Document ID: chunk:federal_register_of_legislation:F2023L01242:body:0:p2
Version: federal_register_of_legislation:F2023L01242
Segment Type: other
Provision Reference: 
Character Range: 2999–6255

meaning given in section 16C of the Life Insurance Act.

    general insurer has the meaning given in section 11 of the Insurance Act.

    life company has the meaning given in the Schedule to the Life Insurance Act.

private health insurer has the meaning given in section 4 of the PHIPS Act.

registered NOHC has the meaning given in the Schedule to the Life Insurance Act.

RSE licensee has the meaning given in subsection 10(1) of the SIS Act.

the Banking Act means the Banking Act 1959.

the Insurance Act means the Insurance Act 1973.

the Life Insurance Act means the Life Insurance Act 1995.

the PHIPS Act means the Private Health Insurance (Prudential Supervision) Act 2015.

the prudential standard means Prudential Standard CPS 230 Operational Risk Management in the form set out in the Schedule.

the SIS Act means the Superannuation Industry (Supervision) Act 1993.

Schedule
Prudential Standard CPS 230 Operational Risk Management comprises the document commencing on the following page.

Prudential Standard CPS 230

Operational Risk Management
Objectives and key requirements of this Prudential Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is resilient to operational risks and disruptions. An APRA-regulated entity must effectively manage its operational risks, maintain its critical operations through disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its size, business mix and complexity. The key requirements of this Prudential Standard are that an APRA-regulated entity must:
     * identify, assess and manage its operational risks, with effective internal controls, monitoring and remediation;

     * be able to continue to deliver its critical operations within tolerance levels through severe disruptions, with a credible business continuity plan (BCP); and

     * effectively manage the risks associated with service providers, with a comprehensive service provider management policy, formal agreements and robust monitoring.

Authority
     1. This Prudential Standard is made under:
       (a)          section 11AF of the Banking Act 1959 (Banking Act);
       (b)          section 32 of the Insurance Act 1973 (Insurance Act);
       (c)          section 230A of the Life Insurance Act 1995 (Life Insurance Act);
       (d)          section 92 of the Private Health Insurance (Prudential Supervision) Act 2015 (PHIPS Act); and
       (e)          section 34C of the Superannuation Industry (Supervision) Act 1993 (SIS Act).

Application and commencement
2.             This Prudential Standard applies to all APRA-regulated entities defined as:
       (a)          authorised deposit-taking institutions (ADIs), including foreign ADIs, and non-operating holding companies authorised under the Banking Act (authorised banking NOHCs);
       (b)          general insurers, including Category C insurers, non-operating holding companies authorised under the Insurance Act (authorised insurance NOHCs) and parent entities of Level 2 insurance groups;
       (c)          life companies, including friendly societies, eligible foreign life insurance companies (EFLICs) and registered