A Guide to Operating CPS 230 Efficiently​

Operational resilience has always depended on understanding the organisations you rely on most. As regulatory expectations continue to evolve, that understanding has become more important than ever.

At Hellios, we've spent more than a decade helping hundreds of regulated organisations improve supplier assurance through collaboration, standardisation and trusted data. Throughout that time, one thing has remained constant: compliance is never the end goal. The real objective is building a resilient, cost-effective and sustainable way of managing supplier risk.

CPS 230 represents an important milestone in that journey. While many organisations have successfully delivered their implementation programmes, the focus is now shifting towards embedding these requirements into day-to-day operations.

This guide bring that to life. It introduces a practical maturity framework to help organisations strengthen visibility, build confidence in supplier information and create a more efficient approach to managing third and fourth-party risk.

INDUSTRY INSIGHT

When financial services leaders were polled on their biggest hurdles moving past "Day 1" compliance:

The future of CPS 230 depends on repeatable, scalable supplier assurance.

In 2025, CPS 230 introduced new requirements for APRA-regulated entities to identify critical
operations, strengthen operational resilience and improve oversight of Material Service Providers (MSPs). Organisations were required to establish governance frameworks, maintain accurate supplier information and implement processes capable of supporting ongoing operational resilience.

For many organisations, these requirements were delivered through dedicated implementation programmes, bringing together people, time and resources to achieve compliance.

With that in place, the challenge is evolving.

CPS 230 requires organisations to maintain accurate supplier information, monitor Material Service Providers, assess emerging risks and support ongoing board oversight, year after year.

This shift is exposing several common challenges:

• Existing data lacks the depth required for effective scenario testing and resilience planning.

• Risk, supplier and operational data remains fragmented across multiple systems and teams.

• Ongoing monitoring of Material Service Providers creates significant operational effort.

• Fourth-party visibility remains difficult to achieve in practice.

• Boards require more meaningful reporting to support increasing accountability.

The organisations that succeed won't be those that simply maintain compliance. They'll be those that build operating models capable of measuring, monitoring and improving supplier assurance continuously.

The next stage of this journey is being shaped by three emerging realities:

01 Greater Accountability
Boards need better visibility and stronger assurance over supplier risk.

02 Growing Complexity
Supplier ecosystems continue to expand, making it harder to maintain visibility, monitor Material Service Providers and manage fourth-party risk.

03 Long-term Sustainability
Traditional assurance models don't scale. Resource constraints, fragmented data and supplier fatigue demand a more efficient approach.

Benchmark your organisation.

Supplier assurance maturity is not defined by the volume of data an organisation holds, the size of its supplier population or the resources available to manage it. It is defined by the ability to access, trust and act upon supplier information consistently and effectively.

As supplier ecosystems become larger and more interconnected, this capability is becoming a defining characteristic of operational resilience.

Use the levels below to assess your organisation's current capability and identify the next stage of development.

INSIGHT

It’s normal for an individual organisation to have a mixture of characteristics across the maturity levels in different functions within the business. This can be a result of departmental requirements, resources or priorities.

Improving maturity brings alignment and consistency to business functions, which removes duplication, eliminates gaps and strengthens supply chain resilience. Doing that in an efficient way improves productivity whilst reducing costs.

Three practical steps to improve supplier assurance maturity

Improving supplier assurance maturity requires organisations to develop three core capabilities: Visibility, Confidence and Efficiency. Together, these capabilities create the foundation for stronger oversight, better decision-making and a more sustainable operating model.

Each capability builds on the one before it. Organisations cannot establish confidence without visibility, and efficiency can only be achieved when supplier information is visible, trusted and consistently managed.

INSIGHT

Supplier assurance maturity isn't achieved by applying the same level of due diligence to every supplier.

It is achieved by establishing a consistent foundation of supplier information that enables
organisations to identify where greater scrutiny is required. With trusted, accessible information, assurance activities can be prioritised according to criticality, inherent risk and regulatory obligations.

The result is a more proportionate, efficient and sustainable approach to supplier assurance.

Build a complete, accessible view of your supplier ecosystem.

