CPG 235 in Action: Practical Ways for Australian Financial Organisations to Treat Data Strategically

In Australia’s financial services industry, data is more than a resource; it's the foundation of trust, resilience, and innovation. However, recent trends reveal how fragile that foundation can be. In the first half of 2025, the Office of the Australian Information Commissioner (OAIC) recorded 532 data breach notifications, with the financial services industry accounting for 14% of incidents, second only to healthcare.  

These figures underscore an opportunity for transformation.  

The Australian Prudential Regulation Authority (APRA) has set clear expectations through CPG 235 – Managing Data Risk, a guide for the financial services industry that reframes data as a strategic asset rather than an operational byproduct. By embedding governance and risk management across the entire data lifecycle, financial organisations can not only meet compliance requirements but also leverage data for stronger decision-making and customer confidence.

This blog explores practical steps to operationalise CPG 235, focusing on how automation and governance can help financial organisations achieve regulatory alignment while unlocking efficiency and business value.

3 Steps to Make Data a Strategic Asset

Treating data as a strategic asset demands more than policies. It requires governance, lifecycle oversight, and automation.

Step 1: Establish a Comprehensive Data Management Framework

Over the next three years, 71% of organisations globally expect to embark on digital transformation initiatives that will require the support of compliance. Meeting APRA’s expectations under CPG 235 isn’t just about compliance; it’s about building resilience and trust through data, while providing a unique opportunity for growth.  

A data management framework goes beyond checklists; it lays the groundwork for automation, lifecycle management, and integrated risk oversight, enabling organisations to scale without adding complexity. Similarly, it establishes clear accountability for data owners, custodians, and stewards, ensuring governance is cohesive rather than fragmented. Financial organisations that fail to define these roles risk more than inefficiencies: They risk eroding confidence in their ability to manage risk and deliver value in an increasingly data-driven regulatory landscape.

For financial organisations in particular, compliance is not just about avoiding penalties; it’s also about ensuring that data supports strategic decision-making, effective risk management, and customer trust.

But where should financial organisations start?  

Industry standards like the Data Management Capability Assessment Model (DCAM) and the Data Management Body of Knowledge (DMBOK) provide the foundation. These frameworks benchmark data management maturity and codify governance best practices by outlining governance principles, measuring organisational maturity, and guiding consistent data practices.

APRA’s CPG 235 then serves as the benchmark for gap analysis, ensuring alignment with the broader CPS 220 – Risk Management standard. This approach ensures alignment with regulatory expectations while creating a scalable risk management framework that supports innovation.

Solutions like the AvePoint Confidence Platform don’t just support these capabilities, it also operationalises governance as a discipline through automated policy enforcement, role-based accessed management, and comprehensive compliance insights. This approach embeds accountability into daily operations by ensuring that the right stakeholders are involved in governance processes. For Australian organisations, this approach turns regulatory obligations into strategic advantage, unlocking resilience, trust, and long-term value.

Step 2: Embed Information Lifecycle Management and Assurance

APRA’s CPG 235 makes it clear that data risk must be managed at every stage of its lifecycle — capture, processing, retention, publication, and disposal. This expectation goes beyond basic governance; it requires organisations to demonstrate a clear understanding of how data moves and transforms across systems. Clause 27 of CPG 235 specifically calls for visibility into data lineage, ensuring that organisations can trace the origin and flow of critical information.

Without this level of oversight, Australia's financial services industry faces heightened exposure to operational and compliance risks. Information lifecycle management is not just about retention schedules; it’s about embedding controls that protect data integrity and availability throughout its journey.

Transparency is central to APRA’s guidance: Regular assurance reviews by internal audit or independent functions are essential. IBM reports that generative AI (GenAI) in financial services drives innovation in fraud detection and risk management, analysing massive datasets for patterns that could point to fraudulent activities and illustrating how automation can strengthen assurance processes.

Achieving true data governance requires more than policies — it demands visibility and trust. Implementing metadata repositories and lineage diagrams creates a single source of truth, enabling organisations to understand how data flows and evolves across the enterprise. This transparency is critical for compliance and risk management.  

Integrated solutions like the AvePoint Confidence Platform take this further by centralising lifecycle controls and assurance capabilities into a single view, transforming complexity into clarity. For organisations, this means compliance isn’t a burden. Instead, it becomes a driver of operational efficiency and strategic confidence.

By embedding information lifecycle management and continuous assurance into a cohesive risk management framework, the financial services industry can move beyond reactive compliance and build a resilient, transparent data ecosystem that supports both regulatory obligations and business objectives.

Step 3: Leverage Automation to Scale Governance and Reduce Risk

With vast volumes of structured and unstructured data flowing across hybrid environments, manual governance isn’t just inefficient, it’s also a liability. The complexity of these ecosystems demands automation as a strategic enabler, not a tactical fix.  

By embedding automation into lifecycle controls and governance processes – such as classification, retention, and access controls – organisations not only reduce operational risk but also free teams to focus on higher-value activities such as analytics and innovation.

This approach can transform compliance from a reactive obligation into a proactive driver of efficiency, resilience, and long-term value.

For example, automated data discovery and classification tools can continuously scan core banking systems, loan origination platforms, and customer data repositories to identify personally identifiable information (PII), payment card details, and sensitive financial records. These tools can then apply APRA-aligned retention and access policies automatically, ensuring compliance with both CPG 235 and the Privacy Act 1988.  

Similarly, workflow automation can streamline approval processes for high-risk activities such as granting access to credit risk models or treasury data, enforcing segregation of duties, and reducing the likelihood of fraud — all without slowing down critical business operations. While APRA’s CPG 235 is a prudential practice guide rather than a prescriptive standard, its principles provide a strong foundation for governance maturity. When combined with compliance obligations under the Privacy Act 1988, automation ensures that organisations apply consistent controls aligned with regulatory expectations and privacy requirements.

Automating processes offers benefits beyond meeting compliance requirements. Organisations that integrate automated governance into their data strategies report faster audit cycles and significant reductions in compliance-related costs. These efficiencies translate into tangible business value, enabling financial organisations in Australia to reinvest resources into customer experience and digital transformation initiatives.

The AvePoint Confidence Platform exemplifies this approach by centralising governance, lifecycle management, and assurance capabilities within a single solution. By leveraging automation, organisations can maintain regulatory alignment while unlocking agility and resilience, all of which are critical attributes in an increasingly competitive and risk-sensitive market. This positions compliance as a driver of trust, resilience, and innovation rather than a regulatory burden.

CPG 235: A Blueprint for Resilience and Growth

APRA’s CPG 235 marks a pivotal moment for financial institutions: Data is no longer a back-office function, but a strategic asset that defines resilience, competitiveness, and growth. In this new paradigm, governance must be embedded into the fabric of daily operations, automation leveraged to scale with confidence, and transparency maintained across the entire data lifecycle.

This isn’t about ticking compliance boxes. It’s about architecting a data ecosystem that accelerates decision-making, fortifies customer trust, and fuels innovation. Solutions like the AvePoint Confidence Platform enable this transformation by unifying governance, automation, and assurance-without adding complexity.

For financial organisations navigating an increasingly digital and risk-sensitive market, the mandate is clear: Elevate compliance from a regulatory obligation to a catalyst for agility and sustainable advantage.