PRUDENTIAL STANDARD CPS 230 · IN FORCE 1 JULY 2025
Contrata ships pre-configured automated controls for APRA-regulated entities — researched clause-by-clause against CPS 230, executed on schedule, evidenced automatically.
Provider Health Check
Polls provider health hourly; fires when issues are detected.
SLA Evidence Collector
Gathers status, uptime and SLA terms; drafts the assessment.
Human Review
Confirm tolerance impact; approve escalation or dismiss.
to notify APRA of a material operational risk incident
CPS 230 §33
to notify a disruption outside tolerance
CPS 230 §42
material service provider register, submitted annually
CPS 230 §51
prudential standards replaced by CPS 230
CPS 231/232 + SPS/HPS
AFTER DAY ONE
CPS 230 came into force on 1 July 2025. The frameworks are approved, the registers filed. What remains is the standing obligation: monitor, review and test controls for design and operating effectiveness — and prove it, continuously.
Control libraries exist, but proof of operating effectiveness is collated by hand, quarter after quarter.
Material service providers — and the fourth parties behind them — change faster than annual review cycles can see.
Reporting built for point-in-time compliance can't answer for tolerance levels in real time.
RISK AS A SERVICE
Contrata is not a workflow tool you configure from scratch. We research each obligation, map clauses to executable controls, and ship them pre-configured — you adapt them to your entity and turn them on.
01
We work through the standard, the practice guide and industry findings — clause by clause.
02
Each obligation becomes a named, versioned control with an owner, a schedule and a defined evidence artifact.
03
Controls execute on schedule, escalate to your team when judgment is needed, and file their own evidence.
| Clause | Control | Name | Cadence |
|---|---|---|---|
| CPS 230 §30 | CTL-014 | Control operating-effectiveness test | Weekly |
| CPS 230 §42 | MON-007 | Tolerance-level breach monitor | Continuous |
| CPS 230 §51 | REG-002 | MSP register upkeep & annual submission | Quarterly |
| CPS 230 §59 | NTF-003 | Material arrangement notification | On change |
CONTROL LIFECYCLE
01
Watch service providers, systems and thresholds continuously — not at review time.
02
Scheduled control tests run as workflows, step by step, with every action recorded.
Provider Health Check
Polls provider health hourly; fires when issues are detected.
SLA Evidence Collector
Gathers status, uptime and SLA terms; drafts the assessment.
Human Review
Confirm tolerance impact; approve escalation or dismiss.
03
When a check needs human judgment, it lands with the right person — inside the same workflow.
MSP Service-Level Monitor · Run #146
06:00:00 Trigger fired
Provider Health Check · hourly
04
Each run closes with a timestamped record: what ran, what it found, who signed off.
1,240
control runs · 30 days
98.6%
passed without escalation
4
escalations to human review
Runs per day
CONTROL LIBRARY
Each pack is researched against the standard, shipped ready to adapt. The library grows with each engagement.
PACK-MSP-01
Continuous checks over MSP health, incidents and service levels — including deemed MSPs.
CPS 230 §50–51
PACK-CTL-02
Scheduled design and operating-effectiveness tests with evidence filed per run.
CPS 230 §30–31
PACK-TOL-03
Track outage time, data loss and service levels against board-approved tolerances.
CPS 230 §37–42
PACK-REG-04
Keep the register current through the year; submission-ready for APRA annually.
CPS 230 §51
PACK-INC-05
Structured 72-hour and 24-hour notification paths with the clock visible.
CPS 230 §33, §42
PACK-AI-06
Inventory AI dependencies in critical operations and monitor fallbacks — per 2026 APRA and ASIC letters.
APRA/ASIC 2026
Bring us one obligation you're evidencing by hand. We'll show it running as a control — researched, scheduled and self-evidencing.