What Is third-party risk? CPS 230 explained

With the introduction of APRA’s new Prudential Standard CPS 230 (Operational Risk Management), third-party risk has come to the forefront for many actuaries.

This regulatory standard makes it clear that APRA expects financial institutions to identify their Material Service Providers, keep a register of those providers and actively manage the risks that arise from relying on them.

But what exactly is third party risk? Who are our third-parties and why do they matter so much to the way financial institutions operate today? This article provides a brief introduction to third-party risk and uses a recent news event to illustrate how these risks can arise in practice and why they deserve greater attention.

Third-party risk in plain English

Third‑party risk is the risk an organisation takes on when important work, technology or services are handled by outside companies. Even though the work is outsourced, the Board and the trustee are still responsible for the outcomes and must answer to members, regulators and other stakeholders.

Some examples of third-party risk include:

Technology failure: Cloud provider outage, prohibiting customers from accessing online banking
Data breach: An external IT company loses customer data
Processing errors: A payroll service miscalculates super contributions
Service delays: A call-centre provider fails to answer member queries in time.

If a third-party fails, it can cause operational disruption, financial loss, regulatory penalties, customer/member harm and damage to the organisation’s reputation.

Recent industry events have shown that poor oversight of major service providers — especially when switching to a new provider — can lead to serious service breakdowns and direct member harm. This has resulted in regulatory action and extra licence conditions for some corporations. APRA has made it clear that the Board and the trustee must show strong governance and risk management when overseeing critical operations and key service providers, with even higher expectations when services essential to customers and members are involved.

HESTA and CPS 230: A real-world case study

APRA imposes licence conditions on HESTA after outsourced admin transition failure

APRA has imposed additional licence conditions on HESTA after identifying major risk management and governance deficiencies in the fund’s transition to an outsourced administration provider, which was finalised in June 2025. HESTA is one of Australia’s largest superannuation funds with 1.1 million members and approximately $100 billion in funds under management.

The regulator found HESTA was not adequately prepared to oversee or manage the transition, resulting in a “severe and prolonged disruption” that left members unable to access their funds for weeks causing direct harm to members. Under the new conditions, HESTA must undertake independent reviews of both its risk management framework and board effectiveness, with the reviews covering how the transition was managed^[1].

APRA has consistently stressed that outsourcing does not remove a trustee’s responsibility. Poorly managed third‑party transitions often lead to member disruption, compliance failures and regulatory action.

Around the world, regulators have introduced new standards to strengthen outsourcing practices, recognising that growing reliance on external providers brings higher risks that must be addressed through stronger frameworks, controls and clear accountability.

In Australia, CPS 230 raises expectations for the governance of critical service providers and operational resilience. Similarly, in Europe, the supervisory authorities (EBA, ESMA, and EIOPA) have introduced the Digital Operational Resilience Act (DORA), which requires real‑time evidence of operational resilience, continuous monitoring and the ability to withstand disruptions originating deep within digital supply chains.

This article is just a starting point

This article is just the starting point. Third-party risk spans a broad and evolving landscape — from identifying Material Service Providers and building registers, to managing fourth-party exposures and meeting the real-time resilience requirements of frameworks like DORA.

Future articles from the Risk Insights Working Group will go deeper on each of these areas. In the meantime, if you're working in this space and want to contribute to a future article, we'd love to hear from you .