News and Media
Operational resilience testing under APRA CPS 230 requires organisations to demonstrate that critical operations can continue through severe disruptions, within defined tolerance levels. This means testing business continuity arrangements against severe but plausible scenarios, evaluating response effectiveness and addressing identified weaknesses.
For most APRA-regulated organisations, testing is already an established part of operational risk management.
The challenge is making it more effective.
Traditional business continuity exercises can be resource-intensive to coordinate, difficult to scale across multiple business functions and limited in how frequently they can be conducted. While they provide valuable insights, the time between exercises can leave organisations with an incomplete picture of their response capability.
So how can organisations test operational resilience more frequently, involve more people and generate meaningful evidence of their ability to respond, without significantly increasing the operational workload?
What does APRA CPS 230 require for operational resilience testing?
APRA CPS 230 requires regulated entities to maintain a systematic business continuity testing program covering all critical operations, including an annual business continuity exercise.
Testing must assess the effectiveness of business continuity plans and the organisation's ability to operate within defined tolerance levels during severe but plausible disruptions.
These scenarios must reflect material operational risks, including disruptions involving material service providers and situations requiring contingency arrangements.
Testing outcomes should also inform improvements to business continuity arrangements, with findings and remediation tracked and reported through the organisation's governance processes.
For operational resilience leaders, the requirement is clear. But demonstrating that arrangements are effective across critical operations, dependencies and teams presents a more complex challenge.
Why is traditional operational resilience testing difficult to scale?
Traditional tabletop exercises and business continuity tests remain essential components of operational resilience programs. They allow organisations to explore complex disruptions, assess recovery arrangements and bring key decision-makers together.
However, several challenges emerge when organisations attempt to increase the frequency and reach of their testing.
Exercises require significant coordination
Developing scenarios, securing stakeholder availability, coordinating facilitators and documenting outcomes can take considerable time.
For organisations managing multiple critical operations, repeating this process across different teams and locations can create a substantial operational burden.
Testing often involves the same participants
Formal exercises tend to focus on business continuity teams, risk functions, technology specialists and senior leadership.
Yet maintaining critical operations during a disruption depends on a much broader workforce.
Customer service teams, operational managers, technology support staff and other employees may all need to recognise disruptions, escalate issues or activate alternative procedures.
Their ability to respond matters, but they may have limited opportunities to practise.
Testing provides a point-in-time view of capability
A successful exercise demonstrates how participants responded to a particular scenario at a particular moment.
It does not necessarily demonstrate whether the same level of capability exists across other teams, locations or operating conditions.
Personnel change, dependencies evolve and new risks emerge between formal testing cycles.
Without regular practice, gaps in response capability may remain undetected until the next exercise or an actual disruption.
Exercise completion doesn't always demonstrate response capability
Organisations may be able to report how many exercises were conducted, who participated and which actions were identified.
But these measures alone reveal little about how consistently teams recognise disruptions, make decisions, coordinate responses or follow established procedures.
The opportunity is not to replace traditional testing, but to make the broader testing program more continuous, scalable and measurable.
How can organisations make CPS 230 testing more efficient and effective?
An effective approach combines comprehensive business continuity exercises with shorter, more frequent scenario-based testing.
This allows organisations to test different aspects of operational resilience at an appropriate level of depth, while extending response practice across a wider group of employees.
1. Run shorter, more frequent scenario exercises
Not every test needs to be a full-scale, facilitated exercise.
Many aspects of operational resilience can be tested through shorter scenarios focused on a particular decision, procedure or operational risk.
For example, a five-minute exercise might challenge a team member to:
- Recognise the early indicators of a critical service disruption.
- Identify the appropriate escalation pathway.
- Determine when a business continuity procedure should be activated.
- Respond to a failure involving a critical third-party provider.
These focused exercises allow organisations to assess specific response behaviours without bringing an entire crisis management team together.
With iluminr Single-Player Microsimulations, employees can complete realistic, scenario-based exercises in just 3–5 minutes, with AI-driven feedback to reinforce effective responses.
