Article
Material provider or material arrangement? A CPS 230 example
Separate provider and arrangement decisions under CPS 230 with a fictional private health insurer example and a practical classification record.
Contrata editorial team ·
One supplier provides your claims platform and a small employee survey tool. Someone marks the supplier “material”. Does that answer how each service should be assessed, recorded and managed?
It answers only part of the question. Your team still needs to understand the arrangements, their boundaries and the risks created by their combined use. A provider-level label is a useful starting point, but it cannot describe every service relationship on its own.
This article uses a fictional private health insurer to show how to keep the two decisions connected. It is a suggested assessment method, not legal advice or a substitute for your organisation's materiality policy.
Keep the two questions distinct
Under CPS 230, materiality concerns reliance for a critical operation or exposure to material operational risk. Provider materiality can arise from one arrangement or several. CPG 230 clarifies that not every arrangement with a material provider is necessarily material.
For your working records, use two questions:
- What does this particular arrangement support, and what could go wrong if it fails?
- What does our overall relationship with this provider expose us to?
The first question preserves service-level differences. The second catches risks that disappear when each contract is considered separately.
Do not use contract value as the only shortcut. A low-cost service can sit at a difficult-to-replace point in a process. Conversely, a large invoice does not explain the operational effect of losing the service. Spending information helps describe the relationship; it does not replace the dependency assessment.
Fictional case: one supplier, two services
Seabrook Health is a fictional Australian private health insurer. It uses a provider called Northline Services for two separate services. Neither company represents a Contrata customer.
The claims platform receives claim information, routes it for assessment and returns processing outcomes. The survey tool sends voluntary staff feedback questionnaires. The services have separate schedules, separate administrators and different data flows.
The risk team records the following starting position:
| Question | Claims platform arrangement | Staff survey arrangement |
|---|---|---|
| Business owner | Head of claims operations | People team lead |
| Work supported | Claims intake and processing workflow | Internal staff feedback |
| Immediate failure effect | Claims cannot pass through the normal workflow | Current survey responses pause |
| Alternative route | Manual process proposed, capacity untested | Survey can be postponed |
| Evidence still needed | Recovery coverage and manual processing capacity | Confirmation of technical separation |
These observations do not constitute the final assessment. They show what the team knows, what it assumes and which evidence could change the decision.
Step 1: define what each arrangement includes
Before discussing materiality, reconcile the commercial documents with actual service use. A contract called “business services” may cover several products. A statement of work may change the original scope. A shared login or data integration may connect services that appear separate on paper.
For each arrangement, record:
- The service delivered and the internal process using it.
- The legal entity providing it and the relevant contract documents.
- The systems, information and access needed to use it.
- Any shared dependencies with another arrangement.
- The service boundary, including tasks the insurer still performs.
Seabrook discovers that the claims platform and survey tool use different application environments, but the same supplier account team. That is helpful information. It still needs to check whether they share authentication, hosting or support dependencies that could affect the assessment.
Step 2: assess the arrangement on its own evidence
The claims owner describes the impact of unavailable intake, delayed decisions and failed reconciliation. The team challenges the proposed manual workaround: who can operate it, where does the input data come from and how will duplicate claims be prevented when normal service resumes?
For the survey arrangement, the people team explains why postponing the survey is workable. Risk considers whether the information held or access granted creates a material operational exposure despite the limited disruption impact.
This second question matters. “It does not support our named critical operation” is not enough to conclude that an arrangement cannot be material. Equally, the team should not manufacture a critical-operation connection merely to make the register look consistent.
The result is a reasoned decision under Seabrook's policy, supported by the actual use and risks of each service. If information is missing, the assessment records that uncertainty and names the person who will resolve it.
Step 3: consider the provider relationship as a whole
Now look across the arrangements. Could a provider-wide event affect both? Is there shared ownership, financial stress, a common support team or a dependency on the same infrastructure? Could separate contracts create conflicting exit obligations?
The purpose is not to automatically give every arrangement the same label. It is to identify relationship-level risks that deserve a common response.
For example, Seabrook might monitor provider financial information once, then link that assessment to both arrangements. It might maintain a common escalation contact while keeping different service-level measures. A provider-wide issue can trigger both owners to review their services without erasing their different operational consequences.
Step 4: write a decision another reviewer can follow
A useful decision note contains more than a category and a date. The following is an illustrative structure:
| Part of the note | What to record |
|---|---|
| Decision scope | Provider identifier and specific arrangement identifiers |
| Policy basis | Applicable criteria and version used |
| Operational effect | Process affected, credible disruption impact and alternatives |
| Other risk exposure | Relevant risks beyond service interruption |
| Relationship view | Combined dependencies and provider-wide considerations |
| Evidence and limitations | Sources reviewed, service coverage and unresolved assumptions |
| Decision authority | Decision-maker, review date and conditions |
| Reassessment trigger | Changes that would reopen the decision |
Avoid saying “non-material because low spend” or “material because supplier is important”. Those statements give the next reviewer very little to test.
A more useful survey note might explain that postponement is acceptable for the defined use, describe the information involved, reference the separation evidence and specify that a new integration would trigger review. It should not claim that the arrangement has no risk.
What changes when the service changes?
Suppose Seabrook later expands the survey tool to collect member information and connect to its customer platform. The previous decision concerned a different service boundary. The owner should reopen the assessment rather than rely on the old supplier label.
The same applies if the claims workflow changes or a workaround proves unusable. Review triggers should come from operational changes and new evidence, not only the anniversary of the assessment.
For maintaining the resulting records, use the provider register maintenance workflow. If your organisation is a superannuation trustee, the superannuation materiality example provides separate sector context.
Once the classification is settled, the decision-record guide shows how to preserve the evidence, alternatives and reasons behind it.
The practical test is simple: can a reviewer explain why this arrangement has its classification, and how that decision fits the wider provider relationship? If the record can answer both questions, the provider label is doing useful work without hiding the services beneath it.