Investment governance and operational risk: The rising regulatory bar for super funds

Investment governance and operational risk have never been more critical for superannuation trustees. APRA’s Deputy Chair, Margaret Cole, recently addressed trustees at the Conexus Chair Forum, reinforcing the urgent need for stronger governance, accurate asset valuations, and robust risk management. With increased scrutiny, new disclosure requirements, and stricter prudential standards, trustees must act now to ensure compliance and safeguard member outcomes.

Investment governance: The foundations of compliance and performance 

Investment governance is the cornerstone of sustainable, long-term performance for super funds. APRA’s SPS 530 Investment Governance outlines strict requirements that trustees must meet, including:   

• Transparent investment decision-making processes to ensure disciplined and consistent strategies   
• Defined risk management frameworks to identify, measure, and mitigate investment risks   
• Regular monitoring, stress testing, and performance evaluation to validate strategy effectiveness   
• Robust governance of unlisted assets and liquidity risks, ensuring fair valuation and adequate liquidity   

Margaret Cole’s speech specifically called out concerns around valuation practices for unlisted assets and liquidity management, areas where poor governance can lead to mispriced portfolios and member detriment. Trustees must ensure their governance frameworks support accurate, consistent, and timely investment data to avoid exposure to financial instability and regulatory action. 

Why data is the key to strong investment governance

Meeting SPS 530’s investment governance requirements is an uphill battle without high-quality, well-managed data. Data inconsistencies, siloed systems, and manual processes create inefficiencies that weaken oversight.   

At AlphaCert, we understand that investment data is the foundation of governance. Our investment data management platform provides:   

• A single source of truth, eliminating data silos and ensuring consistent reporting   

• Automated data validation and reconciliation, reducing errors and enhancing data integrity   

• Improved transparency across portfolios, helping trustees monitor exposures and liquidity risks effectively   

With APRA increasing regulatory pressure, super funds must take control of their data to maintain compliance and strengthen decision-making.

Operational risk: The next big compliance challenge

Beyond investment governance, APRA’s CPS 230 Operational Risk Management—effective from July 2025—places even greater responsibility on trustees to manage operational risks. This new standard requires funds to:   

• Strengthen risk identification and assessment to prevent financial and operational disruptions   

• Enhance business continuity planning to withstand unexpected shocks, such as market disruptions or cyberattacks   

• Improve third-party risk management, ensuring service providers meet the same high governance standards   

Cole’s speech emphasised APRA’s growing focus on operational resilience, particularly cybersecurity and data security. Trustees must have robust data management and security frameworks to mitigate risks associated with outsourcing, cyber threats, and operational failures.

Why investment data management is critical for CPS 230 compliance

Under CPS 230, funds must demonstrate clear oversight and control over investment data and operational risks. Inadequate data governance can lead to compliance failures, reputational damage, and regulatory intervention.   

AlphaCert helps super funds meet these challenges by:   

• Providing an enterprise-wide investment data platform that ensures accuracy and accessibility   

• Automating data reconciliation and validation, reducing operational risk   

• Enhancing security and compliance controls, supporting funds in meeting CPS 230’s requirements   

With increasing regulatory pressure and growing operational complexity, now is the time for trustees to assess their data infrastructure and risk frameworks.  

Trustees must act now

APRA’s latest speech makes one thing clear: trustees cannot afford to be complacent. With fund expenditure data becoming public, new investment governance expectations, and the looming CPS 230 compliance deadline, trustees must proactively strengthen their data management, governance, and risk oversight.   

At AlphaCert, we help super funds take control of their investment data, ensuring compliance, transparency, and better decision-making. Don’t wait for regulatory pressure to force change—speak to us today about how we can support your fund.   

Read APRA’s full speech here: APRA speech.