This Standard consolidates a set of interlocking concepts that govern how auditing and assurance operate in the APRA-regulated general insurance sector and Level 2 insurance groups. The principal concepts, and their operational meanings in the document, are:

• Appointed Auditor and Group Auditor roles, scope and primacy: The Appointed Auditor must audit an insurer’s yearly statutory accounts and perform an annual review and testing of systems, processes and controls relevant to prudential compliance and reliable APRA reporting (Roles and responsibilities paras 15-17). For Level 2 insurance groups, the Group Auditor must conduct a limited assurance review of the group’s annual accounts and test the group’s systems and controls (Attachment B paras 4, 11). The Standard makes the Auditor the primary source of impartial advice to assist the Board and senior management (Objective and key requirements).

• Assurance levels and coverage: The Standard specifies the type of assurance engagement required for various outputs. Appointed Auditors must issue an audit-level certificate on yearly statutory accounts (Audit certificate and report paras 29-33), and base their annual report on at least a limited assurance engagement (para 35). For Level 2 groups, Group Auditors must perform a limited assurance review of the group annual accounts (Attachment B para 4, 11, 21-23). Attachment E details the required assurance level for many specific returns under the Collection of Data Act for Level 1 insurers, distinguishing Reasonable, Limited or None for particular returns.

• Mandatory submission and timing: Insurers must submit to APRA all certificates and reports prepared by their Appointed Auditor, typically on or before the day the yearly statutory accounts are submitted under reporting standards under the Collection of Data Act (Obligations paras 12, 18). Level 2 groups have analogous timing obligations (Attachment B para 8, 13). Special purpose review reports must be submitted within three months of commissioning, unless APRA grants an extension (Special purpose review paras 21; Attachment B para 16).

• Auditors’ access and information obligations: Insurers and Level 2 parent entities must ensure their Auditors have access to all relevant data, reports, staff, boards and, where reasonable, contractors, that the Auditor reasonably believes necessary to fulfil responsibilities (Obligations para 11; Attachment B para 7). Insurers must ensure Auditors are fully informed of applicable prudential requirements and given APRA-provided material that may assist the Auditor (Obligations para 10; Attachment B para 6).

• Non-routine reporting and protection: Appointed Auditors and Group Auditors must report to APRA on a non-routine basis where APRA requests information or where they consider information would assist APRA (Non-routine reporting paras 22, 17). An Auditor is not excused from providing information on grounds of self-incrimination, although statutory protections under the Act apply (Non-routine reporting para 26 and footnotes referring to the Act and s127B).

• Independence and fit and proper constraints: The Standard requires Group Auditors to satisfy fit and proper criteria under CPS 520 and independence standards under CPS 510, and prescribes that the Group Auditor cannot be the Group Actuary, the actuary of an entity within the group, their employee or partner, or otherwise conflicted (Attachment B paras 2-3 and footnotes).

• APRA discretion and adjustments: APRA may adjust or exclude a specific requirement for a regulated institution (para 37), and previous exercises of APRA discretion continue to have effect as corresponding powers in this Standard (para 38). APRA must exercise its powers in writing (Interpretation para 7).

• Financial Information Declaration: The Standard requires an annual declaration by the CEO and CFO that the financial information lodged with APRA is prepared in accordance with the Act, prudential standards, the Collection of Data Act and accounting and professional reporting requirements, subject to conflicts between accounting standards and legislative prudential requirements (Attachment D paras 1-3). Where CEO and CFO are the same person, an alternative signatory agreed with APRA is required (Attachment D para 1).

These concepts are implemented via prescriptive operational elements such as the content and form of certificates and reports, the list of matters an Appointed Auditor or Group Auditor must address in their reports (Attachment A and Attachment C), and the mapping of assurance levels to specific reporting returns (Attachment E). The Standard situates these concepts within the Insurance Act and other prudential standards, making them part of the statutory prudential compliance architecture (Authority para 1; Application para 3).

GPS 310 identifies and confines its primary subjects. The regulated population and other affected parties are set out explicitly:

• General insurers authorised under the Insurance Act 1973, referred to within the Standard as insurers (Application para 2(a); Obligations of an insurer para 8). This includes those entities required by section 39 of the Act to appoint an Appointed Auditor (footnote 1).

• Authorised non-operating holding companies (authorised NOHCs) where the Standard’s application is relevant, as referenced in the instrument’s preamble and Application para 2. The Schedule requires the Standard to be applied to authorised NOHCs as specified (instrument preamble; Application para 2).

• Parent entities of Level 2 insurance groups. When requirements apply to a Level 2 insurance group, the requirement is imposed on the parent entity of that group (Application para 2 second sentence; Attachment B introductory text). The Standard includes specific attachments dealing exclusively with Level 2 insurance groups, which are therefore directly affected.

• Subsidiaries of general insurers or authorised NOHCs that are parent entities of Level 2 insurance groups. The instrument’s commencement text explicitly includes a subsidiary of a general insurer or authorised NOHC where that subsidiary is a parent entity of a Level 2 insurance group (instrument preamble).

