Client Alert

Time to prepare for APRA CPS 234 Tripartite Reviews

By:
Matthew Green,
Daniel Farthing,
Claire Scott
01 Sep 20213 min read
APRA has now begun issuing notices to regulated financial institutions advising them to start preparing for CPS 234 tripartite reviews.
Contents

The reviews are part of APRA’s four year strategy to increase the rigor of compliance of and require the Board of regulated entities to engage third party independent Auditors to undertake a thorough CPS 234 compliance audit with the results reported not only to the Board, but also directly to APRA.

The audits are expected to take around three months and will need to be completed by September 2022. We can assist you in performing these reviews.

Our team have already had exposure to a number of completed tripartite reviews and tripartite readiness reviews as part of the pilot series. We can also provide assistance in developing and enhancing your approach to CPS 234 compliance in order to be better prepared against cyber threats and to better meet the changing regulatory requirements.

Early feedback from APRA’s tripartite reviews suggest that all Financial Services organisations should consider what an ongoing assurance roadmap for CPS 234 compliance will look like going forward for FY22 and beyond.

Below are some key areas that financial institutions should start considering:

  • Has your organisation identified and documented your information security controls (rather than testing against the APRA standard)?
  • Have you implemented an annual plan for testing controls?
  • Does your internal audit form clear conclusions on design and operating effectiveness (OE) of controls?
  • Does your internal audit plan demonstrate that comprehensive assurance over information security risk is achieved over time and testing is triggered by risks or changes to the IT environment?
  • Do you have clarity over the information assets and the controls that are required to protect them?
  • Do you have visibility over compliance around third-parties and key suppliers?
  • Does your Board reporting process demonstrate how it expects to be engaged with in respect to information security, including the escalation of risks, issues and vulnerabilities?
  • Have you considered the expertise and qualifications of personnel conducting information security control testing and performing internal audits under this standard?
TAGS
Authors
  • Matthew Green
    Matthew Green Matthew brings 19 years’ experience in providing IT risk assurance and advisory services to listed, Government and private enterprise. His extensive IT risk assurance and advisory experience covers business and technology across strategy, governance, operations, service delivery, procurement, major projects, data risk management and 3rd party auditing. View Profile
  • Daniel Farthing
    Daniel Farthing Daniel is a cyber security risk and technology controls Partner based in Grant Thornton's Sydney office. With 15 years of experience in the United States and Australia, Daniel is one of the market's leading experts on SOC-2 and technology controls audits more broadly -- including reviews with a focus on cyber/information security, access, change management, data governance and processing integrity. View Profile
  • Claire Scott
    Claire Scott Claire has 17 years of external audit, assurance & advisory experience for financial services clients including superannuation funds, investment managers, ADIs such as Credit Unions, Mutual Banks and foreign banks, mortgage funds and other financiers covering residential mortgage funds, personal lending, commercial lending, leasing and specialty finance. View Profile

Related content

View more
The importance of strong Expected Credit Loss modelling frameworks
Client alert The importance of strong Expected Credit Loss modelling frameworks
The transition to Expected Credit Loss (ECL) modelling under AASB 9 revolutionises financial accounting. Success relies on understanding ECL principles, ensuring data quality, robust methodologies, and effective governance.
Liam Te-Wierik
Claire Scott
| 3 min read | 19 Mar 2024
Strengthening capital management in the Australian banking sector
Client Alert Strengthening capital management in the Australian banking sector
Read more for insights from the latest APRA statistics and ICAAP reviews highlighting the Australian banking sector's strengthened capital management. Learn key considerations for ADIs to balance risk and growth effectively, including data quality, operational risk focus, and leveraging automation.
Claire Scott
Tari Makanda
| 3 min read | 14 Mar 2024
APRA's proposed new guidelines on IRRBB
Client Alert APRA's proposed new guidelines on IRRBB
Discover APRA's proposed new guidelines on Interest Rate Risk in Banking Book (IRRBB) through APS 117, impacting non-significant financial institutions (non-SFI). Learn about key requirements, including risk management framework integration, technology capacity assessment, and data quality evaluation, ensuring compliance and effective risk management.
Claire Scott
Tari Makanda
| 4 min read | 14 Mar 2024
    View more

    Subscribe to receive our publications

    Subscribe now to be kept up-to-date with timely and relevant insights, unique to the nature of your business, your areas of interest and the industry in which you operate.