Article
Supplier risk appetite and tolerance: turn the limits into service checks
Distinguish risk appetite, material-risk limits and CPS 230 critical-operation tolerances, then test a supplier target against the whole operation.
Contrata editorial team · Published · Prepared on
A supplier proposes a two-hour recovery target. Your organisation’s critical operation has a four-hour disruption tolerance. It is tempting to conclude that the service fits comfortably inside the limit.
That comparison may omit your own recovery work, the service level needed during disruption and the information you must preserve. It also confuses an operational limit with the organisation’s broader willingness to take risk.
Risk appetite and risk tolerance answer different questions
Risk appetite expresses the risk an organisation is prepared to accept while pursuing its objectives. Risk tolerance translates that position into limits within which it is willing to operate. Use the definitions in your approved framework; a supplier questionnaire cannot set them for you.
APRA’s CPS 220 sets risk-management requirements for banking and insurance institutions within its scope. SPS 220 is the corresponding risk-management standard for RSE licensees. Both require Board-approved appetite statements and address material-risk tolerances. They should not be treated as one interchangeable standard for every financial-services entity.
For a supplier review, connect the stated position to the service:
| Concept | Question for the review | What it does not establish |
|---|---|---|
| Risk appetite | What exposure is the organisation prepared to accept in pursuing its objectives? | That this provider or arrangement is acceptable |
| Material-risk tolerance or limit | Which approved boundary applies, how is it measured and what happens if it is exceeded? | That a favourable supplier rating overrides the boundary |
| Supplier commitment | What does the provider promise for this service, under which conditions? | That your whole operation meets its own limits |
| Evidence | What has been demonstrated, for which scope and period? | That an untested plan already works |
A statement such as low appetite for disruption needs an operational interpretation. A register entry should identify the relevant approved limit, its owner and the evidence used to assess the arrangement. It should not invent a numeric threshold simply because a form requires a number.
CPS 230 critical-operation tolerances are a specific application
Under CPS 230, an APRA-regulated entity establishes tolerance levels for each critical operation across disruption time, acceptable data loss and minimum service under alternative arrangements. These concern the operation, not merely a vendor’s platform uptime.
A provider’s recovery time can contribute to that assessment. So can internal access restoration, data validation, staffing and the steps needed to deliver the required service. Check the boundaries before comparing any two durations.
The minimum service level also matters while alternative arrangements operate. It is not enough to show an attractive final recovery time while leaving an intervening service gap unexplained. The data-loss measure requires its own evidence; a timing result cannot satisfy it.
The CPG 230 guidance provides supporting context on mapping resources, dependencies and severe but plausible scenarios. It is guidance alongside the standard, not a separate supplier certification.
A fictional four-hour limit and a two-hour supplier target
Consider a fictional insurer with an approved maximum disruption period of four hours for a defined claims operation. Its plan separately specifies acceptable data loss and the minimum service under alternative arrangements. Four hours is an invented example, not APRA’s prescribed target or a recommendation for another insurer.
An exercise starts the clock when the defined operation is disrupted. It records this deliberately simple sequence:
| Observed stage in the fictional exercise | Duration | Elapsed time |
|---|---|---|
| Provider restores the contracted platform | 2 hours | 2 hours |
| Insurer restores access and validates the recovered records | 1 hour | 3 hours |
| Team establishes the defined minimum service | 1.5 hours | 4.5 hours |
The supplier met its two-hour target. The operation’s time result still exceeds the fictional four-hour boundary. If the minimum service was not maintained during the alternative arrangements, that is a separate weakness to record, not something excused by eventual restoration.
This arithmetic assumes sequential stages. Real work may overlap, or depend on further steps. Retain actual timestamps and dependencies rather than adding estimates that already include one another. Define the start and end events consistently.
Reaching minimum service does not mean all accumulated work has been cleared or normal service restored. Record backlog reconciliation and the return to normal separately. The recovery-beyond-the-restart guide explains that distinction; the claims disruption exercise guide helps plan observations.
Use an early trigger without quietly moving the limit
An early-warning trigger tells the team when to act before a limit is reached. It is not a replacement tolerance. In the fictional exercise, the absence of a required recovery dependency could prompt escalation before four hours, because waiting until the final boundary would leave no time to respond.
Document the trigger, the person who receives it, the action expected and the approved limit it protects. Separate an observed threshold breach from an inability to establish the result because evidence is missing. Both can require action, but they are different findings.
CPS 230 requires reporting failures to meet tolerance levels and remediation to the Board. Its notification provisions also distinguish an actual disruption outside tolerance from other operational incidents. Do not treat every failed exercise or appetite exception as the same reportable event; apply the relevant requirement and the organisation’s incident process.
Keep acceptance, remediation and a changed limit separate
An open risk can need an authorised decision while remediation continues. Accepting an exposure under the organisation’s governance does not itself alter a critical-operation tolerance or remove a prudential obligation.
If a provider cannot support the required operation, options may include an evidenced fallback, a revised service design, remediation or another arrangement. Record the choice, dependencies, decision authority and review point. A provider’s newly promised target belongs in planned work until evidence supports it.
Use the decision-record guide and inherent/residual assessment guide to show what has actually changed. A revised score alone does not demonstrate recovery capability.
A handover checklist for the next reviewer
Before recommending the arrangement, make these points traceable:
- The approved appetite statement and relevant material-risk limit, with their scope and owners.
- The critical operation and all applicable tolerance measures, where CPS 230 applies.
- The supplier commitment, including the service, dependencies and clock definitions.
- The evidence showing how internal and supplier steps combine, including alternative service and data checks.
- Early triggers, escalation responsibility and any unresolved evidence gaps.
- The decision, remaining remediation and conditions for reassessment.
For broader professional context, the Department of Finance’s risk-framework toolkit discusses appetite and tolerance for Commonwealth entities. It does not impose those entities’ requirements on private firms. The practical discipline is to identify which approved limit governs this service, then retain evidence another reviewer can use to test the conclusion.