Map where an agent touches a critical operation.
Twelve questions about your own operation. The worksheet asks you for nothing back: no account, no email field, and no answer that leaves your browser. You answer here, you print the result, and you keep it.
Each question names the clause it comes from and the date that clause was read from APRA's text, so you can check the question before you answer it. Part three asks whether the record behind a notification to APRA already exists on the day you would have to send it.
Nothing you enter here leaves your browser. Answers live in the page while it is open: there is no form to submit, no answer is stored or sent, and closing the tab discards them. Print before you do.
Every question here comes from CPS 230. Read the obligation clause by clause.
Part one. What the register does not say.
Assume your critical operations register exists and is current. Paragraph 35 sets the minimum classification. For an RSE licensee it names investment management and fund administration. For all APRA-regulated entities it names customer enquiries and the systems and infrastructure needed to support critical operations. These four questions are not about whether you hold the register. They are about whether it says where an agent acts.
Part two. Design is not the whole test.
Paragraphs 28 and 29 ask you to test the control for operating effectiveness, not only for design. A design review reads what the control was meant to do. An effectiveness test asks what it did, on days you can name. The next five questions apply that test to an agent.
Part three. What you could send on the day.
Paragraph 41 gives 24 hours after a disruption to a critical operation outside tolerance. Paragraph 32 gives 72 hours for an operational risk incident with a material impact. Both windows assume the record behind the notification already exists. On the day, it does or it does not.
Your gap map.
Every question you answered no is listed here. Beside each one sits the clause it bears on, the paragraph, and the date that paragraph was read from APRA's text. There is no score, no percentage and no maturity level, because a score would be a claim about your operation that we cannot derive.
Nothing is listed yet, because nothing has been answered yet.
This page prints as a clean document with the clause references intact. It names no vendor and it commits you to nothing.
Question twelve asks something you can check rather than estimate. Your own auditor builds the verifier from source and runs it on a machine you control, without us in the room. See what that verification does and does not prove.
Map the gap before an assessor does.
You leave with a gap map you own, in your own terms, covering the operations you name. It is not a proposal. You keep it whether or not you go further.
45 minutes with your risk or investment operations lead. We walk your CPS 230 critical operations, mark where agents act, and name what evidence exists today.
Email is faster than a calendar link. A short note describing the operation tells us more than a meeting request.