A warm second source and a cold one look identical in a BCP document. They look completely different when activation is required. The audit that reviewed the documentation and passed it did not ask the question that determines the difference: which platform does the second source operate on today?
Standard BCP audits are documentation reviews. They check whether the second-source agreement exists, whether the activation protocol is documented, whether the right contacts are current, and whether scenario coverage is complete. These are important checks. They are not the same as a test of whether the arrangement would work.
CPS 232 governs business continuity management requirements for APRA-regulated carriers in Australia. CPS 230, which came into force on 1 July 2025, adds an active management obligation for concentration risk in third-party arrangements. Both standards are satisfied by an arrangement that is genuinely operational. A documentation review confirms the documentation is complete. It does not confirm the arrangement is operational.
Every carrier's BCM framework includes a recovery time objective for its critical operations. The RTO specifies how quickly operations must be restored after a disruption. For insurance claims processing, policyholder service, and related functions, that RTO is typically measured in hours or days.
Most cold second sources cannot meet an RTO measured in hours or days. Industry pattern puts the activation ramp for a partner without platform fluency at eight to sixteen weeks before they can carry regulated volume without supervision. That is eight to sixteen weeks of operational degradation against an RTO that may require restoration in days.
In a BCP document, a warm second source and a cold one are indistinguishable. In a BCP rehearsal, or on an actual activation day, the difference is twelve weeks of ramp versus near-zero. This inconsistency - stated RTO versus cold source ramp - is the resilience gap most BCP reviews surface only when an activation is triggered.
For NZ carriers, RBNZ and FMA resilience expectations similarly require that arrangements are genuinely operational. The RTO problem exists identically in NZ without requiring a specific regulatory instrument to name it.
The platform question is the test. It has a binary answer.
A warm second source operates on the carrier's policy administration platform today - currently, with active production volume on the same system. When activated, no training runway begins because the runway already happened. The ramp is near-zero. The RTO can be met.
A cold second source would operate on the carrier's platform if needed. When activated, the training runway begins. The ramp is eight to sixteen weeks. The RTO cannot be met during that window.
The two arrangements look identical in a document. The platform question separates them. Ask any second source named in a BCP document: which of our specific platforms do you operate on today, with active volume? The answer determines whether the arrangement is warm or cold - and whether the stated RTO is achievable.
Three tests should be applied to any BCP second-source arrangement.
First, the platform test: ask the second source to identify the specific policy administration platform they currently operate on and provide a named operating reference. Not a platform they could train on - one they operate on now.
Second, the RTO test: calculate the realistic activation timeline from decision to full volume carry, given the partner's current platform knowledge. Compare that to the carrier's stated RTO. If the ramp exceeds the RTO, the gap is documented.
Third, the rehearsal test: when was the last activation exercise conducted? A rehearsal on a cold source surfaces the ramp problem in a controlled environment rather than during an actual disruption event.
ISO 22301-class BCP credentials provide external validation of the partner's BCM framework - the international standard for business continuity management, independently assessed. They do not substitute for the platform test. They confirm that the BCM arrangement has been reviewed against a recognised standard. By 1 July 2026, CPS 230 transitional arrangements for pre-existing contracts in Australia expire - making this the right window to run all three tests.
ISSI operates as a warm second source on the platforms ANZ carriers already run. Because platform fluency already exists, ramp is near-zero when activated. ISO 22301-class BCP credentials have been independently verified. The operating record on carrier platforms including PetSure demonstrates warm capability in practice, not in a proposal document.
If a BCP review, vendor governance assessment, or second-source credibility check is active, it is worth thirty minutes.
Sources: APRA CPS 230 (Operational Risk Management, in force 1 July 2025); APRA CPS 232 (Business Continuity Management); ISO 22301 (Business Continuity Management Systems); RBNZ and FMA operational resilience guidance (NZ)
