What "using" a CPS 230 framework looks like on a quiet Tuesday

On 30 April 2026 APRA released the final targeted amendments to CPS 230, the practice guide CPG 230, and the material service provider register template. The amendments introduce limited exemptions from specific contractual requirements for material arrangements with certain categories of service providers, where contractual compliance is not practicable. The updated standard and guide commence on 1 July 2026, the same date the deferred resilience requirements apply to non-significant financial institutions. For pre-existing service provider contracts, the requirements apply from the earlier of the next renewal or 1 July 2026. The core standard has applied since 1 July 2025.

With weeks left before 1 July, most organisations will reach the date with the artefacts in place. A list of critical operations. Tolerance levels written down. A material service provider register. A business continuity plan. A scenario testing schedule. Having these is necessary. It is not the same as using them.

A framework that is used shows up in ordinary decisions. When a change is proposed, someone asks which critical operation it touches and whether it stays inside tolerance. The register is consulted before a contract is signed, not reconstructed after. The continuity plan is something people have rehearsed, not a document they would open for the first time during an incident. The tell is not the quality of the writing. It is whether the document changes what people do on a quiet Tuesday.

Tolerance is the clearest example. On paper, a tolerance level is a number in a table. In use, it is a live instrument. Someone watches it, knows how close the operation is sitting to it this week, and can say what would push it over. Where the framework is only had, the tolerance was set once to satisfy a template and has not been looked at since.