Efficient Business Solutions · The first eleven lines of The Board Pack, in auditor language

The CPS 230 Client Checklist

Tick the 11 questions your APRA-regulated client will send you that you could answer today with evidence, and read your readiness score, in 5 minutes.

Five minutes, five steps

  1. Read the eleven questions. They are the ones a CPS 230-regulated client sends its service providers.
  2. Tick each one you could answer today with a document to show, not a sentence to say.
  3. Count the ticks.
  4. Read the band: 9 to 11 ready, 5 to 8 exposed, 0 to 4 the questionnaire will hurt when it lands.
  5. Every blank is a Living Risk Register line. Open each question for what a defensible answer looks like.

Tick each question you could answer today with a document to show, not a sentence to say. These are the questions an APRA-regulated client asks the service providers it depends on, under Prudential Standard CPS 230. They are the bar the banks now set for their suppliers, whether or not a bank is asking you.

1. Can you show us your business continuity plan for the services you provide to us, and when it was last tested?
What a defensible answer looks like

Name the document, the date of the last test, and who owns it. A plan nobody has tested is a document, not a plan.

2. What is the longest disruption to this service you could tolerate, and can you show you would recover inside our tolerance?
What a defensible answer looks like

State your recovery time in hours or days, and point to the test that proves it.

3. How and how quickly will you notify us of an incident affecting our service?
What a defensible answer looks like

Name the person, the channel, and the hour. Regulated clients need to notify APRA quickly, so they need to hear from you first.

4. Which parts of the service do you subcontract to a fourth party, and how do you manage them?
What a defensible answer looks like

List them. Hosting, payroll, offshore processing. A client cannot accept a risk you have not named.

5. Where is our data held, who can access it, and how is it protected?
What a defensible answer looks like

Country, system, named roles with access, and the control that limits it.

6. Which key people does the service depend on, and what happens if one of them leaves?
What a defensible answer looks like

Name the roles, the backup for each, and where the handover is written down.

7. Can you give us, our auditor and APRA access to information and premises relating to the service?
What a defensible answer looks like

Yes, and the contract clause that says so. This is a standard condition of material service provider agreements.

8. What are your exit and transition arrangements if the contract ends?
What a defensible answer looks like

How the data comes back, in what format, in what timeframe, and who runs the service meanwhile.

9. What is your financial position, and could you keep delivering through a downturn?
What a defensible answer looks like

What you would show: audited accounts, or a statement from your accountant, and for how long you could operate at reduced revenue.

10. How do you monitor and report service performance against what we agreed?
What a defensible answer looks like

The measures, the frequency, and the report they would receive.

11. What insurance and liability cover applies to the service you provide us?
What a defensible answer looks like

Policy type, cover amount, and expiry. The certificate, not the promise.

Your readiness score
–
Tick what you can evidence.

Build it once, properly.
Tony TaslimEfficient Business Solutions · Melbourne
Enterprise structure, translated.
Every figure on this page is yours. Nothing here is my estimate. What you type stays in your browser and is not sent anywhere.