Financial Sector (Collection of Data) (reporting standard) determination No. 107 of 2023

Operational Risk Charge (ORC) is a derived item. The insurer must compute it using the formula in HPS 118, then report the result. The Reporting Standard does not reproduce that formula. Instead, it requires the insurer to input three building blocks: (a) accrued premium for the 12 months ending on the reporting date, (b) accrued premium for the 12 months ending 12 months prior to the reporting date, and (c) the central estimate of insurance liabilities. Accrued premium is defined by cross-reference to Prudential Standard HPS 001 Definitions. Importantly, it must be reported gross of any outwards reinsurance expense. That means the insurer does not deduct reinsurance recoveries or ceded premiums; the figure is the full premium earned or receivable before any risk transfer. This inflates the numerator relative to a net-of-reinsurance approach and likely increases the ORC, all else equal. Central estimate of insurance liabilities is the value determined under Prudential Standard HPS 340 Insurance Liability Valuation. It is the best estimate (not including a risk margin) of future claim payments and related expenses. Health benefits fund and general fund are fund types. The former is defined by the Private Health Insurance (Prudential Supervision) Act 2015; the latter by HPS 001. The insurer must report ORC items separately for each health benefits fund and for its general fund. Reporting period means a calendar quarter or an annual reporting period, unless APRA changes it for a particular insurer. Capital standards means prudential standards relating to capital adequacy as defined in HPS 001 (a closed set). The Act in this context means the Private Health Insurance (Prudential Supervision) Act 2015, not FSCODA. Officer has the meaning given in that Act, which is broader than the Corporations Act definition and can include persons concerned in management. Private health insurer has the same meaning as in the Act - it covers organisations registered under the Private Health Insurance Act 2007. The standard also contains a general interpretation provision (paragraph 18) that all references to Acts, Prudential Standards, Reporting Standards, and accounting or auditing standards are references to those instruments as in force from time to time. That means compliance must track future amendments to HPS 001, HPS 118, HPS 340, and the underlying Acts. There is no static grandfathering. The reporting table itself is a specification of column order and data constraints. The constraint “any specific combination of values in the table must not appear on more than one row” prevents duplicate entries but also means the reported dataset is a strict set with no repeated keys.

The primary duty bearers are all private health insurers registered under the Private Health Insurance Act 2007. There is no exemption by size, fund type, or business complexity. Every insurer that operates one or more health benefits funds or a general fund must prepare and submit the ORC data. Within each insurer, the compliance burden falls on the board of directors and senior management collectively. Paragraph 10 explicitly makes them responsible for ensuring appropriate systems, processes and controls exist for internal review and authorisation of the submitted information. That means if data is inaccurate or late, the board cannot deflect blame to a data entry clerk - the deficiency is a governance failure. The person who physically submits the information must be “suitably authorised by an officer of the private health insurer” (paragraph 15). That creates a delegation chain: an officer (as defined in the Act) formally authorises someone, likely a finance or compliance employee, to hit send. That employee then becomes the submitter on record. Auditors are also directly affected. The annual data (due 30 September) must be externally audited to ensure consistency with the insurer’s statutory financial accounts and faithful application of the capital standards. The auditor must issue a report that includes the audit program and be signed by the named responsible auditor. If the previous year’s auditor report was qualified, the current report must state whether the auditor examined the issues and is satisfied the insurer has rectified them. This adds to audit scope and cost, especially for smaller insurers that may have only one health benefits fund. APRA itself is the recipient and user. Its staff rely on this data for prudential supervision, including assessing compliance with capital standards. The agency also gains power to vary reporting periods and requirements for individual insurers (paragraphs 7 and 16), which allows it to single out insurers it considers higher risk or more complex. That introduces an asymmetric burden: an insurer APRA deems problematic may face more frequent or more detailed reporting. Indirectly, the standard affects policyholders and the broader market. The ORC is a component of the capital adequacy framework that determines how much capital an insurer must hold. More capital means higher premiums or lower returns for shareholders. The requirement to report gross of reinsurance inflates the ORC relative to a net basis, potentially raising capital requirements. That cost feeds into premium setting. For listed health insurers, shareholders bear the compliance cost as a deadweight administrative expense. Small health insurers with limited in-house actuarial and data teams face a disproportionately higher fixed compliance burden relative to premium revenue.