• Appointed Auditors and Group Auditors. The Standard sets out requirements that apply to all auditors appointed under the Act, and the Standard’s provisions are described as functions of an auditor for the purposes of paragraph 49J(1)(b) of the Act (Application para 3). This means auditors carrying out Appointed Auditor or Group Auditor roles are directly subject to the Standard’s operational duties and reporting expectations.

• Boards and senior management of the insurer or parent entity. While not direct addressees of every obligation, Boards must receive the Appointed Auditor’s certificate and report (Audit certificate and report paras 29, 34), and insurers must ensure the Auditor has access to Board and Board committees where required (Obligations para 11; Attachment B para 7).

• Chief Executive Officer and Chief Financial Officer. Attachment D requires the CEO and CFO to sign a Financial Information Declaration annually, thereby placing a discrete statutory attestation duty on these officers (Attachment D para 1-3).

• External contractors and staff. Insurers must take reasonable steps to ensure the Appointed Auditor has access to contractors of the insurer where the Auditor reasonably believes contractor access is necessary (Obligations para 11). Similarly, Level 2 parent entities must ensure Group Auditors have access to staff, reports and boards across the group (Attachment B para 7).

• Audit firms and engagement counterparts. The Standard restricts who may act as Group Auditor in a Level 2 group context, including fit and proper and independence constraints under CPS 520 and CPS 510 (Attachment B paras 1-3 and footnotes). Contracts engaging Group Auditors must include terms requiring performance of specified tasks under the Standard (Attachment B para 24).

Geographic and organisational scope. The Standard applies to the Australian regulatory regime for general insurers and Level 2 insurance groups. It is framed to operate alongside reporting standards under the Collection of Data Act and other APRA prudential standards (Application para 2; Authority para 1). For Level 2 groups, the Standard defines the group-level reporting and review responsibilities that are imposed on the parent entity (Attachment B paras 1, 5, 6).

Who does not carry an audit obligation under this Standard. The Standard permits APRA to exempt an insurer from the requirement to appoint an Appointed Auditor under the Act (Obligations para 9 and footnote 2). That statutory exemption power remains an avenue for APRA to reduce direct impact on particular low-risk or otherwise qualifying entities, although the instrument itself does not set exemption criteria.

In sum, the Standard directly affects insurers, their boards and senior officers, appointed auditors and group auditors, parent entities of Level 2 groups, and audit firms engaged to perform these functions. The practical reach includes contractors and any entity within a Level 2 group from which the Group Auditor may require information. Relevant paragraphs include Application paras 2-5, Obligations paras 8-13, Attachment B paras 1-9.

This section sets out the principal positive duties and procedural rights created or clarified by GPS 310, with textual references.

Insurer duties

• Appoint an Appointed Auditor where required under the Act, unless APRA grants an exemption (Obligations paras 8-9; footnotes 1-2). The underlying statutory reference is section 39 of the Act (footnote 1).

• Make arrangements necessary to enable the Appointed Auditor to undertake functions required by the Act and prudential standards, including ensuring the Auditor is fully informed of applicable prudential requirements, provided with APRA material that may assist, and given information requested by the Auditor (Obligations para 10).

• Ensure Appointed Auditor access to all relevant data, information, reports, staff and, as reasonable, contractors, including access to the insurer’s Board and Board committees (Obligations para 11).

• Submit to APRA all certificates and reports prepared by the Appointed Auditor. Generally these must be submitted on or before the day the insurer’s yearly statutory accounts are submitted under the Collection of Data Act reporting standards, with special purpose review reports submitted within APRA-specified timing (Obligations para 12; Special purpose review para 21).

• Provide to APRA an annual Financial Information Declaration signed by the CEO and CFO stating that financial information lodged with APRA is prepared consistently and fairly, subject to making appropriate enquiries (Attachment D paras 1-3).

Appointed Auditor duties and rights

• Audit the insurer’s yearly statutory accounts and provide a certificate in respect of those accounts, addressed to the Board and giving an opinion on whether the yearly statutory accounts present a true and fair view in accordance with the Act, prudential standards and reporting standards, and Australian Accounting Standards to the extent not inconsistent (Roles and responsibilities paras 15, Audit certificate and report paras 29-33).

• Perform an annual review, testing the insurer’s systems, processes and controls designed to address compliance with prudential requirements and to enable reliable reporting to APRA, and provide a report to the insurer addressing specified matters (Roles and responsibilities paras 16-17; Attachment A).

• Base the annual report on at least a limited assurance engagement and have regard to AUASB professional standards and guidance insofar as they do not conflict with this Prudential Standard (Audit certificate and report paras 31, 35).

• Undertake special purpose reviews when APRA specifies matters in writing, and submit the special purpose review report to APRA and the insurer within three months of commissioning unless APRA extends time in writing (Special purpose review paras 19-21).

• Retain working papers and documentation for seven years after the date of the report or certificate, to enable compliance with any APRA requests for information or documents (Non-routine reporting para 23; footnote referring to Corporations Act s307B).

