Model Risk Directory emblemModel Risk Directory
CPG 230

APRA CPG 230 Operational Risk Management

CPG 230 explains APRA's view of sound practice for entities implementing Prudential Standard CPS 230 Operational Risk Management. It covers operational-risk governance, controls, business continuity, critical operations, and material service-provider arrangements across APRA-regulated industries. For model risk management, its practical relevance is the operating environment around models and third-party dependencies. It does not replace model validation, model inventory, or model-lifecycle standards and should not be presented as Australia's direct equivalent of SR 26-2.

Published: Last updated: Last reviewed by: Model Risk Directory editorial team
Quick answer

APRA CPG 230 is operational-risk guidance for implementing CPS 230. It is not a standalone Australian MRM standard. It matters to model risk teams when critical operations depend on model platforms, data services, cloud providers, validation vendors, or other material service providers that must be governed, monitored, and supported by continuity plans.

Jurisdiction
Australia
MRM relevance
Adjacent risk and governance guidance
Effective date
1 July 2026
Issuing body
Australian Prudential Regulation Authority
Official reference
www.apra.gov.au/practice-guides/cpg-230

What it covers

  • Board oversight of operational risk, business continuity, and material service-provider arrangements.
  • Identification of critical operations and tolerance levels for disruption.
  • Operational-risk controls, indicators, monitoring, escalation, and remediation.
  • Due diligence, contractual controls, monitoring, and exit planning for material service providers.
  • Integration of operational risk management with the entity's broader risk-management framework.

Adoption status

The updated CPG 230 and targeted CPS 230 amendments took effect on 1 July 2026. APRA states that prudential practice guides describe sound practice but do not themselves create enforceable requirements. Teams should read CPG 230 together with CPS 230 and the applicable risk-management standards.

Reference only. This page explains what CPG 230 covers; it is not a claim that Model Risk Directory or any listed vendor satisfies it. Verify alignment directly against the issuing body's own current text before relying on it.

Sources. source 1 · source 2 · source 3. Data as of 2026-07-29. See methodology.

Related content

GuideModel Risk Management FrameworkA model risk management framework is the documented set of policies, roles, and processes an institution uses to identify, tier, govern, and validate its models. Under SR 26-2, a sound framework covers model development and use, independent validation, and governance and controls, scaled to the institution's size and model risk profile rather than applied uniformly.GuideModel Risk Management SoftwareModel risk management software centralizes a bank's model inventory, tracks validation status and lifecycle events, and automates governance workflows like tiering, revalidation scheduling, and audit-trail documentation. It replaces manual spreadsheet tracking, which becomes unmanageable once an institution has more than a handful of tiered models.GuideBest model risk management softwareThe best MRM software is the platform that fits your model inventory, governance workflow, evidence requirements, validation process, integrations, security controls, and operating model. This guide summarizes the directory's software vendors alphabetically. It does not award a winner without a shared test environment, verified pricing, and comparable customer evidence.InsightThe global map of model risk management frameworksThere is no single global MRM rulebook. This map separates enterprise model risk guidance from model-specific and adjacent controls so banks, insurers, and procurement teams can identify the right source before scoping validation work.