Banking (prudential standard) determination No. 16 of 2022

APS 310 organises audit oversight around a small set of concepts and operational distinctions that drive duties and reporting flows. The principal concepts in the standard are Level 1 and Level 2 application, the appointed auditor and its contractual terms, reporting and assurance types, tripartite engagement, special purpose engagements, and APRA discretion.

Level 1 and Level 2. The standard applies to ADIs on a Level 1 basis and to groups on a Level 2 basis where relevant (paras 2-4). For locally incorporated ADIs a reference to an ADI is taken to mean the ADI on a Level 1 basis and the group of which the ADI is a member on a Level 2 basis (para 3). For foreign ADIs it applies to the Australian operations as if they were a standalone ADI (para 4). When a Level 2 group is headed by an authorised NOHC or an intermediate holding company, references to auditors, CEOs, Boards and Board Audit Committees in a Level 2 context are taken to refer to the equivalent persons at the head of the Level 2 group (para 6).

Appointed auditor and terms of engagement. ADIs must appoint an auditor for APS 310 purposes (para 15). The terms of engagement must be a legally binding contract and require the auditor to perform the roles and responsibilities specified in the standard, comply with AUASB Auditing Standards and Guidance subject to stated caveats, and be referred to statutory provisions requiring auditors to give information to APRA and Part VIA protections (para 16(a)-(c)). The ADI must use all reasonable endeavours to ensure the auditor complies with those contractual obligations (para 17).

Assurance and reporting types. APS 310 distinguishes routine annual reports and special purpose engagements. Routine reports must be provided within three months of the ADI’s financial year end and cover APRA data collections and internal controls (para 35). The appointed auditor must provide reasonable assurance for data sourced only from accounting records, limited assurance for data sourced only from non‑accounting records, and a mixture where data are a combination (para 36(a)-(c)). The auditor must provide limited assurance on controls designed to ensure compliance with prudential requirements and reliable reporting (para 36(d)). Special purpose engagements may be required by APRA by notice and are typically commissioned after consultation; the auditor must provide limited assurance on such engagements unless APRA specifies otherwise and submit the report within three months after notice (paras 38-40).

Tripartite and bilateral engagement. APRA anticipates liaison being conducted through tripartite arrangements between APRA, the ADI and the appointed auditor, while preserving the ability for APRA and the auditor to meet bilaterally at either party’s request (paras 28-29). The appointed auditor is required to attend meetings with APRA related to APS 310 unless APRA says otherwise, and to supply all requested information and documents relevant to the ADI (para 30).

Group auditors and Board access. The standard allows the same auditor to be used for Level 1 and Level 2 purposes where the group is headed by the ADI, or for the authorised NOHC’s auditor to perform both roles where the ADI’s Board agrees in writing (para 21). That agreement must be accompanied by the Board or its Board Audit Committee being able to communicate directly with the appointed auditor, to commission Level 1 reports, and to receive copies of reports or supporting assessments relating to the ADI (para 21(b)(i)-(iii)).

APRA discretion and adjustments. APRA may adjust or exclude a specific prudential requirement in relation to one or more specified ADIs or authorised NOHCs (para 13), may require additional auditors by written notice (para 15), and may specify alternative standards and guidance to be used by the appointed auditor (para 16(b)(ii)). The standard therefore blends prescriptive requirements with supervisory discretion.

Statutory overlay. The standard explicitly references statutory auditor obligations under the Banking Act, including ss 16B and 16BA, and Part VIA protections in relation to information, and cross‑references prudential standards CPS 510 and CPS 520 for governance, independence and fit and proper requirements (para 16(c); para 20).

Attachment A. The Attachment lists APRA ADI reporting forms subject to audit testing and identifies whether reasonable or limited assurance is required for various reporting standards and types of ADIs (Attachment A and paras 35-36). It is not exhaustive and is confined to APRA collections under FSCODA (Attachment A; footnote 5).

Together these concepts allocate reporting flows and assurance burdens across ADIs, their Boards, internal auditors and appointed auditors, while preserving APRA’s supervisory discretion to require additional assurance or to grant adjustments.

APS 310 identifies and binds several categories of parties, with duties and operational impacts allocated across them. The primary entities directly affected are ADIs and authorised NOHCs. The standard also affects appointed auditors, Boards and Board Audit Committees, internal auditors, senior management, intermediate holding companies and APRA itself.

