APRA's geopolitical assessments put supplier fallback assumptions in focus

Retrospective analysis of APRA’s 22 October update, originally drafted 23 October and refreshed 31 October 2026.

APRA reported that targeted geopolitical readiness assessments were underway across selected entities in superannuation, banking and general insurance. In his 22 October 2026 speech, Deputy Chair David Bradbury said participants include 12 of the largest superannuation trustees. Participating entities must submit action plans by the end of April 2027, with evidence that identified crisis-preparedness gaps have been effectively closed expected by the end of November 2027. Later phases will assess personnel and political risk.

These are targeted exercise milestones, not submission deadlines for every regulated entity. APRA's 17 June industry letter explains how its expectations inform existing prudential requirements. Entities outside the targeted group remain expected to respond proportionately to their risks. The letter includes staffing continuity, offshore dependencies and service-provider vulnerabilities; it does not treat smaller organisations as exempt.

For supplier-risk teams, a useful next step is to separate three questions: are the systems available, can people perform the work, and may that work still be performed through the proposed cross-border arrangement?

Review the fallback, not only the primary service

A supplier's main service and its fallback can depend on the same people, jurisdiction or approval path. A second processing location might share the original location's specialist team. An alternative supplier might need data that cannot be transferred through the proposed route. A recovery environment may be technically available while the staff authorised to use it are unavailable.

Those are different problems. Asking for another copy of the continuity policy may not distinguish them.

Start with one service whose interruption would matter to an identified operation. Describe the work needed during disruption, then trace the dependencies of that work. The existing offshoring review guide helps establish where people, access and delivery sit. This review adds a specific question: which of those facts stop being true under the chosen geopolitical scenario?

A fictional fallback with two separate weaknesses

Consider a fictional Australian insurer whose provider processes supporting documents for claims. The platform remains available during a hypothetical regional disruption, but the provider's specialist processing team cannot work. Its continuity plan names another delivery location.

The insurer asks the provider to demonstrate a synthetic case using only the alternative team's resources. The exercise reveals that the alternative team can receive documents but needs the unavailable specialists to classify unusual cases. The normal workflow works; the exception queue does not.

A second review finds that the proposed backup location has never been cleared for the relevant data access. That is an unresolved legal, privacy and security question, not an instruction to grant access during an emergency. Appropriate owners must determine whether the route is permissible before it becomes an operational assumption.

All organisations, circumstances and findings here are invented. The example does not describe an actual country, sanction, supplier or APRA assessment result.

The service owner now has two distinct actions. The provider needs an independently staffed exception-handling capability, or an explicitly limited alternative. The insurer needs a decision on the proposed access route. Completing either action alone would leave the fallback incomplete.

Original illustration. Systems being available does not establish usable, permitted staffing capacity.

Ask for evidence of usable capacity

For an initial review, use these suggested questions rather than a new supplier-wide questionnaire:

• Which tasks require specialist knowledge or authority, and who can perform them if the primary team is unavailable?
• What evidence shows that alternative staff can complete normal and exceptional cases, using permitted access and the tools actually available to them?
• Is backup capacity reserved, shared with other customers or dependent on staff moving from the disrupted location?
• Which legal, contractual, privacy or security decisions remain unresolved for the alternative route, and who owns each decision?
• What service can continue while those gaps remain, and what demand or disruption duration would exceed that limited capability?

Use synthetic records where possible. Do not request staff identity documents, personal travel details or credentials to populate a general supplier-risk record.

Keep the conclusion narrower than the evidence

A successful normal-case demonstration supports that tested capability. It does not establish that the provider can handle every exception or sustain an extended disruption. Record the scenario, tested tasks, assumed staffing and unresolved constraints alongside the result.

For each gap, name the owner, the decision needed and the evidence required to close it. The remediation closure guide provides a practical way to distinguish completed work from a supplier's promise.

The workflow above is an original review aid, not an APRA checklist. The organisation retains its risk decisions and compliance responsibilities. Begin with the fallback's most important unsupported assumption and ask what would demonstrate that it can work.