GS 017

This Guidance Statement has been formulated by the Auditing and Assurance Standards Board (AUASB) to provide guidance to the auditor of a life company^[1] in reporting, pursuant to the prudential reporting requirements specified by the Australian Prudential Regulations Authority (APRA) in Prudential Standard LPS 310 Audit and Related Matters (January 2013) (LPS 310).

LPS 310 applies to Life Companies from 1 January 2013.

This Guidance Statement is issued on 17 December 2014 by the AUASB and replaces GS 017 Prudential Reporting Requirements for Auditors of a Life Company, issued in June 2010.

Prudential Supervision of a Life company

Under the Life Insurance Act 1995 (Life Act), APRA is responsible for the prudential supervision and monitoring of prudential matters relating to all life companies, a specified class of life companies or one or more specified life companies in order to protect the interests of policy holders or prospective policy holders of the life companies concerned.

APRA formulates, promulgates and enforces prudential policy and practice through life company Prudential Standards (LPSs) and Crossindustry Prudential Standards (CPSs). In addition, APRA may also issue nonenforceable life company Prudential Practice Guides (LPGs), letters, publications, circulars and other guidelines, to assist life companies in complying with the requirements in its Prudential Standards and, more generally, to outline prudent practices in relation to certain elements of a life company’s operations.^[2]

Under the Life Act, a life company is required to appoint an auditor. LPS 310 provides eligibility criteria for auditors. The auditor of a life company has an important role to play in the prudential supervision process. Requirements for auditors of life companies to provide reports on prudential matters to APRA are intended to assist APRA in assessing the reliability of information supplied to it by a life company.

The use by life companies and APRA of assurance reports prepared by auditors is to be evaluated in the context of the inherent limitations of an audit or review (refer paragraphs 111–115) and the subject matter of the audit or review (refer paragraphs 47-53 of this Guidance Statement).

LPS 310 warns that all persons involved in the provision of information (which includes the auditor) are to note that it is an offence under subsection 137.1 and 137.2 of the Criminal Code 1995 to provide, whether directly or indirectly, false or misleading documents or information to a Commonwealth entity (such as APRA).

Scope of this Guidance Statement

LPS 310 provides for two types of engagements to be conducted by the auditor of a life company, namely:

1. annual prudential reporting engagements (see paragraphs 30-136); and
2. special purpose engagements (see paragraphs 137-147).

The audit or review of financial reports required under the Corporations Act 2001 (the Act) (where required) is directed towards obtaining sufficient appropriate evidence to form an opinion or conclusion, as applicable, on whether the financial report is presented fairly in accordance with the required financial reporting framework. The financial report audit or review is not designed to enable the auditor to conclude in relation to the matters specified in LPS 310.

The LPS 310 prudential reporting requirements, imposed on the auditor via the terms of engagement with a life company, are in addition to the audit or review of financial reports required under the Act.

Responsibilities of the Auditor

The responsibilities and reporting requirements of the auditor of a life company are contained in:

1. applicable AUASB Standards;
2. LPS 310;
3. other applicable APRA Prudential Requirements^[3], including the Life Act, the Financial Sector (Collection of Data) Act 2001 (FSCODA), and APRA Prudential and Reporting Standards; and
4. relevant ethical and professional standards.

APRA places reliance on accounting and auditing standards to the extent that they do not conflict with Prudential Requirements applicable to life companies. LPS 310 requires auditors in meeting their role and responsibilities, to comply with the Australian Auditing Standards and consider Guidance Statements issued by the AUASB, except where:

1. they are inconsistent with the requirements of LPS 310, in which case LPS 310 prevails; or
2. APRA otherwise specifies, in writing, to the life company that alternative standards and guidance are to be used by the auditor. In the case of an eligible foreign life insurance company (EFLIC), APRA requires compliance with Australian Accounting Standards in the completion of APRA annual returns under LPS 310.

The following AUASB Standards are applicable to the engagement:

1. Australian Auditing Standards – where reasonable assurance on historical financial information is required; and
2. Standard on Assurance Engagements ASAE 3000 Assurance Engagements Other than Audits or Reviews of Historical Financial Information (ASAE 3000) – where reasonable and limited assurance is required in relation to information other than historical financial information, including internal controls. ASAE 3000 has been written for general application to assurance engagements other than audits or reviews of historical financial information covered by Auditing Standards or Standards on Review Engagements. Where topic specific ASAEs exist, for example ASAE 3100 Compliance Engagements, the auditor applies the relevant topic specific ASAEs, as well as ASAE 3000.

The auditor accepts the prudential reporting engagement only when the auditor has no reason to believe that the auditor and the engagement team (if applicable) will not satisfy the relevant ethical requirements relating to audit and assurance engagements^[4].

The concept of independence is important to the auditor’s compliance with the fundamental ethical principles of integrity and objectivity. The auditor is required to meet the independence requirements set out in:

1. APRA’s life company Prudential Standard CPS 510 Governance (CPS 510); and
2. ASA 102 Compliance with Ethical Requirements when Performing Audits, Reviews and Other Assurance Engagements (ASA 102).

For the purposes of this Guidance Statement, the following items have the meanings attributed below:

Assurance engagement means an engagement in which an assurance practitioner^[5] aims to obtain sufficient appropriate evidence in order to express a conclusion designed to enhance the degree of confidence of the intended users other than the responsible party about the subject matter information (that is, the outcome of the measurement or evaluation of an underlying subject matter against criteria).

Auditor means an independent auditor(s) appointed by a life company to meet the prudential reporting requirements under LPS 310^[6].

Engagement risk means the risk that the assurance practitioner expresses an inappropriate conclusion when the subject matter information is materially misstated.

Internal control^[7] encompasses the following components:

1. the control environment;
2. the life company’s risk assessment process;
3. information systems, including the related business processes, relevant to financial and prudential reporting, and communication;
4. control activities; and
5. monitoring of controls.

The way in which internal control is designed and implemented varies depending on the life company’s size and complexity.

Life company means all life companies (including friendly societies) registered under section 21 of the Life Act.

Life company auditable annual return(s), means a form used for the collection and reporting of information in relation to a life company, as required to be provided to APRA by a life company in accordance with APRA Reporting Standards made under the FSCODA.

Limited assurance engagement means an assurance engagement in which the assurance practitioner reduces engagement risk to a level that is acceptable in the circumstances of the engagement but where that risk is greater than for a reasonable assurance engagement as the basis for expressing a conclusion in a form that conveys whether, based on the procedures performed and evidence obtained, a matter(s) has come to the assurance practitioner’s attention to cause the assurance practitioner to believe the subject matter information is materially misstated. The nature, timing, and extent of procedures performed in a limited assurance engagement is limited compared with that necessary in a reasonable assurance engagement but is planned to obtain a level of assurance that is, in the assurance practitioner’s professional judgement, meaningful. To be meaningful, the level of assurance obtained by the assurance practitioner is likely to enhance the intended users’ confidence about the subject matter information to a degree that is clearly more than inconsequential.