ADIs. The standard applies to all ADIs (para 2) and to all operations and activities of an ADI (para 12). For locally incorporated ADIs, the reference extends to Level 1 and Level 2 group contexts (para 3). ADIs must appoint auditors, contractually bind them to specified roles and ensure auditors have access to necessary information and staff (paras 15-16, 23). ADIs must supply to their Board or Board Audit Committee the reports and associated material provided by the appointed auditor and any APRA commentary on those reports (para 25). ADIs bear the costs of preparing and submitting required reports and materials (para 18).

Authorised NOHCs and intermediate holding companies. Where an ADI is a subsidiary of an authorised NOHC, the authorised NOHC must ensure the requirements are met on a Level 2 basis, and ensure immediate parent NOHCs, their Boards and senior management meet the same requirements (para 5). References to an intermediate holding company mean the immediate parent NOHC and, where a Level 2 application is relevant, references to the auditor, CEO, senior management, Board and Board Audit Committee of an ADI must be taken to refer to the equivalent persons at the intermediate holding company or authorised NOHC (para 6).

Foreign ADIs. For foreign ADIs the standard applies to Australian operations as if they were a stand‑alone ADI (para 4). The Board reference for foreign ADIs is taken to mean the senior officer outside Australia to whom authority has been delegated under CPS 510, while the CEO refers to the senior manager in Australia with responsibility for conduct of the Australian operations (para 7). Attachment A identifies which collections and assurance burdens apply to foreign ADIs in specified instances.

Appointed auditors. The standard creates direct duties and reporting obligations on the appointed auditor. The auditor must be fit and proper and independent in accordance with CPS 520 and CPS 510 respectively (para 20). The appointed auditor is responsible for submitting reports directly to APRA and supplying associated assessments and material on the basis that APRA may rely on them (para 31). The auditor must attend APRA meetings and supply requested information unless APRA indicates otherwise in writing (paras 28-30).

Internal auditors and Boards. Internal audit scope must include review of policies, processes and controls put in place by management to ensure compliance with APRA’s prudential requirements (para 26). Internal auditors may be represented in tripartite meetings (para 26). Boards and Board Audit Committees have rights to receive auditor reports and to commission reports where a group auditor is used (paras 21 and 25).

Persons providing information. The standard warns that persons involved in providing information to APRA, including auditors, officers and employees of an ADI and members of a Level 2 group, should note that providing false or misleading information to a Commonwealth entity is an offence under ss 137.1 and 137.2 of the Criminal Code Act 1995 (para 19). The standard also requires the engagement contract to refer auditors to s 16B and s 16BA of the Banking Act and to Part VIA protections (para 16(c)).

APRA. The regulator is an active party: it may require additional auditors or special purpose engagements by written notice, adjust or exclude specific prudential requirements, meet auditors bilaterally, and rely upon auditors’ reports in performing its functions (paras 13, 15, 28, 38, 31). APRA also specifies the reporting standards and assurance levels in Attachment A.

Who pays. The ADI bears the costs of preparing and submitting the required reports and documents (para 18). This allocates the direct financial burden of assurance activity onto regulated entities.

Collectively these allocations affect governance, resourcing and contractual arrangements across groups, and require ADIs and authorised NOHCs to consider governance of audit relationships, cross‑border delegation and access rights for regulatory oversight.

APS 310 sets out a set of affirmative duties and contingent rights for ADIs, appointed auditors, Boards and APRA. The standard prescribes duties in contract formation, information rights, assurance standards, attendance at meetings, and reporting, and it preserves certain statutory powers and protections for auditors.

Duties of ADIs

• Appointment and contractualisation. An ADI must appoint an auditor to undertake the functions in APS 310 and must set out the terms of engagement in a legally binding contract (paras 15-16). The contract must require the auditor to fulfil the roles and responsibilities specified in the Prudential Standard (para 16(a)).
• Ensure compliance with AUASB standards except where inconsistent. The terms must require the appointed auditor to comply with AUASB Auditing Standards and Guidance unless inconsistent with this Prudential Standard or APRA specifies an alternative in writing (para 16(b)(i)-(ii)).
• Provide access. An ADI must ensure the appointed auditor has access to all data, information, reports and staff reasonably believed necessary to fulfil its role, including access to the Board, Board Committees and internal auditors (para 23).
• Inform the auditor. An ADI must ensure the appointed auditor is fully informed of all prudential requirements applicable to the ADI and any APRA information that may assist the auditor (para 24).
• Provide reports to Board. ADIs must ensure certain materials are provided to the Board or Board Audit Committee, including reports by the appointed auditor and APRA commentary on those reports (para 25).
• Bear costs. The ADI must bear the costs of preparing and submitting required reports and materials (para 18).
• Provide documents to APRA on request. If APRA requests, the ADI must within a reasonable time provide APRA with the terms of engagement and other instructions or correspondence, including management letters, that may bear on the scope, conduct or form of the auditor’s work (para 22).
• Internal audit scope and tripartite representation. ADIs must ensure internal audit reviews compliance‑related policies and that internal auditors may be represented in tripartite meetings (paras 26-27).

