Five things your board can be doing now to prepare for CPS 510

APRA’s draft CPS 510 Governance standard is still in consultation. Submissions close 28 August 2026, the final standard is expected by year end, and commencement is likely from January 2028.

That sounds like plenty of time. It isn’t, if you want to get ahead of this rather than scramble when it lands. Experience tells us boards that start reviewing practice now avoid the last-minute rush later.

Five things your board can be doing today.

1. Map your board against a skills matrix

Draft CPS 510 lifts the bar on having the right mix of skills and experience around the table. You don’t need the final wording to start this. Cyber and technology literacy is the gap boards most often overstate. Be honest about where yours sit, find the gaps, and start closing them now.

2. Know your tenure profile

The draft proposes a 12-year default tenure limit for non-executive directors, up from an initially floated 10. Whatever the final number turns out to be, work out now which directors are approaching long tenure. This matters most for boards with long-serving chairs and NEDs, who may be facing succession conversations they’ve never had to have before. Start them early, not under pressure.

3. Revisit how you handle group and related-party conflicts

APRA has dropped the idea of a hard cap on directors sitting across multiple group boards, in favour of requiring explicit consideration of intra-group conflicts. Strengthen your conflicts register now, and make sure escalation actually happens in practice, not just on paper.

4. Get your delegation framework in writing

Draft CPS 510 draws a clearer line between what the board must retain and what it can delegate, provided the delegation is clearly documented. Most boards already delegate plenty. Far fewer can point to a document that spells out what’s delegated, where responsibility sits, and what gets reported back to the full board. Make yours clear and succinct.

5. Don’t treat this separately from your cyber governance

Skills mix, board literacy and accountability are exactly what APRA and ASIC’s recent cyber governance letters have been pushing on too. Bring board-level cyber oversight and CPS 510 readiness together as one piece of work. It’s a far more coherent answer when APRA comes knocking on your cyber governance.

None of this depends on the final wording. A board that starts now will find the final standard, whatever shape it takes, far less disruptive to implement.