material arrangement where the service provided is undertaken outside Australia.

The requirement to annually submit a register of material service providers to APRA is new. APRA hopes this will assist it with industry-wide monitoring so it can step in where it sees 'concentration risk' (ie the overuse of a single service provider).

Notifications to APRA where material changes are made (to onshore agreements) or significant change proposed (to material offshore arrangements) are also new. Private health insurers should note that APRA notification timeframes will be shortened to 20 business days (as opposed to the 28 days that currently apply under HPS 231).

Otherwise, APRA has downgraded its oversight of offshoring arrangements. CPS 230 requires entities only to notify APRA prior to entering into such agreements (instead of the current requirement to consult).