{"id":"F2016L01437","name":"Banking, Insurance and Life Insurance (prudential standard) determination No. 4 of 2016","slug":"banking-insurance-and-life-insurance-prudential-standard-determination-no-4-of-2016","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":95059,"registerId":"commonwealth-F2016L01437-current","compilationNumber":null,"startDate":"2026-04-02","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Authority","sectionType":"part","heading":"Authority","content":"# Authority\n\n1.  This Prudential Standard is made under:\n\n(a) section 11AF of the Banking Act 1959 (Banking Act);\n\n(b) section 32 of the Insurance Act 1973 (Insurance Act); and\n\n(c) section 230A of the Life Insurance Act 1995 (Life Insurance Act).\n\n2. In this Prudential Standard, the term ‘Prudential Acts’ is used to refer to the Banking Act, the Insurance Act and the Life Insurance Act.","sortOrder":0},{"sectionNumber":"Application","sectionType":"part","heading":"Application","content":"# Application\n\n3. This Prudential Standard applies to each Level 3 Head.\n\n4. This Prudential Standard commences on 1 July 2017.","sortOrder":1},{"sectionNumber":"Interpretation","sectionType":"part","heading":"Interpretation","content":"# Interpretation\n\n5. Terms that are defined in Prudential Standard 3PS 001 Definitions appear in bold the first time they are used in this Prudential Standard.\n\n6. Where this Prudential Standard provides for APRA to exercise a power or discretion, this power or discretion is to be exercised in writing.","sortOrder":2},{"sectionNumber":"General requirements","sectionType":"part","heading":"General requirements","content":"# General requirements\n\n7. For the purposes of this Prudential Standard, a Level 3 Head must appoint a group auditor. This ‘Appointed Auditor’ may be the same auditor who audits a Level 3 Head for the purposes of the Corporations Act 2001. Separate auditors may be appointed to undertake the different engagements provided for in this Prudential Standard. APRA may also require a Level 3 Head to appoint another auditor, in addition to any auditor already appointed by the Level 3 Head, for the purposes of this Prudential Standard.\n\n8. A Level 3 Head must ensure that the terms of engagement of the Appointed Auditor are set out in writing in a legally binding contract between the Level 3 Head and the Appointed Auditor and that the terms of engagement:\n\n(a) require the Appointed Auditor to fulfil the roles and responsibilities of the Appointed Auditor as specified in this Prudential Standard and in the manner specified in this Prudential Standard; and\n\n(b) require the Appointed Auditor, in meeting its role and responsibilities, to comply with Australian Auditing and Assurance Standards and Guidance issued from time to time by the Auditing and Assurance Standards Board (AUASB) except where:\n\n(i) they are inconsistent with the requirements of this Prudential Standard, in which case this Prudential Standard prevails; or\n\n(ii) APRA otherwise specifies to the Level 3 Head that alternative standards and guidance must be used by the Appointed Auditor.\n\n9. A Level 3 Head must use all reasonable endeavours to ensure the Appointed Auditor complies with the terms of engagement contained in paragraphs 8(a) and 8(b) of this Prudential Standard.\n\n10. For the purposes of this Prudential Standard, ‘reasonable assurance’ and ‘limited assurance’ have the meanings given in the Framework for Assurance Engagements issued by the AUASB.\n\n11. The costs of preparing and submitting reports, documents and other material required by this Prudential Standard, whether routine or as part of a special purpose engagement (refer to paragraphs 26 to 31), must be borne by the Level 3 Head.\n\n12. Persons involved in the provision of information (including the Appointed Auditor, officers and employees of a Level 3 Head and Level 3 institutions in the Level 3 group) must note that it is an offence under subsection 137.1 and 137.2 of the Criminal Code 1995 to provide, whether directly or indirectly, false and misleading information to a Commonwealth entity such as APRA.","sortOrder":3},{"sectionNumber":"Fitness and propriety of the Appointed A","sectionType":"part","heading":"Fitness and propriety of the Appointed Auditor","content":"# Fitness and propriety of the Appointed Auditor\n\n13. A Level 3 Head must ensure that its Appointed Auditor:\n\n(a) is a fit and proper person in accordance with the Level 3 Head’s Fit and Proper Policy as required by Prudential Standard CPS 520 Fit and Proper, including those requirements that apply specifically to the auditor;\n\n(b) satisfies the auditor independence requirements in Prudential Standard CPS 510 Governance; and\n\n(c) is not subject to a direction or order issued under the Prudential Acts.