APRA CPS 220 Risk Management
Review

APRA CPS 220 Risk Management CPS220-P46: Scope of the Comprehensive Review

The scope of the comprehensive review must have regard to the size, business mix and complexity of the institution, the extent of any change to its operations or risk appetite, and any changes in the external environment in which it operates.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 9 controls across 7 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

SOC 2 · 2 controls

  • SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
  • SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)

C5 (Germany) · 1 control

  • C5-SP-02 Review and Approval of Policies and Instructions

HIPAA Security Rule · 1 control

  • 164.306 Security Standards: General Rules

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-53 Rev 5 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Review

Query this from an agent

The graph holds this control, the 9 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll APRA CPS 220 Risk Management controls