As CPS 230 comes into force, Andrew Foot, Regional Vice President ANZ, Dynatrace, says Australian banks and insurers must prove their ability to handle operational disruption.
Observability has long been critical in the financial sector.
Now, with CPS 230 in force, the efficacy of current setups will really be put to the test.
Australia’s financial sector is increasingly digital and dependent on technology and the companies that deliver those solutions. Any disruption can have significant ramifications for the institutions as well as their customers.
The most recent assessment of Australia’s central bank is that the financial system overall remains at risk of “serious disruption” from operational incidents affecting core systems.
Such resiliency concerns are also front of mind with the Australian Prudential Regulation Authority (APRA), culminating in their CPS 230 standard, which aims to strengthen operational risk management for financial institutions such as banks and insurers.
In response to CPS 230’s emergence, banks and insurers have had to rethink their approach to compliance, with added focus and urgency on timely risk reporting and strengthening organisational resilience to minimise operational disruption due to technology or service provider failures. This has been a complex undertaking due to the challenge of integrating regulatory needs with digital processes.
Elevated resilience requirements
Given its importance to customer experience delivery, resilience has always been prioritised to some extent at the banks and insurers.
The consequences of an outage are well known – impacted revenue, disrupted operations and damage to customer and stakeholder trust. And that’s before any regulatory repercussions.
While resiliency challenges in the sector pre-date CPS 230, the prudential standard places a sharper focus on the way banks and insurers detect and address these challenges.
Variances in the risk tolerances between entities have been replaced with more uniform expectations that make resilience levels across the sector more consistent.
Within CPS 230, business continuity and crisis response planning, incident reporting and effective oversight of outsourced or managed service provider arrangements are particular areas of focus.
On business continuity planning, to satisfy CPS 230, entities require a register of critical operations, evidence they’ve taken “reasonable steps to minimise the likelihood and impact of disruptions” to these operations and a “credible business continuity plan” that is systematically tested to ensure it can be enacted if needed.
If an incident does occur and is judged “likely to have a material financial impact or a material impact on the ability of the entity to maintain its critical operations”, details must be provided to APRA in under 72 hours.
In the context of an active incident, when time is of the essence and attention is rightly focused on recovery, banks and insurers must now also involve the prudential regulator and keep them abreast of developments. This will be very labour-intensive without proper tooling, intelligent and actionable insights and automation.
From compliance to confidence
With CPS 230 compliance requirements now live, Australia’s banks and insurers are one degradation, disruption or outage away from their first CPS 230-related regulatory interaction.
How well they handle this first incident will be a test of whether their current observability, security and risk compliance tools are battle-ready or if additional capabilities are needed.
Unified observability and security platforms have long enabled banks and insurers to meet these challenges head-on. Such platforms have only increased in relevancy in the CPS 230 era while growing cloud-native complexity and business risk are also driving the need to reconsider technology in place.
An end-to-end observability and security platform provides banks and insurers with critical insight into the health and performance of their infrastructure and applications.
Using synthetic monitoring capabilities, entities can simulate user behaviour and identify performance bottlenecks when systems are under load. Teams can use this information to improve systems and ensure business continuity plans remain fit for purpose.
Going a step further, observability platforms that incorporate AI – causal, predictive and generative – and automation can aggregate all the system telemetry available and use it to pinpoint the root cause of issues and resolve them efficiently.
Because incident detection and response are data-driven, this data can be easily repurposed into the mandatory reports required under CPS 230 and delivered quickly to APRA – ensuring the heightened regulatory requirements are met and that systems can be returned to normal operation in as little time as possible.
Proactive control is part of setting a new resilience baseline
While this goes a long way to meeting CPS 230 requirements today, compliance is not a point-in-time exercise. An important part of being “ready” in a CPS 230 context is continuous on-going compliance with the standard.
Responding to incidents reactively is no longer enough. Proactive risk management is the new expectation. Under CPS 230, being able to identify issues and stop them from becoming bigger problems is critical. Organisations should ask themselves: do we have ongoing, real-time visibility over our services? How about over our downstream service providers?
A modern unified platform approach to observability is key to achieving this real-time insight into the IT environment – helping the organisation stay compliant, resilient and ahead of any imminent risks.
Real-time, AI-powered anomaly detection is essential for identifying risks before they escalate into full-blown incidents that also breach compliance thresholds. AI-driven detection and automation capabilities within observability platforms also help reduce the compliance reporting burden on overstretched workforces and remove some of the administration load while improved visibility helps tackle the complexity of sprawling tech stacks. Access to actionable and intelligent observability information is critical in CPS 230 contexts.
When organisations have visibility across their entire IT environment and can proactively prevent issues, core systems remain available and the likelihood of a costly operational incident decreases. This demonstrates organisational commitment to operational risk management – not only to regulators but to customers as well.
In doing so, the benefits of a finely tuned AI-powered observability platform extend far beyond compliance: they underpin customer confidence and nurture lifetime loyalty. That is a victory for everyone involved in keeping critical financial services online and available despite the challenges that remain in the sector.
