Assess related-party services without assuming they are low risk

The technology team sits in another company in the same group. Its people attend the same meetings, use the same branding and describe the platform as “our system”. Those connections can make cooperation easier, but they do not answer who will restore the service when several group entities need help at once.

For an APRA-regulated entity, a related-party service deserves a review grounded in the actual arrangement. Begin with the service your entity receives and the consequences if it changes or stops.

Identify the entity receiving the service

Write down the legal entity receiving the service, the entity providing it and the operation supported. Then identify the relevant agreement, service description and internal owner.

CPS 230 expressly recognises that a material service provider may be a related party or connected entity. Common ownership therefore does not settle the materiality question. The actual application of group and branch requirements should be checked for the organisation concerned.

The review method below is a suggestion for making that analysis practical. It is not a separate exemption test or an APRA-prescribed form.

Distinguish access to people from authority to act

A local service owner may know the group technology director well. That does not establish who can approve an emergency change, allocate recovery resources or prioritise competing entities.

Ask the people involved to walk through an incident:

• Who can declare that the local service is disrupted?
• Who authorises a workaround or change to the shared platform?
• How are competing recovery requests prioritised?
• Who speaks for the regulated entity when decisions affect its obligations?
• What happens if the usual contacts are unavailable?

Record the decision rights and escalation route. Where a group committee owns a decision, check its availability and how urgent local concerns reach it. A monthly meeting schedule may not fit the decision needed during an outage.

Work a shared-platform example

Consider a fictional private health insurer that receives claims technology from a group service company. The same team supports other group businesses. The insurer has a local continuity plan that assumes technology support will be available immediately.

In a walkthrough, the group team explains that recovery priorities are set across all entities. It cannot confirm the local assumption without considering the wider incident. The useful finding is a gap between the insurer's plan and the shared team's decision process.

The review should not jump to a conclusion that the group arrangement is unsuitable. It should establish the priority rules, expected service capabilities and any constraints. The insurer can then assess whether its own continuity approach is credible and what changes or evidence it needs.

A revised contact list alone would not resolve that gap. The question concerns resource allocation and authority, not simply whom to telephone.

Check what group assurance actually covers

A group control report may provide useful evidence. Inspect its legal-entity coverage, systems, period, exclusions and unresolved findings before relying on it for the local service.

If the report tests group access administration but excludes local privileged accounts, the local reviewer still needs to understand that excluded area. If a recovery exercise covers a different business, ask which assumptions transfer and which do not.

APRA's CPG 230 discusses controls owned by related parties and the continuing responsibility of the entity using a service. A shared assurance programme can contribute to oversight while leaving specific local questions open.

Keep the group report in its authorised location and link the relevant sections to the local review. Record any restrictions on access or distribution. Internal group membership should not be treated as permission to distribute sensitive information without checking the applicable controls.

Examine the difficult exit assumptions

Related-party arrangements can involve shared licences, staff, infrastructure and data. A local entity may have little direct procurement experience for a service it has always received from the group.

Ask how the service could be substituted or separated if needed. Identify what data can be extracted, who controls access, which capabilities would need replacing and what legal or technical constraints require specialist advice.

This is not an instruction to duplicate every group service or start an unnecessary exit. It is a way to expose assumptions that would matter during a significant change. A statement that “the group would support us” needs enough detail to explain how that support would work under the scenario being considered.

Where the arrangement is material, have the appropriate legal and risk owners review the formal terms and operational expectations against the current standard. Do not assume a service is covered adequately because a broad group agreement exists.

Maintain a local review record

A concise record can identify the local reliance, group provider, service expectations, decision rights, assurance coverage and unresolved local gaps. Attach each action to a person with the authority to resolve it.

Review triggers might include a group restructure, a platform migration, a changed support model or a recovery exercise that challenges local assumptions. These are suggested triggers, not a fixed regulatory review schedule.

Use the assurance-report review to check group evidence boundaries and the financial-resilience review when the assessment relies on support from another group entity.

The evidence checklist can help organise the record. Use the next service review to test one important assumption with the group provider, such as recovery prioritisation. Document the answer in terms the local operations team can use when the usual contacts are unavailable.