The Australian Prudential Regulation Authority (APRA) has commenced consultation on a proposal to update Prudential Standard SPS 310 Audit and Related Matters (SPS 310) to align with changes to APRA’s reporting standards for superannuation.
APRA observed a relatively high number of data resubmissions leading into the initial Your Future, Your Super (YFYS) performance test. It is crucial that RSE licensees develop and maintain systems, procedures and internal controls to ensure a robust approach to data management and reliable reporting to APRA.
Attachment A to SPS 310 sets out the APRA reporting standards that the annual auditor’s report must address and the level of assurance required for each form. Recent changes to APRA’s reporting obligations for RSE licensees require this Attachment to be updated to ensure an appropriate scope for the audit of reporting on RSE licensees’ business operations.
The proposed changes to SPS 310 are outlined in the attachment to this letter. In summary, APRA intends to update SPS 310 to:
remove the requirement to review seven reporting standards because the data collected will (after a short period of parallel reporting) be superseded by new reporting standards;
leave the requirements applying to six existing reporting standards unchanged; and
require assurance over six new reporting standards. Of these, the review must cover specified data items within three reporting standards.
The specified data items that APRA proposes to subject to review include those that will be used for APRA’s administration of the YFYS performance test and will also be published in APRA’s Heatmap. Most of the new reporting standards that necessitate independent assurance will replace equivalent RSE and MySuper product level reporting after a short period of parallel reporting. APRA expects that these factors will guide the view of the RSE licensee and its RSE auditor in determining its audit approach in relation to data which may have a material impact to outcomes for the RSE. APRA also proposes to require limited assurance review of the new reporting standard that provides information on expenses.
When determining an appropriate audit program in relation to its reporting obligations, APRA also expects an RSE licensee to consider Prudential Practice Guide CPG 235 Managing Data Risk which includes expectations for undertaking testing and assurance to ensure the adequacy of data quality and controls. RSE licensees should also have regard to Prudential Standard SPS 220 Risk Management which requires an annual Risk Management Declaration that includes an attestation that the RSE licensee has adequate reporting systems and internal controls supporting the preparation and reporting of accurate financial and statistical information to APRA.
Proposed approach for auditing data about choice products and investment options
The new reporting forms apply to both MySuper and choice products. Some RSEs may have many choice products, associated investment menus and investment options, resulting in large volumes of data reported under four of the new reporting standards in respect of which APRA proposes to require independent assurance.
APRA has therefore proposed that limited assurance would cover examination of the data lineage for an appropriate sample (validate that the item and controls reflect the data points which contribute to that item). In defining a sample selection for choice investment options, the Auditor must select an appropriate sample of products and investment options with coverage of different product and investment option types. APRA does not propose to prescribe a number of products or investment options, or an approach for sample selection. However, APRA would expect the scope, and rationale for the scope, of the auditor's work to be explained in the Approved Audit Form.
APRA welcomes feedback on these proposals. Consultation on these proposals closes on 11 March 2022.