Prudential Requirements^[8], are defined in LPS 001 and include requirements imposed by:

1. the Life Act;
2. Regulations (made under the Life Act);
3. APRA Prudential Standards (made under the Life Act);
4. the FSCODA;
5. APRA Reporting Standards (made under the FSCODA);
6. APRA conditions on the registration of a life company; and
7. any other requirements imposed by APRA, in writing, in relation to the life company.

Reasonable assurance engagement means an assurance engagement in which the assurance practitioner reduces engagement risk to an acceptably low level in the circumstances of the engagement as the basis for the assurance practitioner’s conclusion. The assurance practitioner’s conclusion is expressed in a form that conveys the assurance practitioner’s opinion on the outcome of the measurement or evaluation of the underlying subject matter against criteria.

Reliability under the Australian Accounting Standards Board’s Framework for the Preparation and Presentation of Financial Statements means information has the quality of reliability “… when it is free from material error and bias and can be depended upon by users to represent faithfully that which it either purports to represent or could reasonably be expected to represent”.

Under normal circumstances, APRA does not consult directly with an auditor of a life company on matters concerning an individual life company. APRA’s liaison with an auditor of a life company is normally conducted under tripartite arrangements involving APRA, the life company and its auditor(s)^[9].

Any one of the parties involved in the tripartite relationship may initiate meetings or discussions at any time, when considered necessary.

Notwithstanding the tripartite relationship, APRA and the auditor may meet, at any time, on a bilateral basis at the request of either party. APRA may communicate with an auditor of a life company on a bilateral basis to obtain or discuss information for whatever reason it considers appropriate.

Under CPS 510, a life company is required to ensure that its internal policy and contractual arrangements do not explicitly or implicitly restrict or discourage auditors (or other parties) from communicating with APRA.

Under CPS 510, it is the responsibility of a life company’s Board and management to ensure that the life company meets prudential and statutory requirements and has management practices in place to limit risks to prudent levels.

Under the Life Act, a life company is required to appoint an auditor(s) to meet the prudential reporting requirements under LPS 310. LPS 310 sets out the eligibility criteria for the appointment of an auditor.^[10]

Under LPS 310, a life company is required to ensure that its auditor(s):

1. has access to all relevant data, information, reports and staff of the life company, which the auditor reasonably believes is necessary to fulfil their role and responsibilities under LPS 310. This includes, access to the life company’s Board^[11], Board Audit Committee and internal auditors as required;
2. is kept fully informed of all APRA prudential requirements applicable to the life company; and
3. is provided with any other information that APRA has provided to the life company that may assist the auditor in fulfilling their role and responsibilities.

Under LPS 310, a life company must ensure that the following are provided to its Board or Board Audit Committee (if not already sighted by one of them):

1. reports, provided by the auditor in accordance with LPS 310, and any associated assessments and other material prepared in connection with fulfilling the requirements of LPS 310;
2. commentary or responses provided by APRA to the life company on reports provided by the auditor, and any associated assessments and other material; and
3. any commentary or response on the reports, associated assessments and other material provided by the auditor that is given by the life company to APRA.

LPS 310 requires a life company, if requested by APRA, within a reasonable time to provide APRA with the terms of engagement and other instructions or correspondence, including management letters, that may have a bearing on the:

1. scope or conduct of the work undertaken by the auditor in accordance with LPS 310; and
2. form, content (including findings made or opinion/conclusions expressed by the auditor) or scope of the reports provided in accordance with LPS 310.

In order for the life company to provide the reports under LPS 310 to APRA within the period specified by APRA’s Reporting Standard LRS 001 Reporting Requirements^[12], the auditor of a life company must provide their report(s) to the Board of the life company, in relation to the following matters:

1. Reasonable Assurance on Annual returns^[13]: LPS 310 requires the auditor to prepare a report that provides reasonable assurance that, in all material respects the:
   1. annual returns are reliable and in accordance with the relevant prudential requirements, and
   2. prudential requirements in relation to the accounting for statutory funds have been met.
2. Limited Assurance on Controls: LPS 310 requires the auditor to prepare a report that provides limited assurance that, based on the review which is not an audit, in all material respects, nothing has come to the attention of the auditor that:
   1. the life company has not implemented systems, procedures and internal controls that are designed to ensure the life company has:
      1. complied with all applicable prudential requirements; and
      2. provided reliable data to APRA in the life company auditable annual returns prepared under the FSCODA; and
   2. the controls in paragraph 27(b)(i) have not operated effectively throughout the financial year; and
   3. the life company’s systems, procedures and internal controls relating to actuarial data integrity and financial reporting risks (the risks that incorrect source data will be used in completing the annual returns under FSCODA) are not adequate and effective.

Refer to paragraphs 124-127 for further guidance on the auditor’s opinion/conclusions.

The Life Act specifies in section 88 the circumstances where the auditor is required to report to APRA in the instance where a life company or its directors may have contravened the Life Act or any other law and the contravention may significantly prejudice the interests of the holders of policies issued by the life company. When a report is made to APRA, the auditor should not disclose this to the life company if the auditor:

1. has lost confidence in or mistrusts the Board or senior management of the life company; or
2. the auditor considers that by doing so the interests of policy holders may be jeopardised.

In accordance with LPS 310, an auditor, whether as part of the annual prudential reporting or special purpose engagements, must not place sole reliance on work performed by APRA.

The requirement to report in accordance with APRA’s annual prudential reporting requirements is in addition to the audit or review of financial reports required under the Act, and is to be treated by the auditor as a separate assurance engagement.

The auditor and the life company agree on the terms of the engagement in accordance with the requirements of Auditing Standard ASA 210 Agreeing the Terms of Audit Engagements (ASA 210) and ASAE 3000. These arrangements have to be legally binding and include the required terms of engagement specified in LPS 310.

An engagement letter (or other suitable form) confirms both the client’s and the auditor’s understanding of the terms of the engagement and the auditor’s acceptance of the appointment. Both parties sign the engagement letter to acknowledge that it is a legally binding contract.

For recurring engagements, the auditor considers whether circumstances require the terms of the engagement to be revised and whether there is a need to reconfirm in writing the existing terms of the engagement. While the auditor may decide not to reconfirm the terms of engagement each year, factors that may make it appropriate to do so include a recent change of senior management or those charged with governance, or any indication that the life company misunderstands the objectives and scope of LPS 310 prudential reporting engagements.

