MyRISK Trace · APRA-regulated entities
The register says who your material service providers are. It does not say why.
CPS 230 and CPG 230 commenced on 1 July 2026, with an updated Material Service Provider Register template and an APRA Connect return for the 2026 submission. The register is an inventory. What gets asked about afterwards is the decision behind an entry — and that lives across procurement files, committee minutes, email and someone's memory.
Why it surfaces now
An obligation with a date on it, and a first submission behind it
The standard is in force and the first return is a real event rather than a future one. That changes which question gets asked. Before commencement the question was whether the register was complete; after it, the question is whether a particular arrangement was reasonably assessed, by someone with authority, on evidence that existed at the time.
A register entry records a conclusion. It does not preserve the reasoning that produced it, and the reasoning is what a reviewer asks for.
Where it bites first
Six decisions worth being able to replay
01
A materiality determination
Why this arrangement was assessed as material, or was not — against what criteria, on whose judgement, and when it was last revisited.
02
A service-provider exception
An arrangement continued past its assessed review date, the conditions attached, and whether those conditions were ever evidenced.
03
A tolerance decision
What disruption was judged acceptable for a critical operation, on what basis, and who accepted it.
04
A resilience trade-off
A remediation deferred, a dependency accepted, a migration delayed — sound at the time, and thin in the record.
05
An incident decision trail
What was known when notification, containment or escalation was decided, and who decided it.
06
A fourth-party dependency
What was understood about your provider's own providers at the point the arrangement was approved.
Only two of these are cyber questions. The rest are operational resilience and supplier judgement, which is where CPS 230 actually sits.
What a replay produces
The evidence as it stood, not as it reads now
A Trace record preserves what existed at the time and the policy version that applied, the rationale and the alternatives considered, who held authority and what exactly was approved, the conditions and their expiry, and whether anything has changed since that unsettles the approval. Corrections are append-only and never overwrite the snapshot.
Two different jobs
The position is one job. The reasoning behind it is another.
MyRISK does both, and they are separate engagements because a reviewer asks two different questions — what your position is, and why it was reasonable.
Core
The control and evidence position
Controls, evidence, owners and reporting mapped once and reused across the register, the return and the board pack, instead of each being assembled by hand.
Trace
The decision behind the entry
Why this arrangement was assessed as it was, on what evidence, by whom, under what conditions, and what has changed since.
Most organisations need both eventually and one of them first. Which one depends on whether your problem is the position or the reasoning behind it.
The boundaries, in writing
What this is not
Read this before taking it further
- Whether your position satisfies an obligation is your assessment and your regulator's, never a vendor's. No product determines that for you, and one that implies otherwise is selling you a risk rather than removing one.
- MyRISK does not sell into the compliance-platform category, and that is a choice rather than a limit. Core is an assurance layer and can hold controls, evidence, owners and reporting against a standard. What MyRISK argues is narrower and harder to copy: the decisions taken around those controls are what get questioned later, and almost nothing holds them. If a compliance platform is what you are shopping for, say so early and we will tell you plainly whether this is the wrong conversation.
- Compliance is not guaranteed and “regulator-ready” is not promised. Replayability is a property of the record, not a supervisory conclusion.
- Trace is not the register. It holds the decision behind an entry, not the inventory itself. MyRISK Core holds control, evidence, owner and reporting records and can carry that position; if your GRC platform already does, Trace sits alongside it.
- No saving is quantified here. Reconstruction time varies by firm and by decision, and any figure MyRISK has not measured with you would be invented.
- Trace complements your GRC, ITSM and collaboration systems. It replaces none of them.
Which service-provider decision would be hardest to explain in the return?
Bring that one. The Diagnostic compares your current reconstruction with a Trace-style replay — fixed scope, fixed price, one decision class first.