CPS 230 is live: can you evidence your customer interactions?

CPS 230 has shifted operational resilience from a planning exercise into an ongoing governance responsibility for APRA-regulated organisations.

The standard is focused on operational risk, critical operations, business continuity and material service-provider risk. It does not create a blanket requirement to record every customer call, meeting or digital interaction. However, where customer interactions form part of a critical operation, control process, complaint, investigation or audit trail, an organisation may need reliable records to demonstrate that its processes operated as intended.

That distinction matters. The practical question is not simply whether an interaction was recorded. It is whether the relevant record can be governed, trusted and produced when scrutiny arises.

APRA describes CPS 230 as requiring regulated entities to manage operational risks effectively, maintain critical operations through disruption and manage risks arising from service providers. View the CPS 230 standard on APRA’s website.

For compliance, risk, operations and technology leaders, this creates a useful reason to examine how customer interaction records support the wider control environment — without overstating what CPS 230 itself requires.

What does CPS 230 require?

CPS 230 is an operational risk standard. Its core expectations include effective operational-risk management, continuity of critical operations through severe disruption, and stronger oversight of material service providers.

In practice, regulated entities need governance arrangements, documented controls, clear accountability, testing and evidence that operational-risk arrangements are working. The exact records needed will depend on the entity, its critical operations and the controls it has designed.

Customer interaction records may form part of that evidence where they help an organisation:

• reconstruct how a customer issue or operational incident was handled;
• show that an approved process was followed;
• support complaint, conduct or quality investigations;
• verify communications involving a critical operation or material service provider;
• demonstrate that records remained available through a platform change or disruption; or
• respond to an auditor, regulator or internal assurance review.

This is an evidence and governance question, not an assumption that every interaction must be captured.

Why customer interaction evidence can matter to operational resilience

Operational resilience is often tested after something has gone wrong. A service has been disrupted, a customer has complained, a third party has failed, or an internal review has identified a control weakness. At that point, decision-makers need to establish what happened, who was involved and whether agreed processes were followed.

A recording or transcript can contribute to that reconstruction, but only when it is part of a controlled recordkeeping process. A file that cannot be located, verified or connected to the wider incident record offers limited assurance.

This is where organisations can encounter a gap between recording and evidence. They may hold large volumes of communications but still struggle to answer basic questions:

• Which channels contain interactions relevant to this control or investigation?
• Can the organisation locate the correct record across current and legacy platforms?
• Can it show who accessed, exported or changed the record?
• Are retention and deletion policies applied consistently?
• Would records remain available if the underlying platform or provider changed?
• Can the organisation produce the evidence within the timeframe expected by its auditors or investigators?

Recording alone is not the same as evidencing a control

Many organisations already record calls or meetings through contact-centre, UCaaS, Microsoft Teams or legacy telephony platforms. That capability can be valuable, but it does not automatically create a defensible evidence base.

A useful interaction record normally depends on more than capture. It also needs appropriate governance, retention, retrieval and auditability. The organisation should be able to explain why the record exists, how it is protected, who can access it and how it can be produced.

A practical way to assess the difference

Five checks for compliance and risk leaders

CPS 230 should prompt a proportionate review of how interaction records fit into the organisation’s operational-risk framework. These five checks provide a practical starting point.

1. Identify where interactions support critical operations or controls

Map the customer and third-party interactions that genuinely matter to operational resilience, compliance, complaint handling or investigation. Avoid assuming every channel and conversation has the same significance.

2. Confirm that relevant records remain available

Test whether records can be accessed across live systems, long-term archives and legacy platforms. Availability should be considered during platform migrations and service-provider changes, not after the old environment has been retired.

3. Review governance and access

Confirm that access is role-based, logged and consistent with policy. The organisation should be able to show how records are protected and how administrative activity is monitored.

4. Test retrieval as an operational process

Run realistic retrieval exercises using a known interaction, date range or participant. A theoretical search capability is not the same as a tested response process.

5. Connect the records to wider assurance

Interaction evidence should support, rather than sit apart from, incident management, complaint handling, business continuity, internal audit and service-provider oversight.

The service-provider dimension

CPS 230 places particular emphasis on risks arising from material service providers. This is relevant where communication, recording, archive or contact-centre services depend on third-party platforms.

An organisation should understand what happens to relevant interaction records if a provider experiences an outage, changes its retention policy, restricts access, ends support or is replaced. Contractual rights matter, but so do practical capabilities such as export, migration, retrieval and continuity of governance.

A platform-independent archive can help reduce dependency on individual communications systems, but the design must still be aligned with the organisation’s actual obligations, security model and risk framework.

What good evidence readiness looks like

A mature position is not defined by recording the largest possible volume of communications. It is defined by being able to identify the records that matter and manage them consistently.

Good evidence readiness may include:

• a documented view of which interactions support specific controls, obligations or investigations;
• consistent capture across the relevant communications channels;
• policy-led retention and controlled deletion;
• tamper-evident storage and logged access;
• search and retrieval across current and historical records;
• tested procedures for audit, investigation and incident response; and
• clear ownership across compliance, risk, operations and technology.

These capabilities can strengthen confidence that the organisation can reconstruct events and demonstrate how its controls operated. They do not, by themselves, guarantee compliance with CPS 230 or any other regulation.

From recording to governed evidence

CPS 230 is live, but the right response is not to turn every customer interaction into a regulatory claim. The more defensible approach is to identify where interaction records genuinely support operational-risk management and then test whether those records are available, governed and usable.

For some organisations, the review will reveal that current recording arrangements are adequate. For others, fragmented archives, inconsistent retention or platform dependencies may make it difficult to produce reliable evidence when it matters.

Next step: Compliance Readiness Guide

The Liquid Voice Compliance Readiness Guide provides a broader framework for assessing capture, governance, retention, retrieval and auditability.

How Liquid Voice can support governed interaction records

Liquid Voice helps regulated organisations bring recording, retention and governance across current and legacy communications environments into a more consistent workflow. The Liquid Voice Compliance Solution supports vendor-neutral capture, policy-led retention, controlled access, consolidated archives and retrieval for audits and investigations.

The appropriate design depends on the organisation’s platforms, operational risks and regulatory obligations. Liquid Voice can help teams assess existing recording and archive arrangements, identify continuity and governance gaps, and plan a more defensible approach.

Talk to Liquid Voice

Review your current interaction-recording and archive environment with a Liquid Voice specialist. Book a demo.

Sources and editorial notes

This article provides general information and is not legal or regulatory advice. Organisations should interpret CPS 230 in the context of their own regulated activities, risk framework and professional advice.

• APRA — CPS 230 Operational Risk Management
• Liquid Voice — Compliance Solution