Ordinarily, matters that are contained in the engagement letter include the following:

• The objectives and scope of the annual prudential reporting engagement pursuant to LPS 310.
• The responsibilities of management and, where appropriate, those charged with governance, for the subject matter of the report.
• The role and responsibilities of the auditor in accordance with the requirements of LPS 310.
• Acknowledgement that the auditor, in meeting their role and responsibilities, will comply with the requirements of applicable AUASB Standards and will consider relevant Guidance Statements issued by the AUASB, except where inconsistent with the requirements of LPS 310 or where APRA specifies alternative standards and guidance to be used.
• Identification of the relevant AUASB Standards under which the engagement will be conducted and inclusion of a statement that, although it does not prescribe or create new mandatory requirements, the auditor will consider the guidance contained in this Guidance Statement.
• Agreement from management and, where appropriate, those charged with governance, to provide unrestricted access to records, documentation and other information requested in connection with the prudential reporting engagement.
• Agreement from management and, where appropriate, those charged with governance, to provide written representations requested by the auditor.
• Any limitations on the engagement (see paragraphs 112-115).
• The agreed use of the assurance report(s) issued by the auditor, and the extent to which, and the basis on which, the assurance reports may be made available to others (refer paragraphs 124-127).
• The auditor’s additional responsibilities to report to APRA under sections 80(3), 88 and 88A of the Life Act for which the auditor is provided protection in relation to the disclosure of such information under section 89.
• Confirmation that the auditor will meet the independence requirements under CPS 510 and ASA 102.
• The form of reporting and communication in relation to the engagement.

The engagement letter explains that any special purpose engagement of any aspect of the life company’s operations, risk management or financial affairs, will constitute a separate engagement(s) and that the details of such engagement(s) will be the subject of a separate engagement letter(s).

The engagement letter furthermore clarifies that, in accordance with LPS 310 and CPS 510, the auditor is not to be a party to any contractual arrangements, or any understandings with a life company, that seek in any way to limit the auditor’s ability or willingness to communicate to APRA. The auditor notifies APRA of any attempts by a life company to achieve such arrangements or understandings. APRA may liaise bilaterally with an auditor and may although not usually, request information directly from the auditor.

The nature and extent of planning activities will vary with the engagement circumstances. Specific matters that may be considered by the auditor as part of the planning process include:

• The auditor’s understanding of the life company and its environment, including its internal control and compliance framework (see paragraphs 38-46).
• The auditor’s previous experience with the life company.
• The characteristics of the subject matter and the identified criteria (see paragraphs 47-53).
• The internal controls relating to actuarial data integrity and financial reporting risks and the reliability and accuracy of the underlying source data (see paragraph 40).
• The intended users of the auditor’s assurance report and their needs (see paragraphs 54-55).
• Materiality (see paragraphs 56-70).
• Engagement risk (see paragraphs 41-46).
• The appropriate assurance strategy to adopt for each part of the engagement and possible sources of evidence.
• Personnel and expertise requirements, including the nature and extent of experts’ involvement (see paragraphs 71-75).
• Work to be performed by another auditor (see paragraph 76).
• The activities of the internal audit function and the effect on audit and review procedures (see paragraphs 77-79).
• The auditor’s additional reporting responsibilities under the Life Act (see paragraphs 132-135).

Further guidance on planning an audit may be found in ASAE 3000 and ASA 300 Planning an Audit of a Financial Report (ASA 300).

The auditor obtains an understanding of the life company and its environment, including its internal control and compliance framework, and other assurance engagement circumstances, sufficient to:

1. identify and assess the risks of the subject matter information being materially misstated, that significant deficiencies in internal controls may exist (in relation to the area of activity to be examined), and/or that the life company may not be complying with applicable prudential requirements; and
2. design and perform further evidence gathering procedures.

The auditor exercises professional judgement to determine the nature and extent of the understanding that is needed. When performing procedures to obtain an understanding of the life company and its environment, consideration of the following matters may be helpful:

• The size, nature and complexity of the life company and its activities.
• Any changes in the market environment.
• Governance and management functions within the life company, including the attitude, awareness and actions of those charged with governance and of management concerning the life company’s compliance with Prudential Requirements, and the respective roles and responsibilities attributed to the finance, risk management, compliance and internal audit functions.
• Relevant aspects of the life company’s risk management framework and systems applicable to the engagement, including the life company’s risk assessment process for identifying risks relevant to prudential reporting objectives and deciding on actions to address those risks through its risk management systems.
• The life company’s internal control relevant to the assurance engagement.
• The life company’s compliance framework, processes and controls (refer to ASAE 3100).
• The significance and complexity of the life company’s information technology environment and systems.
• Any formal communications between APRA and the life company, and the results of any supervisory visits conducted by APRA in relation to the engagement.
• Recent reports prepared by other assurance practitioners appointed to report on any aspect of the life company.
• Work performed by the internal audit, risk management and compliance functions, for example key findings, control deficiencies, compliance register or incident reporting, and any reliance that may be placed on this work.
• Discussions with life company staff responsible for monitoring regulatory compliance, such as the life company’s compliance officer or chief risk officer.

In addition to the general planning considerations, the auditor takes the following factors into account when planning the review of the life company’s internal controls relevant to the assurance engagement:

• The overall compliance framework adopted by the life company to ensure compliance with all applicable prudential requirements, including its controls, policies and processes, and consideration of whether or not these are appropriate given the size, nature and complexity of the life company.
• The sufficiency and appropriateness of the life company’s risk management strategy, including systems, policies and controls adopted in accordance with specific prudential standards, and consideration of whether these are up to date and in sufficient detail to facilitate compliance with the relevant prudential standards.
• Matters relating to the life company’s organisational structure and operating characteristics, and recent significant changes thereto, which could impact on the life company’s internal controls.
• Knowledge of the life company’s internal controls obtained during other assurance engagements conducted in relation to the life company.
• Previously communicated instances of material non compliance with prudential requirements and/or material deficiencies in internal controls designed to ensure compliance with all applicable prudential requirements and the provision of reliable data to APRA in annual returns that have and have not been resolved by the life company.
• In relation to actuarial data integrity and financial reporting risks the auditor may consider some of the following:
  • Sufficiency of expert resources within the life company e.g. actuarial or financial analysis and modelling;
  • Level/frequency of internal/external review of actuarial forecasting systems, models and associated controls;
  • Complexity of the underlying IT systems and general IT controls including:
    • storage and protection of data;
    • number of source systems;
    • system interfaces;
    • data transfer processes;
    • updating of actuarial data/key fields in the source systems; and
    • end user computing controls in relation to spreadsheets or other business owned applications e.g. version control, integrity, password control and logic tests.

The above is not meant to represent an exhaustive list and there may be other factors relevant to the specific circumstances of a life company.

In accordance with ASA 315 Identifying and Assessing Risks of Material Misstatement through Understanding the Entity and its Environment, the auditor performs risk assessment procedures and related activities to obtain an understanding of the life company and its environment. The Prudential Capital Requirement (PCR) of a life company is intended to take account of the range of risks to which a typical life company is exposed. The PCR for a life company, a statutory fund or a general fund is determined under LPS 110 Capital Adequacy and includes but is not limited to consideration of the following:

1. the Insurance Risk Charge (IRC)
2. the Asset Risk Charge (ARC)
3. the Asset Concentration Risk Charge (ACRC)
4. the Operational Risk Charge (ORC)

In identifying and assessing the risks of material misstatement, the auditor may need to consider the use of accounting estimates in the calculation of the life company’s PCR under ASA 540 Auditing Accounting Estimates, Including Fair Value Accounting Estimates, and Related Disclosures and evaluate the degree of estimation uncertainty associated with any accounting estimates.

