Article
Keep your CPS 230 material service provider register current
A practical maintenance workflow for a CPS 230 provider register: link arrangements, assign owners, record changes and check the reporting export.
Contrata editorial team ·
A provider changes its hosting arrangements. The contract owner knows. The technology team updates its records. The material service provider register still shows last year's information.
That is a maintenance problem, even if the register was accurate when submitted. A useful CPS 230 register needs a way to absorb changes between reporting dates, preserve the reasons for decisions and show who checked the update.
This article sets out a suggested working method for a lean Australian risk team. It separates APRA's reporting template from the internal records that make the information reliable. The examples and field names below are illustrative, not an APRA-prescribed register design.
Start with the current official template
CPS 230 requires an entity to maintain a material service provider register and submit it annually. APRA's operational risk management page links the 2026 template, including support for exempt arrangements. Use the current workbook and its instructions when preparing the submission.
Do not copy a deadline from an old announcement into this year's calendar. The consultation page retains historical material, including the first submission timetable. Confirm the applicable return and submission instructions through your organisation's authorised reporting process.
The reporting workbook and the working register serve related purposes. The workbook gives the submission its required structure. Your internal records can also hold document references, unresolved questions, review history and change approvals. Keep those records linked so preparing the return does not become a separate reconstruction exercise.
Give providers and arrangements different identifiers
Use one stable identifier for each provider and separate identifiers for its arrangements. A trading-name change should not produce a second provider record. A new service should not disappear into an old row with an expanded description.
For example, the fictional Harbour Mutual uses P-017 for a technology provider. A-041 identifies its customer platform arrangement and A-052 identifies a separate analytics service. Both point to the same provider. Each has its own owner, service scope and assessment.
This structure makes several questions easier to answer:
- Which arrangements will a provider-level change affect?
- Which contract and service schedule support this entry?
- Does the same provider support more than one operation?
- Is an apparent duplicate actually a separate legal entity?
- Which record should be retained when a service ends?
If a spreadsheet is sufficient for your organisation, use linked tabs and controlled identifiers. If you use a system, check that its export preserves those relationships. The choice of tool does not remove the need for a clear record owner.
Maintain a small set of linked records
CPG 230 discusses linking material arrangements to responsible people, critical operations or material risks, and relevant fourth parties. The following working records extend that idea into a maintenance process.
| Working record | Information to keep together | Question it helps answer |
|---|---|---|
| Provider | Identifier, legal name, known aliases and related provider records | Are we referring to the right organisation? |
| Arrangement | Identifier, service boundary, contract reference and internal owner | What do we actually receive? |
| Assessment | Decision, reasons, evidence references and reviewer | Why is this entry treated this way? |
| Dependency | Operation or risk reference and the service's role | Where would disruption matter? |
| Change | What changed, effective date, source and affected records | What needs to be reassessed? |
| Issue | Uncertainty, responsible person, next action and due date | What remains unresolved? |
Avoid turning every cell into a document store. A short summary plus a stable link to the controlled evidence is usually easier to maintain than pasted extracts that age independently.
Use changes to trigger review
A fixed review cycle is useful, but it will not catch a change that happens the day after sign-off. Agree which teams can identify relevant events and how those events reach the register owner.
Suggested triggers include a new service schedule, a change of legal entity, a different delivery location, a change in a material dependency, a significant incident, a failed recovery exercise or a new internal use of an existing service. These are practical review prompts, not a claim that every event has the same regulatory consequence.
Ask the person raising the change to supply four things: the source, the effective date, the service affected and what remains uncertain. The risk team can then decide which assessment, contract or continuity records need attention. Where notification obligations may be involved, refer the event promptly to the person responsible for that assessment rather than waiting for routine register maintenance.
Worked example: a hosting change
In this fictional example, a platform provider tells Harbour Mutual it will move one service to a different hosting location. The notice arrives through an account-management email.
The arrangement owner records the notice against A-041 and confirms whether A-052 is also affected. Technology checks the service scope and proposed location. Risk reviews the dependency and assessment records. Legal or compliance considers any contract and notification questions relevant to the change.
The team does not mark the new location as verified merely because someone entered it in the register. It keeps the status as “proposed, confirmation outstanding” until the evidence supports a different status. If the reporting template requires a specific response format, the reporting owner resolves how to represent the information using the official instructions. Free-text uncertainty in the working record must not be silently converted into an unsupported answer.
After the change takes effect, the owner checks the implementation evidence, updates the current record and preserves the previous state in the change history. The open question about recovery testing remains open until separately resolved.
Check the export before sign-off
An accurate working register can still produce an inaccurate submission. Mapping errors, duplicate names and stale spreadsheet formulas can change the result.
Before the reporting owner signs off, run a practical reconciliation:
- Compare the provider and arrangement counts with the previous approved version. Explain additions, closures and consolidations.
- Sample records from the export back to the working register and supporting documents.
- Check that required classifications and identifiers use the official template's instructions.
- Review blank fields and repeated default values. Establish whether they are valid, unresolved or mapping errors.
- Confirm that owners reviewed relevant changes, rather than simply receiving a reminder.
- Save the approved export, the version used and the sign-off evidence together.
Do not delete an ended arrangement simply to tidy the current view. Use your organisation's retention approach to preserve the history and distinguish current services from closed ones.
A manageable maintenance rhythm
Start with one owner responsible for the register process and named business owners responsible for their arrangements. Give each team a clear route for reporting changes. Review exceptions more closely than unchanged, well-supported records, while following your organisation's policy and reporting obligations.
When a notice changes the record, use the subcontractor-change review or supplier-acquisition review to identify what needs reassessment before updating the register.
For the next review, select one recently changed provider and trace it from the original notice to the current register and reporting export. Any break in that chain is a specific maintenance task you can assign and fix.