Duty to submit information: For each quarterly reporting period, the insurer must provide the ORC items (Table 1) within 28 calendar days after the quarter ends. For the annual period (ending 30 June), the annual data must be provided by 30 September. The annual data set is the same as quarterly but must also be externally audited. Duty to have internal review and authorisation: The insurer’s board and senior management must develop and maintain systems, processes and controls for internal review and authorisation of the reported data. This is not optional - paragraph 10 uses mandatory language: “All information … must be subject to systems, processes and controls.” Duty to ensure authorised submission: The person lodging the data must be formally authorised by an officer of the insurer. That officer likely needs to be a board member, CEO, CFO, or company secretary, depending on the insurer’s internal delegation policy. Duty to engage external auditors for annual data: The annual ORC submission must be audited, and the auditor’s report must be provided by 30 September. The audit must confirm consistency with statutory financial accounts and faithful application of the capital standards. Right to request an extension: APRA may, in writing, grant an extension of a due date. The insurer must apply before the due date? The standard does not say; it simply says APRA may grant an extension in writing. In practice, an insurer should apply as soon as it anticipates delay. Right to have reporting periods varied: APRA may, by notice in writing, require more or less frequent reporting for a particular insurer if it considers that necessary or desirable. This is a right in the sense that the insurer can be relieved of quarterly reporting if APRA is satisfied less frequent is sufficient - but it is more likely used to impose more frequent reporting on higher-risk insurers. Right to have reporting requirements varied: Paragraph 16 gives APRA power to vary reporting requirements for a particular insurer. This is a unilateral power; the insurer has no veto, but it does mean compliance can be tailored. The insurer cannot simply choose to comply with the standard’s default tables; it must comply with any variation notice. Right to rely on definitions: The standard incorporates definitions from HPS 001, the Private Health Insurance (Prudential Supervision) Act 2015, and FSCODA. Insurers can rely on those definitions as binding interpretive guides. Duty to report gross of reinsurance: The instructions specify that all items must be reported gross of any associated outwards reinsurance expense. That means the insurer cannot net off ceded premium or recoveries. This is a departure from some accounting treatments and may require separate data extraction from gross premium systems.

The Reporting Standard itself does not contain penalty provisions. It is made under section 13 of FSCODA, which provides for civil penalty provisions and other enforcement mechanisms in Part 6 of that Act. Failure to provide information as required can attract a civil penalty of up to 2,000 penalty units (currently $626,000 for an individual, more for a body corporate under section 59 of FSCODA). Additionally, providing false or misleading information to APRA can attract criminal penalties under section 137.1 or 137.2 of the Criminal Code (Cth) (up to 12 months imprisonment for reckless falsehood, 10 years for intentional falsehood). The Private Health Insurance (Prudential Supervision) Act 2015 also gives APRA enforcement powers: it can issue directions, impose license conditions, or in extreme cases apply to the Federal Court for a civil penalty order or seek disqualification of officers. The standard itself does not impose fines for late or non-submission, but the underlying Acts do. APRA’s standard practice for data defaults is to issue breach notices, require corrective action, and potentially publish the breach. The external audit requirement creates additional enforcement pressure. If the auditor qualifies the ORC data because of inconsistency with statutory accounts or misapplication of capital standards, that qualification must be disclosed and addressed. APRA may treat that as a red flag for capital adequacy concerns and escalate supervision. The requirement that the auditor examine prior year issues if there was a qualified report ensures that unresolved problems are not carried over silently. For submitters, knowingly submitting incorrect data is a serious offence. The obligation on the board and senior management (paragraph 10) means directors and executives cannot claim ignorance of faulty systems. A breach of the duty to maintain appropriate systems, processes and controls could itself be a breach of prudential standards and lead to APRA imposing additional capital requirements or restricting business operations. In extreme cases, APRA could use failure to report as grounds for suspending or cancelling a health insurer’s registration under the Private Health Insurance (Prudential Supervision) Act 2015. That would effectively put the insurer out of business.