[\\[1\\]](#_ftn1)","sortOrder":4},{"sectionNumber":"Responsibilities of a Level 3 Head","sectionType":"part","heading":"Responsibilities of a Level 3 Head","content":"# Responsibilities of a Level 3 Head\n\n14. A Level 3 Head, if requested by APRA, must within a reasonable time provide APRA with the Appointed Auditor’s terms of engagement and related instructions or correspondence, including management letters.\n\n15. A Level 3 Head must ensure that the Appointed Auditor has access to all data, information, reports and staff of the Level 3 group that the Appointed Auditor reasonably believes is necessary to fulfil its role and responsibilities under this Prudential Standard. This includes access to the Board and Board Audit Committee of the Level 3 Head, and the auditors of Level 3 institutions in the Level 3 group as required.\n\n16. A Level 3 Head must ensure that its Appointed Auditor is fully informed of all prudential requirements applicable to the Level 3 Head. Prudential requirements include requirements imposed by the Prudential Acts, regulations, prudential standards, the Financial Sector (Collection of Data) Act 2001 (FSCODA), reporting standards, conditions on authority and any other requirements imposed by APRA in relation to a Level 3 Head. In addition, the Level 3 Head must ensure that the Appointed Auditor is provided with any other information APRA has provided to the Level 3 Head that may assist the Appointed Auditor in fulfilling its role and responsibilities under this Prudential Standard.\n\n17. A Level 3 Head must ensure that its Board or Board Audit Committee are provided with:\n\n(a) reports provided by the Appointed Auditor in accordance with this Prudential Standard, and any associated assessments and other material provided by an Appointed Auditor to the Level 3 Head on request;\n\n(b) commentary or responses provided by APRA to the Level 3 Head on reports provided by the Appointed Auditor, and any associated assessments and other material; and\n\n(c) any commentary or response on the reports, associated assessments and other material provided by the Appointed Auditor that are given by the Level 3 Head to APRA.","sortOrder":5},{"sectionNumber":"Internal audit","sectionType":"part","heading":"Internal audit","content":"# Internal audit\n\n18. A Level 3 Head must ensure that the scope of its internal audit includes a review of the policies, processes and controls put in place by management to ensure compliance with APRA’s prudential requirements.\n\n19. A Level 3 Head must allow its internal auditor to be represented in meetings with APRA, the Level 3 Head and its Appointed Auditor.","sortOrder":6},{"sectionNumber":"Meetings with the Appointed Auditor","sectionType":"part","heading":"Meetings with the Appointed Auditor","content":"# Meetings with the Appointed Auditor\n\n20. APRA’s liaison with an Appointed Auditor will normally be conducted under arrangements involving APRA, the Level 3 Head and the Appointed Auditor. APRA and an Appointed Auditor may meet, at any time, on a bilateral basis at the request of either party.\n\n21. For the purposes of this Prudential Standard, it is the responsibility of an Appointed Auditor to attend all meetings with APRA related to this Prudential Standard, whether:\n\n(a) on a bilateral basis between APRA and the Appointed Auditor;\n\n(b) between APRA, the Level 3 Head and the Appointed Auditor; or\n\n(c) on any other basis which APRA may specify to the Appointed Auditor,\n\nunless APRA indicates otherwise. It is also the responsibility of an Appointed Auditor to supply all information and documents requested by APRA relevant to the Level 3 Head and Level 3 group.","sortOrder":7},{"sectionNumber":"Responsibilities of the Appointed Audito","sectionType":"part","heading":"Responsibilities of the Appointed Auditor","content":"# Responsibilities of the Appointed Auditor\n\n22. It is the responsibility of an Appointed Auditor to submit directly to APRA:\n\n(a) all reports required to be produced under this Prudential Standard; and\n\n(b) all assessments and other material associated with the reports, if requested by APRA.\n\nSuch reports, assessments and other material must be prepared by the Appointed Auditor on the basis that APRA may rely upon them in the performance of its functions under the Prudential Acts.