• Report to APRA on a non-routine basis where APRA requests information or where the Auditor has information that would assist APRA in performing its functions, including where the Auditor has reasonable grounds to believe policyholder interests may be materially prejudiced when considering aggregated deficiencies (Non-routine reporting paras 22, 24; footnotes to Act provisions).

• In most cases, notify the insurer about matters reported to APRA, except where doing so would jeopardise policyholder interests or where there is mistrust between Auditor and the Board or senior management (Non-routine reporting para 25).

Group Auditor duties

• For Level 2 insurance groups, the Group Auditor must be appointed by the parent entity and be either the Appointed Auditor of the parent insurer, the Appointed Auditor of an APRA-authorised insurer within the group, or a responsible auditor of the parent entity where it is an authorised NOHC (Attachment B para 1).

• Meet fit and proper criteria under CPS 520 and independence requirements under CPS 510, and avoid specified conflicts such as acting as Group Actuary or being an employee or partner of the Group Actuary (Attachment B paras 2-3 and footnotes).

• Conduct a limited assurance review of the group’s annual accounts and provide a limited assurance report to the parent entity board addressing the matters in Attachment C, and lodge the report with APRA in accordance with the timing rules (Attachment B paras 4, 11, 21-23).

• Perform special purpose reviews when APRA specifies, and submit reports within three months unless APRA extends time in writing (Attachment B paras 14-16).

APRA powers and rights

• APRA can specify in writing matters for a special purpose review and may advise an alternative professional standard if the AUASB standards are considered inappropriate for the review purpose (Special purpose review para 20).

• APRA may require an Appointed Auditor or Group Auditor to provide information or produce books, accounts or documents to assist APRA in performing its functions, and may meet bilaterally with the Auditor (Non-routine reporting paras 22, 23; Meetings paras 27-28).

• APRA may adjust or exclude specific requirements in relation to a regulated institution (para 37), and previous exercises of APRA discretion continue to have effect under the new Standard (para 38).

Procedural and content requirements

• Certificates must be addressed to the Board and specify whether the yearly statutory accounts present a true and fair view, and must be qualified with reasons if compliance is prevented by matters beyond the Auditor’s control (Audit certificate and report paras 29-33).

• Appointed Auditor and Group Auditor reports must address specified matters laid out in Attachment A (insurers) and Attachment C (Level 2 groups), including systems and controls for actuarial data integrity, compliance with RMS and ReMS, and matters likely to adversely affect policyholders (Attachment A and C).

• Contracts engaging Group Auditors must include terms requiring performance of the tasks or services set out in the Standard (Attachment B para 24).

Rights and protections

• Auditors are subject to statutory protections under the Act when supplying information to APRA, including protection under section 127B of the Act referenced in the Standard (Non-routine reporting para 26 and footnote 21).

• The Standard permits bilateral meetings between APRA and an insurer’s Auditor, enabling direct communication channels where either party considers it necessary (Meetings paras 27-28).

In sum, the Standard tightly integrates statutory auditing obligations with prudential assurance, gives APRA routes to commission further reviews and obtain documentation, and places documentary and attestation responsibilities on insurer executives. See Obligations paras 8-13, Roles and responsibilities paras 14-18, Audit certificate and report paras 29-36, Attachments A-D.

GPS 310 itself primarily sets prudential obligations and reporting rules; it operates within the enforcement architecture of the Insurance Act 1973 and related legislation. The Standard references several statutory provisions that create APRA’s powers to require information, to receive reports and to take regulatory action when duties are not fulfilled. This section sets out the enforcement mechanisms and practical compliance consequences that the Standard invokes, with textual references.

APRA’s statutory information and compulsion powers

• The Standard cross-references section 49 of the Act and related provisions, under which APRA may require an Appointed Auditor to provide information or produce books, accounts or documents if it will assist APRA in performing its functions (Non-routine reporting para 23; footnote 14 referring to section 49 of the Act). This creates an enforceable right for APRA to compel documents from auditors.

• Where Appointed Auditors have information that could assist APRA, or where APRA explicitly requests information, auditors must report to APRA on a non-routine basis (Non-routine reporting para 22; footnote 13). The Standard states that auditors are not excused from such requests on grounds of self-incrimination, subject to statutory protections (para 26; footnote 20 referring to subsection 38F(1) and footnote 21 referring to section 127B of the Act).

Retention and documentary obligations

• Appointed Auditors and Group Auditors must retain working papers and documentation for seven years after the date of the report or certificate, as required under the Corporations Act 2001 (Non-routine reporting para 23; footnote 15 referencing Corporations Act s307B). Failure to retain could expose auditors or institutions to statutory consequences under Corporations Act provisions where retention is enforced.

APRA oversight and discretionary relief

• APRA may specify matters to be covered in special purpose reviews and may require alternative standards to be used for those reviews when AUASB standards are inappropriate to the purpose of the review (Special purpose review para 20). This gives APRA discretion to shape the scope of reviews.

• APRA may adjust or exclude a specific requirement in the Prudential Standard in relation to a regulated institution (para 37). The ability to adjust or exclude may be exercised in writing (Interpretation para 7). This discretion can affect the practical enforcement posture applied to individual regulated institutions.