Duties of appointed auditors

• Direct reporting to APRA. Appointed auditors must submit directly to APRA all reports required under APS 310 and all associated assessments and material if requested by APRA. These must be prepared on the basis that APRA may rely upon them (para 31).
• Attendance and information provision. Appointed auditors must attend all APRA meetings related to APS 310 (bilateral, tripartite or other basis specified by APRA) unless APRA indicates otherwise in writing, and must supply all information and documents requested by APRA relevant to the ADI (para 30).
• Limited disclosure to ADI in specific circumstances. An appointed auditor must refrain from notifying the ADI of, or providing the ADI with, documents referred to in paragraph 31 where it considers that doing so would jeopardise the interests of depositors or where there is a situation of mistrust between the auditor and the Board or senior management (para 32).
• Independence and fit and proper. The auditor must be a fit and proper person in accordance with the ADI’s fit and proper policy as required by CPS 520 and must satisfy auditor independence requirements in CPS 510 (para 20).
• No sole reliance on APRA. In preparing reports, the appointed auditor must not place sole reliance on work performed by APRA (para 33).

APRA’s rights and discretions

• Bilateral meetings with auditors. APRA may meet appointed auditors at any time on a bilateral basis at the request of either party (para 28).
• Require additional auditors. APRA may require an ADI to appoint another auditor, in addition to any already appointed, for APS 310 purposes by notice in writing (para 15).
• Adjust or exclude requirements. APRA may adjust or exclude a specific prudential requirement in relation to one or more specified ADIs or authorised NOHCs (para 13).
• Commission special purpose engagements. APRA may require an ADI to appoint an auditor to provide a special purpose report on specified matters and may do so with or without prior consultation (paras 38-39). APRA may determine the assurance level required (para 39).

Boards and Board Audit Committees

• Receive reports and material. Boards or Board Audit Committees must receive reports provided by the appointed auditor under APS 310, associated assessments and other material provided by the appointed auditor to the ADI, and APRA’s commentary on those reports (para 25).
• Right to commission and direct communications when group auditor used. Where an authorised NOHC’s auditor is used for Level 1 and Level 2 purposes, the ADI’s Board must agree in writing, and the ADI’s Board or Board Audit Committee must be able to communicate directly with the appointed auditor, commission reports as to the ADI on a Level 1 basis, and receive copies of reports and associated assessments (para 21(b)(i)-(iii)).

Statutory protections and references

• The engagement contract must refer the appointed auditor to s 16B (Auditors to give information to APRA), s 16BA (Requirement for auditors to give information about ADIs) and Part VIA Protections in relation to information (para 16(c)(i)-(iii)). The standard notes the need for auditors to be aware they may be required to immediately notify APRA of certain matters under s 16BA (footnote to para 36).

Timings and assurance standards

• Routine reports must be provided within three months of the ADI’s financial year end (para 35; footnote 3 provides the four month period for non‑disclosing entities).
• Special purpose engagement reports must be submitted within three months of the date of the notice commissioning the report unless otherwise determined by APRA (para 40).

These duties reallocate information flows and create a dual reporting relationship for auditors to both APRA and the ADI’s governance bodies. The standard also gives APRA tactical discretion to require additional engagements and to set assurance expectations for specified data collections (Attachment A).

APS 310 itself is a prudential standard and does not set out new criminal penalties; however it operates within a statutory enforcement ecosystem and cross‑references statutory obligations and criminal provisions that have enforcement consequences.

Criminal offences for false or misleading information. The Prudential Standard warns that persons involved in the provision of information, including appointed auditors and officers and employees of ADIs and authorised NOHCs, should note that it is an offence under ss 137.1 and 137.2 of the Criminal Code Act 1995 to provide false and misleading information to a Commonwealth entity such as APRA (para 19). This is a direct statutory criminal exposure for those who transmit information to APRA.