Delivered regularly, these exercises help teams become familiar with their responsibilities and develop the muscle memory needed to act during an actual disruption.
2. Test cross-functional decision-making and coordination
Operational disruptions rarely remain confined to one team.
A critical technology outage, for example, may require coordinated decisions across IT, risk, operations, legal, communications and executive leadership.
Even where individual teams understand their responsibilities, delays and misunderstandings can emerge when they need to work together.
iluminr Multiplayer Microsimulations bring stakeholders into a shared, evolving scenario to test how effectively they coordinate their response.
Participants respond to new information, assess operational impacts and make decisions as the disruption develops.
This allows organisations to examine:
- Whether escalation pathways work as intended.
- How effectively information moves between teams.
- Where decision-making authority is unclear.
- How participants manage competing priorities.
- Whether teams can adapt when initial response arrangements become ineffective.
These exercises help organisations identify coordination gaps that may not be apparent when testing individual functions in isolation.
3. Extend testing beyond risk and resilience teams
One of the biggest opportunities to strengthen operational resilience is to involve more of the organisation.
A business continuity plan may be owned by a central resilience function, but its execution depends on the people responsible for maintaining critical operations.
Testing should therefore extend beyond the teams that design and manage the plans.
With Microsimulations, organisations can deploy relevant scenarios across different employee groups, functions and locations without requiring everyone to participate in the same facilitated session.
For example, a third-party service outage could be tested from multiple perspectives:
- Operations: How should alternative processes be activated to maintain critical services?
- IT: What immediate actions are required to assess and manage the technology disruption?
- Customer service: How should employees respond to customer enquiries while systems are unavailable?
- Risk and compliance: What escalation and reporting obligations need to be considered?
- Executive leadership: Which decisions require senior management intervention?
By exercising these responsibilities independently and collectively, organisations can build a more complete understanding of their response capability.
This approach also helps make resilience a shared organisational responsibility rather than an activity confined to specialist teams.
4. Capture evidence of response capability, not just exercise completion
Completing an exercise is a measure of activity. Understanding how participants performed provides a more meaningful view of capability.
For operational resilience leaders, useful evidence includes how teams recognise and escalate incidents, the decisions they make, how effectively they coordinate and whether they follow established response procedures.
iluminr Microsimulations capture participant responses and exercise outcomes, helping organisations identify patterns and areas for improvement.
Through Capability Intelligence, leaders can examine performance across participants, teams and exercises to better understand:
- Where response capability is strong.
- Which decisions consistently create uncertainty or delays.
- Whether particular functions require additional preparation.
- How response performance changes through repeated testing.
- Where further investigation or remediation may be necessary.
These insights provide an additional layer of evidence alongside formal business continuity testing results.
Importantly, scenario-based decision testing does not replace technical recovery testing or independently prove that critical operations can remain within tolerance levels.
It does, however, help demonstrate whether the people responsible for executing continuity arrangements are prepared to respond.
5. Use testing insights to drive continuous improvement
Testing is only valuable when the findings lead to better outcomes.
CPS 230 expects organisations to address weaknesses identified through business continuity testing and use those findings to improve their arrangements.
Rather than waiting for the next formal exercise to revisit an issue, organisations can use targeted Microsimulations to reinforce the required response and assess progress.
For example, an exercise may reveal that employees recognise a critical service outage but are uncertain about when to escalate it.
A follow-up Microsimulation can focus specifically on escalation thresholds and responsibilities.
Subsequent exercises can then assess whether participants demonstrate greater confidence and consistency in their decisions.
This creates an ongoing cycle of testing, measurement, improvement and retesting.
Over time, organisations can build a more current picture of response capability rather than relying solely on periodic exercise results.
What should organisations measure during CPS 230 testing?
Effective operational resilience testing requires organisations to evaluate both the ability to maintain critical operations and the capability of the people responsible for responding to disruptions.
These are related, but distinct, measures.
