APRA CPS 234 Assessment Tool

Overview

The CPS 234 Assessment Tool gives Australian APRA-regulated entities a structured, evidence-backed way to evaluate their compliance posture against Prudential Standard CPS 234 Information Security — at the individual entity level and across the entire APRA-regulated group. Whether you are preparing for an APRA prudential review, a board briefing, an independent ASAE assurance engagement, your FAR Accountable Person attestation, or your own internal gap analysis, the tool does the heavy lifting: scoring, gap identification, risk prioritisation, evidence management, and report generation — entirely within your browser, with no data leaving your environment unless you explicitly enable an AI feature.

The assessment covers all nine assessable obligation areas across the three functional groupings — Govern, Protect, and Respond & Assure — translated from the Standard and CPG 234 (Prudential Practice Guide) into structured, defensible practices. Multi-entity group mode aggregates assessments across every APRA-regulated entity in your group, surfacing cross-portfolio patterns no single-entity view can show. Period tracking and year-over-year comparison turn point-in-time scoring into a defensible trajectory of improvement — exactly the evidence APRA examines in supervisory engagement and post-incident review.

What CPS 234 Asks You to Do — and How the Tool Handles It

CPS 234 has been in force since 1 July 2019 and applies to every APRA-regulated entity: authorised deposit-taking institutions, general insurers, life insurers, private health insurers, RSE licensees (superannuation), and non-operating holding companies. It is APRA's first mandatory cross-industry prudential standard for information security, placing ultimate responsibility on the board and requiring information security controls commensurate with the vulnerabilities and threats to which the entity's information assets are exposed.

The Standard's 42 paragraphs structure into nine assessable obligation areas — from board accountability and information security capability through to control implementation, testing, internal audit, and APRA notification within 72 hours. The tool integrates every element of the framework — the structural obligations, the proportionality expectation, the third-party flow-down requirements, the FAR (Financial Accountability Regime) linkage that APRA's June 2025 letter made explicit — so the question is never "did we cover the Standard?" but rather "what does the evidence support?".

Assessment Domains

All nine CPS 234 assessable obligation areas, structured across three functional categories aligned to the Standard:

The Six Common Gaps — Built In

APRA's independent tripartite assessment programme — covering more than 300 banks, insurers and superannuation trustees — identified six common gaps in CPS 234 compliance across the regulated population. These are not theoretical weaknesses. They are the patterns APRA itself has observed in real entities and continues to surface in supervisory engagement.

1. Incomplete identification and classification of critical and sensitive information assets
2. Limited assessment of third-party information security capability
3. Inadequate definition and execution of control testing programs
4. Incident response plans not regularly reviewed or tested
5. Limited internal cyber audit review of information security controls
6. Inconsistent reporting of material incidents and control weaknesses to APRA in a timely manner

The tool embeds these six common gaps directly into the assessment workflow as a dedicated Common Gap Detection view — assessing each one binary (present / not present), surfacing the structural weaknesses traditional self-assessment misses, and turning APRA's tripartite findings into actionable internal evidence.

Multi-Entity Group Mode

APRA-regulated groups frequently span multiple regulated entities — a Level 2 banking group with subsidiaries, a Level 3 conglomerate spanning banking and insurance, a superannuation trustee licensee with multiple registrable superannuation entities. CPS 234 obligations apply at the entity level, but supervisory expectations increasingly look across the group. The Entity Registry holds every APRA-regulated entity in your group, each with its own APRA registration class, FAR Accountable Person mapping, proportionality tier, and assessment progress — all visible on a single group dashboard. The portfolio-level views go well beyond simple aggregation:

• Entity × Domain Heatmap — A colour-coded cross-group matrix showing every regulated entity against the nine obligation areas, with average compliance by domain across entities, sortable to surface the weakest domains across the group.
• Compliance by Entity Type — Compare compliance posture across entity types (ADI, general insurer, life insurer, RSE licensee, NOHC) to see whether systemic weaknesses cluster by APRA registration class.
• Common Gaps Across the Group — Practices where multiple entities are non-compliant, with the explicit list of affected entities. Fix one root cause at the group policy level, clear many entity-level gaps at once.
• Common Evidence Weaknesses — Patterns where evidence quality is consistently weak across entities, pointing at systemic documentation deficiencies worth addressing centrally — plus reference examples of entities with strong evidence for the same practice.
• FAR Accountable Person Mapping — Each domain mapped to the responsible FAR Accountable Person, with consolidated views showing what each named accountable person is responsible for and where the evidence is.
• Group Overview Dashboard — Tile metrics across the top show total entities, average compliance, common gap count, and outstanding actions. Compliance leads see exactly where to push next.

