This Prudential Standard prescribes minimum requirements for the appointment, responsibilities, reporting and operational interaction of auditors engaged by registrable superannuation entity licensees (RSE licensees). It is made under section 34C of the Superannuation Industry (Supervision) Act 1993 (SIS Act) and commences on 30 June 2024 (paras 1-4). The Standard applies to all RSE licensees and expressly includes requirements that feed into the functions and duties of an RSE auditor for the purposes of s 35AC(3) of the SIS Act (paras 2-3).

Mechanically, the instrument requires each RSE licensee to:

• appoint an RSE auditor for each RSE within its business operations (para 8);
• enter a legally binding engagement contract that sets out the auditor’s roles and obligations, including compliance with Auditing and Assurance Standards Board (AUASB) standards and relevant statutory provisions (para 10);
• grant the RSE auditor access to all data, information, reports and staff reasonably necessary, including the Board, Board Audit Committee and internal auditors (para 12);
• ensure auditors meet fitness, propriety and independence requirements under SPS 520 and SPS 510 and are not disqualified under relevant SIS Act disqualification provisions (paras 13-14);
• obtain an annual auditor’s report for each RSE that meets specified assurance levels (reasonable or limited) against a defined set of reporting standards and legislative provisions (paras 15-22 and Attachments A and B);
• retain working papers and documentation for at least seven years and provide them to APRA on request (para 25);
• bear the costs of complying with the Standard and facilitate APRA meetings with auditors and other responsible persons (paras 26-27).

The Standard sets out the minimum content and assurance basis of the auditor’s report. Paragraph 22 requires the report to provide, as a minimum, reasonable assurance for specified reporting standards and legislative compliance (Attachment A and Attachment B), and limited assurance for a set of reporting standards, system and control effectiveness, data reliability, and compliance with the risk management framework required under Prudential Standard SPS 220 (para 22). Attachment A lists specific APRA reporting standards and the level of assurance required for each (for example SRS 114.1 Operational Risk Financial Requirement , reasonable assurance; SRS 533.0 Asset Allocation in relation to MySuper lifecycle options , limited assurance). Attachment B lists legislative provisions in the SIS Act, the Superannuation Industry (Supervision) Regulations and provisions of the Corporations Act and Regulations which must be addressed at reasonable assurance level where applicable.

APRA retains supervisory discretion. It may adjust or exclude specific requirements in relation to an individual or specified RSE licensees (para 6), and may require special purpose engagements on matters APRA specifies (paras 28-30). The Standard also addresses group arrangements for auditors, including allowing one auditor appointed by a group to act as RSE auditor provided the auditor meets the Standard and related prudential standards and, if applicable, Corporations Act requirements (para 9). There are specific rules on reporting for small APRA funds (SAFs) and for RSEs that have wound up or been transferred during the year of income (paras 16-18; Attachment A para 2).

In short, the Standard converts APRA’s supervisory expectations into binding engagement, access, assurance and reporting mechanics for RSE audits. It allocates costs to RSE licensees, requires specified audit output and retention, and embeds AUASB and prudential cross-references into audit engagements. The Standard also creates a pathway for APRA to require additional targeted auditor work and to vary requirements on a case by case basis.

The core concepts in the Standard are appointment and engagement, access and information rights, fitness and independence, assurance scope and level, reporting content and timing, retention and produce-on-demand of audit documentation, APRA discretion and special purpose engagements, and cost allocation.

Appointment and engagement: An RSE licensee must appoint an RSE auditor for each RSE (para 8). The engagement must be documented in a legally binding contract specifying the roles and responsibilities required by the Standard, mandatory adherence to AUASB standards and guidance, and cross-reference to the SIS Act and Corporations Act provisions as relevant (para 10).

Access and information rights: The RSE auditor must be given access to all data, information, reports and staff reasonably required to fulfil the audit role (para 12). This includes access to the Board, Board Audit Committee, internal auditors and any information APRA has provided to the RSE licensee, as required by the auditor (para 12).

Fitness and independence: The Standard ties auditor eligibility to existing prudential fit and proper requirements and disqualification tests. Individuals (and lead auditors) must not be disqualified under s 130D of the SIS Act and must meet eligibility criteria in SPS 520 and independence requirements in SPS 510 (para 13). Audit firms and audit companies must not be disqualified under s 130EA of the SIS Act and must meet SPS 510 independence requirements (para 14).