Statutory auditor obligations. The standard mandates that the engagement contract refer to relevant provisions of the Banking Act, namely s 16B (Auditors to give information to APRA) and s 16BA (Requirement for auditors to give information about ADIs) as well as Part VIA protections in relation to information (para 16(c)). The Prudential Standard therefore sits alongside statutory duties that may carry separate enforcement consequences under the Banking Act. Footnote guidance also reminds auditors that s 16BA requires immediate notification to APRA in certain circumstances and timely notification in others (footnote to para 36).

APRA’s supervisory powers. APS 310 is made under s 11AF of the Banking Act (Authority, para 1). APRA retains supervisory discretions and powers that may lead to administrative enforcement steps:

• Adjustment or exclusion powers. APRA may adjust or exclude a specified prudential requirement in relation to one or more ADIs or authorised NOHCs (para 13). That power is an instrument of supervisory flexibility and can be used to tailor obligations, but also to withdraw relief.
• Requiring additional auditors. APRA may require an ADI to appoint another auditor in addition to any auditor already appointed, by notice in writing, for APS 310 purposes (para 15). Non‑compliance with a written notice from APRA may expose the ADI to enforcement action under the Banking Act, though the text of APS 310 does not itself set out the sanctions.
• Reliance on reports. APRA may rely on auditors’ reports and associated assessments in the performance of its functions under the Act (para 31). This reliance could inform regulatory action, including directions or other administrative measures under the Banking Act, where APRA identifies prudential concerns.

Contractual and administrative consequences. APS 310 requires ADIs to include specific terms in engagement contracts (para 16) and to produce material on request to APRA (para 22). Failure to comply with prudential standards can trigger supervisory measures or enforcement under the Banking Act. The Prudential Standard does not prescribe civil penalties in its text, but it operates within APRA’s statutory enforcement architecture.

Practical enforcement mechanics. The standard also contains operational enforcement levers: APRA can meet auditors bilaterally (para 28), require attendance at meetings and production of documents (para 30), and commission special purpose engagements by written notice (para 38). These levers create immediate compliance costs and administrative obligations which APRA can use to probe and remediate prudential concerns.

Limitations and scope. The instrument’s footnotes and cross‑references indicate that some procedural matters, such as reporting forms and instructions, are determined under other legislation, notably the Financial Sector (Collection of Data) Act 2001 (footnote 5), and so enforcement of reporting standards may also involve those statutory frameworks.

In short, while APS 310 does not itself create new criminal penalties or specify administrative sanctions, it embeds statutory references and supervisory mechanisms that expose ADIs, their officers and appointed auditors to criminal liability for false information and to APRA’s supervisory enforcement powers under the Banking Act.

APS 310 is designed to operate within a web of existing statutory instruments, prudential standards and reporting regimes. The Prudential Standard explicitly cross‑references and integrates, by contract requirement or incorporation, the Banking Act 1959, the Financial Sector (Collection of Data) Act 2001 (FSCODA), the Corporations Act 2001, the Auditing Standards established by the Australian Auditing and Assurance Standards Board (AUASB), and other APRA prudential standards such as CPS 510 Governance, CPS 520 Fit and Proper and APS 001 Definitions.

Banking Act 1959. APS 310 is made under s 11AF of the Banking Act (Authority, para 1). It requires that engagement contracts refer to Banking Act provisions concerning auditors, specifically s 16B and s 16BA, and Part VIA protections in relation to information (para 16(c)). The standard therefore supplements statutory auditor obligations under the Banking Act rather than displacing them. Footnotes clarify that s 16BA requires the auditor to immediately notify APRA of certain matters and to notify APRA as soon as practicable about others (footnote to para 36). APRA’s power to adjust or exclude requirements is referenced to s 11AF(2) (footnote to para 13).

Financial Sector (Collection of Data) Act 2001. APS 310 anchors its routine reporting obligations to APRA data collections conducted under FSCODA. The routine assurance obligations concern data collected under FSCODA (para 35) and Attachment A lists APRA ADI reporting standards and forms that are part of Reporting Standards determined under s 13 of FSCODA (Attachment A; footnote 5). The standard makes clear that APRA data collections referred to in Attachment A are those collected under FSCODA and that audit testing is required only for specified collections and ADIs (Attachment A and footnote 6).

