Navigating APRA’s CPS 230 — a Guide for Investment Managers

Operational risk management and data protection are vital for investment managers entrusted with sensitive investment information. In July 2023, the Australian Prudential Regulation Authority (APRA) introduced the Operational Risk Management (CPS 230) framework for APRA-regulated superannuation funds.  

Super funds under CPS 230 are required to draw up a register of material service providers, including investment managers. From October 2025, investment managers providing services into the superannuation industry will be subject to ongoing operational and financial risk assessments, business continuity reviews, and cyber-security audits related to providing their services. 

Read through and understand how to implement safeguards to protect your reputation and meet super fund CPS 230 expectations through robust investment data management and operational risk oversight.  

What is CPS 230 

CPS 230 is a comprehensive operational risk management framework aimed at bolstering resilience against cyber threats, data breaches, and service disruptions. It mandates that APRA-regulated entities, such as superannuation funds, establish business continuity plans (BCPs), define their material service providers (MSPs), and implement effective risk controls.  

One of the CPS 230 requirements for super funds is to oversee their material service providers; and as a result, it is increasingly expected of investment managers to demonstrate strong and reliable cybersecurity, operational resilience, and faster incident response capabilities. 

Why CPS 230 Matters to Investment Managers

Although primarily directed at superannuation funds, this framework places an obligation on these funds to closely monitor their material service providers for reliable risk management. For investment managers, this means aligning with CPS 230 requirements and ensuring demonstrable resilience, data security, and continuity in operations.  

Non-compliance can lead to significant repercussions from reputational damage and loss of confidence, eroding client trust due to data breaches or operational failures to potential financial penalties from APRA to the super fund, which could hinder future partnerships with super fund clients. Super funds are more likely to engage with MSPs who are proactive in meeting CPS 230 standards.  

Put yourself ahead across these five key areas: 

Secure Data Management 

Enforce strong measures for securely managing operationally critical data, addressing key operational risks. 

Minimise Key-Person Risk 

Reduce dependency on specific individuals and ensure stability and reliability in data handling. 

Enhance Business Continuity 

Mandate reliable consistent planning, improving recovery time objectives (RTOs) and ensure fast recovery in just hours or minutes in case of disruptions. 

Strengthen Cybersecurity 

Demand higher standards in cybersecurity practices to protect sensitive investment data from breaches or unauthorised access. 

Improve Service Provider Oversight 

Increase accountability, aligning with CPS 230’s expectations for operational resilience, benefitting client trust and compliance efforts. 

AlphaCert and CPS 230 compliance 

As a platform designed to support CPS 230 standards, AlphaCert empowers not just super funds, but all investment managers to meet these requirements by safeguarding investment data, ensuring business continuity, and facilitating compliance with regulatory expectations.  

AlphaCert’s automated workflows streamline business continuity planning, helping investment managers meet their clients’ recovery time objective (RTO) requirements and offers robust data encryption and access controls to protect sensitive investment information. 

With AlphaCert, investment managers can confidently align with their clients’ CPS 230 standards for their investment data, and demonstrate resilience, and competitiveness in the market.