Operational performance measures assess whether business continuity arrangements can deliver the required outcomes. These may include:
- Recovery and continuity performance against established tolerance levels.
- Ability to maintain minimum service levels under alternative arrangements.
- Effectiveness of technical recovery and contingency procedures.
- Performance of critical internal and third-party dependencies.
Response capability measures assess how effectively individuals and teams execute their responsibilities. These may include:
- Incident recognition and escalation.
- Decision-making speed and quality.
- Adherence to response procedures.
- Cross-functional coordination.
- Ability to adapt as disruption scenarios evolve.
- Improvement in response performance across repeated exercises.
Together, these measures provide a more comprehensive view of operational resilience.
Technical and operational testing helps establish whether continuity arrangements can work. Scenario-based exercises help reveal whether people understand their roles and can execute the decisions required.
Both contribute to stronger assurance.
How do iluminr Microsimulations support CPS 230 operational resilience testing?
iluminr helps organisations build a more continuous approach to operational resilience testing by making scenario-based exercises easier to deliver, scale and measure.
Rather than relying exclusively on periodic, resource-intensive exercises, organisations can introduce shorter testing activities throughout the year.
Single-Player Microsimulations allow individuals to practise critical response decisions. Multiplayer Microsimulations bring teams together to exercise coordination and collective decision-making. Capability Intelligence provides visibility into exercise outcomes and areas requiring further development.
This approach helps organisations:
- Improve testing efficiency: Run targeted exercises without the coordination requirements of a full-scale event.
- Increase testing frequency: Reinforce response procedures between scheduled business continuity exercises.
- Expand participation: Reach more employees across critical operations, business functions and locations.
- Identify gaps earlier: Surface weaknesses in decisions, escalation and coordination before they contribute to a real incident.
- Generate measurable insights: Capture evidence of response capability to inform assurance, reporting and improvement activities.
Microsimulations complement comprehensive business continuity exercises, technical recovery tests and other assurance activities. Together, they can help organisations establish a more effective and sustainable operational resilience testing program.
Frequently asked questions about CPS 230 testing
How often should organisations test operational resilience under CPS 230?
CPS 230 requires a systematic business continuity testing program covering all critical operations, including an annual business continuity exercise. Testing must assess business continuity arrangements against severe but plausible disruption scenarios. More frequent, targeted scenario exercises can help organisations assess and reinforce response capability between formal testing cycles.
Can Microsimulations be used for CPS 230 testing?
Yes. Microsimulations can support CPS 230 testing by exercising incident recognition, escalation, decision-making and cross-functional coordination. They complement broader business continuity and technical recovery testing but do not independently demonstrate that operational tolerance levels can be met.
How can organisations scale operational resilience testing across the workforce?
Organisations can combine formal business continuity exercises with short, role-specific Microsimulations. This allows different teams and employees to practise relevant disruption scenarios without the coordination and facilitation requirements of large-scale exercises.
What evidence should organisations capture from operational resilience testing?
Evidence should include the critical operations and tolerance levels tested, demonstrated outcomes, identified weaknesses and associated remediation actions. Organisations can supplement this with data from scenario-based exercises, including participant decisions, escalation performance, coordination and changes in capability over time.
From periodic exercises to continuous resilience testing
APRA CPS 230 reinforces the importance of maintaining critical operations through disruption and demonstrating that business continuity arrangements are effective.
For organisations with established testing programs, the next opportunity is to make those programs more efficient, scalable and continuous.
Comprehensive exercises will always have an important role. But they need not be the only opportunity for employees to practise their response.
By combining traditional testing with frequent, targeted Microsimulations, organisations can extend participation, identify capability gaps earlier and build stronger response muscle memory across their workforce.
The goal isn't simply to conduct more exercises. It's to make every exercise count, reach more of the people responsible for maintaining critical operations and develop a clearer understanding of how prepared they are to respond.
Make operational resilience testing more scalable and measurable
Discover how iluminr Microsimulations help organisations exercise more frequently, strengthen response capability and capture the evidence needed to support continuous improvement.
CPS 230