Corporations Act 2001. APS 310 allows the appointed auditor to be the same auditor who audits an ADI for the purposes of the Corporations Act 2001 (para 15). That permits consolidation of audit appointments where appropriate, but APS 310 imposes additional APRA‑facing duties over and above any Corporations Act obligations.

AUASB Auditing Standards. Paragraph 16(b) requires the engagement contract to require the appointed auditor to comply with Auditing Standards and Guidance issued by the AUASB, except where inconsistent with APS 310 or where APRA specifies alternatives in writing. This creates a hierarchy in which APS 310 may prevail over AUASB standards to the extent of inconsistency for prudential purposes.

APRA prudential standards. The Prudential Standard incorporates and depends upon other APRA standards. Definitions required by APS 001 are incorporated (para 9). CPS 510 is referenced for governance and for interpreting Board references for foreign ADIs (para 7). CPS 520 is referenced for fit and proper requirements applicable to auditors (para 20). The standard therefore sits within APRA’s suite of governance and prudential instruments and relies on those instruments for key interpretative and normative content.

Criminal Code Act 1995. APS 310 references ss 137.1 and 137.2 of the Criminal Code Act 1995, which create criminal offences for providing false or misleading information to a Commonwealth entity such as APRA (para 19). That statutory overlay applies to persons providing information to APRA, including auditors.

Information protections. The engagement contract must refer auditors to Part VIA Protections in relation to information (para 16(c)(iii)). Part VIA (in the Banking Act) contains protections for auditors who provide information to APRA, for example protection from liability in certain circumstances, and is therefore an important legal interaction.

Reporting standards and forms. Attachment A makes clear that the APRA ADI reporting forms are part of Reporting Standards determined under FSCODA and that Attachment A is not exhaustive (Attachment A; footnote 5). The Prudential Standard’s assurance obligations therefore rely on the content, definitions and instructions contained in those reporting forms and reporting standards.

In practice, these interactions mean that ADIs must coordinate contractual language, AUASB standards, Corporations Act audit arrangements, APRA reporting forms and statutory obligations under the Banking Act and FSCODA to achieve compliance. Where conflicts arise, APS 310 expressly directs that its requirements prevail over AUASB standards to the extent of inconsistency (para 16(b)(i)), and that APRA may specify alternative standards in writing (para 16(b)(ii)). APRA also retains the discretion to grant adjustments or exclusions under its statutory powers (para 13). These tensions produce legal and operational choices for ADIs when drafting engagement contracts, selecting auditors and designing reporting processes.

The instrument itself contains limited amendment history in that it expressly revokes the prior prudential standard instrument and replaces it with the new determination. The relevant points from the text are:

• Revocation and replacement. The instrument states that Renée Roberts, a delegate of APRA, revokes Banking (prudential standard) determination No. 2 of 2019, including Prudential Standard APS 310 Audit and Related Matters that was made under that earlier determination, and determines the Prudential Standard APS 310 Audit and Related Matters in the form set out in the schedule (instrument preamble). This is an explicit single‑step replacement.
• Date and commencement. The instrument is dated 1 December 2022 and commences on 1 January 2023 (instrument preamble; Application and commencement paras 8 and 1 of the instrument body). The standard therefore gives a clear effective date for compliance actions.
• APRA discretion going forward. The Prudential Standard contains provisions granting APRA the ability to adjust or exclude specific prudential requirements in relation to one or more specified ADIs or authorised NOHCs (para 13), and an ADI or authorised NOHC must contact APRA if it seeks to rely on a previous exemption or other exercise of discretion by APRA under a previous version of the Prudential Standard (para 14). Those provisions preserve a path for case‑by‑case modifications and indicate that APRA’s prior discretions under the replaced standard do not automatically carry over without consultation.
• Footnote references to statutory powers. The text’s footnote to para 13 refers to s 11AF(2) of the Banking Act as the source of APRA’s power to adjust or exclude requirements (footnote 2). This anchors the amendment flexibility in the Banking Act rather than in consequential or ad hoc administrative practice.

What the instrument does not record. The instrument does not include a recorded history of earlier amendments or the policy changes introduced relative to the 2019 determination beyond the act of revocation and replacement. The text does not catalogue differences between the 2019 standard and the 2022 determination, nor does it include an explanatory memorandum within the instrument body describing the policy rationale for each change. The only historical action recorded is the revocation of the previous determination and the start date for the new standard.

