Operational risk comes in many forms. An APRA-regulated entity not only needs to manage the risks that may arise in critical operational processes, but also needs to manage risks arising from the third and "fourth" parties that are involved in the performance of those processes. APRA's CPS230 refreshes the standards applicable to the management of operational risk by an APRA-regulated entity with specific standards applicable to the introduction of risks from outsourcing arrangements.