Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 1 of 2018
Internal auditInternal audit
Start here
Get a plain-English read of Internal audit
Turn the raw legal text into a practical explanation grounded in Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 1 of 2018.
Internal audit
-
An APRA-regulated entity’s internal audit activities must include a review of the design and operating effectiveness of information security controls, including those maintained by related parties and third parties (information security control assurance).
-
An APRA-regulated entity must ensure that the information security control assurance is provided by personnel appropriately skilled in providing such assurance.
-
An APRA-regulated entity’s internal audit function must assess the information security control assurance provided by a related party or third party where:
(a) an information security incident affecting the information assets has the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers; and
(b) internal audit intends to rely on the information security control assurance provided by the related party or third party.[13]