Quality control

10. The information provided by an ADI under this reporting standard (except for the information required under paragraph 3) must be the product of processes and controls that have been reviewed and tested by the external auditor of the ADI. AGS 1008 ‘Audit Implications of Prudential Reporting Requirements for Authorised Deposit-taking Institutions’, issued by the Auditing and Assurances Standards Board of the Australian Accounting Research Foundation, provides guidance on the scope and nature of the review and testing required from external auditors. This review and testing must be done on an annual basis or more frequently if necessary to enable the external auditor to form an opinion on the accuracy and reliability of the data.

11. All information provided by an ADI under this reporting standard must be subject to processes and controls developed by the ADI for the internal review and authorisation of that information. It is the responsibility of the board and senior management of the ADI to ensure that an appropriate set of policies and procedures for the authorisation of data submitted to APRA is in place.

Authorisation

12. If an ADI submits information under this reporting standard using the ‘Direct to APRA’ software, it will be necessary for an officer of the ADI to digitally sign, authorise and encrypt the relevant data. For this purpose, APRA’s certificate authority will issue ‘digital certificates’, for use with the software, to officers of the ADI who have authority from the ADI to transmit the data to APRA.

13. If information under this reporting standard is provided in paper form, it must be signed on the front page of the relevant completed form by either:

(a) the Principal Executive Officer of the ADI; or

(b) the Chief Financial Officer of the ADI (whatever his or her official title may be).