Administrative timetables and compliance triggers

• Failure to provide certificates and reports to APRA by the day the insurer’s yearly statutory accounts are submitted, or within the specified time for special purpose reviews, will place the insurer outside the Standard’s timing requirements (Obligations para 12; Special purpose review para 21; Attachment B para 8). APRA can use such omissions as evidence of non-compliance and invoke powers under the Act to require remediation or to take regulatory action.

Protections and legal intersections

• The Standard recognises statutory protections for auditors who supply information to APRA, including reference to section 127B of the Act (Non-routine reporting para 26; footnote 21). The Auditor is not excused from providing information on grounds of self-incrimination or potential penalty, but protections exist to limit downstream prosecution in relation to compelled disclosures.

• The Standard expressly requires auditors to have regard to AUASB professional standards to the extent not inconsistent with the Prudential Standard (Audit certificate and report para 31; para 35). That cross-reference means enforcement may consider whether an auditor followed relevant professional standards, bearing on professional liability and potential disciplinary action by professional bodies.

Practical enforcement levers available to APRA under the Act

• The Prudential Standard is made under the Act and is part of APRA’s prudential framework. APRA’s enforcement options under the Act and related law include directions, enforceable undertakings, restrictions on business activities, and in more significant cases, actions affecting licences or seeking civil penalties where the Act provides. While GPS 310 does not itself list civil or criminal penalties, non-compliance with obligations under prudential standards can trigger regulatory responses under the Act’s enforcement regime, as reflected in the cross-references to the Act’s reporting and information provisions (see Authority para 1 and footnotes to relevant Act sections).

Costs and allocation of financial burden

• The Standard explicitly allocates the cost of special purpose reviews to the insurer or Level 2 group (Special purpose review para 21; Attachment B para 16). This creates a direct financial enforcement mechanism where APRA can require additional scrutiny and the regulated entity must pay.

Summarised enforcement picture

• APRA’s enforcement framework for GPS 310 relies on existing statutory powers to require documents and reports from auditors and regulated entities, the requirement for insurers to lodge certificates and Financial Information Declarations, documentary retention obligations, and APRA’s discretion to adjust or exempt requirements where appropriate. Non-compliance with these obligations will place the insurer or group within APRA’s statutory enforcement toolkit under the Insurance Act and related law. Specific references for these enforcement touchpoints include Non-routine reporting paras 22-26, Interpretation para 7, Adjustments and exclusions para 37, and Attachment D para 3.

GPS 310 is framed to operate within and alongside several statutory and prudential instruments. The Standard repeatedly cross-references the Insurance Act 1973, the Financial Sector (Collection of Data) Act 2001, the Corporations Act 2001 and other APRA prudential standards and professional auditing frameworks. The main interactions and cross-references are as follows.

Insurance Act 1973

• GPS 310 is made under section 32 of the Insurance Act and includes a determination under subsection 7(1) of the Act (Authority para 1). Multiple duties in the Standard are tied to Act provisions, for example the appointment of Appointed Auditors is required by section 39 of the Act (Obligations para 8; footnote 1), and the Standard states certain requirements are functions of an auditor for the purposes of paragraph 49J(1)(b) of the Act (Application para 3; footnote references through the document).

• The Standard relies on the Act for its non-routine reporting mechanics, referencing sections 49, 49A and 49B for auditor reporting duties (Non-routine reporting para 22; footnote 13), and section 49L for the requirement that insurers submit certificates and reports to APRA (Obligations para 12; footnotes 4, 11).

• The protections available to auditors when supplying information to APRA are referenced to section 127B and other Act provisions in footnotes (Non-routine reporting para 26; footnote 21).

Financial Sector (Collection of Data) Act 2001

• The Standard ties the lodgement timing for auditor certificates and reports to the timing for submission of yearly statutory accounts as required by reporting standards made under the Collection of Data Act (Obligations para 12(a); Audit certificate and report paras 18, 29-34). The Standard therefore depends on the Collection of Data Act’s reporting standards for the timing and scope of financial reporting obligations.

Corporations Act 2001

• The Standard requires auditors to retain working papers and documentation for seven years after the date of the report or certificate, "as required under the Corporations Act 2001" (Non-routine reporting para 23; footnote 15 referencing Corporations Act s307B). This aligns auditor retention obligations under GPS 310 with existing Corporations Act documentary retention requirements, creating an overlap with corporate law enforcement and professional obligations.

APRA prudential standards (CPS series and GPS 001)

• GPS 310 references other APRA prudential standards. For example, definitions of Level 2 insurance group and parent entity are taken from Prudential Standard GPS 001 Definitions (Application para 2; Interpretation para 6; Attachment B). Fit and proper criteria for auditors are governed by CPS 520, and auditor independence by CPS 510 (Attachment B paras 2-3 and footnotes 28-29). The Standard also cross-references CPS 320 in relation to the continuation of previous APRA discretions on actuarial matters (para 38; footnote 24).

