The compliance head has prepared a thorough presentation on the carrier's third-party risk posture. It documents every vendor arrangement, maps every service boundary, and explains the monitoring framework. The regulator reads it, sets it down, and asks one question: what happens to your critical operations if your primary BPO cannot service your book tomorrow?
CPS 230 came into force on 1 July 2025. For the first time, APRA's operational risk framework explicitly requires carriers to manage concentration risk in critical third-party operations - not merely document them. The requirement is not a vendor register. It is evidence that operations can continue through material disruption.
In New Zealand, RBNZ is actively reviewing its expectations around third-party operational risk. NZ regulatory governance requirements are moving in the same direction. The question facing risk teams in both markets is no longer whether they have a framework. It is whether that framework proves operational resilience.
Most third-party risk frameworks were built to satisfy the questions regulators used to ask. They document service boundaries. They track SLA performance. They maintain vendor registers. These frameworks are complete. They are also answering a question that has changed.
APRA is now asking whether critical operations are genuinely dependent on a single third-party provider, and whether alternative arrangements are operational or theoretical. A warm-standby arrangement that has never been tested, with a provider who has never operated on the carrier's platform, is a documentation answer to an operational question. The gap between what the framework documents and what the regulator wants to see is where compliance risk now lives - and it is not always the same thing.
CPS 230 requires that transitional arrangements for pre-existing contracts be remediated by 1 July 2026. Carriers who have not begun that remediation have a narrowing window.
Regulatory compliance at minimum standard is a lagging position. The carriers who have earned genuine regulatory goodwill have done something different: they have built an operational posture that answers the regulator's current question rather than the one from three years ago.
APRA's CPS 230 focus is on three things: documented governance, concentration risk management, and operational continuity evidence. The third element is where most carriers are weakest. Governance documentation is achievable with effort. Demonstrating that operations genuinely continue through disruption requires something more than a plan - it requires a second-source arrangement with a provider who can carry regulated volume without a training runway.
RBNZ is watching the same space. Carriers operating in both markets who build their third-party risk posture around operational continuity evidence will find that posture holds under scrutiny from both regulators.
The carrier with a defensible third-party risk posture has four things in place.
First: documented governance with evidence of active oversight. Not a static vendor register, but a live framework capturing vendor performance, operational events, and escalation pathways.
Second: concentration risk analysis that is honest about single-point dependencies. If a single provider carries all servicing for a critical book, that concentration needs to be named and actively addressed.
Third: a genuine alternative arrangement. A second source who can carry load without a ramp period - which requires the second source to already be fluent on the carrier's platform. A provider who needs training when activated is a theoretical backup, not a warm standby.
Fourth: tested continuity evidence. Regulators increasingly want to see that alternative arrangements have been exercised, not just designed. A BCP framework that has been audited and tested occupies a categorically different position than one that exists only in documentation.
The carriers building this posture before being asked present to regulators from a position of confidence rather than defence.
ISSI operates as a warm second source on the platforms ANZ carriers already run. Because platform fluency already exists, there is no ramp period before load can be carried. ISO 22301-class business continuity credentials and audit-passed operations support a third-party risk posture that holds up under regulatory scrutiny. If concentration risk in critical operations is an active concern, it is worth thirty minutes.
Sources: APRA Quarterly Life Insurance Performance Statistics (2025); APRA Quarterly Insurance Performance Statistics (September 2025); IMARC Group Australia BPO Market Report (2025); APRA CPS 230 Operational Risk Management (effective 1 July 2025)
