The board approved the warm-standby arrangement at the previous quarter's risk committee. The documentation was thorough: service provider identified, contract in place, BCP framework updated. The risk team presented the arrangement as evidence that concentration risk in critical operations had been addressed. One question was not asked at that meeting: how long would the standby team need before they could actually carry regulated volume?
Warm standby is a governance category, not an operational capability designation. Under CPS 230, which came into force on 1 July 2025, APRA requires carriers to maintain genuine alternative arrangements for critical operations. The word "genuine" is the relevant one. Genuine means the arrangement can actually be activated - not just that it is contracted and documented.
The approval process typically covers the right ground for a contractual arrangement: provider identified, terms agreed, BCP framework updated to reference the arrangement. What it rarely covers is the operational readiness question. Has anyone measured the ramp-to-competence timeline for the standby provider on this carrier's platform?
Insurance BPO onboarding is not a short process. A provider who has not previously operated on the carrier's platform needs to learn the specific system environment, the carrier's process workflows, the exception-handling procedures, the regulatory obligations specific to the book, and the data quality standards in place. Each of these takes time. Together, they produce a ramp-to-competence timeline measured in months for basic operations.
A warm standby with a training requirement is a cold standby with a better name.
CPS 230 requires that transitional arrangements for pre-existing contracts be remediated by 1 July 2026. For carriers who have documented warm standby arrangements that have never been tested for activation speed, that remediation window is the moment to ask the question that was not asked at the board meeting.
The variable that determines whether a warm standby is genuine is not the contract category. It is whether the standby provider has pre-built fluency on the carrier's platform.
Each carrier's instance has its own configuration, process documentation, and system-specific workflows. The majority of the ramp-to-competence timeline for a new provider is platform-specific. A provider who already operates the same platform type for another carrier has absorbed that ramp already. Their activation timeline is days, not months.
This is the point at which the resilience conversation and the speed conversation converge. The question of whether a warm standby is genuine and the question of how fast a new provider can be operational have the same answer: pre-built platform fluency.
A warm standby arrangement that passes four tests is a genuine one.
First: platform fluency. Does the provider already operate on the carrier's admin platform, or a platform of the same type? If not, the activation timeline is not days.
Second: activation timeline. When the arrangement is triggered, how long before the provider can carry regulated volume? Days is warm. Months is cold, regardless of the label.
Third: tested activation. Has the arrangement been exercised - a partial or full activation to verify that the standby team can operate the carrier's book? Documentation that has never been tested is a plan, not a capability.
Fourth: volume capacity. Is the provider's available bench large enough to carry the volume of the critical operations being backed up? A warm standby with insufficient capacity is a partial solution at best.
A genuine warm standby passes all four. Most arrangements that have been documented but not tested fail the first.
ISSI operates as a warm second source on the platforms ANZ carriers already run. Because platform fluency already exists, there is no ramp period before load can be carried. The pre-trained, platform-fluent bench that makes the resilience arrangement genuine is the same bench that makes the speed claim credible. If warm standby credibility is the active question, it is worth thirty minutes.
Sources: APRA CPS 230 Operational Risk Management (effective 1 July 2025); APRA CPS 232 Business Continuity Management; APRA Quarterly Life Insurance Performance Statistics (2025); IMARC Group Australia BPO Market Report (2025)