AUASB professional standards and guidance

• The Standard repeatedly requires that Appointed Auditors and Group Auditors have regard to relevant professional standards and guidance issued by the Auditing and Assurance Standards Board (AUASB), except where those standards are inconsistent with GPS 310 (Special purpose review para 20; Audit certificate and report paras 31, 35; Attachment B para 22). Thus, AUASB standards constitute a backstop professional framework, but APRA may direct alternative approaches where it considers AUASB standards inappropriate for a given special purpose review.

Reporting standards and reporting documents

• Attachment E sets out the assurance required for a list of returns under reporting standards made under the Collection of Data Act, including where the level of assurance is Reasonable, Limited or None for particular returns. Footnote 36 notes that an Insurance Exemption Determination of 2023 exempts certain returns from audit opinion for insurers, which modifies the practical application of GPS 310 to certain reporting lines (Attachment E and footnote 36).

Legal protections and compulsion

• The Standard indicates that auditors are not excused from providing information to APRA on the basis that doing so would incriminate them or make them liable to a penalty (Non-routine reporting para 26), but also references statutory protections under the Act that apply when auditors comply with such requests (footnote 21). This interacts with general legal protections against self-incrimination and the statutory privilege frameworks in corporate and regulatory law.

Practical interplay and potential friction points

• The Standard’s instruction that certificates must state whether yearly statutory accounts present a true and fair view in accordance with the Act and prudential standards, and "to the extent" that Australian Accounting Standards do not conflict with those requirements, creates an ordering of legal norms where prudential and legislative requirements may be prioritised over Australian Accounting Standards where conflicts exist (Audit certificate and report para 32). This could create situations where auditors, accountants and directors must reconcile differing legal and accounting obligations.

• The Standard’s retention requirement references the Corporations Act retention rules; failure to conform to either regime may expose parties to enforcement under both APRA and corporate law authorities.

• APRA’s discretion to adjust or exclude a requirement under GPS 310 (para 37) and to continue previous discretions (para 38) means that historical regulatory decisions and tailored arrangements under earlier versions of the Standard are intended to survive the transition, subject to alignment with other prudential standards such as CPS 320 (para 38; footnote 24).

In short, GPS 310 integrates tightly with the Insurance Act’s auditor duties, the Collection of Data Act reporting regime, Corporations Act retention obligations, AUASB professional standards and APRA’s broader prudential rulebook. Practitioners should map GPS 310 obligations against these statutes and standards, with particular attention to timing interactions, documentary retention, conflicts between accounting standards and prudential requirements, and APRA discretions permitted in writing.

The instrument text provides a limited, but clear, amendment history. The key mechanical change is the revocation and replacement of an existing APRA prudential determination.

• Revocation of previous instrument: The instrument revokes Insurance (prudential standard) determination No. 9 of 2019, including Prudential Standard GPS 310 Audit and Related Matters that were made under that previous determination (instrument preamble). The revocation is effected under subsection 32(4) of the Insurance Act 1973.

• Determination of new Standard: Under subsection 32(1) of the Act, the delegate of APRA determines a new Prudential Standard GPS 310 Audit and Related Matters, in the form set out in the Schedule, which applies to the entities specified (instrument preamble; Schedule start).

• Commencement date: The instrument commences on 1 October 2024, which is the date from which regulated institutions and auditors must comply with the new text (instrument preamble; Application para 4).

• Continuity with prior discretions: The Standard provides for continuity by expressly stating that exercises of APRA’s discretion under previous versions of the Prudential Standard continue to have effect as corresponding powers under this Prudential Standard, with a footnote indicating that prior discretions with respect to actuarial matters are captured in CPS 320 Actuarial and Related Matters (para 38; footnote 24). This preserves regulatory arrangements and creates a predictable transition for entities that had APRA waivers, approvals or directions under the previous Standard.

• Cross-references to other Standards and Acts: The Standard’s footnotes and attachments indicate reliance on, or interaction with, other standards and instruments. For example, Attachment E footnote 36 references Insurance Exemption Determination no.1 of 2023 which affects audit opinions on certain returns. The Standard’s adoption of AUASB standards subject to non-conflict with GPS 310 suggests that subsequent AUASB amendments could be adopted by auditors to the extent consistent with the Standard (Audit certificate and report paras 31, 35).

• No other historical amendments recorded in the instrument: The text of the instrument does not list prior amendment dates or a history of prior amendments beyond the revocation of the 2019 determination and the preservation of previous APRA discretion. There are no transitional provisions set out beyond the commencement date and the statement that prior discretions continue to have effect (para 38). Practitioners should therefore treat 1 October 2024 as the effective date for the new obligations and check APRA registers for any standing exemptions or discretions recorded under the previous Standard that will continue.

• Interaction with prior Standard: Paragraph 38 explicitly addresses the application of previous exercises of discretion, which implies that existing waivers, approvals or directions granted under the 2019 Standard should remain effective, rather than being automatically terminated on revocation and replacement. Where questions arise about the scope or terms of a previous discretion, the Standard points entities to CPS 320 for actuarial matters and otherwise expects APRA to confirm in writing.

