Prudential Practice Guide CPG 230, plain-English definition from TheAICommand
← Glossary
Reference

What is APRA Prudential Practice Guide CPG 230?

CPG 230 Operational Risk Management is APRA's practice guide supporting CPS 230. The current version is dated July 2026, following the targeted amendments APRA finalised on 30 April 2026 to clarify expectations for material arrangements with exempt service providers.

Quick answer

CPG 230 is APRA's prudential practice guide for operational risk management. It offers guidance to APRA-regulated entities on complying with Prudential Standard CPS 230, covering the risk management framework, roles and responsibilities, business continuity and service provider arrangements. Practice guides do not themselves create enforceable requirements.

Verified against the current authoritative text on by the editorial team at TheAICommand.

This page is an educational summary for professionals working with AI. It is not the law and not legal advice. Always work from the current authoritative text linked below.

What does CPG 230 do?

CPG 230 sets out APRA's view of sound practice for operational risk management, structured to follow CPS 230: the risk management framework, roles and responsibilities, operational risk management, business continuity, and management of service provider arrangements. It reproduces the enforceable CPS 230 paragraphs in blue boxes and surrounds them with guidance. Read the July 2026 guide on the APRA website.

Who does it bind?

No one directly. APRA states that practice guides discuss requirements from legislation, regulations or prudential standards but do not themselves create enforceable requirements. CPS 230 binds; CPG 230 explains what meeting it looks like, with stronger expectations of significant financial institutions.

What do practitioners get wrong?

Two version problems. Citing the June 2024 edition after the July 2026 one commenced, and attributing a blue box paragraph to the guide when it is CPS 230 text. Both make an obligation look softer or harder than it is. See CPS 220 for where the risk management pillar starts.

Where does AI use touch it?

Service provider arrangements. A model vendor an entity relies on to run a critical operation, or that exposes it to material operational risk, is a material arrangement. The 2026 exemptions relax certain contractual requirements where compliance is not practicable; they do not relax the duty to manage the arrangement. See AI vendor concentration on a common foundation model.

Bottom line

CPG 230 is the working manual for CPS 230. Read the current July 2026 edition, and keep the blue boxes and the guidance apart when citing it.

TheAICommand. Intelligence, At Your Command.

Frequently asked questions

Which version of CPG 230 is current?
The July 2026 version. APRA released final targeted amendments to CPS 230 and CPG 230 on 30 April 2026, and both the updated standard and the updated guide commenced on 1 July 2026. The earlier June 2024 version of CPG 230 is superseded and should not be cited as current.
What changed in the 2026 update?
APRA introduced limited exemptions in CPS 230 from specific contractual requirements for material arrangements with certain categories of service providers, where contractual compliance is not practicable. The CPG 230 updates clarify APRA's expectations for managing material arrangements with those exempt service providers.
What do the blue boxes in CPG 230 contain?
The guide reproduces relevant paragraphs from CPS 230 in blue boxes, and notes that those are the enforceable requirements while the remainder of the text is guidance. Quoting a blue box and attributing it to CPG 230 misstates the source, because the obligation is CPS 230's.
Does CPG 230 apply the same way to every entity?
No. The guide states that CPS 230 sets baseline expectations for all APRA-regulated entities, and that APRA expects significant financial institutions to have stronger practices commensurate with the size and complexity of their operations. All entities are expected to mature their practice as operations grow.

Primary sources

← Back to the glossary

General information and education only. Not legal, compliance, financial, or professional advice. Always confirm obligations against the primary source and current regulator guidance.