\n\n23. The responsibilities of an Appointed Auditor include an obligation to refrain from notifying the Level 3 Head of, or from providing the Level 3 Head with, the documents referred to in paragraph 22 of this prudential standard, where:\n\n(a) the Appointed Auditor considers that by doing so the interests of depositors, policyholders or RSE beneficiaries of prudentially regulated institutions within the Level 3 group would be jeopardised; or\n\n(b) there is a situation of mistrust between the Appointed Auditor and the Board of the Level 3 Head or senior management of the Level 3 group.\n\n24. As part of its responsibilities, an Appointed Auditor in preparing reports, whether as part of routine or special purpose engagements (refer to paragraphs 26 to 31), must not place sole reliance on the work performed by APRA.","sortOrder":8},{"sectionNumber":"Reports by the Appointed Auditor","sectionType":"part","heading":"Reports by the Appointed Auditor","content":"# Reports by the Appointed Auditor\n\n25. Unless otherwise instructed by APRA, reports, assessments and other material required by this Prudential Standard must make it clear where the Appointed Auditor is referring to matters relating to the Level 3 Head or the Level 3 group.","sortOrder":9},{"sectionNumber":"Routine reports","sectionType":"part","heading":"Routine reports","content":"# Routine reports\n\n26. The responsibilities of the Appointed Auditor include reporting simultaneously (subject to paragraph 23) to APRA and the Board or Board Audit Committee of the Level 3 Head, within three months of the end of the financial year of the Level 3 Head[\\[2\\]](#_ftn2), on:\n\n(a) matters relating to APRA data collections; and\n\n(b) internal controls at a Level 3 basis,\n\nas referred to in paragraph 27. For this purpose, ‘APRA data collections’ means any data collected in accordance with FSCODA.\n\n27. An Appointed Auditor’s responsibilities must specifically include reporting as follows:","sortOrder":10},{"sectionNumber":"APRA data collections","sectionType":"division","heading":"APRA data collections","content":"### APRA data collections\n\n(a) for those collections where the data are sourced only from accounting records – the Appointed Auditor must provide reasonable assurance that the information in these collections at the financial year-end is reliable and in accordance with the relevant prudential standards and reporting standards;\n\n(b) for those collections where the data are sourced only from non-accounting records – unless otherwise indicated by APRA, the Appointed Auditor must provide limited assurance[\\[3\\]](#_ftn3) that the information in these collections at the financial year-end is reliable and in accordance with the relevant prudential standards and reporting standards;\n\n(c) for those collections where the data are sourced from a combination of accounting and non-accounting records – unless otherwise indicated by APRA, the Appointed Auditor must provide reasonable assurance for information sourced from accounting records, and limited assurance[\\[4\\]](#_ftn4) that information sourced from non-accounting records at the financial year-end is reliable. This must be in accordance with the relevant prudential standards and reporting standards;","sortOrder":11},{"sectionNumber":"Internal controls relating to prudential","sectionType":"division","heading":"Internal controls relating to prudential requirements","content":"### Internal controls relating to prudential requirements\n\n(d) an Appointed Auditor must provide limited assurance that the Level 3 Head has controls that are designed to ensure that the Level 3 Head:\n\n(i) has complied with all applicable prudential requirements; and\n\n(ii) has provided reliable data to APRA in the reporting forms prepared under FSCODA,\n\nand, in relation to (i) and (ii), the Appointed Auditor must also provide limited assurance that these controls have operated effectively throughout the financial year; and","sortOrder":12},{"sectionNumber":"Compliance with prudential and reporting","sectionType":"division","heading":"Compliance with prudential and reporting requirements","content":"### Compliance with prudential and reporting requirements\n\n(e) a report must take the form of limited assurance, based on the Appointed Auditor’s work in (a) to (d) above, that the Level 3 Head has complied with all relevant prudential and reporting requirements under the Prudential Acts and FSCODA, including compliance with prudential standards and reporting standards during the financial year.