CPS 230 Third-Party Assurance: Getting SOC Reports and Evidence From Material Providers

A SOC 2 report sitting in a shared drive is not assurance. It is a PDF. Assurance is what you can demonstrate to APRA about whether your material service providers can keep your critical operations inside tolerance, and that is an evidence-gathering exercise, not a clause you negotiated once.

CPS 230 has applied since 1 July 2025, and the transitional relief for pre-existing service-provider arrangements runs out at the earlier of the next contract renewal or 1 July 2026. For most APRA-regulated entities, that second date is the one that matters. By then the arrangements you inherited have to meet the standard, and the part that catches technology and risk functions off guard is not the contract drafting. It is the ongoing obligation to obtain, review and reconcile assurance over what those providers are actually doing. This is a reading of that obligation as an operational workflow, written for the people who have to build it.

Assurance is a verb, not a clause

Most third-party programmes treat assurance as something you secure at signing: an audit-rights clause, a right to receive the provider’s control report, a commitment to notify you of incidents. Those clauses matter, but they are the plumbing. CPS 230 asks a different question. It requires you to monitor material arrangements on an ongoing basis, to assess service performance against agreed levels, and to satisfy yourself that the provider’s controls are effective for the risks you rely on them to manage. That is continuous, and it produces evidence or it does not.

The distinction is not pedantic. A supervisor reviewing your CPS 230 position will not be impressed that you have a right to audit. They will ask whether you exercised it, what you found, and what you did about it. The clause is a permission; the assurance is the record of having used it. If your register lists a material provider and your file for that provider contains only the signed contract, you have documented an intention, not a control. The standard is, at heart, a proof standard wearing a policy standard’s clothes, and third-party assurance is where that character shows most clearly.

The evidence a supervisor will actually accept

The primary artefact for most material providers is an independent controls report. Which report, and what it covers, decides how much of your assurance need it actually meets:

• SOC 2 (ISAE 3000), Type II. Covers security, availability, processing integrity, confidentiality and privacy over a period. The Type II operating-effectiveness scope is what you want; a Type I attests only to design at a point in time and tells you little about whether the controls held.
• SOC 1 (ISAE 3402). Scoped to controls relevant to financial reporting. Useful for transaction-processing providers, but narrow, and rarely sufficient on its own for an operational-resilience judgement.
• ASAE 3150. The Australian assurance standard on controls, flexibly scoped against defined objectives. Where a provider will engage, this can be tailored to the CPS 230 obligations you actually care about, which the offshore SOC templates were not written for.
• GS 007. Relevant for investment-management service providers, again with a transaction and financial-controls emphasis.
• ISO 27001 certification. Confirms an information-security management system exists. It does not evidence that the specific controls you depend on operated effectively over the period, so treat it as a floor, not the assurance itself.

None of these was designed around your critical operations. That is the gap you close, not the provider.

Holding a report is not the same as mapping it

Here is the failure mode I see most. An entity collects the SOC 2 reports for its material providers, files them, and ticks the assurance box. Nobody has read the scope section to check that the report covers the service you actually consume, from the data centres and sub-services you actually use, over a period that overlaps your reporting year. Nobody has read the exceptions the auditor noted, or the complementary user-entity controls the report assumes you operate at your end. And nobody has mapped any of it to a tolerance.

Mapping is the work. For each material provider, you have defined the critical operations they support and the tolerance levels for those operations. The assurance question is then specific: does the provider’s evidenced recovery capability sit inside the recovery time and recovery point objectives you have set for the operation it underpins? A report that shows a 24-hour restoration capability behind an operation you have told the board tolerates four hours of disruption is not a green tick. It is a documented breach waiting to be found. This is why third-party assurance cannot be run separately from your critical operations and tolerance evidence; the two are the same exercise seen from opposite ends.

The fourth-party problem, and the gaps providers leave

CPS 230 also expects you to satisfy yourself that a material provider manages the material providers it in turn depends on. Your provider’s own SOC report frequently carves those sub-services out, listing them as a scope exclusion. That exclusion is exactly where your concentration and continuity risk often lives, so read for it deliberately. If three of your material providers all rest on the same hyperscaler region or the same identity provider, you have a concentration exposure no single provider’s report will surface for you.

Some providers will not hand over a controls report at all, or will only share a heavily redacted one. That is not a dead end, and it is not an excuse to record the arrangement as assured. Where an independent report is unavailable, you fall back to your own due diligence: structured questionnaires tied to your tolerances, site visits or virtual walkthroughs, independent penetration-test summaries, and joint recovery testing to validate the capabilities that actually support restoration of your service. Whatever route you take, the output is a written assessment on file, dated, with a conclusion and any follow-up actions.

Build the workflow, not the folder

Treat assurance as a recurring pipeline attached to the material service provider register you submit to APRA. Each material entry needs an owner, an assurance method, a defined refresh cadence tied to the provider’s reporting cycle, a mapping to the critical operations and tolerances it supports, and a place to record exceptions and the actions taken to close them. When a new controls report lands, someone reviews it against last year’s, checks the period and scope still fit, and reconciles the findings to your tolerances. That cadence is the control. The folder of PDFs is just its exhaust.

The targeted amendments finalised in 2026 ease specific contractual obligations for a narrow class of non-traditional providers, such as central banks and clearing and settlement facilities, and refresh the register template. They do not soften the assurance expectation for the providers that carry your critical operations. When the transition closes, a SOC report nobody has mapped to a tolerance will prove exactly what an unread contract proves: that you meant to.