The degree of estimation uncertainty associated with an accounting estimate may be influenced by factors such as:

• The extent to which the accounting estimate depends on judgement.
• The sensitivity of the accounting estimate to changes in assumptions.
• The existence of recognised measurement techniques that may mitigate the estimation uncertainty (though the subjectivity of the assumptions used as inputs may nevertheless give rise to estimation uncertainty).
• The length of the forecast period, and the relevance of data drawn from past events to forecast future events.
• The availability of reliable data from external sources.
• The extent to which the accounting estimate is based on observable or unobservable inputs.
• The degree of estimation uncertainty associated with an accounting estimate may influence the estimate’s susceptibility to bias.

Matters the auditor considers in assessing the risks of material misstatement in an accounting estimate may also include:

• The actual or expected magnitude of an accounting estimate.
• The recorded amount of the accounting estimate (that is, management’s point estimate) in relation to the amount expected by the auditor to be recorded.
• Management’s documentation of the judgements involved in estimates, for example, assumptions, model risk and understanding and data quality.
• Outcomes of the sensitivity analysis performed on the assumptions by management.
• Adequacy and outcomes of the process adopted by the life company in determining the PCR is appropriate as it relates to the life company as a whole.
• Complexities and disclosures required for each component of risk under the life company’s PCR calculation.
• Whether the models developed by management are using recognised measurement techniques and are independently reviewed and approved by appropriate personnel or an external expert.
• Reliance on and use of internally developed or externally sourced models to estimate scenarios arising from movements in future mortality, morbidity, longevity, servicing expenses, lapses and other insurance risks.
• Whether relevant and reliable controls are in place around the modelling process and the protection of model integrity.
• Whether management has used an expert in making the accounting estimate.
• The effectiveness of the controls and processes relied upon in setting the best estimate assumptions and insurance risk stress margins underlying the life company’s PCR calculation.
• Outcomes of the Appointed Actuary’s Financial Condition Report (FCR) and any impacts they may have on accounting estimates.
• Outcomes of the review of prior period accounting estimates.

The auditor considers the above factors and their impact on the audit approach and uses professional judgement in forming a view as to whether the accounting estimates are reliable.

In addressing the risks and accounting estimates associated with each of the areas in paragraph 41, the auditor may need to consider performing further substantive procedures to respond to significant risks associated with estimation uncertainty.

The auditor uses professional judgement to assess whether there is sufficient evidence available to enable the auditor to form an opinion in relation to accounting estimates.

The auditor identifies the most recent yearend life company annual returns submitted to APRA for audit.

The auditor identifies, and obtains an understanding of, all the prudential requirements (refer to definition under paragraph 17) applicable to the specific life company (including any additional guidance provided by APRA to the life company), with particular attention to changes in these requirements during the reporting period. The auditor makes enquiries with respect to any requirements that are imposed in writing by APRA on the life company, or in relation to conditions on the life company’s authorisation, as these requirements may vary from one life company to another.

Compliance with prudential requirements (see paragraphs 27(a) and 27(b) of this Guidance Statement) is broader than compliance with only the quantitative limits in APRA Prudential Standards (for example, capital adequacy requirements). The auditor is required to obtain reasonable assurance in relation to the preparation of the annual return(s) in accordance with the Life Act, the FSCODA Act 2001 and the applicable APRA reporting standards (refer Auditor’s Opinion in Appendix 1 Part A).

In relation to a life company’s responsibility to keep the auditor informed of all APRA prudential requirements applicable to the life company, the auditor obtains written representations from those responsible (see paragraphs 109-110).

APRA Prudential and Reporting Standards provide the criteria for evaluation or measurement, within the context of the auditor’s professional judgement, of the reliability of the information included in life company annual returns.

The auditor identifies and obtains an understanding of the applicable prudential requirements that govern the preparation of data within life company annual returns, with particular attention to changes in these requirements during the reporting period under review. In addition to the Prudential and Reporting Standards issued by APRA, other Prudential Requirements, including the life company Reporting Form Instruction Guides, will have an impact on the provision of reliable data to APRA under the FSCODA and, therefore, the auditor has regard to all relevant Prudential Requirements when planning and conducting the engagement.

It is important that the auditor obtains an understanding of how APRA Prudential Standards and APRA Reporting Standards differ from the financial reporting framework (Australian Accounting Standards), which determines data recorded in the life company’s accounting records.

Data collected in a life company annual return(s) is primarily used by APRA to ensure that:

1. the regulated entity has met the requirements of all prudential standards and other statutory and regulatory requirements;
2. statistical and financial data provided to APRA is reliable; and
3. other matters that could materially prejudice/adversely affect the interests of policyholders are concluded upon.

APRA has the power under subsection 56(5) of the Australian Prudential Regulation Authority Act 1998 to make ‘protected information’ (which may include auditors’ reports or information extracted from such reports) available to another financial sector supervisory agency (for example, the Reserve Bank of Australia (RBA), the Australian Bureau of Statistics (ABS) and the Australian Securities and Investments Commission (ASIC), or any other ‘specified’ agency (including foreign agencies), when APRA is satisfied such information will assist those agencies in performing their functions or exercising their powers.

The auditor considers materiality when:

1. determining the nature, timing and extent of audit and review procedures;
2. evaluating the effect of uncorrected misstatements identified in life company annual returns;
3. evaluating the effect of identified deficiencies in internal controls designed to ensure:
   1. compliance with Prudential Requirements; and
   2. reliable data is provided in the life company annual returns; and
   3. integrity of actuarial data;
4. assessing the significance of identified instances of non compliance with relevant Prudential Requirements.

Determining materiality involves the exercise of professional judgement. Judgements about materiality are made in light of relevant circumstances, and are affected by quantitative and qualitative factors as well as consideration of the potential impact of misstatements, control deficiencies and/or instances of noncompliance that are individually immaterial but in the aggregate may be of concern.

Since the concept of materiality is applied differently in the context of an audit or review of financial and other information, a review of internal controls, and for the purpose of reporting on a life company’s compliance with Prudential Requirements, it is considered separately below in paragraphs 67-69.

Although there is a greater risk that misstatements, control deficiencies or instances of noncompliance may not be detected in a review than in an audit, the judgement as to what is material is made by reference to the subject matter on which the auditor is reporting and the needs of those relying on that information, as opposed to the level of assurance obtained.

Audit of Life Company Annual Returns

The principles of assessing materiality for the purpose of expressing an opinion on a life company’s annual returns (an audit), will generally be similar to that applying to the audit of a financial report.

For the purposes of the audit of life company annual returns, the auditor considers materiality, as appropriate, under Auditing Standard ASA 320 Materiality in Planning and Performing an Audit (ASA 320).

Misstatements in the life company annual returns, either individually or in aggregate with other misstatements, are considered material if the auditor believes the intended users (refer paragraphs 54-55) may be influenced by the misstatement(s) of the information.

