Subdiv 5Compliance audits

Subdivision 5—Compliance audits 114—Compliance audits A compliance audit is an audit that is performed for any of the following purposes: (a) to assess a person's compliance with, or capability of complying with, this Act; (b) to assess or identify any contravention or suspected contravention of this Act (including any contravention or other deficiency identified in another audit); (c) to identify measures for improved compliance with this Act. 115—Imposition of requirement to perform compliance audit (1) The Chief Executive or a Chief Officer may require a compliance audit to be performed in relation to any person at any time. (2) An accreditation authority, other than the Chief Executive, may require a compliance audit to be performed in relation to a person who is, or has been, a biosecurity auditor or biosecurity certifier at any time, but only if the accreditation authority is, or was, the responsible accreditation authority for the appointment or accreditation of the person. (3) An accreditation authority that requires a compliance audit to be performed must give the audit target notice of the decision to require a compliance audit, unless the giving of notice would defeat the purpose of the audit. 116—Decision to require compliance audits (1) A designated authority must have regard to the following in making a decision about whether to require a compliance audit or the frequency of compliance audits: (a) the designated authority's audit frequency policy; (b) the compliance history of the audit target; (c) any previous biosecurity audits performed in relation to the audit target that the designated authority considers relevant (including any deficiencies identified in those audits); (d) any information provided to the designated authority by authorised officers about compliance with this Act; (e) any other matters that the designated authority considers relevant. (2) An accreditation authority (other than the Chief Executive) must require a compliance audit to be undertaken in relation to a person if— (a) it is directed to do so by the Chief Executive; or (b) it is required to do so under a condition of its approval as an accreditation authority. (3) If the Chief Executive directs an accreditation authority to require a compliance audit, subsection (1) applies to the decision of the Chief Executive to make such a direction as if it were a decision about whether to require the compliance audit. 117—Audit frequency policy (1) A designated authority must adopt a policy (an audit frequency policy) in relation to the frequency of audits which may be performed for the purposes of this Act. (2) An audit frequency policy may make provision for, or with respect to, the following matters: (a) the frequency of compliance audits; (b) any other matters that are prescribed by the regulations. (3) An audit frequency policy adopted by an accreditation authority, other than the Chief Executive, has no effect unless it, and any amendment to it, has been approved by the Chief Executive. (a) is minor in nature or for the purpose of correcting an error; or (iii) the provider of a course or a qualification; or (5) A designated authority must ensure that an audit frequency policy is publicly available. (6) An audit frequency policy may apply generally or apply differently according to different factors of a specified kind, including but not limited to the following: (a) the type of biosecurity matter involved; (b) the type of activity involved and the level of biosecurity risk associated with that activity; (c) the class of biosecurity registration or accreditation involved (if relevant). (7) A designated authority may adopt an audit frequency policy for each type of accreditation. (8) A reference in this Act to an audit frequency policy is a reference to the audit frequency policy that is relevant to the audit concerned. 118—Engagement of auditor (1) A designated authority that requires a compliance audit may— (a) engage or appoint the biosecurity auditor to perform the audit; or (b) direct the audit target to engage a biosecurity auditor to perform the audit and specify requirements relating to— (i) the engagement of the biosecurity auditor; and (ii) the scope of the compliance audit to be performed. (2) A direction may only be given under subsection (1)(b) if the audit target is— (a) a registered entity; or (b) an accreditation authority other than the Chief Executive; or (c) a biosecurity auditor; or (d) a biosecurity certifier; or (e) the holder of a permit; or (f) an entity responsible for preparing a draft biosecurity program; or (g) a person who has entered into a biosecurity control agreement; or (h) a prescribed person or a person of a prescribed class. 119—Functions of biosecurity auditor—compliance audits (1) A biosecurity auditor has the following functions in connection with a compliance audit, subject to any limitations specified in the biosecurity auditor's instrument of appointment: (a) to assess the audit target's compliance with, and capability of complying with, this Act; (b) to assess or identify any contravention or suspected contravention of this Act (including any contravention or other deficiency identified in another biosecurity audit); (c) to identify measures for improved compliance with this Act; (d) to report, to the designated entity that requires the audit, on the biosecurity auditor's assessment of those matters. (2) A biosecurity auditor has such other functions in connection with a compliance audit as are— (a) prescribed by the regulations; or (b) subject to the regulations, conferred on the biosecurity auditor by the biosecurity auditor's instrument of engagement for the compliance audit. 120—Recovery of fee for compliance audit (1) If a compliance audit is carried out by a biosecurity auditor who is an authorised officer, a fee for the performance of the compliance audit prescribed under this Act or calculated in accordance with a fee notice under section 306(11) is payable by the audit target in accordance with the regulations (and may be recovered in accordance with the regulations). (2) An audit target is responsible for any fee payable in connection with a compliance audit performed by a biosecurity auditor who is not an authorised officer (being a fee specified by the biosecurity auditor for the conduct of the audit and recoverable by the biosecurity auditor as a debt). 121—Use of compliance audits A designated authority that requires a compliance audit must have regard to the compliance audit in performing the designated authority's functions under this Act in relation to the audit target.