Operational implications for amendment risk. Because the instrument allows APRA to issue written adjustments or exclusions to specific ADIs and because APS 310 cross‑references other prudential and reporting instruments that may themselves change over time (for example, Reporting Standards under FSCODA or AUASB Auditing Standards), ADIs face a continuing need to monitor not only APS 310 but also amendments to related instruments and the exercise of APRA discretions. Paragraph 11 confirms that references to Acts, Regulations and Prudential Standards are to be taken as references to those instruments "as in force from time to time", indicating the standard is intended to operate dynamically with legal updates (para 11).

In sum, the amendment history recorded in the instrument is limited to the revocation of the 2019 determination and the establishment of the 2022 determination effective 1 January 2023, while preserving supervisory discretion for future adjustments and pointing to a continuing need to monitor related regulatory instruments.

The Prudential Standard APS 310 document supplied contains no litigation history and does not cite any judicial decisions. It does not name or reference any cases, nor does it summarise any judicial interpretations of the provisions it invokes. The instrument is an administrative prudential instrument made under s 11AF of the Banking Act and functions within APRA’s supervisory framework rather than as the product of litigation.

Relevant statutory hooks that could generate litigation are present in the document. For example:

• The Banking Act provisions referenced in the contract terms, including s 16B and s 16BA and Part VIA protections (para 16(c)), are statutory provisions that in other contexts could be the subject of litigation concerning the scope of auditor obligations to APRA, the meaning of "as soon as practicable" notifications, or the limits of information protections. APS 310 requires engagement contracts to refer to these Banking Act provisions but does not itself define them.
• Criminal Code provisions are referenced for false and misleading information offences (para 19). Prosecutions or contested enforcement actions under ss 137.1 and 137.2 of the Criminal Code could arise from false statements to APRA, but nothing in APS 310 describes case law or enforcement precedents.
• APRA’s powers to adjust or exclude prudential requirements (para 13) and to require an additional auditor by written notice (para 15) could lead to administrative law challenges about APRA’s exercise of discretion in particular cases. The standard reiterates APRA’s statutory discretions but does not discuss the limits of those powers or prior judicial review outcomes.

Because the source contains no litigation references, readers seeking jurisprudential guidance must consult separate case law on APRA’s statutory powers, auditor obligations under the Banking Act, and criminal prosecutions for false statements to Commonwealth bodies. APS 310 itself provides the regulatory architecture but not any settled legal interpretations or litigation outcomes.

APS 310 contains several provisions that create practical frictions, governance trade‑offs and uncertainty points for ADIs, auditors and Boards. These are items that can produce unexpected compliance costs or operational surprise if not anticipated.

Direct reporting to APRA. Appointed auditors must submit reports and associated assessments directly to APRA (para 31). This creates a dual reporting channel for auditors, where the auditor is contractually required to report to both APRA and the ADI’s Board. ADIs should not assume that auditor communications will remain private or mediated solely through the ADI. Relatedly, paragraph 32 permits auditors, in narrowly defined circumstances, to withhold documents from the ADI where disclosing them would jeopardise depositors’ interests or where there is mistrust between the auditor and the Board or senior management. This can create governance tensions and affect Board oversight and internal remediation processes.

Costs fall on ADIs. The costs of preparing and submitting reports and other material required by APS 310 must be borne by the ADI (para 18). Where APRA requires special purpose engagements on short notice, ADIs will bear the marginal cost of such engagements (paras 38-40). ADIs that are part of Level 2 groups should anticipate costs associated with cross‑border or group audits, and may need to fund group auditors for both Level 1 and Level 2 assurance activities.

APRA discretion to require additional auditors. APRA may, by written notice, require an ADI to appoint another auditor in addition to any appointed auditor (para 15). This can lead to duplication of audit effort and higher costs. ADIs should not assume a single auditor will suffice in all supervisory scenarios.

Assurance level variability and evidence types. Paragraphs 36(a)-(c) require reasonable assurance for data derived solely from accounting records and limited assurance for data from non‑accounting records, with mixed treatment where data sources combine both. Attachment A lists which reporting forms are subject to which assurance approach but is not exhaustive. ADIs must therefore map their reporting forms to Attachment A and prepare for different assurance methodologies. Auditing non‑accounting records typically requires different processes and may be less straightforward to evidence, which can increase audit effort and timing uncertainty.