ASA 320 deals with materiality in the context of the financial statements taken as a whole. For the purpose of reporting on the reliability of information included in specified life company annual returns, the auditor considers and applies materiality at the level of individual annual returns, or data items, as appropriate.

In applying ASA 320 and ASAE 3000, as appropriate, to individual annual returns, the auditor has regard to the nature, purpose and use of the information included in each annual return. The collection and analysis of data in specified annual returns is a critical component of APRA’s supervisory function. APRA collects data from life companies and friendly societies (and other APRA regulated entities) in order to:

1. verify compliance with prudential requirements (e.g. solvency and capital requirements);
2. understand the operations of the company and the industry;
3. identify emerging issues in both the company and the industry;
4. pass on data to other government agencies; and
5. provide information on the finance sector to research organisations and the general public.

The auditor’s preliminary assessment of materiality is based largely on quantitative factors. A percentage is often applied to a chosen benchmark as a starting point in determining materiality. The base and percentage may vary depending upon the life company annual return in question.

The auditor has regard to alternative bases such as profit, revenue or assets when considering whether a misstatement within a life company’s annual returns such as the Statement of Financial Position, Income Statement, Summary of Revenue and Expenses or Retained Profits, is material.

Review of Internal Controls

In accordance with ASAE 3000, when reviewing internal controls, the auditor assesses materiality in the context of the life company’s objectives relevant to the particular area of activity being examined, and whether the internal controls will reduce to an acceptably low level, the risks that may threaten the achievement of the control objectives – in this case compliance with prudential requirements and integrity of actuarial data.

In assessing materiality, the auditor has regard to the measures the life company has adopted to ensure:

1. reliable data is provided to APRA in all of the life company’s annual returns prepared under the FSCODA;
2. compliance with all applicable Prudential Requirements; and
3. integrity of actuarial data.

ASAE 3100 sets out the requirements and provides guidance to the auditor in applying materiality in the context of a compliance engagement.

Reporting on Compliance with Prudential Requirements and Actuarial Data Integrity

LPS 310 requires the auditor to provide limited assurance that the life company has suitably designed systems, procedures and controls to ensure the life company has complied, in all material respects, with all applicable Prudential Requirements (see paragraph 27(b) of this Guidance Statement). The auditor considers materiality when evaluating the significance of identified instances of noncompliance with relevant Prudential Requirements (refer to paragraphs 93-99). For further guidance in relation to the controls and appropriate audit evidence (refer to paragraphs 81 –92) and the evaluation of findings by the auditor (refer to paragraphs 101-103).

An auditor gives further consideration as to whether the auditor has, or will be able to obtain, adequate knowledge and the required skills to undertake the engagement.

LPS 310 prohibits auditors from placing sole reliance on the work performed by APRA. As required by professional ethical requirements, auditors exercise their professional judgement and reach their own conclusions when undertaking any assurance engagement.

The nature and complexity of the life company determines whether the auditor may need to involve experts in the engagement. When conducting this type of engagement, there are a number of considerations that need to be addressed by the auditor in relation to the use of, for example, an actuarial expert:

• whether there is an expert appointed by management or those charged with governance (management’s expert) under the requirements outlined in LPS 320 Actuarial and Related Matters (LPS 320), in which case ASAE 3000^[14] will need to be considered;
• whether there is a requirement for an auditor’s expert (auditor’s expert) in which case ASA 620 Using the Work of an Auditor’s Expert (ASA 620) and ASAE 3000 will need to be considered; and
• where the engagement team includes actuarial experts.

Under the Life Act, a life company must appoint an appointed actuary (management’s expert as defined by ASA 620). One of the key requirements to be met by the appointed actuary is to complete a financial condition report on the life company. As outlined in LPS 320, this is the minimum requirement for a life company or a friendly society.

The complexity and nature of the life company may warrant the use of both a management’s expert and an auditor’s expert on the same engagement. Generally this is the case for the larger more complex life companies, however, in the case of a friendly society the management’s expert may be able to provide the auditor with sufficient appropriate audit/review evidence.

The life company auditor also liaises with the life company appointed actuary with regard to the requirements of s80(2) of the Life Act in order for the auditor to obtain assurance that the income and outgoings apportionments have been made equitably and in accordance with generally accepted accounting principles (refer to paragraph 133).

Where the auditor plans to use the work of another independent auditor or assurance practitioner, the auditor:

• for the audit of financial information, complies with the requirements of Auditing Standard ASA 600 Special Considerations Audits of a Group Financial Report (Including the Work of Component Auditors) (ASA 600); and
• for other assurance, complies with the requirements of ASAE 3000.

CPS 510 requires all life companies (including an eligible foreign life insurance companies (EFLICs), to have in place an independent and adequately resourced internal audit function.^[15]

CPS 510 requires that the objectives of the internal audit function include an evaluation of the adequacy and effectiveness of the financial and risk management framework of the life company.

In considering the activities of the internal audit function and evaluating the effect, if any, on audit and review procedures, the auditor:

• for the audit of financial information, complies with the requirements of Auditing Standard ASA 610 Using the Work of Internal Auditors (ASA 610); and
• for other assurance, complies with the requirements of ASAE 3000.

Audit Objective

The auditor is required to prepare a report that provides reasonable assurance on the life company’s annual returns to APRA, as specified in attachment A to LPS 310^[16]. In particular, the report must specify whether in all material respects, the auditor concludes the:

1. annual returns are reliable in accordance with relevant prudential requirements; and
2. prudential requirements in relation to the accounting for statutory funds have been met.

The report to the life company is addressed to the board of the life company.

Review Objective

Under LPS 310, the auditor is required to express a conclusion, based on a review, as to whether anything has come to the attention of the auditor to cause the auditor to believe that, in all material respects:

1. The life company has not implemented internal controls that are designed to ensure the life company has:
   1. complied with all applicable Prudential Requirements; and
   2. provided reliable data to APRA in the life company’s annual returns prepared under the FSCODA.
2. The controls in paragraph 81(a) have not operated effectively throughout the financial year.
3. The life company’s systems, procedures and internal controls relating to actuarial data integrity and financial reporting risks (the risks that incorrect source data will be used in completing the Annual returns under FSCODA) are not adequate and effective.

AUASB Standards

The auditor conducts the review of internal controls in accordance with ASAE 3000 and other relevant topic specific ASAEs, for example, ASAE 3150 Assurance Engagements on Controls.

Gathering Assurance Evidence

The evaluation of whether the life company has implemented internal controls that are designed to achieve the relevant control objectives as set out in paragraph 81 above, is performed in the context of the auditor’s general understanding of the life company and its environment, the life company’s risk management practices, and its internal control and compliance framework, as obtained for the purpose of planning the engagement. This review is based on whether the life company has implemented internal controls that have been suitably designed to reduce to an acceptably low level, the risks that threaten achievement of the relevant control objectives.

