A second source that takes twelve weeks to activate is not a second source. It is a recovery timeline with a different name. The distinction matters because a recovery timeline is measured in the weeks after the disruption. A second source is measured in the hours before the disruption causes lasting damage.
CPS 230, which came into force on 1 July 2025, changed what "second source" needs to mean for Australian carriers. The standard requires active management of concentration risk in critical operations - not a document that describes a theoretical arrangement, but a defensible operational structure that can withstand scrutiny.
For carriers in New Zealand, where RBNZ and FMA oversight increasingly emphasises operational resilience, the same logic applies without the specific CPS 230 instrument. The question regulators and boards are asking is consistent: can the second source actually carry load when the primary arrangement fails?
The answer that most existing second-source arrangements provide is: eventually.
There are two kinds of second-source arrangements in practice: the one that exists in a document, and the one that could actually carry load under pressure.
The cold second source is named in the BCP document. It has a contract. It has agreed terms. What it does not have is operating history on the carrier's policy administration platform. When activated, the partner must be onboarded, trained, and ramped before volume can transfer. Industry pattern puts that process at twelve to sixteen weeks for a partner without prior platform experience.
During those twelve to sixteen weeks, the disruption that triggered the activation is still running. Policyholders are affected. Operations are degraded. In Australia, a service gap long enough to affect policyholders generates an AFCA complaints tail that outlasts the outage itself. The cold second source satisfies the document requirement. It does not satisfy the risk.
The warm second source is defined by one thing: it can carry load before a recovery timeline would be needed.
That is only possible if platform fluency already exists before the activation event. A partner already operating on the carrier's policy administration system does not need a training runway. The skills exist. The processes are known. The ramp is near-zero because the ramp already happened - in the normal course of operations, not in response to a crisis.
Platform fluency is the question the board did not ask when it approved the concentration risk assessment. It is the question that separates a warm second source from a cold one. Speed is not a feature of the arrangement. It is the proof that the arrangement is actually warm.
Three questions test any second-source arrangement for actual warmth.
First: which platform does the second source operate on today? Not which platforms it could train on - which ones it operates on now, with active production volume.
Second: what is the realistic activation timeline from decision to full volume carry? Not the contracted SLA - what would actually happen, given the partner's current platform knowledge?
Third: is there an operating reference that demonstrates platform performance at scale? Not a proposal. An existing operating relationship on the same platform.
A second source that cannot answer all three without qualification is, in practice, a cold source with warm-source language. CPS 230 transitional arrangements for pre-existing contracts expire by 1 July 2026. The window to review existing arrangements and replace cold sources with warm ones is open now.
ISSI operates as a warm second source on the platforms ANZ carriers already run. Because platform fluency already exists, there is no ramp period before load can be carried. The operating track record on carrier platforms including PetSure demonstrates speed in practice, not in a proposal document.
If concentration risk posture is under active review - whether under CPS 230 or NZ regulatory governance requirements - it is worth thirty minutes to discuss what a genuinely warm second source looks like.
Sources: APRA CPS 230 (Operational Risk Management, in force 1 July 2025); APRA Quarterly Insurance Performance Statistics (September 2025)
