The clock is ticking on APRA’s new operational risk management regulation
The forthcoming Operational Risk Management regulation from APRA will have a significant impact on financial institutions. With less than a year to comply, risk leaders should waste no time, writes Dan Cooke, Chief Business Officer for Asia Pacific at Roboyo.
The concept of operational resilience, or understanding and managing operational risks, isn’t new to those operating in financial services. But the industry is fast approaching a critical point of injunction. Like many other regulators around the world, the Australian Prudential Regulation Authority (APRA) has mandated the industry to strengthen their management of operational risk and improve business continuity planning.
Having recently released its Prudential Practice Guide CPG 230 Operational Risk Management (CPG 230), designed to assist in the implementation of Prudential Standard CPS 230 Operational Risk Management (CPS 230), APRA is once again sounding the bell on the date the new standard takes effect: 1 July 2025. Banks, insurers and superannuation trustees now have less than twelve months to comply.
The evolving environment for Australia’s financial services sector necessitates the focus on the resilience of critical operations and uplift in third-party risk management. Open Banking increases the need for organisations to have sufficiently prepared, funded and maintain their ability to manage risks.
As financial services businesses consider their preparedness for CPS 230 by 2025, they need to consider the role of compliance and how it’s managed for the organisation in the longer term.
A compliance reset
Compliance is often viewed as an existential threat, a box-ticking cost centre within an organisation. It is a function that consumes margin but offers no replenishing revenue line attached.
The traditional approach to operationalising compliance also tends to be siloed and limited, with a good measure of myopia thrown in. The short-term view of compliance is perpetuated when key performance indicators (KPIs) are not linked to key risk indicators (KRIs). Organisations neglect to consider the long-term opportunity costs and potential ROIs for inclusion in strategy and budget decisioning.
When executed well, compliance management can become a strategic advantage that sets organisations apart from their competitors, by enhancing their reputation as a responsible and trustworthy provider.
Another barrier to instilling meaningful operational resilience is the issue of optimistic bias. The belief that “it will never happen to us” means decisions to comply are made based on the minimum amount of spend to remain compliant on the surface.
The obligations associated with a standard like CPS 230 are highly interconnected across people, processes and technology. As such, compliance has a far more important role, in serving as an advisory to organisational leaders and imparting continuous strategic impact across the organisation.
Organisations should not view operational resilience merely with a compliance lens, but rather with a strategic, ROI-driven perspective, as they are challenged to maintain revenue streams and increase both margin and footprint in an ever-changing landscape.
Regulation meets innovation
Legal and compliance tasks remain slow, largely manual, and complicated, even with digital transformation improvements in many financial services organisations. The growing volume of compliance requirements today underscores the need for organisations to streamline processes and maximise efficiency and productivity in their compliance efforts.
The creation of digital twins supports continuous process excellence in a safe environment that allows testing of iterations before rolling them out to the wider business. A digital twin is a virtual replica of an organisation’s most important operations, mapping the many interconnected business processes behind its day-to-day operations.
Most compliance solutions that purport to be modern do not use digital twins or a real time approach. Instead, they rely on static data sets with regulation analysed at a point in time that is not tailored to specific operational needs. Modern compliance solutions use a combination of AI-powered low-code technologies, process digital twins, process excellence, and real-time reporting. These tools not only build resilience against regulatory actions but also ensure a sustainable and profitable business model.
For financial services organisations, the innovative solution integrates regulatory requirements into automated processes, allowing for real-time data handling and insights, quick identification of systems affected by regulatory changes, and transparent reporting through configurable dashboards. This integration enhances risk management, cuts costs, and accelerates innovation and decision-making. More importantly, it helps business leaders foresee and address any impact on the organisation before it becomes a problem.
Embracing risk
The regulatory landscape in Australia is constantly evolving, and CPS 230 is just one piece of the puzzle. The right technology and automation can help financial services organisations flex and adapt as and when change happens.
It’s important to remember that risk is not a four-letter-word; it can be managed and is often essential for success. At the same time, automation and digitisation does not mean a “computer say no” approach. Such thinking is counter-productive, reduces agility, and could even increase risks while stifling revenue growth and innovation.
While any technological advances are positive, implementing AI, automation and process management in isolation doesn’t account for the highly integrated and interconnected complexities of operationalising compliance. These tools alone do not solve for scalability or drive benefits across the entire organisation.
Only through embracing risk as a strategic imperative and using technology to support compliance can financial leaders drive true operational and organisational resilience.