The auditor generally adopts a ‘top down’ approach in gathering evidence, by making enquiries of key personnel, observing the life company’s operations, performing ‘walk through’ tests of controls, and inspecting relevant documentation, as appropriate, in order to achieve the following:

• Obtaining an understanding of the life company’s overall control environment and compliance framework.
• Identifying the internal compliance function(s) designed to ensure compliance with all applicable Prudential Requirements.
• Identifying policies, procedures and controls designed to ensure compliance with all applicable Prudential Requirements, by reviewing documents such as the life company’s Internal Capital Adequacy Assessment Process (ICAAP) Summary Statement and management declaration, Risk Management Framework, Risk Management Strategy and similar risk management policy documents issued by the life company in accordance with applicable prudential standards.
• Identifying the processes used by the Board of the life company to support its Risk Management Declaration to APRA as outlined in CPS 220 Risk Management (CPS 220).
• Identifying key Board and operational matters by reviewing the minutes of the life company’s Board, as well as minutes of any sub committees responsible, for example, for oversight of risk, compliance and audit, held during the year and enquiring about matters discussed and outcomes from Board decisions.
• Identifying the internal risk and compliance functions designed to oversee the provision of data to APRA in life company annual returns.
• Identifying significant processes for the preparation of life company annual returns e.g. ICAAP.
• Identifying the key controls over these significant processes that are designed to ensure that reliable data is provided to APRA in life company annual returns.

The above is not an exhaustive list of procedures that the auditor may perform in gathering evidence. An auditor’s professional judgement would be used as appropriate in the circumstances of the assurance engagement.

Life companies have different systems and procedures in place to monitor compliance with specific Prudential Standards. Projections and estimates are likely to be part of the monitoring process, as the preparation of a full financial report is unlikely to be practical on a daybyday or weekbyweek basis. Varying degrees of precision may exist therefore in applying the monitoring process. Notwithstanding these differences, such systems seek to ensure that life companies comply with all Prudential Standards on a continuous basis.

The way in which internal control is designed and implemented varies with a life company’s size and complexity. Smaller life companies may use less formal means and simpler processes to achieve their control objectives.

The auditor gathers evidence in response to assessed risks with a focus on identifying key controls within the control systems design. The auditor exercises professional judgement in determining the specific nature, timing and extent of review procedures to achieve the review objective.

Following the evaluation of whether the life company has internal controls designed to achieve the relevant control objectives, the auditor performs review procedures to obtain evidence about whether these controls have operated as designed throughout the financial year. The auditor may consider how the controls were applied, the consistency with which they were applied, by whom they were applied and the period of time over which the controls were applied.

The review of operating effectiveness may include procedures such as:

• Enquiry of appropriate life company personnel (and obtaining written representations).
• Observation of the control process.
• Ascertaining whether the person(s) performing the control(s) possesses the necessary authority and competence to perform the control(s) effectively.
• Review of relevant documentation.
• ‘Walk through’ tests; and
• Limited re performance of the controls.

Interpretation of the word ‘reliable’ in the context of the review of controls over life company annual returns has practical limitations in some circumstances. For many life companies, it is only at the financial yearend (or for life companies that are disclosing entities, also at the half yearend) that all the necessary accounting adjustments, such as accruals, prepayments, provisioning and valuations, are prepared and subjected to audit or review. APRA accepts this position that annual returns prepared throughout the year are based on the life company’s normal accounting process.

The auditor makes enquires as to whether there were any changes in internal control, or other matters, subsequent to the financial yearend date and up to the date of the auditor’s assurance report, that may have an impact on the auditor’s conclusion about the effectiveness of internal controls, and obtains written representations from management relating to such matters.

Materiality is to be considered as outlined in paragraphs 56-70 of this Guidance Statement.

Audit of Life Company Annual Returns

The auditor evaluates, individually and in the aggregate, whether uncorrected misstatements that have come to the auditor’s attention, are material to the reported information. Materiality is applied in the context of paragraphs 56-69 of this Guidance Statement.

In evaluating whether or not the specified life company annual returns, or data in annual returns, are, in all material respects, reliable and in accordance with the relevant APRA Prudential and Reporting Standards, the auditor exercises professional judgement, having regard to both the users and intended uses of the information in the annual returns.

The magnitude of a misstatement alone is only one factor used to assess the misstatement. The auditor evaluates each identified misstatement in the context of information relevant to users of the annual return, by considering qualitative factors and the circumstances in which each misstatement has been made. For example, in evaluating identified misstatements, the auditor has regard to factors such as the level of the life company’s buffer above the particular minimum prudential capital requirements (determined under periodic quantitative calculations) and the sensitivity of these buffers to fluctuations in the life company’s financial performance and position.

The auditor may designate an amount below which misstatements need not be aggregated, because the auditor expects that the aggregation of such amounts clearly would not have a material effect on the reported information. In doing so, the auditor considers that the materiality of misstatements involves qualitative as well as quantitative considerations and those misstatements of a relatively small amount could nevertheless have a material effect on the reported information.

A key concern with any misstatement within a life company’s annual returns is its potential impact on the life company’s ‘capital adequacy requirement’ that is determined in accordance with APRA’s prudential standards^[17]. This is taken into consideration by the auditor when evaluating whether a misstatement in the life company’s annual returns, has a material impact on the Prescribed Capital Amount.

The auditor may also consider LPS 112 Capital Adequacy: Measurement of Capital, where materiality in relation to capital adequacy must be evaluated and applied at the statutory fund level. The materiality of the statutory fund relative to the size of the company overall may be taken into account for the purposes of assessing the impact on the Prescribed Capital Amount.

In extremely rare circumstances, the auditor may conclude that information reported in life company annual return(s) in accordance with the relevant APRA Prudential and Reporting Standards is misleading. The auditor discusses the matter with management and, depending how it is resolved, determines whether, and how, to communicate the matter in the auditor’s assurance report.

Review of Internal Controls

The auditor evaluates, individually and in aggregate, whether internal control deficiencies that have come to the auditor’s attention are material. Materiality is to be applied in the context of paragraphs 67-69.

The auditor exercises professional judgement in evaluating the materiality of internal control deficiencies, having regard to the intended users of the auditor’s assurance report.

In evaluating the severity of identified internal control deficiencies, the auditor having regard to materiality, considers:

1. the likelihood that the relevant internal controls may fail to prevent or detect:
   1. non compliance with a Prudential Requirement;
   2. a misstatement in the data being provided to APRA in life company annual returns;
   3. misstatements in actuarial data used in financial reporting;
2. the significance of the potential resulting non compliance with a Prudential Requirement in the context of the life company’s overall compliance with applicable Prudential Requirements;
3. the magnitude of the potential misstatement that could result from the internal control deficiency in the information reported in the life company annual returns; and
4. the magnitude of the potential misstatement that could result from a deficiency in internal control over the adequacy and effectiveness of actuarial data integrity and financial reporting risks.

The evaluation of the severity of a deficiency in internal control does not depend on whether a misstatement or noncompliance with a Prudential Requirement has actually occurred, but rather the likelihood that the life company’s controls may fail to prevent or detect a material misstatement or material noncompliance with a Prudential Requirement.

