CPS 230. Prove you’re doing it all and doing it right.
CPS 230 compliance software for critical operations, tolerance levels and scenario testing.
From mapping risks to engaging your Board - here's how Drova makes it simple.
Trusted by forward-thinking financial services teams
“”
What does CPS 230 ask of you?
CPS 230 is APRA's Prudential Standard for Operational Risk Management. It asks banks, insurers and superannuation trustees to know their critical operations, keep them within Board-approved tolerance levels through disruption, and manage the service providers they rely on.
- Operational risk management: know your operational risk profile, keep controls effective, run scenario analysis and handle incidents.
- Business continuity: identify critical operations, set Board-approved tolerance levels, keep a plan that holds you within them and test it, with a business continuity exercise every year.
- Service provider management: a register of material service providers, submitted to APRA every year.
It has applied since 1 July 2025, and in full since 1 July 2026. For the detail, read CPS 230, explained, check what to have in place now, or see the material service provider rules.
CPS 230, sorted
Map critical operations, set tolerance levels, test severe but plausible scenarios and report to the Board from one Drova workspace.
Operational Resilience
Cover CPS 230 operational risk management in one place
Critical operations, tolerance levels, testing and reporting, connected.
- Set up and define critical operations in one place
- Recommended scenario test plans built from your mapped operations, risks and controls
- Mates, Drova's AI agents, draft service maps and flag weak points
- Export an Operational Resilience Self-Assessment report as PDF, Word or Excel
SCENARIO TESTING
Test against severe but plausible scenarios, the way APRA asks
- Run test scenarios for cyber incidents, outages and supplier failure
- Link impacts to the people, processes and systems behind each critical operation
- Built-in logic and AI show your progress, ready to share with the Board
AUDITABLE EVIDENCE
Map what matters, prove you're protecting it
- Identify critical services and tolerances
- Generate and store tests to show control
- Replace spreadsheets with an auditable plan
- Create a single source of truth
CPS 230 is one part of building broader operational resilience software into how the business runs.
AUTOMATED REPORTING
Engage your Board, show accountability
- Let Boards visualise operational risk, clearly
- Assign roles and responsibilities by requirement
- Scenario testing that drives accountability
- Automated, evidence-backed reporting whenever the Board or APRA asks
Compliance, tested. Resilience, documented. CPS 230, covered.