For users tracking compliance obligations, the practical implication is to treat the new GPS 310 as replacing the 2019 text from the stated commencement date, to map pre-existing discretions and waivers that APRA granted to confirm continuity, and to ensure that systems and contractual arrangements with auditors are updated ahead of 1 October 2024. See instrument preamble, Application paras 4-5 and para 38.

The text provided for GPS 310 contains no judicial decisions, proceedings or case citations. The Standard itself names no cases and does not summarise any litigation related to auditor duties under the Insurance Act or prior versions of the Standard.

Because the instrument cross-references statutory duties under the Act and principles in the Corporations Act and AUASB standards, potential litigation could arise in practice in scenarios consistent with those statutory provisions, for example disputes over:

• Whether an auditor complied with professional standards in preparing a certificate or report that APRA then relies on, given the Standard’s instruction that auditors have regard to AUASB standards to the extent they are not inconsistent with GPS 310 (Audit certificate and report paras 31, 35). Any litigation would therefore involve the intersection of professional negligence, contractual duties and statutory obligations, but no cases are cited in the Standard itself.

• Whether APRA’s exercise of discretion to adjust or exclude a requirement for an institution was made correctly in accordance with the Act, given that para 37 allows APRA to adjust or exclude specific requirements. The Standard requires discretionary acts to be in writing (Interpretation para 7), which affects judicial review and administrative law considerations, but the Standard names no judicial review outcomes.

• Disputes about whether auditors’ compelled disclosures to APRA were protected under the Act, since the Standard states auditors are not excused on self-incrimination grounds but that statutory protections exist (Non-routine reporting para 26 and footnote 21). Again, the instrument does not reference litigation.

Practical note for practitioners

• Because the Standard is instrument-based and sits within the Act’s regulatory regime, litigation is most likely to involve interactions with statutory enforcement under the Insurance Act, judicial review of APRA discretion, or professional liability claims against auditors and insurer officers, where the content and timing of certificates, retention of working papers and disclosures to APRA are contested. None of these potential litigation avenues are discussed or exemplified in the Standard text.

• If legal disputes arise in the future about interpretation or application of GPS 310, the starting points for litigation will be the Act’s provisions that the Standard cites, the written exercise of APRA’s discretions, the wording of certificates and reports, contract terms with auditors (noting Attachment B para 24 requires Group Auditor contracts to include relevant terms), and alignment or inconsistency with AUASB standards.

Because the instrument itself contains no litigation history, practitioners should consult case law databases and APRA guidance or determinations to find any judicial decisions that later develop around GPS 310’s application after its commencement on 1 October 2024.

This section flags provisions and practical traps to monitor closely when implementing GPS 310. Each item is grounded in the Standard’s text.

Timing bottlenecks and tight synchronous submissions

• Certificates and reports must generally be submitted to APRA on or before the day the insurer’s yearly statutory accounts are submitted under Collection of Data Act reporting standards (Obligations para 12(a); Audit certificate and report para 18). This creates a single-day deadline where delays in delivering the auditor’s certificate or report could prevent timely lodgement and expose the insurer to APRA scrutiny.

• Special purpose review reports must be submitted to APRA and the insurer within three months of commissioning unless APRA extends time in writing (Special purpose review para 21; Attachment B para 16). The three-month window is short for complex, in-depth reviews.

Assurance level mismatches and excluded items

• Attachment E identifies several returns with "NONE" assurance required for insurers, such as GRS_400.0 Statement of Risk by Country, certain GRS_420.0 and GRS_460 series returns, but flags that Level 2 Group Auditors must provide limited assurance on group returns (Attachment E; Attachment B paras 4 and 21-23). Practitioners must map which returns need assurance at the insurer level versus the group level. Footnote 36 notes an Insurance Exemption Determination of 2023 that affects whether insurers require an audit opinion on certain returns, which further complicates assurance coverage.

Board and executive attestations

• The Financial Information Declaration must be signed by both the CEO and CFO, and filed by the time the yearly statutory accounts are submitted (Attachment D paras 1-3). Where CEO and CFO are the same person, GPS 310 requires an additional signatory to be agreed with APRA (Attachment D para 1). This creates a potential procedural snag if internal signatory arrangements are not pre-cleared with APRA.

Access expectations and contractor access

• Insurers must take all reasonable steps to ensure Appointed Auditors have access to contractors of the insurer, where the Auditor reasonably believes contractor access is necessary (Obligations para 11). Contracts with third-party service providers and outsourcing arrangements therefore need clauses allowing auditor access, and operational teams must be prepared to provide access in a timely fashion.

Non-routine reporting and notification conflicts

• An Appointed Auditor must report to APRA where they have reasonable grounds to believe policyholder interests may be materially prejudiced, taking into account aggregated deficiencies, not single matters in isolation (Non-routine reporting para 24). In most cases matters reported to APRA should also be reported to the insurer; however, the Auditor must not notify the insurer if doing so would jeopardise policyholder interests or where there is mistrust between Auditor and Board (Non-routine reporting para 25). This dual-path reporting regime means auditors face judgment calls on whether to notify the insurer, and firms must be prepared for instances where the auditor reports to APRA but withholds notice to the insurer.