The auditor is required under LPS 310 to express a conclusion, based on the audit or review(s) conducted under paragraphs 80-103 above, as to whether anything has come to the attention of the auditor to cause the auditor to believe that, during the financial year, the life company has not complied, in all material respects, with all applicable Prudential Requirements in the Life Act and the FSCODA, including compliance with APRA Prudential and Reporting Standards.

Under sections 88 and 88A of the Life Act, auditors are required to report to APRA when the auditor believes the life company or its directors may have contravened the Life Act or to assist APRA to perform its functions under the Life Act (refer to paragraphs 28, 132-136 of this Guidance Statement for further detail).

The auditor considers materiality when assessing the significance of identified instances of noncompliance with relevant Prudential Requirements.

In order to conclude on a life company’s compliance with all applicable Prudential Requirements, the auditor considers the existence of relevant matters that may indicate instances of noncompliance, throughout the reporting period and up to the date of signing the auditor’s assurance report.

The auditor complies with the requirements of Auditing Standard ASA 560 Subsequent Events (ASA 560), as appropriate, which may include the following audit procedures:

• Reading minutes of the life company’s Board, as well as minutes of any sub committees responsible, for example, for oversight of risk, compliance and audit, held after balance date and enquiring about matters discussed at these meetings for which minutes are not yet available.
• Examining the life company’s breach registers up to the date of the auditor’s assurance report.
• Enquiring of the life company’s management as to whether any subsequent events have occurred which might represent non compliance with applicable Prudential Requirements.

Prior to issuing the Auditor’s Annual Prudential Assurance Report, the auditor obtains written representations, as are considered appropriate to matters specific to the life company, from the party responsible^[18] for the life company.

These written representations are generally in the form of a representation letter. In obtaining and using these written representations, the auditor complies with the requirements of, as appropriate, Auditing Standard ASA 580 Written Representations (ASA 580) and ASAE 3000.

As the systems, procedures and controls to ensure compliance with Prudential Requirements are part of the life company’s operations, it is possible that either the inherent limitations of the internal control structure, or weaknesses in it, may impact on the effective operation of the life company’s specific control procedures. Furthermore, fraud, error or noncompliance with laws and regulations may occur and not be detected.

Due to the nature of audit and review procedures and other inherent limitations of an audit and review, there is a possibility that a properly planned and executed audit or review may not detect all errors or omissions in life company annual returns, deficiencies in controls, or instances of noncompliance with Prudential Requirements.

An audit provides reasonable assurance and cannot constitute a guarantee that the information included in life company annual returns specified in Attachment A to LPS 310, sourced from accounting records, is reliable, or that all instances of noncompliance with relevant APRA Prudential and Reporting Standards have been detected.

While reviews involve the application of audit related skills and techniques, usually they do not involve many of the procedures performed during an audit. In an audit, as the auditor’s objective is to provide a high, but not absolute, level of assurance on the reliability of information included in life company annual returns, the auditor uses more extensive audit procedures than in a review. Review procedures, therefore, do not provide all the evidence required in an audit and, consequently, the level of assurance obtained is less than that in an audit.

The auditor performs procedures appropriate to provide limited assurance in relation to internal controls existing at the review date, and whether those controls have operated as documented throughout the financial year.

It is the responsibility of the auditor to make the life company aware, as soon as practicable, of any identified material misstatements in life company annual returns, material deficiencies in internal controls and instances of material noncompliance arising from the prudential reporting engagement.

Such communications are made as soon as practicable, either orally or in writing. The auditor’s decision whether to communicate orally or in writing ordinarily is affected by factors such as the nature, sensitivity and significance of the matter to be communicated and the timing of the communications. If the information is communicated orally, the auditor documents the communication.

When, in the auditor’s judgement, those charged with governance do not respond appropriately within a reasonable period of time, the auditor considers whether to modify the auditor’s annual prudential assurance report.

It is important that the auditor understands the additional statutory responsibilities to report certain matters to APRA under the Life Act. Failure to notify APRA as required represents a criminal offence, which attracts criminal penalties (refer paragraphs 132-136).

Material findings (misstatements, control deficiencies and noncompliance) are reported to APRA and the life company’s Board (or Board Audit Committee) as modifications to the auditor’s assurance report (refer paragraph 125).

Under Auditing Standard ASA 260 Communication with Those Charged With Governance (ASA 260), ASA 265 Communicating Deficiencies in Internal Control to Those Charged with Governance and Management (ASA 265) and ASAE 3000, the auditor communicates relevant matters of governance interest arising from the engagement to those charged with governance on a timely basis. Examples of such matters may include:

• The general approach and overall scope of the engagement, or any additional requirements.
• Fraud or information that indicates that fraud may exist.
• Significant deficiencies in internal controls identified during the engagement. A significant deficiency in internal control means a deficiency or combination of deficiencies in internal control that, in the auditor’s professional judgement is of sufficient importance to merit the attention of those charged with governance.
• Disagreements with management about matters that, individually or in aggregate, could be significant to the engagement.
• Expected modifications to the auditor’s prudential assurance report.

The auditor informs those charged with governance of the life company of those uncorrected misstatements, other than clearly trivial amounts, aggregated by the auditor during and pertaining to the engagement that were considered to be immaterial, both individually and in the aggregate, to the assurance engagement.

Under LPS 310, if requested by APRA, the auditor submits directly to APRA all assessments and other material associated with the auditor’s report, such as management letters issued by the auditor to the life company which contain material findings relating to the auditor’s prudential assurance report.

The auditor evaluates the conclusions drawn from the evidence obtained in conducting the assurance engagement as the basis for the auditor’s opinion/conclusion as required under LPS 310.

If the auditor:

1. concludes that a material misstatement, internal control deficiency and/or non compliance exists; or
2. is unable to obtain sufficient appropriate assurance evidence to conclude whether a material misstatement, internal control deficiency and/or non compliance may exist,

the auditor modifies the opinion/conclusion, and includes a clear description of the reasons in the assurance report, in accordance with the requirements of, as appropriate, ASA 705 Modifications to the Opinion in the Independent Auditor’s Report (ASA 705) or ASA 706 Emphasis of Matter Paragraphs and Other Matter Paragraphs in the Independent Auditor’s Report (ASA 706) and applicable ASAEs. (Refer Appendix 2 of this Guidance Statement).

As required under LPS 310, the auditor of a life company must provide the reports to the life company’s Board (or Board Audit Committee)^[19], to ensure the life company can provide the reports to APRA within the timeframes specified in LRS 001.

To avoid the possibility of the assurance report being used for purposes for which it was not intended, the auditor indicates in the auditor’s report the purpose for which the report is prepared and any restrictions on its distribution and use in an emphasis of matter paragraph as required by ASA 706 (refer paragraphs 30-36).