This Reporting Standard is part of a layered regulatory framework. At the base is the Financial Sector (Collection of Data) Act 2001 (Cth) , which empowers APRA to make reporting standards. Section 13 is the specific head of power. The standard must be read consistently with that Act, including its definitions of terms like “officer” where relevant (though here “officer” is defined by the Private Health Insurance (Prudential Supervision) Act 2015). The standard directly incorporates Prudential Standard HPS 001 Definitions, which supplies meanings for terms such as “accrued premium”, “central estimate”, “general fund”, “capital standards”, and “ORC” itself (though the Reporting Standard defines ORC as a derived item per HPS 118). Prudential Standard HPS 118 Capital Adequacy: Operational Risk Charge is the companion standard that sets out the calculation method for ORC. This Reporting Standard only asks for the inputs and the final derived ORC; it does not instruct how to compute it. Insurers must refer to HPS 118 for the formula, which may incorporate weighting factors, floors, or scaling adjustments. Prudential Standard HPS 340 Insurance Liability Valuation governs how the central estimate of insurance liabilities is determined. The reporting item “ORC - Central estimate of insurance liabilities” must be calculated in accordance with HPS 340, which sets out actuarial methods, assumptions, and documentation requirements. Private Health Insurance (Prudential Supervision) Act 2015 is the overarching Act for health insurance prudential regulation. Definitions from that Act apply (e.g., “private health insurer”, “health benefits fund”, “officer”). Breaches of this Reporting Standard are also breaches of that Act’s requirement to comply with prudential standards. Australian Accounting or Auditing Standards are relevant by cross-reference: the annual audit must ensure consistency with the insurer’s statutory financial accounts (prepared under Australian Accounting Standards) and faithful application of the capital standards. The auditor must be a registered company auditor under the Corporations Act 2001 or equivalent. The standard also interacts with competition and consumer law indirectly. The ORC data feeds into capital adequacy, which affects pricing. An insurer with a higher ORC may need to charge higher premiums to maintain solvency, which could affect its competitive position in the private health insurance market. However, APRA does not set premiums; that is market-driven. The standard does not preempt state or territory laws because prudential regulation is a Commonwealth matter. There is no inconsistency with the Private Health Insurance Act 2007 (which governs registration and benefit rules) - the two regimes are complementary.

The source text does not contain any amendment history or table of amendments. It is a standalone Reporting Standard made under FSCODA, and its effective date is for reporting periods ending on or after 1 July 2023. There is no indication of whether this is a new instrument replacing an earlier version, or a first edition. In the absence of any textual history, the analyst must assume this is the version currently in force, with no known amendments. APRA may issue amending reporting standards from time to time, which would be published on the Federal Register of Legislation. The standard itself contains a cross-reference (paragraph 18) that references to other instruments are to the version in force from time to time - but that does not self-amend. If APRA wishes to change the data fields, due dates, or definitions, it would need to remake or vary this standard under section 13 of FSCODA. The variation power in paragraph 16 allows APRA to vary reporting requirements for a particular insurer by notice in writing, which is a targeted amendment rather than a global one. Global amendments would require a formal legislative instrument. Practitioners should check the Federal Register for any subsequent instruments that may have replaced or varied this standard. The standard’s commencement date (1 July 2023) aligns with the start of the 2023-24 financial year and the quarter ending 30 September 2023 (the first due date 28 October 2023). Prior to that date, insurers would have reported under a different regime, possibly an earlier version of the ORC reporting standard.

The source text contains no reference to any litigation involving this Reporting Standard. As a subordinate legislative instrument governing data submission, it is unlikely to have been litigated in its own right. The underlying capital standards (HPS 118) or valuation standards (HPS 340) are more likely to generate disputes if APRA imposes additional capital requirements based on the data. Any litigation would typically be an appeal against an APRA decision (e.g., a direction to hold extra capital) rather than a direct challenge to the Reporting Standard’s validity. The Administrative Appeals Tribunal (now the Administrative Review Tribunal) and the Federal Court have jurisdiction to review APRA decisions under the Private Health Insurance (Prudential Supervision) Act 2015. To date, there is no publicly reported case specifically concerning the ORC reporting obligations for private health insurers under this standard. The standard is a data collection tool, so challenges are more likely to arise from its application (e.g., an insurer disputing that a particular item is required, or that APRA’s power to vary periods is exercised unreasonably) than from the instrument’s text. Because the standard is made under FSCODA, which itself has rarely been litigated beyond procedural matters, the litigation history is essentially nil. This may change if APRA imposes a penalty for non-compliance or if an insurer challenges a variation notice. For now, the analyst must report that no litigation history is disclosed in the source.

