Audit arrangementsAudit arrangements

Audit arrangements

33. The insurer’s internal audit function must review any proposed outsourcing of a material business activity and regularly review and report to the Board or Board Audit Committee on compliance with the insurer’s outsourcing policy. Where APRA has exempted an insurer from having a dedicated internal audit function, or approved alternative arrangements under Prudential Standard GPS 510 Governance, APRA may also vary the requirements of this paragraph.

34. APRA may request the external auditor of the insurer, or an appropriate external expert, to provide an assessment of the risk management processes in place with respect to an arrangement to outsource a material business activity. This could cover areas such as IT systems, data security, internal control frameworks and business continuity plans. Such reports will be paid for by the insurer and must be made available to APRA.

‘Grandfathering’ of transition arrangements

35. Any transitional relief granted under Prudential Standard GPS 231 Outsourcing made on 29 September 2006 continues in effect until the date specified by APRA when granting the relief, or such other date as APRA may specify in writing.

Determinations made under previous GPS 231

36. An approval, determination, direction or requirement made by APRA under a provision specified in Column 1 of the following table that is in operation immediately prior to the commencement of this Prudential Standard is taken, on and from the effective date, to have been made under the provision of this Prudential Standard specified in the same row of Column 2 of the table.