APRA CPS 234 compliance services

APRA regulates financial institutions including: 

• authorised deposit-taking institutions (such as banks, building societies and credit unions)
• general insurers
• life insurers
• friendly societies
• private health insurers
• reinsurance companies, and
• superannuation funds (other than self-managed funds). 

APRA may contact a previously unregulated entity to advise of pending regulated status. 

CPS 234 compliance is mandatory for all APRA-regulated entities.

APRA typically will be satisfied to view an independent assessment report, provided the assessment evidence-gathering practices align with an appropriate audit methodology. Thales commonly follows ISO 19011 guidelines to ensure that evidence provides reasonable assurance of compliance as outlined in the standard.

Duration of the assessment may vary depending on organisational scope and the availability of client information, evidence, and interviewees. Activities of a typical CPS 234 assessment will span 3 to 5 weeks.

Thales can provide expert consultants to assist in CPS 234 gap remediation, and observes sound practices to avoid conflicts of interest. Organisations providing gap remediation support are generally precluded from auditing controls and activities which they have designed or performed. Your Thales Account Executive will collaborate with our subject matter experts to mitigate potential conflicts and ensure optimal outcomes for the client.

APRA will generally liaise with the regulated entity regarding next actions, expected remediation timelines, and, where it deems applicable, possible regulatory penalties.

APRA’s Prudential Standard CPS 234 and ISO 27001 are both focused on strengthening information security—but they differ in scope, specificity, and regulatory weight. 

• CPS 234 is a mandatory prudential regulation for APRA-regulated Australian financial entities with prescriptive controls
• ISO 27001 is a voluntary, international standard for any organisation worldwide, providing a framework (ISMS) to manage information security risk. 

There is significant alignment between CPS 234 and ISO 27001 as both require governance structures, risk-based controls, asset inventories, testing, and incident management. However, CPS 234 imposes additional obligations, including stricter timelines, explicit board oversight, and tighter regulation of third-party relationships.