The board asked a direct question after the CPS 230 update was presented. The risk register now showed a line item for third-party operational concentration. The question was straightforward: if the primary BPO partner failed tomorrow, how quickly could the second source carry load? The honest answer was somewhere between twelve and sixteen weeks. That answer was not given.
CPS 230 came into force on 1 July 2025. The standard requires APRA-regulated carriers to identify their critical operations and actively manage concentration risk in their third-party service arrangements.
The shift is from documentation to active management. Carrying a second-source partner in a BCP document is not, by itself, active management of concentration risk. Active management means the arrangement can actually function - which requires the carrier to know whether the second source can carry load when called on, and how quickly.
Transitional arrangements for pre-existing contracts expire by 1 July 2026. Carriers who have not yet reviewed the warmth of their second-source arrangements have a defined window to do so.
The standard BPO model for Australian insurance concentrates operational risk in two dimensions: a single primary vendor and a single geography. Both represent concentration risk under CPS 230.
Single-vendor concentration means that if the primary BPO partner has an operational disruption - technology failure, cyber incident, commercial difficulty - the carrier has no operational alternative. The second-source arrangement named in the BCP is intended to address this. In most cases, it does not.
The cold second source is named in the document, contracted, but not operating on the carrier's platform. Activation requires onboarding, training, and ramp-up. Industry pattern puts this at eight to sixteen weeks before the partner can carry volume without supervision. During that window, operations are degraded, policyholders are affected, and AFCA complaints accumulate at a rate that outlasts the original disruption.
A document naming a cold second source satisfies a documentation requirement. It does not satisfy the intent of active concentration risk management.
One is a document. The other is an operational capability that can carry volume within days of activation. Under CPS 230, active management of concentration risk implies the carrier knows the difference.
The mechanism that makes a second source warm is platform fluency. A partner already operating on the carrier's policy administration platform does not need a training runway when activated. The skills exist. The processes are known. The ramp is near-zero because it already happened - in the ordinary course of operations, not in response to a crisis.
Warmth is tested by one question: which platform does the second source operate on today? If the answer is "ours," the source is warm. If the answer is "we would train," the source is cold. The two arrangements look identical in a board presentation. They look completely different on the day activation is required.
A CPS 230-defensible second-source arrangement meets four criteria.
First: the second source operates on the same platform today - not theoretically, currently, with active production volume.
Second: the activation timeline is measured in days, not weeks. This is demonstrated by the partner's existing operating record on the platform, not by contracted SLA language.
Third: the arrangement is periodically tested. CPS 230's intent - active management - implies rehearsal, not assumption. A tested arrangement is more defensible at examination.
Fourth: BCP credentials are independently audited. ISO 22301-class business continuity management provides an externally verified baseline that the arrangement meets the management standard.
Transitional arrangements for pre-existing contracts under CPS 230 expire by 1 July 2026. The window to replace a cold source with a warm one is defined and closing.
ISSI operates as a warm second source on the platforms Australian carriers already run. Because platform fluency already exists, there is no ramp period before load can be carried. ISO 22301-class BCP credentials have been independently verified. The operating record on carrier platforms including PetSure demonstrates warm capability in practice.
If CPS 230 compliance posture, concentration risk review, or second-source credibility is the active conversation, it is worth thirty minutes.
Sources: APRA CPS 230 (Operational Risk Management, in force 1 July 2025); APRA CPS 232 (Business Continuity Management); APRA Quarterly Insurance Performance Statistics (September 2025)