Assurance scope and level: Paragraph 22 defines two assurance buckets. Reasonable assurance is required for particular APRA reporting standards and statutory provisions identified in Attachments A and B (para 22(a)). Limited assurance is required for other reporting standards and for systems, procedures and internal controls designed to ensure compliance with prudential requirements, data reliability for APRA reporting, and the RSE licensee’s risk management framework under SPS 220 (para 22(b)). The Standard adopts AUASB definitions for reasonable and limited assurance (para 22 final sentence).

Reporting content and timing: The RSE auditor must provide an annual auditor’s report for each year of income for each RSE, covering the RSE’s whole year of income (paras 15, 17). Where the RSE is wound up during the year the report must cover the period up to wind-up and be completed no later than three months after the end of the year of income (para 18). RSE licensees, other than SAFs, may lodge the report with ASIC together with the s 319 Corporations Act report, or must lodge it with APRA within three months after the end of the year of income (para 16). SAFs must submit the report to APRA within three months (para 16).

Primary obligations fall on RSE licensees and the auditors they appoint. The Standard applies to all RSE licensees without exception in the text (para 2). It also sets requirements that apply directly to individual auditors, lead auditors, audit firms and audit companies engaged as RSE auditors (paras 10-14, 25).

RSE licensees: The licensee must appoint an RSE auditor for each RSE (para 8), ensure contracts meet specified terms (para 10), ensure auditors have access to information and governance bodies (para 12), ensure auditors satisfy fit and propriety and independence requirements (paras 13-14), ensure timely lodging of auditor’s reports with APRA or ASIC (para 16), and bear the cost of preparing and submitting required reports and facilitating APRA meetings (paras 26-27). RSE licensees that are part of a group must also manage group auditing arrangements and ensure clear delineation between group and RSE-specific matters where necessary (para 9 and para 21).

RSE auditors and audit firms: Individuals and lead auditors must not be disqualified under s 130D of the SIS Act, must meet SPS 520 criteria and be fit and proper under the licensee’s Fit and Proper Policy, and must satisfy auditor independence under SPS 510 (para 13). Audit firms and audit companies must not be disqualified under s 130EA and must meet SPS 510 independence (para 14). Auditors must comply with AUASB standards and guidance (para 10(b)), prepare the specified auditor’s report addressing the assurance buckets (para 22), exercise independent judgement (para 24), retain working papers for seven years (para 25) and modify opinions for material breaches (para 23, 31).

Boards and audit committees: The Standard requires RSE licensees to ensure auditors have access to the Board and Board Audit Committee (para 12). The Board receives the auditor’s report (paras 15, 30) and must manage any follow up. The Board is also obliged to be available for APRA-meeting facilitation when APRA requests it (para 27).

Internal auditors and other staff: Auditors must have access to internal auditors and staff as reasonably necessary (para 12). Internal auditors may be asked to attend meetings facilitated by the licensee at APRA’s request (para 27).

APRA and ASIC: APRA is the supervising regulator that both issues the Standard (para 1) and retains discretion to adjust or exclude requirements for particular RSE licensees (para 6), to require special purpose audit engagements (para 28), and to receive lodged reports (para 16, 30). ASIC is a potential recipient of the auditor’s report for RSE licensees other than SAFs, where the RSE licensee chooses to lodge the auditor’s report with ASIC together with the Corporations Act s 319 report (para 16). Attachment B links the auditing obligations to specific SIS Act provisions and Corporations Act/Regulations provisions which will affect entities that are subject to those provisions (Attachment B).

This section lists the principal duties imposed and the rights established by the Standard, with references.

Duties of RSE licensees

• Appointment: Appoint an RSE auditor for each RSE within the licensee’s business operations (para 8).
• Contracting: Ensure the terms of engagement are in a legally binding contract requiring the auditor to fulfil roles and responsibilities under the Standard, to comply with relevant AUASB standards, and to be referred to relevant SIS Act and Corporations Act provisions (para 10).
• Facilitation and cooperation: Use all reasonable endeavours to ensure the RSE auditor complies with the contract and assist the auditor in being fully informed of all prudential requirements applicable to the RSE licensee (para 11).
• Access: Ensure the RSE auditor has access to all data, information, reports and staff reasonably necessary, including access to the Board, Board Audit Committee, internal auditors and any information APRA has provided (para 12).
• Fitness and propriety: Ensure individuals and lead auditors are not disqualified under s 130D, that they satisfy SPS 520 criteria and the licensee’s Fit and Proper Policy, and meet SPS 510 independence requirements; ensure audit firms are not disqualified under s 130EA and meet SPS 510 independence (paras 13-14).
• Reporting and lodgement: Ensure the RSE auditor prepares the annual auditor’s report for each year of income and that reports are lodged with APRA within three months after year end (SAFs required; para 16); non-SAF licensees may instead lodge with ASIC together with s 319 reports or lodge with APRA within three months (para 16). Ensure separate reports for each RSE unless a single SAF report is used in accordance with para 20.
• Costs and meetings: Bear the costs of preparing and submitting reports required by the Standard and facilitate meetings requested by APRA with the auditor, internal auditor and group responsible persons where relevant (paras 26-27).
• Working papers retention: Implicitly must ensure auditor retains working papers for seven years, and that those papers can be produced to APRA on request (para 25).

