Time to prepare for APRA CPS 234 Tripartite Reviews

Client Alert

By: Matthew Green, Daniel Farthing, Claire Scott

01 Sep 2021 3 min read

APRA has now begun issuing notices to regulated financial institutions advising them to start preparing for CPS 234 tripartite reviews.
Contents

The reviews are part of APRA’s four year strategy to increase the rigor of compliance of CPS 234: Information Security and require the Board of regulated entities to engage third party independent Auditors to undertake a thorough CPS 234 compliance audit with the results reported not only to the Board, but also directly to APRA.

The audits are expected to take around three months and will need to be completed by September 2022. We can assist you in performing these reviews.

Our team have already had exposure to a number of completed tripartite reviews and tripartite readiness reviews as part of the pilot series. We can also provide assistance in developing and enhancing your approach to CPS 234 compliance in order to be better prepared against cyber threats and to better meet the changing regulatory requirements.

Early feedback from APRA’s tripartite reviews suggest that all Financial Services organisations should consider what an ongoing assurance roadmap for CPS 234 compliance will look like going forward for FY22 and beyond.

Below are some key areas that financial institutions should start considering:

  • Has your organisation identified and documented your information security controls (rather than testing against the APRA standard)?
  • Have you implemented an annual plan for testing controls?
  • Does your internal audit form clear conclusions on design and operating effectiveness (OE) of controls?
  • Does your internal audit plan demonstrate that comprehensive assurance over information security risk is achieved over time and testing is triggered by risks or changes to the IT environment?
  • Do you have clarity over the information assets and the controls that are required to protect them?
  • Do you have visibility over compliance around third-parties and key suppliers?
  • Does your Board reporting process demonstrate how it expects to be engaged with in respect to information security, including the escalation of risks, issues and vulnerabilities?
  • Have you considered the expertise and qualifications of personnel conducting information security control testing and performing internal audits under this standard?

TAGS  

Authors

  • Matthew Green

    Matthew brings 19 years’ experience in providing IT risk assurance and advisory services to listed, Government and private enterprise. His extensive IT risk assurance and advisory experience covers business and technology across strategy, governance, operations, service delivery, procurement, major projects, data risk management and 3rd party auditing. View Profile

  • Daniel Farthing

    Daniel is a cyber security risk and technology controls Partner based in Grant Thornton's Sydney office. With 15 years of experience in the United States and Australia, Daniel is one of the market's leading experts on SOC-2 and technology controls audits more broadly -- including reviews with a focus on cyber/information security, access, change management, data governance and processing integrity. View Profile

  • Claire Scott

    Claire has 17 years of external audit, assurance & advisory experience for financial services clients including superannuation funds, investment managers, ADIs such as credit unions, mutual banks and foreign banks, mortgage funds and other financiers covering residential mortgage funds, personal lending, commercial lending, leasing and specialty finance. View Profile

Related content

View more

ATO raises the evidence bar for treaty claims through fiscally transparent entities

Client alert

ATO guidance increases evidence requirements for treaty claims through FTE structures.

Avinesh Naidu
| 5 min read | 23 Aug 2026

ASFA guidance lifts the bar on operational due diligence

Insight

The Association of Superannuation Funds of Australia (ASFA), in collaboration with JANA, has released its final Investment Manager Operational Due Diligence (ODD) Guidance Note, providing a practical framework to strengthen how superannuation funds assess and oversee operational risk

Tari Makanda
Daniel Farthing
| 4 min read | 27 May 2026

Why we can’t keep avoiding real tax reform

Insight

As debate intensifies ahead of the Federal Budget, this insight examines why incremental tax changes are no longer sufficient for Australia. It argues for meaningful, productivity‑focused tax reform that addresses growing reliance on personal income tax, system complexity and long‑term budget sustainability, while carefully considering broader reforms such as the GST to ensure fairness and economic resilience.

Vince Tropiano
| 6 min read | 06 May 2026
    View more