APRA CPS 230 — Operational Risk Management

APRA CPS 230 — Operational Risk Management — 92% of in-scope requirements covered.

6 requirements · 6 in scope (5 enforced · 1 designed). The 92% is weighted over the in-scope base.

APRA CPS 230: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. 13 · enforced

    Paragraph 13 — Effective management of operational risk across the full life cycle of all business operations

    Audit events: kye.compliance.attestation.v1, kye.risk_assessment.v1, kye.evidence.decision_map.v1 · Constitution: 13 resilience loop, 51 no spof

  2. 15 · enforced

    Paragraph 15 — Maintain a comprehensive operational risk profile and assess the impact of material changes

    Audit events: kye.risk_assessment.v1, kye.compliance.attestation.v1 · Constitution: 13 resilience loop

  3. 18 · enforced

    Paragraph 18 — Effective internal controls, monitoring and assurance over operational risk

    Audit events: kye.evidence.decision_map.v1, kye.purpose.admissibility.v1 · Constitution: 12 purpose permission

  4. 35 · enforced

    Paragraph 35 — Maintain a register of material service providers and manage the risks associated with the use…

    Audit events: kye.risk.authority_register.v1, kye.compliance.attestation.v1 · Constitution: 51 no spof

  5. 20 · designed

    Paragraph 20 — Notify APRA of operational risk incidents that have a material financial impact or affect the…

    Audit events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1 · Constitution: 13 resilience loop

  6. 42 · enforced 1 unverified citation

    Paragraph 42 — Critical-operation tolerances and the ability to continue critical operations within tolerance…

    Audit events: kye.resilience.signal.v1, kye.replay.proof.v1 · Constitution: 25 edge governance, 51 no spof

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: Australian Prudential Regulation Authority, Prudential Standard CPS 230 Operational Risk Management (effective 1 July 2025). Operational risk management (paras 13-21), business continuity (paras 30-34), service provider management (paras 35-48).

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Operational risk management (paras 13-21)4310088%
Service provider management (paras 35-48)11000100%
Business continuity (paras 30-34)11000100%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
apra-cps-230.13Paragraph 13 — Effective management of operational risk across the full life cycle of all business operationsenforcedaudit_events: kye.compliance.attestation.v1, kye.risk_assessment.v1, kye.evidence.decision_map.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/51-NO-SPOF.md
apra-cps-230.15Paragraph 15 — Maintain a comprehensive operational risk profile and assess the impact of material changesenforcedaudit_events: kye.risk_assessment.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
apra-cps-230.18Paragraph 18 — Effective internal controls, monitoring and assurance over operational riskenforcedaudit_events: kye.evidence.decision_map.v1, kye.purpose.admissibility.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
apra-cps-230.20Paragraph 20 — Notify APRA of operational risk incidents that have a material financial impact or affect the entity's ability to maintain critical operationsdesignedaudit_events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
apra-cps-230.35Paragraph 35 — Maintain a register of material service providers and manage the risks associated with the use of those providersenforcedaudit_events: kye.risk.authority_register.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/51-NO-SPOF.md
apra-cps-230.42Paragraph 42 — Critical-operation tolerances and the ability to continue critical operations within tolerance during a disruptionenforced 1 unverified citationaudit_events: kye.resilience.signal.v1 unverified citation, kye.replay.proof.v1
engines: internal, internal
constitution_refs: constitution/25-EDGE-GOVERNANCE.md, constitution/51-NO-SPOF.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.