Duties of RSE auditors

• Deliver reports that provide the specified reasonable assurance and limited assurance outcomes for reporting standards and legislative compliance identified in Attachments A and B and paragraph 22 (paras 22, Attachments).
• Modify opinions where breaches of the specified laws are material, using AUASB guidance to determine materiality (para 23).

The Prudential Standard itself does not create a standalone schedule of civil or criminal penalties within its text. Instead, it establishes mandatory operational and reporting obligations and situates those obligations within APRA’s supervisory architecture and within statutory obligations under the SIS Act and Corporations Act to which the Standard refers. The enforcement picture in the Standard is therefore composed of three main strands: APRA supervisory powers and discretion, audit opinion mechanisms, and documentary/meeting powers.

APRA supervisory discretion and directions: APRA is explicitly given power to adjust or exclude a specific requirement in this Standard for a particular RSE licensee or specified RSE licensees (para 6). APRA may also require special purpose engagements and specify the auditor and scope for those engagements (paras 28-30). Those features are supervisory tools. The Standard requires RSE licensees to contact APRA if they seek to rely on a previous exercise of APRA discretion in complying with the Standard (para 7). The Standard therefore contemplates APRA exercising discretion and requiring further work; it does not in this text specify the suite of statutory sanctions APRA may use for non-compliance with either the Standard or the underlying statutory obligations, but the Standard ties its requirements to legislative provisions that sit in the SIS Act and Corporations Act (paras 1-3; Attachment B).

Audit opinion as a signalling and enforcement mechanism: The Standard requires RSE auditors to modify their opinion in the auditor’s report for material breaches of the laws specified in paragraph 22 (para 23). For special purpose engagements commissioned by APRA an auditor must similarly modify the report for material breaches within the engagement scope (para 31). These obligations create a professional and public signalling mechanism: an auditor’s modified opinion may trigger supervisory actions, obligations on boards to remediate, reputational effects, and possible statutory follow-up by APRA or other enforcement agencies. The Standard requires auditors to prepare reports on the basis that APRA may rely upon them in performing its functions under the SIS Act and to exercise independent judgement (para 24). This embeds reliance by the regulator into the audit output.

Document retention and production: Auditors must retain working papers and other documentation for at least seven years after the end of the year of income (para 25). APRA may require the auditor to provide the working papers and other documentation to APRA (para 25). The ability to compel working papers is an enforcement and investigatory instrument. The obligation on RSE licensees to facilitate APRA meetings, including ensuring attendance by the RSE auditor, internal auditor and, for groups, responsible persons from the head entity (para 27), further supports APRA’s supervisory posture.

The Prudential Standard is explicitly framed as a prudential instrument made under the SIS Act and as part of a web of prudential and statutory obligations. The Standard cross-references multiple statutes and other prudential standards; these cross-references define both the substantive criteria auditors must assess and the governance and independence thresholds auditors must satisfy.

Statutory authority and linkage: The Standard is made under s 34C of the SIS Act (para 1). It includes requirements that apply for the purposes of s 35AC(3) of the SIS Act concerning RSE auditor functions and duties (para 3). Attachment B requires auditors to address compliance at a reasonable assurance level with specified SIS Act provisions (for example s 29VA, s 35A, and others listed in Attachment B para 1(a)). Attachment B also references specified regulations under the Superannuation Industry (Supervision) Regulations 1994 (Attachment B para 1(b)) and specified Corporations Act sections and Corporations Regulations provisions (Attachment B paras 1(c)-(d)). The Standard therefore integrates audit obligations with statutory compliance requirements.

Prudential standards: The Standard cross-references Prudential Standard SPS 510 Governance (SPS 510), Prudential Standard SPS 520 Fit and Proper (SPS 520) and Prudential Standard SPS 220 Risk Management (SPS 220). It requires auditors to meet the independence requirements in SPS 510 (paras 9, 10(b), 13-14) and requires licensees to ensure auditors meet SPS 520 eligibility and fit and proper tests (para 13). The annual report must include limited assurance on the licensee’s compliance with its risk management framework required under SPS 220 (para 22(b)(iii)). These linkages mean compliance with the audit Standard requires alignment with other prudential obligations.