[\\[5\\]](#_ftn5)\n\n28. The reporting requirements in paragraph 27 only apply to audit engagements undertaken for the purposes of this Prudential Standard. Where an auditor is engaged for the purposes of another Prudential Standard, the engagement must ensure that the requirements of that other Prudential Standard are met.","sortOrder":13},{"sectionNumber":"Special purpose engagements","sectionType":"part","heading":"Special purpose engagements","content":"# Special purpose engagements\n\n29. APRA may require a Level 3 Head to appoint an auditor, who may be the existing Appointed Auditor or another auditor (which may be determined by APRA), to provide a report on a particular aspect of the Level 3 group’s operations, prudential reporting, risk management systems or financial position. Such a report will normally only be required following consultation with the Level 3 Head. APRA may, however, require such a report without prior consultation with the Level 3 Head.\n\n30. The responsibilities of an Appointed Auditor for a special purpose engagement include an obligation to provide limited assurance on the matters upon which the Appointed Auditor is required to report, unless otherwise determined by APRA and advised to the Level 3 Head.\n\n31. Under the responsibilities of an Appointed Auditor for a special purpose engagement, the auditor’s report must be submitted within three months of the date of the notice commissioning the report, simultaneously to APRA and to the Board (or Board Audit Committee) of the Level 3 Head, unless otherwise determined by APRA and advised to the Level 3 Head (subject to paragraph 23).","sortOrder":14},{"sectionNumber":"Adjustments and exclusions","sectionType":"part","heading":"Adjustments and exclusions","content":"# Adjustments and exclusions\n\n32. APRA may adjust or exclude a specific requirement in this Prudential Standard in relation to the Level 3 Head.[\\[6\\]](#_ftn6)","sortOrder":15}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":5,"scope_assessment":{"changed":false,"description":"This prudential standard appears focused on its original intent: establishing audit requirements for Level 3 financial groups. It has not expanded beyond this core purpose into unrelated areas."},"complexity_factors":["Cross-references to three separate Acts (Banking Act 1959, Insurance Act 1973, Life Insurance Act 1995) and multiple other prudential standards (CPS 510, CPS 520, 3PS 001)","Conditional logic distinguishing between 'reasonable assurance' and 'limited assurance' based on data source types (accounting vs non-accounting records)","Nested exceptions in paragraph 8(b) where AUASB standards apply except where inconsistent with this standard or where APRA specifies alternatives","Specific trigger conditions for bypassing management in paragraph 23 (jeopardy to depositors/policyholders or 'situation of mistrust')","Dual reporting obligations (simultaneous to APRA and Board/Board Audit Committee) with exceptions","Defined terms imported from external standard 3PS 001 rather than defined within the instrument itself","Distinction between routine engagements (annual) and special purpose engagements (ad hoc) with different timelines and assurance levels"],"plain_english_summary":"Large APRA-regulated banking and insurance groups (the Level 3 ultimate parents) must appoint an independent, qualified auditor to assess their financial data, reporting and internal controls and to report directly to APRA. The auditor provides routine assurance and can be directed to carry out special audits, and may bypass management if depositors or policyholders are at risk. This gives APRA independent, timely oversight of group prudential soundness."},"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":false,"description":"This Prudential Standard is narrowly focused on establishing a group-level audit/assurance framework: appointment of a group (Appointed) Auditor, the content and timing of auditor reports to APRA and Boards, assurance levels for different data types, and APRA’s ability to require special engagements. The text provided remains within that original, narrowly defined supervisory purpose and does not indicate a material expansion beyond requiring group-level prudential assurance and related procedures. There is no clear evidence in the instrument itself of scope creep beyond those objectives."