Improving supplier assurance maturity requires organisations to develop three core capabilities: Visibility, Confidence and Efficiency. Together, these capabilities create the foundation for stronger oversight, better decision-making and a more sustainable operating model.

Visibility is built by collecting the relevant information, connecting it across the
organisation and using it to understand supplier risk and operational dependencies.

1. Collect the right information

Create a consistent foundation of supplier information that supports CPS 230 requirements, including:

• Supplier information

• MSP identification

• Critical operations

• Fourth-party disclosures

• Risk and control information

2. Make information accessible

Eliminate the reliance on spreadsheets and individual knowledge by making information available to the relevant teams, including:

• Procurement

• Information Security

• Operational resilience

• Compliance

• Executive & Board reporting

• Risk

3. Create a connected supplier data ecosystem
Combine your supplier information with external data sources to eliminate silos, integrate this with internal business systems to improve context and support more informed decision-making.

4. Create a single source of truth
Bring supplier information together into a single, trusted record that can be accessed across the organisation. A single source of truth provides consistent reporting, reduces duplicate data management and gives every team confidence they are working from the same, up-to-date information.

50% faster supplier onboarding

By centralising supplier information into a single, accessible system, OSB Group
gave procurement, risk and information security teams access to the same trusted
supplier data, reducing duplication and enabling faster decision-making.

Turn supplier information into trusted decision-making.

1. Collect information directly from suppliers

Prioritise primary supplier information wherever possible. Information provided and maintained by the supplier is more reliable than data aggregated or scraped from external sources alone.

2. Validate critical information

Introduce appropriate validation for the information that matters most.

This may include:

• Independent verification

• Providing documentation

• Human validation

• Consistency checks

Resulting in information that is accurate and suitable for regulatory reporting and decision-making.

3. Keep information current

Supplier information should reflect today's operating environment, not last year's assessment. Establish review cycles, supplier update processes and change notifications so information remains accurate over time.

4. Monitor for change

Monitor for events that could affect supplier risk, such as:

• Ownership changes

• Financial deterioration

• Cyber incidents

• Sanctions

• Adverse media

• Material changes to operations

Continuous monitoring enables organisations to respond quickly as supplier risk evolves.

"Having immediate access to current supplier data makes it so much easier to establish compliance. And even if there are areas to improve within our supply chain, we'd rather know where they are than being kept in the dark.“

Catherine Griffiths, Director of Risk and Compliance, Swansea Building Society

Create a model that scales across your organisation.

Supplier assurance processes are rarely designed. They evolve over time as new regulations, emerging risks and organisational priorities add new systems, teams and ways of working. Building a more efficient operating model starts by asking one simple question:

If you were designing supplier assurance today, what would you do differently?

1. Collect information once

Define a common supplier data standard that supports multiple business functions and regulatory requirements, reducing duplicate requests to suppliers.

2. Share trusted information

Enable Procurement, Risk, Operational Resilience, Information Security and Compliance teams to access consistent, high-quality supplier information through a common platform.

3. Integrate and automate

Connect supplier assurance with existing procurement, governance and risk systems.  Automate repeatable activities wherever possible to reduce manual effort and improve consistency.

4. Collaborate beyond your organisation

Adopt shared assurance approaches that enable multiple organisations to benefit from common supplier information, share best practice, learn from peers and ultimately reduce the burden on suppliers.

1,148 due diligence days saved

"For a lean procurement function like ours, the ability to consolidate supplier due diligence into a single, trusted source of data has been invaluable."
David Byrne, Group Procurement Manager, Benefact Group

Building supplier assurance through a community model.

The Supplier Assurance Maturity Model provides a framework for building Visibility, Confidence and Efficiency. Achieving these capabilities, however, requires more than technology alone. It requires an operating model that reduces duplication, builds trust in supplier information and enables organisations to collaborate where common challenges exist.

The Community Model brings these capabilities together, helping organisations strengthen supplier assurance while reducing effort for buyers, suppliers and the wider industry.

VISIBILITY

One trusted source of supplier information.

CONFIDENCE

Validated, maintained and enriched supplier data.

VISIBILITY

Shared across teams, integrated into existing systems and supported by industry collaboration.