Corporations Act and ASIC interaction: The Standard notes that where applicable the auditor must meet Part 2M.4 of the Corporations Act (para 9). It permits non-SAF RSE licensees to lodge the auditor’s report with ASIC together with the s 319 report under the Corporations Act (para 16). Attachment B lists Corporations Act sections (for example s 1012B, s 1012F, s 1012H(2), s 1017B(1) and others, Attachment B para 1(c)) and Corporations Regulations (Attachment B para 1(d)) that must be addressed in the audit. The Standard therefore positions the RSE auditor’s role at the intersection of APRA’s prudential reporting and ASIC’s corporate reporting regime for entities subject to Corporations Act reporting.

FSCOD Act reporting standards: Attachment A instructs auditors to address specific reporting standards made by APRA under the Financial Sector (Collection of Data) Act 2001 (FSCOD Act). It lists SRS numbers and specifies the required level of assurance for each (Attachment A itemised table). For example, SRS 114.1 and SRS 320.0 require reasonable assurance; SRS 533.0 Asset Allocation for MySuper lifecycle options requires limited assurance (Attachment A). These reporting standards form the data and reporting yardstick for auditor assurance.

This Prudential Standard records limited explicit amendment history in its text. The document contains the following temporal and transitional features:

• Commencement date: The Standard commences on 30 June 2024 (para 4).
• Source of authority: It is made under s 34C of the SIS Act (para 1), and it explicitly references that some of its requirements apply for the purposes of s 35AC(3) of the SIS Act (para 3).
• APRA discretion and continuity: Paragraph 6 provides APRA with the power to adjust or exclude a specific requirement in the Standard in relation to a particular RSE licensee or specified RSE licensees. Paragraph 7 requires that an RSE licensee contact APRA if it seeks to place reliance, for compliance purposes, on an exercise of discretion by APRA made under a previous version of the Prudential Standard. These provisions implicitly recognise prior versions and a transition process when APRA has exercised discretions historically.
• References to other prudential standards: The Standard is designed to operate alongside existing prudential standards such as SPS 510 Governance, SPS 520 Fit and Proper and SPS 220 Risk Management, though the text does not itself record prior amendments to those instruments (paras 9, 10(b), 13, 14, 22(b)(iii)).
• Attachments as living links: Attachment A specifies current APRA reporting standards that auditors must address and the level of assurance required for each, and Attachment B lists legislative provisions to be audited. Those Attachments create a framework that is likely to change when APRA updates its reporting standards or when legislation is amended. The Standard does not itself list a revision history beyond the commencement date and the provisions dealing with APRA discretion and prior discretions (paras 4, 6-7).

What the text does not provide

• No prior versions, amendment dates or supersession history are set out in the text supplied. The Standard acknowledges the possibility of prior APRA discretions (para 7) but does not include an annex cataloguing historical amendments or a list of previous iterations.
• There is no explicit transitional timetable set out beyond the commencement date and the requirement to contact APRA if relying on previous discretions (para 7). The Standard does provide specific implementation timelines for auditor reports in relation to the year of income and wind-ups (paras 15-19), but not a historical amendment log.

Practical consequence for users

The text of the Prudential Standard does not include any litigation history. It does not cite, rely on or discuss court decisions, nor does it list any precedent or judicial interpretation. The Standard references statutory provisions in the SIS Act and the Corporations Act and cross-references other prudential standards and reporting standards, but it does not contain or summarise any case law.

Implications of the absence of litigation history in the text

• No judicial interpretations of the provisions in this Prudential Standard are presented in the instrument itself. Any disputes about the Standard’s interpretation or APRA’s application of it will therefore be novel in the sense of being resolved by future administrative or judicial processes rather than guided by this instrument.
• The Standard relies on AUASB standards and guidance for definitions of reasonable and limited assurance and for materiality judgements (paras 10(b), 22, 23). Disputes about application of those professional standards may arise in audit quality reviews or in litigation concerning auditor opinions, but such cases are not referenced in the text.
• Because Attachment B ties audit coverage to specific statutory provisions, litigation on breaches of those statutes and on APRA’s enforcement responses to auditor reports will be a possible future source of jurisprudence, but none is provided within this instrument.