Retention obligations and cross-jurisdictional documentation

• Auditors must retain working papers for seven years in line with the Corporations Act (Non-routine reporting para 23; footnote 15). For groups with entities in other jurisdictions, retention policies must reconcile local retention regimes and cross-border data access laws, even though GPS 310 focuses on domestic retention length.

Independence and role prohibitions for Group Auditors

• The Group Auditor of a Level 2 insurance group cannot be the Group Actuary, an actuary of an entity within the group, an employee or director of a person who is the Group Actuary, or a partner of such a person (Attachment B para 2). Further independence requirements reference CPS 510 and CPS 520. Group appointment decisions must therefore consider these prohibitions, and governance arrangements must avoid overlaps that would disqualify proposed Group Auditors.

Contractual embedding of Standard obligations

• Attachment B para 24 requires that contracts engaging a Group Auditor include a term requiring the Group Auditor to perform the tasks or services required by the Prudential Standard. Failure to include explicit contractual obligations could impede APRA-required scope or cause disputes about fee and scope, particularly for special purpose reviews whose cost is borne by the insurer or group (Special purpose review para 21; Attachment B para 16).

Conflicts between accounting standards and prudential requirements

• The auditor’s certificate must state whether yearly statutory accounts present a true and fair view in accordance with the Act and prudential standards, and to the extent they do not conflict, Australian Accounting Standards (Audit certificate and report para 32). Practitioners must be alert to situations where Australian Accounting Standards and APRA prudential requirements diverge and prepare reasoning and documentation.

APRA discretion and variability

• APRA may adjust or exclude specific requirements in relation to a regulated institution (para 37). While this provides flexibility, it can also create uncertainty for firms that expect standardised application across entities. The Standard requires exercises of power in writing (Interpretation para 7), so firms should obtain written confirmation of any adjustments.

Practical access to boards and committees

• Auditors must have access to a firm’s Board and Board committees where reasonably believed necessary (Obligations para 11; Attachment B para 7). Boards must therefore be ready to accommodate auditor interaction and to ensure auditor attendance is possible within the timing constraints for reports.

In short, the principal gotchas are timing synchronisation, mapping assurance levels across returns and organisational levels, contractual and access clauses for contractors and Group Auditors, the CEO/CFO attestation mechanics, and the interaction of prudential obligations with AUASB standards and accounting rules. Each of these is specified directly in the Standard, principally in Obligations paras 10-12, Audit certificate and report paras 29-36, Attachment A-D, and Attachment E.

This section gives structured, source-grounded steps and a practical checklist for insurers, Level 2 parent entities, Appointed Auditors and Group Auditors to implement the Standard and align with GPS 310 obligations. Each recommendation references the relevant paragraphs or attachments.

1. Confirm applicability and appointment

• Confirm whether the entity is an insurer, authorised NOHC, or a parent entity of a Level 2 insurance group, because requirements for Level 2 groups are imposed on the parent entity (Application paras 2-5; Attachment B intro).

• If required, appoint or confirm an Appointed Auditor in accordance with the Act, unless an APRA exemption exists (Obligations paras 8-9). For Level 2 groups appoint a Group Auditor in accordance with Attachment B para 1 and ensure the Group Auditor is either an Appointed Auditor within the group or a responsible auditor where applicable.

2. Update engagement letters and contracts

• Ensure audit engagement letters and contracts with the Appointed Auditor and, for Level 2 groups, the Group Auditor include explicit terms requiring performance of the tasks and services in GPS 310, including delivering specified reports on the required timelines (Appointed Auditor duties paras 15-18; Attachment B para 24).

• For contracts with third-party service providers and contractors, include clauses enabling the Appointed Auditor or Group Auditor to access necessary data and personnel, in line with the obligation to take reasonable steps to ensure contractor access (Obligations para 11; Attachment B para 7).

3. Prepare internal arrangements to enable auditor functions

• Establish a documented process to provide auditors with APRA-provided materials and other requested information, ensure auditors are fully informed about applicable prudential requirements, and keep a record of these communications (Obligations para 10; Attachment B para 6).

• Implement a governance schedule that facilitates auditor access to the Board and Board committees when required. Make available a designated liaison contact within senior management for audit coordination (Obligations para 11; Meetings paras 27-28).

4. Map assurance coverage and reporting returns

• Use Attachment E to map which Level 1 returns require Reasonable, Limited or None assurance, and ensure the Appointed Auditor is engaged to provide the required assurance levels for each return where applicable (Attachment E). For Level 2 group reporting, ensure the Group Auditor’s limited assurance review scope covers the group returns required under the Collection of Data Act (Attachment B paras 4, 11; Attachment C).

• Note the exclusion in footnote 29 which means certain reporting documents (GRS 460.0_G and GRS 460.1_G) are excluded from the group annual accounts for purposes of the limited assurance review. Confirm the practical impact with APRA if these items are material.

5. Align auditing work with AUASB standards and document exceptions

• Require auditors to have regard to AUASB professional standards and guidance notes to the extent they are not inconsistent with GPS 310 (Audit certificate and report paras 31, 35; Special purpose review para 20). Document any instances where professional standards are not applied because of inconsistency with GPS 310, and obtain APRA advice in writing if APRA specifies an alternative standard for special purpose reviews (Special purpose review para 20).