},"complexity_factors":["Cross-references to multiple external instruments and laws (Banking Act 1959, Insurance Act 1973, Life Insurance Act 1995, Prudential Standard 3PS 001, CPS 510, CPS 520, FSCODA, Corporations Act 2001, AUASB standards, Criminal Code)","Several distinct reporting streams and assurance levels (APRA data collections, internal controls, overall compliance) with different assurance requirements (reasonable vs limited) (paras 26–27)","Multiple conditional rules and exceptions (confidentiality exception at para 23; AUASB standards except where inconsistent or APRA specifies alternatives at para 8(b))","APRA discretion in many places (ability to require additional auditors, to specify auditors or standards, to adjust/exclude requirements) creating branching logic (paras 7, 8(b)(ii), 29, 32)","Two classes of engagement — routine annual engagements and special-purpose engagements with different triggers and deadlines (paras 26–31)","Timing constraints (three-month deadlines for routine and special reports) interacting with access and information flow obligations (paras 26, 31, 15)","Interplay between duties to APRA and duties to the Level 3 Head/Board (simultaneous reporting, but with possible withholding to protect depositors/policyholders) (paras 22–23)","References to definitions in a separate Prudential Standard (3PS 001), increasing interpretive work to determine scope and key terms (para 5)"],"plain_english_summary":"**What this instrument does, in plain terms**\n\n- It requires each “Level 3 Head” (the top entity of a consolidated banking, general insurance or life insurance group subject to APRA group supervision) to appoint a single group auditor (the “Appointed Auditor”) for the purposes of APRA’s prudential oversight (para 3 and 7).\n\n- The appointment must be in a written, legally binding engagement letter or contract that obliges the Appointed Auditor to perform specified roles and responsibilities and to follow Australian Auditing and Assurance Standards unless those standards conflict with this Prudential Standard or APRA instructs otherwise (paras 8–9, 11).\n\n- The Appointed Auditor must be fit and proper, independent under the relevant prudential governance rules, and not subject to an APRA direction or order (para 13).\n\n- The Appointed Auditor must have access to all group information and staff it reasonably needs, including the Board and Board Audit Committee of the Level 3 Head and the auditors of group entities (para 15). The Level 3 Head must inform the Appointed Auditor of the prudential requirements that apply to the group (para 16).\n\n- Routine reporting: within three months of the Level 3 Head’s financial year end the Appointed Auditor must report simultaneously (subject to a confidentiality exception at para 23) to APRA and the Board or Board Audit Committee on:\n  - APRA data collections (the statutory data returns collected under FSCODA) and;\n  - group-level internal controls that support prudential reporting and compliance (paras 26–27).\n\n  The standard sets out the assurance to be provided depending on the source of the data:\n  - reasonable assurance for information taken only from accounting records;\n  - limited assurance where data are from non-accounting records (unless APRA says otherwise);\n  - mixed assurance for mixed-source items (reasonable for accounting-sourced parts, limited for non-accounting parts) (para 27(a)–(c)).\n\n  For internal controls and overall compliance with prudential and reporting requirements the Appointed Auditor must provide limited assurance that the controls are designed and have operated effectively during the year and that the Level 3 Head complied with relevant prudential and reporting requirements (para 27(d)–(e)).\n\n- Special-purpose engagements: APRA may require additional, specific audit reports on aspects of operations, risk systems, reporting or financial position; those reports normally must be provided within three months of APRA’s notice and will generally be limited assurance engagements unless APRA directs otherwise (paras 29–31).\n\n- Reporting and information flows: the Appointed Auditor must submit required reports and any associated materials directly to APRA (paras 22 and 26). Where the auditor believes notifying the Level 3 Head would jeopardise depositors/policyholders/RSE beneficiaries or where there is mistrust between auditor and management/Board, the auditor may withhold those documents from the Level 3 Head while still providing them to APRA (para 23).\n\n- Costs: the Level 3 Head must bear the costs of preparing and submitting the reports and other material under this Prudential Standard (para 11).