Practical points for practitioners

• Expect that legal challenges involving the Standard will centre on how APRA exercises its discretion (para 6), the sufficiency of the auditor’s work under AUASB standards (paras 10(b), 22, 23), and the interactions with statutory obligations listed in Attachment B.
• Where an auditor modifies an opinion for material breaches, subsequent enforcement action by APRA or other consequences (for example under the Corporations Act) could give rise to litigation, but such litigation would concern the underlying statutory breaches or APRA’s actions rather than the Standard’s wording per se.
• Because the Standard requires retention and production of working papers for seven years (para 25), disputes over access to documentation may lead to administrative or court proceedings; however no such cases are included in the text.

In short, the Standard itself is silent on litigation history. Practitioners should treat the instrument as setting a compliance and evidentiary framework that will interact with existing statutory enforcement regimes and AUASB professional standards, with litigation possible in the future on the application or consequences of those interfaces.

This section flags traps, timing pitfalls, and operational frictions that arise directly from the text. Each item is grounded in a specific provision.

1. Multiple reports per RSE, or aggregated SAF reporting requires strict conditions (paras 19-20)

• By default an RSE licensee must ensure a separate auditor’s report for each RSE (para 19). A single auditor’s report can cover a number of SAFs only if four conditions are met, including that the licensee’s risk management strategy adequately covers each SAF, the auditor’s report is unmodified, each SAF has been individually audited in accordance with AUASB standards, and APRA is provided with a listing of SAFs covered (para 20). Failure to meet any one condition means separate reports are required.

2. Timelines are tight and specific (paras 16, 18, 30)

• Auditor’s reports must be lodged within three months after the end of the year of income with APRA (SAFs mandatory; non-SAFs may lodge with ASIC instead but still must lodge with APRA if not using ASIC) (para 16). If an RSE wound up during the year, the report must cover from start of year to wind-up and be completed no later than three months after the end of the year (para 18). Special purpose engagement reports commissioned by APRA must be submitted within three months of the notice unless APRA decides otherwise (para 30). Missing these deadlines risks being non-compliant with the Standard and invites APRA follow-up.

3. Access and governance obligations require Board-level cooperation (para 12; para 27)

• The auditor must have access to the Board, the Board Audit Committee and internal auditors (para 12). The RSE licensee must facilitate APRA meeting arrangements and ensure attendance by the RSE auditor or lead auditor and the internal auditor and, for groups, responsible persons from the head entity (para 27). Failure to secure board attendance or provision of data can impede the audit and may cause APRA concern.

4. Contractual content is prescriptive (para 10)

• The engagement contract must be legally binding and contain clauses requiring the auditor to meet the Standard’s roles, comply with AUASB standards and be referred to SIS Act and Corporations Act provisions (para 10). A contract that falls short of these terms is non-compliant.

5. Independence and fit and proper are multi-layered (paras 13-14)

This section provides a practical compliance checklist and suggested operational steps that follow directly from the Standard’s provisions. Each step cites the relevant paragraph(s).

1. Appoint and contract the RSE auditor (paras 8, 10)

• For each RSE within your licence, appoint an RSE auditor (para 8).
• Execute a legally binding engagement contract that: a) requires the auditor to fulfil roles and responsibilities as specified in the Standard (para 10(a)); b) requires the auditor to comply with relevant AUASB standards and guidance (para 10(b)); c) refers the auditor to relevant SIS Act and Corporations Act provisions (para 10(c)).
• If your licence is part of a group and you intend to use a group-engaged auditor, document how that auditor meets SPS 510, SPS 520 and any Corporations Act requirements, and record the basis on which the auditor will prepare RSE-specific parts of the report (paras 9, 21).

2. Verify auditor eligibility, independence and fit and proper status (paras 13-14)

• Confirm that lead individuals are not disqualified under s 130D of the SIS Act, meet SPS 520 eligibility criteria and are fit and proper under the licensee’s Fit and Proper Policy (para 13).
• Confirm that the audit firm is not disqualified under s 130EA and satisfies SPS 510 independence requirements (para 14).
• Document independence confirmations and any safeguards in the engagement file.

3. Ensure data, access and governance arrangements are in place (para 12)

• Implement procedures to give the auditor access to all data, information, reports and staff reasonably believed necessary by the auditor (para 12).
• Arrange direct lines for the auditor to the Board, the Board Audit Committee and internal auditors, including scheduling access early in the audit plan (para 12).
• Retain logs of requests and access provided; ensure third-party providers know they must respond to auditor information requests.

4. Prepare for the content and assurance levels required (para 22; Attachment A; Attachment B)

• Map the APRA reporting standards listed in Attachment A to the RSE’s reporting and financial systems and determine the evidence needed to support the reasonable and limited assurance engagements required (Attachment A; para 22).