CPS 230 evidence checklist for lean risk teams

A supplier has returned its questionnaire, uploaded a continuity plan and sent a recovery-test summary. Before closing the review, your team still needs to establish what those documents show about the service you depend on.

This CPS 230 evidence checklist helps a lean risk team assemble a provider review that another person can inspect, challenge and pick up later. It focuses on the connection between a question, its supporting evidence and the decision made. The workflow and example are suggestions, not an APRA-prescribed checklist or a complete compliance assessment.

The transition has passed. Evidence still needs attention.

CPS 230 originally commenced on 1 July 2025. The current version took effect on 1 July 2026. APRA's 2026–27 Corporate Plan sets out further implementation reviews and a focus on common service-provider dependencies.

CPS 230 requires monitoring and reporting on material arrangements. Its proportionality principle concerns an entity's size, business mix and complexity. Having fewer than 200 staff is not a separate exemption.

For a small team, a useful starting point is one current review with an unresolved question. Work through the evidence before extending the same method to other arrangements.

1. Define the question before collecting more documents

Name the service, the arrangement and the operation it supports. Then write the question you need to answer.

“Review administrator resilience” leaves too much room for interpretation. A more useful question is: “Does the available test evidence cover recovery of contribution processing, including the reconciliation work our team performs?”

Record the boundaries. A provider may supply several services through different systems or subcontractors. Evidence for one service may have little bearing on another. Include the relevant internal owner so the reviewer can check how the service is actually used.

If materiality is still unresolved, address it separately. Our worked superannuation classification example explains how to document that assessment. This checklist starts with the evidence needed for the review itself.

2. Record what each source supports

Create a short evidence index alongside the assessment. For each item, capture:

• Document title, version and location
• Issuer, issue date and period covered
• Service, system or entity within scope
• Page or section relevant to the question
• What the reviewer concluded, including limits or missing information

Keep the distinction between a stated intention and an observed result. A continuity plan describes proposed actions. A test report may show what happened in a particular exercise, within its stated scope. A questionnaire answer can identify a claim that still needs supporting material.

A recently issued document can cover an old test. Record both dates where they differ. If a provider supplies a replacement, retain enough version history to show which evidence informed the earlier decision.

3. Keep gaps visible while you seek an answer

An incomplete evidence set needs an explicit status. “Awaiting provider response” is useful only when the reader can also see the unanswered question, its significance and who is following it up.

Use a gap record with an owner, requested evidence, target date and escalation trigger. Distinguish between information you have not received and evidence that points to a control weakness. They may require different responses.

For a targeted follow-up, explain the missing coverage: “The report covers infrastructure restoration. Please provide the result for contribution-file processing and reconciliation, or confirm these were outside the exercise.” This gives the provider a specific question to answer.

Avoid treating a returned questionnaire as proof that the review is complete. Check whether the material received resolves the question you originally recorded.

Worked example: the test ended before reconciliation

The following example is fictional. It illustrates evidence handling and does not set a recovery target or prescribe a risk decision.

A small super fund is reviewing its administrator's recovery evidence. The administrator supplies a test summary stating that the platform was restored successfully. The fund's operations lead asks whether the exercise also tested contribution-file processing and reconciliation with the fund's records.

The summary does not say. The reviewer records the evidence as supporting platform restoration within the exercise's scope. Contribution processing and reconciliation remain unverified.

The review record could read:

The administrator later confirms that reconciliation was outside the exercise. The fund now has a clearer limitation to assess. Its authorised decision-maker can determine the required response, using the fund's tolerances, obligations and risk framework. The record should show that reasoning and any resulting action; it should not silently convert an excluded test into a successful one.

4. Preserve the decision and its limits

Record who reviewed the evidence, who made the decision and when. Explain which facts supported it, which uncertainties remain and what action follows.

Keep any conditions with the decision. A colleague should be able to see whether a conclusion depended on a temporary workaround, further evidence or a planned test. If risk is accepted under internal authority, record the basis and scope. Internal acceptance does not waive a prudential obligation.

CPG 230 provides guidance on implementing CPS 230, including governance and service-provider management. The guide does not itself create enforceable requirements. Use it alongside the standard when checking your organisation's approach; a completed review record is only one part of that work.

5. Decide what would reopen the review

A review date helps with scheduling. Change triggers help the team recognise when an earlier conclusion needs attention.

Examples include a changed service scope, a new dependency, an incident affecting the arrangement, a replacement assurance report with different coverage, or an overdue action that undermines a previous assumption. Set triggers relevant to the arrangement and route them to a named owner.

Check open issues before preparing management reporting. A concise report can identify the affected service, what remains uncertain, the decision needed and the next action, with a link to the underlying record. Readers who need the detail can then inspect it without asking the team to reconstruct the assessment.

Use the checklist on your next provider review

Before closing a review, check that someone outside the original assessment can find:

• The service and question assessed
• The evidence used, with scope and dates
• Unresolved gaps and accountable owners
• The decision, its rationale and any conditions
• The event or date that prompts another review

For the next stage, use targeted supplier follow-ups to resolve missing evidence and the decision-record guide to explain how the resulting evidence supports an action.

See how Contrata supports evidence-linked assessments and human review.

Sources checked on 16 October 2026. This article provides practical information, not legal advice. Check the current standards and your entity's circumstances when determining obligations.