Cyber security gaps found in compliance with CPS 234
On 5 July 2023, APRA announced its early findings from an expansive study on cyber resilience in financial services.
The assessment required APRA’s regulated entities to appoint an independent auditor to assess their compliance with prudential standard CPS 234 Information Security (CPS 234). The standard’s purpose is to ensure that regulated entities have baseline prevention, detection and response capability to withstand cyber security threats.
From the first tranche of assessment, APRA identified the following control gaps:
- incomplete identification and classification of critical and sensitive information assets;
- limited assessment of third-party information security capability;
- inadequate definition and execution of control testing programs;
- incident response plans not regularly reviewed or tested;
- limited internal audit review of information security controls; and
- inconsistent reporting of material incidents and control weaknesses to APRA in a timely manner.
APRA will further engage with the industry to lift the benchmark for cyber resilience as well as continue to work with APRA’s regulated entities to meet CPS 234 requirements.
New prudential standard on operational risk finalised
On 17 July 2023, APRA released its finalised Prudential Standard CPS 230 Operational Risk Management (CPS 230), which is designed to ensure that an APRA-regulated entity (such as banks, insurers and superannuation trustees) is resilient to operational risks and business disruptions.
The new standard provides the foundation to:
- strengthen operational risk management by introducing new requirements to address weaknesses in existing controls;
- improve business continuity planning so that entities are positioned to respond to severe disruptions; and
- enhance third-party risk management by ensuring risks from material service providers are appropriately managed.
The new standard will commence from 1 July 2025.
APRA also released for consultation draft Prudential Practice Guide CPG 230 Operational Risk Management (CPG 230) to assist the regulated entities with the implementation of CPS 230, and the consultation period for the draft guidance will close on 13 October 2023.
Thematic review of Retirement Income Covenant released
On 18 July 2023, APRA announced the release of an information report detailing the findings of APRA and ASIC’s joint thematic review of the implementation of the retirement income covenant (“the covenant”), which came into effect on 1 July 2022.
APRA and ASIC reviewed the progress made by 15 superannuation trustees that were responsible for 16 industry, corporate and public sector superannuation funds and found that while trustees were improving their offerings of assistance to members in retirement, the quality of approach varied and there was a lack of urgency in embracing the intent of the covenant.
The key findings contained in the information report include:
- Understanding members’ needs – trustees were relying on incomplete data which were critical in developing an effective retirement income strategy.
The report recommended trustees address the fundamental data gaps to support effective strategy formulation and enhance their modelling/analytics to better understand their members' needs.
- Designing fit-for-purpose assistance – the measures put in place by trustees weren’t robustly tracking member usage of assistance and a sizeable portion of them lacked concrete plans to address the gaps identified in the types of assistance.
The report recommended trustees tailor their communication and other assistances to members to cater to diverse member preferences, and address any assistance gaps by implementing regular testing and appropriate metrics to track the effectiveness of assistance offered.
- Overseeing strategy implementation – some trustees hadn’t embedded their strategies into concrete actions in their business plans, and a majority of the trustees lack metrics to assess the retirement outcomes provided to members.
The report recommended that trustees integrate their retirement income strategy with their business planning cycles and develop metrics that are focused on member outcomes to measure success of their strategy.
Final investment governance guidance for super trustees
On 20 July 2023, APRA announced that it had updated Prudential Practice Guide SPG 530 Investment Governance (SPG 530) to assist superannuation trustees in meeting APRA’s requirements in relation to investment governance under Prudential Standard SPS 530 Investment Governance (SPS 530), which came into force on 1 January 2023.
SPG 530 provides:
- additional guidance to support trustees in meeting their requirements relating to liquidity management, stress testing and asset valuations;
- an outline of how APRA expects trustees to consider environmental, social and governance risk factors as part of their overall investment risk management;
- greater clarity in areas requested by industry in applying the standard; and
- a more streamlined approach to guidance and bringing SPG 530 in line with APRA’s Modernising the Prudential Architecture strategic initiative.