In the rapidly evolving landscape of financial regulation, a startling insight from KPMG reveals that 47% of large companies still rely on spreadsheets to manage critical data like ESG compliance. This statistic underscores a broader issue plaguing regulated sectors: the persistent reliance on outdated and insecure data management methods.
For APRA-regulated entities such as banks, insurers and superannuation organisations, this dependence on legacy systems and user-developed applications (UDAs) creates significant vulnerabilities in operational risk management.
As we approach the July 2025 deadline for CPS 230 compliance, it's clear that financial organizations must reevaluate their approach to data handling and operational risk mitigation.
This blog post explores how CPS 230, along with related regulations like CPS 234 and CPG 235 guidance, challenges the financial sector in Australia. We'll discuss the need for proactive strategies to address not just initial compliance, but also the ongoing "day-two" risks that require continuous management. Finally, we outline how a risk reduction initiative can turn into an opportunity to drive cost savings and new strategic capabilities.
Why CPS 230 Matters - Understanding CPS 230 and Related Regulations
CPS 230 is APRA's incoming standard for Operational Risk Management, designed to improve resilience and risk management in regulated entities.
With a focus on critical operations, material service providers (MSPs), and robust governance frameworks the standard also requires enhanced ongoing monitoring of operational risks, such as data security and business continuity.
Key areas of impact include:
1. Operational Risks
CPS 230 directly targets operational risks, mandating improvements in risk controls across critical processes. Even if spreadsheets or user-developed applications (UDAs) only form part of these processes, they can potentially create significant vulnerabilities. Given the extensive use of Excel across the financial industry, the known weaknesses of inadequate version control, lack of audit trails and UDAs susceptibility to errors represents a widespread risk. Beyond the immediate deadline, where spreadsheets form part of the process, ensuring ongoing compliance with polices and controls post the initial mapping will pose a material challenge to compliance.
2. Weaknesses in Data Integrity
Many large organisations face challenges with "off-system” process gaps. This is where data is manipulated in tools like Excel outside of strategic platforms and then re-entered (often manually) without any audit trail or controls thus creating gaps in data integrity. Such practices introduce a high potential for error and pose a serious risk to compliance relative to regulatory expectations.
3. Future Proofing
APRA expects entities to go beyond compliance, requiring that data be sufficiently auditable to meet business, regulatory, and legal requirements. Additionally, the regulator emphasises the need for continuous improvement in data practices, particularly around operational and information security obligations.
It is important to recognise that CPS 230 doesn't exist in isolation. It's part of a broader interrelated regulatory framework that includes:
- CPS 234: This standard focuses on information security for APRA-regulated entities, ensuring they are resilient against information security incidents.
- CPG 235: This prudential practice guide provides direction on data risk management, advising organizations on handling large volumes of data securely and ensuring it's readily available and accurate for compliance.
Together, these regulations and guidance points create a comprehensive framework for operational excellence and risk management in the digital age as required by APRA.
The urgency of addressing operational risk management has never been more apparent. With the CPS 230 compliance deadline looming, APRA-regulated entities face increased scrutiny and potential consequences for failing to improve their data security, auditability, and risk management practices. Financial institutions that fail to address these challenges may find themselves at a significant disadvantage in an increasingly regulated and competitive landscape.
Charting the Path: From Understanding and Controlling Spreadsheet Risks to Optimizing Performance Outcomes
Achieving CPS 230 compliance and transforming risk culture around spreadsheet assets requires a strategic, multi-faceted approach, as spreadsheets remain a risk factor for most companies despite extensive UDA policies.
Amongst broader CPS 230 work streams our perspective is that organisations can use the following approach to drive significant impact in mitigating this risk and ultimately unlocking new levels of operating efficiency:
- Develop A New Technology Enabled UDA Risk Framework: Form a comprehensive framework for mapping information assets, highlighting relevant processes and surfacing underlying UDA risk. The framework is necessary to evaluate the complexity and materiality of spreadsheet assets within critical processes and related areas that could pose blind spots. This will lead to the identification of priority groups for assessment.
- Identify Critical UDAs: Using the framework to drive priority, perform an audit of all user-developed applications that impact critical processes. A UDA inventory forms the foundation of your risk assessment and mitigation strategy, starting with the most critical assets first before tackling broader opportunities. This step will highlight where to focus additional risk controls, identify opportunities for efficiency gain and highlight which assets could be good targets for transformation. A program of work can then be designed to achieve the required compliance objectives and rectify any deficiencies identified. Work streams are typically divided into phases with groups of UDA’s assigned priorities and targeted areas for uplift.