Evidence Workflow & Reviewer Overrides

Each practice presents the assessor with a structured answer scale (None, Partial, Strong, plus N/A with justification), an inline guide to what good evidence looks like under CPS 234 and CPG 234, and a drag-and-drop area for attaching supporting documents — PDFs, Word, Excel, images, CSV — directly to the practice.

An independent reviewer workflow captures observations against the evidence in structured fields. The reviewer can override the self-assessed compliance level where the evidence clearly contradicts it, with both the original answer and the reviewer override preserved in the audit trail. This is the dual-control pattern APRA expects under independent assurance engagements. When AI is enabled, AI-suggested compliance levels (with confidence rating low/medium/high) sit alongside the self-assessment and the reviewer override — three independent signals, all visible side-by-side, all auditable.

Period Tracking, Baselines & Annual Audit Cycle

CPS 234 places ongoing obligations — control testing on a frequency commensurate with the rate at which threats and vulnerabilities change, annual internal audit review, board reporting at a frequency that supports informed decision-making. Single-point assessments are necessary but insufficient. The tool treats assessment as a continuous activity, with first-class support for the time dimension:

• Compliance Snapshot & Baseline — Save a point-in-time baseline; capture manual overrides where appropriate; replace, clear or revert baselines as the programme evolves.
• Period Closure — Formally close an assessment period and archive it, freezing the state for audit and historical comparison — ideal for the annual internal audit cycle and the APS/GPS/LPS/SPS/HPS 310 Appointed Auditor cadence.
• Year-over-Year Comparison — Improvements, regressions, evidence added or removed, reviewer-decision changes, domain compliance movement — all surfaced as a structured change report between any two assessment periods.
• Multi-Period Trend Comparison — Load three or more historical periods to visualise compliance trajectory by domain and entity across time.
• Per-Entity Compliance Trends — Each entity's compliance trajectory over multiple closed periods, plus a group-average trend line — the trajectory of improvement APRA examines in supervisory engagement.

For FAR Accountable Persons, this is the evidence trail that demonstrates credible diligence — period by period, not just at point-in-time review.

Audit Log, Collaboration & Resilient Storage

Every answer, note, evidence change and reviewer override is captured in a chronological audit log — the complete record of who did what and when, with full version history accessible from the in-app log viewer. This is the artefact that supports APRA's supervisory powers and the independent assurance opinions required under ASAE 3000 / ASAE 3402.

Optional Shared Folder Mode turns the assessment into a team workspace. Multiple assessors work in parallel on a multi-entity group via OneDrive, SharePoint, Microsoft Teams, Google Drive, or Dropbox. Per-entity file locking prevents conflicting edits; identity stamping records who changed what; live change polling surfaces edits in seconds; and the sync provider conflict detector flags "conflicted-copy" files created by the sync provider so you can resolve them manually rather than discovering them at audit time. A 30-day soft delete with one-click restore prevents accidental data loss.

Evidence storage is resilient by design — content-derived filenames (so evidence titles never leak through the folder browser), per-file and per-question caps, browser-storage quota monitoring, optional encryption-at-rest, a crash-recovery mirror, and a read-only Evidence Health Check audit available from Settings.

Who It's For

• Authorised deposit-taking institutions (ADIs) — banks, neobanks, credit unions, building societies, and authorised banking NOHCs
• General insurance companies (including Category C insurers and authorised insurance NOHCs)
• Life insurance companies, friendly societies, EFLICs, and registered life NOHCs
• Private health insurers under the PHIPS Act
• RSE licensees (superannuation trustees) for their business operations
• Level 2 and Level 3 group heads with group-wide CPS 234 obligations
• FAR Accountable Persons with CPS 234 compliance responsibilities
• Internal audit, compliance and assurance teams supporting independent reviews and ASAE engagements