Group auditor arrangements require ADI Board consent and access. Where an authorised NOHC’s auditor is used for both Level 1 and Level 2 purposes, the ADI’s Board must agree in writing and retain the ability to communicate directly with the appointed auditor, to commission Level 1 reports and to receive copies of reports and supporting material (para 21(b)(i)-(iii)). ADIs that rely on a single group auditor must ensure those contractual and operational access rights are clearly preserved, or else the ADI’s Board loses practical oversight capacity.

Tripartite and bilateral meetings. APRA expects liaison to be conducted through tripartite arrangements but reserves the right to meet auditors bilaterally at any time at the request of either party (paras 28-29). Auditors are required to attend APRA meetings related to APS 310 unless APRA indicates otherwise (para 30). This can create scheduling and confidentiality issues. ADIs should ensure internal audit representation is available for tripartite meetings (para 26).

Conflicts between AUASB standards and APS 310. Contracts must require auditors to comply with AUASB Auditing Standards and Guidance, except where inconsistent with APS 310, in which case APS 310 prevails, or where APRA specifies alternative standards in writing (para 16(b)). This prioritisation can create practical uncertainty where acceptable auditing practice diverges from APRA requirements. Auditors and ADIs must be prepared to document and justify departures from AUASB practice based on APRA directives.

Notification obligations under the Banking Act. The engagement contract must refer auditors to s 16BA, which requires immediate notification of certain matters to APRA (para 16(c) and footnote to para 36). Auditors are therefore operating under legally imposed notification duties that may require immediate escalation irrespective of ADI preferences.

APRA reliance on auditor work not absolute. Paragraph 33 requires auditors not to place sole reliance on APRA’s work. Auditors must therefore perform independent work to underpin their reports. This may duplicate supervisory testing and create additional cost and timing implications.

Data coverage and omissions. Attachment A is not a complete list of all ADI data collections subject to audit testing and states explicitly that it only lists those reporting forms collected under FSCODA that are subject to audit testing for APS 310 purposes (Attachment A). ADIs should therefore confirm the full scope of reporting forms that APRA expects to be audited in their specific circumstances rather than relying solely on Attachment A.

Legal exposure for false statements. Paragraph 19 reminds providers of information that false and misleading statements to a Commonwealth entity are criminal offences. This is a high‑stakes exposure for employees and auditors who prepare or attest to information submitted to APRA.

Timing constraints. Routine reports must be provided within three months of the ADI’s financial year end (para 35) and special purpose engagements are due within three months of notice commissioning them (para 40). ADIs should factor these deadlines into budgeting and audit planning cycles.

In short, the main operational pitfalls are dual reporting obligations and potential withholding of information from Boards, APRA’s ability to require additional auditors or alternative standards, assurance complexity on non‑accounting data, cost allocation to ADIs, and criminal exposure for false information. Each of these points flows directly from the text of APS 310.

Meeting APS 310 requires a combination of contractual, governance, resourcing and procedural adjustments. The following compliance checklist is grounded in the text and sets out actionable steps ADIs and authorised NOHCs should take to align with the standard.

1. Update engagement contracts to reflect APS 310 clauses (para 16)

   • Ensure the legally binding contract with the appointed auditor explicitly requires the auditor to fulfil the roles and responsibilities set out in APS 310 (para 16(a)).
   • Include an obligation for the auditor to comply with AUASB Auditing Standards and Guidance, subject to APS 310 prevailing where inconsistent, and to any written APRA directions about alternative standards (para 16(b)(i)-(ii)).
   • Include a reference to Banking Act obligations: s 16B, s 16BA and Part VIA protections in relation to information, as required (para 16(c)(i)-(iii)).

2. Ensure auditor fit and independence (para 20)

   • Document and maintain evidence that the appointed auditor is a fit and proper person in accordance with CPS 520 and meets auditor independence requirements in CPS 510 (para 20).
   • Verify that the auditor is not subject to a direction issued under s 17(2) of the Banking Act (para 20(c)).

3. Clarify reporting lines and dual reporting obligations (paras 31, 35, 40)

   • Confirm that the auditor will submit required routine and special purpose reports directly to both APRA and the ADI’s Board or Board Audit Committee within the applicable timeframes (paras 31, 35, 40).
   • Update internal procedures to capture and act upon reports received by APRA from the auditor, including APRA commentary provided to the ADI (para 25).