\n\n- APRA discretion: APRA may require additional auditors, meet any auditor bilaterally, instruct an auditor to use alternative standards, and may adjust or exclude requirements in relation to a particular Level 3 Head (paras 7, 20, 8(b)(ii), 32).\n\n**Why it matters and who is affected**\n\n- Who is affected: Level 3 Heads (the supervised group holding entities) and their appointed external auditors. Indirectly affected are group entities, their internal auditors and audit committees because the Appointed Auditor needs access to group information and must report on group-level controls and reporting (paras 3, 15, 18).\n\n- Practical effect: the instrument creates a formal, APRA-centred group-level audit/assurance regime. It specifies the form and timing of auditor reports, the assurance levels required for different types of data, and gives APRA power to commission further targeted audits and to adjust requirements for particular groups (paras 26–31, 32).\n\n**Implementation mechanics, incentives and trade-offs**\n\n- Who pays: the Level 3 Head pays for routine and special-purpose audit work and reports required under the Standard (para 11). That raises direct compliance costs for the supervised group.\n\n- Who decides and exercises discretion: APRA retains a number of controls — it can require additional auditors, instruct auditors to use alternative standards, meet auditors bilaterally, and vary or exclude requirements for a particular Level 3 Head (paras 7, 8(b)(ii), 20, 29, 32). These powers centralise supervisory direction with APRA.\n\n- Behavioural effects: groups must ensure their auditors can access group records and staff, that auditors are appointed under enforceable contracts, and that internal audit covers prudential compliance (paras 8, 15, 18). Auditors will need to plan for both statutory audit work and separate prudential assurance work on non-accounting data, which may increase scope and cost.\n\n- Compliance burden and timing: routine reports are due within three months of year end; special reports are normally due within three months of APRA’s notice. The separate prudential engagement may duplicate or extend work beyond the Corporations Act audit where that audit does not fully cover APRA’s data collections or assurance needs (paras 26, 31).\n\n- Auditor independence and choice: the Standard requires auditor independence and fit/proper standards (para 13) but also allows APRA to require a particular auditor or additional auditors (paras 7 and 29). That creates a tension between supervisory direction and auditor selection by the Level 3 Head.\n\n- Information flows and confidentiality tension: auditors must send reports to APRA directly and may, in narrowly defined circumstances, withhold some material from the Level 3 Head if disclosure would jeopardise regulated parties or if trust has broken down (paras 22–23). That changes the usual bilateral dynamic between auditor and client by inserting a direct channel to the supervisor.\n\n**Concrete risks and implementation considerations**\n\n- Cost and duplication: the need for limited or reasonable assurance over non-accounting data and group-level controls can create extra audit fees and incremental work scope (paras 27(a)–(d)).\n\n- Market effects on audit supply: APRA’s ability to require or specify auditors for particular engagements (para 29) may concentrate demand or affect the competitive position of audit firms.\n\n- Operational risk: ensuring access to group-wide data and timely cooperation across group entities is necessary for auditors to meet the three-month reporting windows (paras 15, 26). If group systems do not consolidate required non-accounting data well, special engagements may be frequent.\n\n- Supervisory reliance and audit independence: APRA will rely on the Appointed Auditor’s reports for prudential supervision (para 22). The Standard requires auditors not to rely solely on APRA’s work (para 24), preserving independent verification responsibility.\n\n(References in parentheses are to the paragraph numbers of the Prudential Standard.)"}},"importantCases":[],"_links":{"self":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-4-of-2016","history":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-4-of-2016/history","analysis":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-4-of-2016/analysis","conflicts":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-4-of-2016/conflicts","importantCases":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-4-of-2016/important-cases","documents":"/api/acts/banking-insurance-and-life-insurance-prudential-standard-determination-no-4-of-2016/documents"}}