CPS 230 Compliance Guide
What CPS 230 requires and the practical path to observable compliance.
Read more →Observed Compliance
Stop asserting compliance. Start observing it.
Your compliance documents say the controls exist. Can you show a supervisor the signal proving they operated last Tuesday? Observed Compliance is RUBIX's continuous compliance monitoring offering for APRA-regulated institutions: your CPS 230, CPS 234, CPG 235, Privacy Act and SOCI obligations mapped to observable signals in your data estate, monitored continuously.
- Live signalsNot point-in-time attestation
- Full audit trailControl, obligation, signal, timestamp
- Board-readySupervisor-ready evidence
How it works
From obligation to observable evidence.
1
Map
Our control library translates regulatory obligations into specific, observable data estate controls: freshness and completeness on pipelines feeding critical operations, lineage coverage, schema change detection, access anomalies, retention conformance.
2
Observe
Data observability, powered by our partnership with Decube, instruments those controls across your platform, whether Databricks, Microsoft Fabric or hybrid.
3
Evidence
Signals roll up to a compliance scorecard with a full audit trail: control, obligation, signal, timestamp. Board-ready, supervisor-ready.
Who it's for.
Mid-tier APRA-regulated institutions: mutual banks, customer-owned banks, superannuation funds and insurers that carry the same obligations as the majors without the same compliance headcount. If your risk function spends its quarter chasing screenshots and attestations, Observed Compliance replaces that with signals that were being collected anyway.
Tiers.
| Tier | What's included |
|---|---|
| Foundation | Control mapping, core observability on critical-operation pipelines, monthly compliance scorecard |
| Assured | Everything in Foundation plus expanded control coverage, third-party data flow monitoring, quarterly control attestation pack |
| Continuous | Full control library coverage, real-time alerting, board reporting pack, and a named RUBIX compliance engineer |
Pricing on application. Every engagement starts with a compliance observability assessment.
Why RUBIX.
Since 2010 we have delivered 450+ data projects for 115+ Australian organisations, including NAB, ANZ, MUFG and AustralianSuper. Observed Compliance productises fifteen years of regulated-industry delivery into a subscription your risk committee can rely on.
Frequently asked questions.
What does "observed compliance" mean?
Compliance demonstrated by continuous signals from operating systems rather than by point-in-time documentation. The control isn't just described; its operation is observed and logged.
Which regulations does it cover?
APRA CPS 230 and CPS 234, CPG 235 guidance, Privacy Act obligations relating to data handling, and SOCI Act requirements where applicable.
Do we need Databricks?
No. The control library is platform-agnostic; we implement on Databricks, Microsoft Fabric/Azure and hybrid estates.
Is this a replacement for our GRC system?
No. It feeds your GRC and risk reporting with live evidence from the data estate, replacing manual attestation gathering.
Related pages.
Financial Services
Data platforms, AI governance and APRA compliance for banks, super and insurers.
Read more →Decube Partnership
The data observability layer behind Observed Compliance.
Read more →