4. Ensure access and information flows (paras 23-24)

   • Put in place processes guaranteeing the appointed auditor has access to all relevant data, information, reports and staff, including Board and internal audit, as required (para 23).
   • Provide the auditor with a documented statement of the ADI’s prudential requirements and any APRA information that would assist the auditor (para 24).

5. Map APRA data collections and determine assurance levels (paras 35-36; Attachment A)

   • Review Attachment A and the APRA Reporting Standards under FSCODA to determine which reporting forms require reasonable assurance and which require limited assurance (paras 35-36; Attachment A; footnote 5).
   • For mixed data sources, document which elements come from accounting records and which from non‑accounting records so the appointed auditor can perform reasonable or limited assurance as required (para 36(a)-(c)).

6. Strengthen internal audit and tripartite arrangements (paras 26-30)

   • Ensure internal audit’s scope includes review of management policies, processes and controls put in place to ensure compliance with APRA prudential requirements (para 26).
   • Provide for internal audit representation at tripartite meetings involving APRA, the ADI and the appointed auditor (para 27).
   • Establish protocols for tripartite and bilateral meetings, including scheduling, document production and confidentiality management (paras 28-30).

7. Board governance and Board Audit Committee processes (paras 21, 25)

   • Ensure the Board or Board Audit Committee receives the appointed auditor’s reports and associated assessments and any APRA commentary on those reports (para 25).
   • If a group auditor will be used for Level 1 and Level 2 purposes, obtain the ADI Board’s written agreement and ensure the Board has direct communication rights, the ability to commission Level 1 reports and receipt of copies of relevant reports (para 21(b)(i)-(iii)).

8. Prepare for special purpose engagements and APRA notices (paras 38-40)

   • Establish a fast‑track process to respond to APRA’s written notice requiring a special purpose engagement, including a budget and resource mobilisation plan to meet the three month submission deadline (para 40).
   • Maintain an up‑to‑date list of potential topics APRA may request and pre‑identify internal SMEs for rapid engagement.

9. Document procedures for information integrity and criminal liability (para 19)

   • Implement quality control measures and attestations to mitigate the risk of false or misleading information being provided to APRA (para 19). Ensure staff and auditors are aware of Criminal Code obligations and have escalation procedures for suspect data.

10. Contractual protections and communication protocols

• Include clauses permitting the auditor to withhold certain documents from the ADI where the auditor reasonably considers disclosure would jeopardise depositors or where there is mistrust, while establishing notification and remediation pathways to manage such events (para 32).
• Include provisions that the ADI will supply to APRA, on reasonable request, terms of engagement, management letters and correspondence that may bear on the scope and content of the auditor’s work (para 22).

11. Monitor legislative and APRA changes (paras 11, 13, 14)

• Adopt a supervisory watchlist to track changes to APRA Reporting Standards, AUASB Auditing Standards and relevant prudential standards such as CPS 510 and CPS 520, since APS 310 operates in an evolving regulatory environment (para 11).
• If relying on previous exemptions or APRA discretions under earlier versions of the Prudential Standard, contact APRA to confirm whether reliance is permitted or whether new approvals are required (para 14).
• Consider applying for an adjustment or exclusion under para 13 if there are material barriers to compliance, being prepared to justify the request under s 11AF(2) and to accept any conditions APRA may impose.

12. Budgeting and resourcing (para 18)

• Budget for the costs of routine reporting, special purpose engagements and potential additional auditors where APRA exercises its right to require them. Ensure contractual fee mechanisms with auditors allow for rapid mobilisation.

13. Recordkeeping and evidence management

• Maintain clear documentation showing the source of data (accounting vs non‑accounting records) and the audit trails required to support reasonable or limited assurance conclusions (para 36).
• Retain correspondence with APRA and the auditor, including management letters and any APRA commentary, to demonstrate compliance with reporting and governance requirements (para 22; para 25).

14. Scenario planning for crises or mistrust scenarios (para 32)

• Plan for situations where the auditor may withhold documents from the ADI, including immediate notification to the Board Audit Committee and pre‑established contingency plans for governance continuity and depositor protection.

If an ADI implements the steps above, documents them, and integrates them into normal audit and governance cycles, it will align operational practice with the express requirements of APS 310. The standard emphasises contractual clarity, facilitation of APRA access, and differentiation of assurance levels; compliance therefore depends on legal certainty in contracts, adequate resourcing for assurance work, and clear governance protocols that accommodate APRA’s supervisory rights.