With less than two months until APRA’s new prudential standard comes into effect, ASFA and EY have released guidance to assist superannuation trustees.
The prudential regulator’s new standard, CPS 230 Operational Risk Management, is fast approaching, with the start date scheduled for 1 July 2025.
CPS 230 seeks to enhance the management of operational risks, improve responses to business disruptions, and manage risks associated with service providers for APRA-regulated entities.
Ultimately, the objective is to enhance the resilience of the financial sector by ensuring that entities have robust frameworks in place to identify, assess, and mitigate operational risks.
In the lead-up to 1 July, ASFA and EY have released joint guidance to help the superannuation industry navigate key aspects of APRA’s incoming standard. This includes complying with the strengthened regulatory obligations around the oversight of material third-party service providers.
The guidance unpacks the various types of assurance available, how trustees can use these to satisfy themselves that their outsourced arrangements are CPS 230-compliant, and how to address any potential shortcomings.
“CPS 230 represents a significant uplift to the regulatory requirements for operational risk management, including management of third-party risk,” said ASFA’s CEO Mary Delahunty.
“Outsourcing of key services has always been a feature of our superannuation industry, so trustees understand the need to ensure outsourced providers of key services are closely monitored, given their important role in providing services to fund members.”
Implementing CPS 230 is not merely a mandatory compliance requirement, Delahunty said, but an important opportunity for super trustees to further evolve their risk management frameworks.
Similarly, EY’s national superannuation leader Maree Pallisco said the incoming standard will enable Australia’s super industry to strengthen its culture of operational resilience, while requiring trustees and service providers to work together in new ways to better identify, report on and manage risks.
“With the implementation date fast approaching, it’s important that trustees develop a clear strategy for overseeing their fund’s material third-party service providers – one that enables them to meet the refreshed standards and support the ongoing management of operational risks and resilience,” Pallisco said.
APRA released the final prudential standard CPS 230 in July 2023. With financial services companies increasingly relying on external service providers to enhance efficiency, this dependence also introduces substantial operational risks, as evidenced by several high-profile public disruptions in recent years, ASFA and EY’s guidance said.
“Recognising the critical need to manage these risks, CPS 230 explicitly mandates that APRA-regulated entities must understand and manage the risks associated with their service provider arrangements,” it said.