Several traps exist for the unwary. Gross of reinsurance requirement: The instructions explicitly state “report all items gross of any associated outwards reinsurance expense.” Many insurers may instinctively report net of ceded premium or recoveries, especially if their general ledger systems are configured for net reporting. This must be overridden. The accrued premium figure is already inflated by not deducting reinsurance, which increases the ORC inputs. Due date falls on non-business day: The note in paragraph 9 states that if the due date falls on a day other than a usual business day, the insurer is nonetheless required to submit no later than that date. There is no automatic extension to the next business day. This is strict - the insurer must ensure its submission system can handle weekends and public holidays. Quarterly deadline is only 28 calendar days: That is a tight turnaround, especially for the September quarter (which includes year-end close for some insurers). Data extraction, validation, board authorisation, and submission must be completed within 28 days. There is no grace period. APRA’s unilateral variation power: APRA may change reporting periods or requirements for a particular insurer without agreement. An insurer that receives a notice under paragraph 7 or 16 must comply with the new terms, even if they are more onerous. There is no mechanism for the insurer to challenge the variation before it takes effect (though judicial review is always available). Definition of “officer” is broader than expected: The term “officer” in the Act means any person who makes, or participates in making, decisions that affect the whole or a substantial part of the business, or who has the capacity to affect significantly the insurer’s financial standing. That can include senior managers who are not directors. An authorised submitter must be approved by someone who qualifies as an officer. If an insurer delegates to a junior employee without formal authorisation from an officer, the submission may be invalid. Annual audit must address prior qualified opinion: If the previous year’s auditor report was qualified, the current year report must state whether the auditor examined the issues and is satisfied the insurer has taken appropriate steps to rectify. This means the auditor cannot simply re-issue a qualified opinion without investigating the prior issues. That adds audit cost and risk. No static definitions: All cross-referenced instruments are “in force from time to time.” If HPS 001 changes the definition of accrued premium, this Reporting Standard automatically adopts the new definition. The insurer must monitor regulatory changes continuously. ORC is a derived item: The Reporting Standard says ORC is calculated per HPS 118, but does not give the formula. An insurer that does not have a correct implementation of HPS 118 (e.g., wrong weightings) will report an incorrect ORC. That error may only be caught during external audit, if at all, and APRA might not detect it until a capital adequacy issue arises. Duplicate row constraint: The instruction “any specific combination of values in the table must not appear on more than one row in that table when reported” means the insurer cannot have duplicate records. If the system inadvertently generates two identical rows, that is a data integrity error. The insurer must have deduplication controls.

To meet the requirements, an insurer should implement a structured compliance program. Step 1 - Understand the data architecture: Identify the three ORC input items plus the derived ORC. Ensure the definitions of “accrued premium” (gross of reinsurance) and “central estimate” (per HPS 340) are correctly interpreted. Train finance, actuarial, and compliance staff on the gross reporting rule. Step 2 - Build or adapt systems: The data must be extracted from premium and liability systems. For accrued premium, the system must capture the gross amount for rolling 12-month periods ending on the reporting date and 12 months prior. For central estimate, the actuarial valuation under HPS 340 must produce a number that is used in the ORC calculation. The ORC itself is computed per HPS 118; that computation should be automated or at least spreadsheet-based with version control. Step 3 - Internal review and authorisation: Paragraph 10 requires systems, processes and controls for internal review and authorisation. The board should approve a written policy that identifies the officer(s) responsible for authorising submissions, the sign-off chain, and the validation steps (e.g., comparing to prior quarter, checking arithmetic). A senior manager (for example, the CFO or Chief Actuary) should review the data before submission. The authorised submitter must be documented. Step 4 - Quarterly submission: For each calendar quarter, prepare the Table 1 data. Submit via APRA’s electronic system (typically by secure file upload or web form) within 28 calendar days after quarter end. Maintain evidence of submission (time stamp, confirmation number). If a quarter ends on a weekend or public holiday, the due date is still 28 days later - plan accordingly. Step 5 - Annual submission and audit: By 30 September each year, submit the annual ORC data (which is the same as the 30 June quarter data plus any additional fields if specified). Engage an external auditor to audit the annual data. The auditor’s report must be provided to APRA by 30 September. The auditor must confirm consistency with statutory financial accounts and faithful application of capital standards. If the previous year’s audit was qualified, the auditor must examine those issues and state satisfaction with rectification. Step 6 - Monitor APRA notices: APRA may issue notices varying reporting periods or requirements for the insurer. Designate a compliance officer to watch for such notices and escalate promptly. The insurer must comply from the date specified in the notice. Step 7 - Record keeping: Retain copies of all submissions, auditor reports, authorisation records, and internal review documentation for at least the period of limitation under FSCODA (up to 5 years). Ensure records include the version of HPS 001, HPS 118, and HPS 340 used at each reporting date, given the “in force from time to time” provision. Step 8 - Policy review: The board should annually review the systems, processes and controls to confirm they remain adequate, especially after any material change in the insurer’s business (e.g., new fund, merger, new reinsurance arrangement). The cost of compliance includes staff time, systems upgrades (potentially hundreds of thousands for a small insurer), external audit fees, and the opportunity cost of diverted management attention. There is no exemption for minimal ORC.