6. Implement internal controls to support auditor testing

• Maintain systems, procedures and controls that address compliance with prudential requirements and that enable the production of reliable financial data for APRA returns, including actuarial data integrity controls. The auditor will test these controls and report on their adequacy (Roles and responsibilities paras 16-17; Attachment A and Attachment C).

• Maintain up-to-date documentation of the Risk Management Strategy (RMS) and Reinsurance Management Strategy (ReMS), and record compliance evidence because auditors must report on compliance with RMS and ReMS (Attachment A para d; Attachment C para e).

7. Prepare for certificates, reports, and timing

• Schedule the Appointed Auditor to provide the statutory audit certificate and the annual report sufficiently in advance to allow lodgement to APRA on or before the day the yearly statutory accounts are submitted under the Collection of Data Act reporting standards (Obligations para 12; Audit certificate and report paras 18, 29, 34). Build contingency time for qualifications or further information requests.

• For Level 2 groups, schedule the Group Auditor’s limited assurance review report to be provided to the parent entity board and lodged with APRA by the day the group’s annual accounts are submitted (Attachment B paras 13, 21-23).

8. Prepare the Financial Information Declaration

• Ensure CEO and CFO complete and sign the Financial Information Declaration set out in Attachment D, attesting that financial information lodged with APRA is accurate and prepared in accordance with the Act and applicable standards, and that information provided to auditors and actuaries is accurate and complete (Attachment D paras 1-3).

• If the CEO and CFO are the same person, agree with APRA on an alternative second signatory well in advance of lodgement (Attachment D para 1).

9. Document retention and evidence trail

• Maintain and retain all audit working papers and related documentation for seven years after the date of the report or certificate to satisfy the Corporations Act 2001 retention requirement and to permit APRA access if requested (Non-routine reporting para 23; footnote 15).

• Keep a documented trail of APRA communications, APRA-specified discretions and any APRA approvals or waivers in writing, because APRA’s exercises of power and discretion must be in writing under the Standard (Interpretation para 7; para 38).

10. Prepare for special purpose reviews and costs

• Establish a process to respond promptly to APRA instructions for special purpose reviews. Recognise that APRA will specify the matters to be reviewed in writing, and that the cost of any special purpose review is to be borne by the insurer or Level 2 insurance group (Special purpose review paras 19-21; Attachment B paras 14-16).

• Ensure budgetary provision and contract terms with auditors cover the potential cost of special purpose reviews, including contingency for extensive or forensic-level work.

11. Ensure Auditor independence and fit and proper compliance

• For Level 2 group Group Auditors, ensure proposed appointees meet CPS 520 fit and proper criteria and CPS 510 independence requirements, and are not subject to the prohibitions in Attachment B para 2 (Attachment B paras 2-3 and footnotes 25-28).

• Where an auditor is an Appointed Auditor also serving as Group Auditor, ensure firm-level independence policies and engagement terms conform with CPS 510 and CPS 520.

12. Prepare internal escalation and reporting protocols

• Develop procedures for dealing with instances where auditors identify issues that may materially prejudice policyholder interests, and coordinate internal disclosure to the Board and senior management while respecting the auditor’s discretion not to notify the insurer where such notification would jeopardise policyholder interests (Non-routine reporting paras 24-25).

13. Review and update governance and outsourcing documentation

• Update outsourcing and service provider contracts to ensure auditors can obtain necessary information and access. Review the insurer’s RMS and ReMS documentation to ensure the auditor can test compliance and sign off accordingly (Attachment A and C).

14. Test readiness and coordinate cross-functional teams

• Conduct an internal readiness review ahead of the first reporting cycle under GPS 310 to ensure systems and reporting processes meet the Standard’s expectations. Include finance, actuarial, risk, compliance and legal teams, and the Appointed Auditor or Group Auditor in planning.

Practical checklist summary

• Confirm auditor appointments and exemptions (Obligations paras 8-9).
• Amend engagement letters and contracts to include GPS 310 tasks (Attachment B para 24).
• Ensure auditor access to data, staff, boards and contractors (Obligations para 11; Attachment B para 7).
• Map return assurance requirements using Attachment E and liaise with auditors (Attachment E).
• Schedule certificate/report delivery to meet Collection of Data Act submission day (Obligations para 12; Audit certificate and report para 18).
• Implement and document controls for actuarial data integrity and financial reporting (Attachment A and C).
• Prepare and obtain CEO/CFO Financial Information Declaration (Attachment D).
• Retain working papers seven years (Non-routine reporting para 23; footnote 15).
• Budget for special purpose reviews and include cost terms in contracts (Special purpose review paras 21; Attachment B para 16).
• Ensure Group Auditor meets independence and fit and proper requirements (Attachment B paras 2-3).

Following these steps will align operations with the Standard’s requirements and reduce the risk of timing, access and documentary compliance failures. For any discretionary relief, seek written confirmation from APRA (Interpretation para 7; para 37).