- Improve Controls: Implement robust data handling controls, such as automated processes for version control and audit trails. Work through data input methods and the integrity of data calculation drivers for opportunities to uplift process resilience. Some information assets may need to be redesigned. This ensures compliance with both CPS 230 and CPS 234.
- Enhance Security: Strengthen information security by implementing data validation, access controls and direct-to-source data connections. This safeguards sensitive information throughout its lifecycle, addressing key requirements of CPS 230 / 234 and CPG 235 guidance. Opportunities also exist to enhance the monitoring of data thereafter to provide certainty that revised protocols remain effective and compliant.
- Drive Transformation: When critical UDA assets and data are governed and controlled there are significant opportunities to then use technology to drive increased efficiency. Typically, there are opportunities to progressively deliver material efficiency gains during earlier phases of execution. However, the opportunity for much larger digital transformations accelerates once all appropriate assets are standardized and available to be scaled. In particular, the ability to leverage previously unstructured data in spreadsheets offers significant potential within broader AI initiatives that are underway in many organisations.
By adopting this best practice approach, organisations can create a solid foundation for CPS 230 compliance and the challenges presented by spreadsheets involved in critical processes. However, true transformation requires more than just internal changes – it calls for a partnership with cutting-edge technology solutions.
Coherent Spark: Your Partner in Compliance and Innovation
In the face of these regulatory challenges, Coherent Spark emerges as a game-changing solution for financial institutions. Our platform can not only help organisations meet CPS 230 requirements that capture spreadsheet exposed processes but also enhance how organisations manage operational risk.
The Spark platform moves organisations beyond risk reduction by delivering new levels of efficiency and strategic optionality with previously trapped, unstructured data sets.
Coherent Spark offers:
- Intelligence: Our Insights functionality leverages AI to identify patterns in workbooks, usage of data between teams and even potential PII, helping you gain insight into key risk areas and possible gaps in CPS 230 compliance. With the ability to rapidly scan and interpret thousands of Excel files, Insights can reduce months of risk assessment work down to just days or weeks.
- Governance and Control: Our automated control framework helps manage large spreadsheet estates and to drive compliance with CPS 230 in a consistent and scalable manner. It provides full access and version control in addition to robust audit trails tracking every execution. Spark enhances transparency across data management systems with a comprehensive dashboard capability giving insight into previously untracked usage patterns.
- Business Solution Efficiency & Scalability: By automating many manual processes, Spark reduces the risk of human error and enhances data integrity. This not only makes it easier to comply with CPS 230's expectations but drives increased operational efficiency which will ultimately drive cost savings and in some scenarios, functional performance.
- Digital Transformation: Spark allows you to modernise your Excel estate, ensuring it remains fit for purpose and compliant with regulations while removing the urgent but unrealistic need to eliminate Excel entirely. The platform also unlocks cost-efficient strategic pathways, enabling you to transform high-value assets and efficiently move away from spreadsheets where it makes sense, without the traditional bottlenecks. This approach gives you two winning paths:1) rapidly increase operational efficiency and enhanced control over your existing Excel assets while 2) selectively pursuing deeper digital transformation.
Coherent Spark is a compelling vision for the future of spreadsheet-driven work. It's a future where spreadsheets are no longer viewed as static and risky documents, but as dynamic, intelligent, and scalable assets, capable of driving business agility and unlocking new possibilities.
From Compliance to Competitive Advantage
Coherent Spark goes beyond helping you meet CPS 230 requirements. It transforms compliance into a strategic advantage by modernising your spreadsheet estate, automating processes, uncovering new pathways for cost-efficient digital transformation, and positioning you to take advantage of your existing data for AI applications now and in the future.
Coherent Spark ensures organizations can achieve fast, day-one compliance without the lengthy timelines other platforms require. Spark enables a rapid first pass to address immediate risks, followed by the targeted uplift of high-risk and high-potential assets at a pace unmatched by traditional approaches.
As compliance deadlines are rapidly approaching and APRA is increasing pressure, Spark can deliver the agility and speed needed to reduce operational risk and ensure compliance in time. It's the ideal solution for quickly navigating today’s regulatory pressures while setting you up for long-term success.
Don't wait for the deadline to arrive.
Take the first step towards compliance and innovation today.
