Due diligence checklist, Australia
APRA CPS 230: what to ask a vendor
Prudential Standard CPS 230 Operational Risk Management. APRA. Material service providers are identified, checked before contracting, bound by set terms and monitored.
What it is
Material service providers are identified, checked before contracting, bound by set terms and monitored.
Who it applies to
Applies to banks, mutuals and credit unions, insurers and pension and superannuation funds in Australia.
What to ask a vendor, and the evidence to request
| # | Ask the vendor for | Evidence to request |
|---|---|---|
| 1 | Business continuity and disaster recovery plans, with tested recovery time and recovery point objectives | The business continuity and disaster recovery plans for the service, the stated recovery time and recovery point objectives, and the report from the last test with its date and outcome. |
| 2 | Notification of incidents and of material changes to the service, within agreed times | The incident notification clause and procedure: what counts as an incident, who is told, within what time, and a record of a past notification if one exists. |
| 3 | Disclosure of sub-contractors (fourth parties) that deliver any part of the service | The list of sub-contractors that deliver any part of the service, what each delivers, where from, and how changes to the list are notified. |
| 4 | Access, audit and information rights for the institution and for APRA | The contract clause giving the institution and its regulator access, audit and information rights, and the vendor's process for an audit request. |
| 5 | Exit and transition assistance, including return of data | The exit plan: how the service ends, how data is returned and in what format, the transition assistance offered, and the timetable. |
In every case
- A named contact at the vendor responsible for this regime, and how the vendor tracks changes to it.
- Which named customers the vendor already serves under this regime, as references you may call.
This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.
Next
- Every checklist, by country
- What a market scan is and how to run one
- Have Vederca run the procurement: the regime goes into the register as a must-have