AUASB Standards do not prescribe a standardised format for reporting on all assurance engagements. Instead, both Auditing Standard ASA 800 and ASAE 3000 identify the basic elements required to be included in the assurance report. The short form auditor’s report ordinarily includes only the basic elements. Appendix 1 provides an example auditor’s report with Section A illustrating a reasonable assurance report on the APRA Annual Returns and Section B illustrating a limited assurance report on Controls to ensure compliance with APRA Prudential Requirements.

Assurance reports are tailored to the specific assurance engagement circumstances. Although not specifically required under LPS 310, the auditor may consider it appropriate to include other information and explanations that do not directly affect the auditor’s opinion or conclusions, but provide additional useful information to the users (that is, a ‘long form’ style of reporting). The inclusion of this information depends on its significance to the needs of the intended users. The following are examples of additional information that may be considered for inclusion:

• Disclosure of materiality considerations (materiality levels) applied.
• Significant findings or exceptions relating to particular aspects of the assurance engagement.
• Recommendations.

The auditor ensures that this additional information is clearly separated from the auditor’s opinion and conclusions, and worded in a manner to ensure that it does not affect the opinion and conclusions. This can be achieved, for example, by including any additional information in:

1. a separate appendix to the auditor’s short form assurance report; or
2. a separate section of the auditor’s short form assurance report, following the ‘opinion and conclusions’^[20] in an other matter paragraph as required by ASA 706 Emphasis of Matter Paragraphs and Other Matter Paragraphs in the Independent Auditor’s Report (ASA 706).

This will enable users to clearly distinguish this additional information from the auditor’s responsibility to report on the matters identified in LPS 310.

Refer to Appendix 1 of this Guidance Statement for an illustrative example of the auditor’s annual prudential assurance report (short form report), prepared pursuant to APRA’s LPS 310 annual reporting requirements.

It is important that management, those charged with governance and the auditor of a life company^[21] understand the additional responsibilities to report to APRA under sections 80, 88 and 88A of the Life Act (refer paragraph 28).

The Life Act specifies under section 80(3) that the apportionment of income and outgoings for a life company carrying on other business as well as its Life Insurance business is not effective unless a report given by the auditor of the life company for the purposes of FSCODA states that the apportionment has been made equitably and in accordance with generally accepted accounting principles. Section 80(2) of the Life Act states that before an apportionment is made, those charged with governance of the company concerned must obtain the appointed actuary’s written advice whether the basis of the proposed apportionment is appropriate.

This report is provided by the auditor as part of the annual return(s) audit opinion. An example is given in Appendix 1 Part A.

Under section 88 of the Life Act, the auditor has certain obligations to report to the company or those charged with governance any matters that come to the attention of the auditor that the auditor thinks requires action to be taken by the company or its directors. If the auditor of a life company concludes that there are reasonable grounds for believing that the company or those charged with governance have contravened the Life Act or any other law and it may significantly affect the interests of the policy holders the auditor must immediately inform APRA in writing. It is a serious offence under sub section 137.1 and 137.2 of the Criminal Code 1995 to provide, whether directly or indirectly, false or misleading documents or information to a Commonwealth entity such as APRA.

Section 89 of the Life Act applies the concept of qualified privilege to auditors of a life company and is in addition to any privilege conferred on a person by the Corporations Act 2001.

Section 88A of the Life Act states:

1. a person who is or was the auditor of a life company may give information, or produce books, accounts or documents, about the life company to APRA if the person considers that doing so will assist APRA in performing its functions under this Act or under the FSCODA.
2. a person who, in good faith and without negligence, gives information to APRA in accordance with this section is not subject to any action, claim or demand by, or any liability to, any other person in respect of the information.

Under LPS 310, in addition to the annual prudential reporting requirements, APRA may require a life company, by notice in writing, to arrange for its auditor (who may be the existing auditor or another auditor agreed to by APRA and who satisfies the criteria in LPS 310), to provide a report on a particular aspect of the life company’s operations, risk management or financial affairs. Although a special purpose engagement report will normally only be requested following consultation with a life company, APRA may commission such a report without prior consultation with a life company.

Unless otherwise determined by APRA, an auditor appointed to undertake a special purpose engagement will be required to provide limited assurance on the matters required to be reported on.

Under LPS 310, the auditor’s special purpose engagement assurance report is to be submitted simultaneously to APRA and the life company’s Board (or Board Audit Committee)^[22], within three months of the date of the notice commissioning the report, unless otherwise determined by APRA, and advised to the life company by notice in writing.

The APRA requirement for an auditor to undertake a special purpose engagement in a selected area of the life company’s operations, risk management or financial affairs constitutes a separate reporting engagement. The details of the engagement will normally be the subject of a specific request from APRA to the life company and a separate engagement letter from the life company to the auditor based on that request.

Following the determination by APRA of the specific area to be examined, the auditor, APRA and the life company agree on the terms of the engagement in accordance with the requirements of applicable AUASB Standards. These arrangements are legally binding and include the required terms of engagement specified in LPS 310.

The auditor accepts the engagement only when the auditor is satisfied that the auditor and the engagement team, if applicable, have met the relevant ethical requirements relating to the assurance engagement. The concept of independence is important to the auditor’s compliance with the fundamental ethical principles of integrity and objectivity and the auditor must be able to meet the independence requirements stipulated under both CPS 510 and ASA 102.

An engagement letter (or other suitable form) helps to avoid misunderstandings with respect to the engagement and confirms both the life company’s and the auditor’s understanding of the terms of the engagement, and the auditor’s acceptance of the appointment. Both parties sign the engagement letter to acknowledge that it is a legally binding contract.

To ensure that there is a clear understanding regarding the terms of the engagement, the following are examples of matters to be agreed:

• APRA is to identify the scope of the life company’s operations, risk management or financial affairs to be the subject of the engagement.
• The auditor, APRA and the life company are to agree on the objectives of the engagement, key features and criteria of the area(s) to be examined, and the period to be covered by the engagement.
• APRA is to identify clearly the level of assurance required, that is, limited or reasonable assurance.
• The format of reports required (for example, long and/or short form reports) and other communication of results of the engagement.
• Responsibility of those charged with governance for the subject matter of the engagement.
• Understanding of the inherent limitations of an assurance engagement.

The format of the special purpose assurance report may vary depending on the type of engagement: that is, an audit (reasonable assurance) or a review (limited assurance), as well as the subject matter and the findings. The auditor has regard to the requirements, guidance and illustrative examples of reports provided in relevant AUASB Standards - ASAs, ASREs and ASAEs, as applicable, when preparing the special purpose assurance report.

AUASB Standards do not require a standardised format for special purpose reporting under LPS 310. Instead, these Standards identify the basic elements to be included in the auditor’s report. Ordinarily, the auditor adopts a long form style of reporting and the report may include a description of the terms of the engagement, materiality considerations applied, the assurance approach and an other matter paragraph which may include - findings relating to particular aspects of the engagement and, in some cases, recommendations.

The auditor’s assurance report is to be restricted to the parties that have agreed to the terms of the special purpose engagement, namely the life company and APRA, as well as other parties with whom APRA is lawfully entitled to share the information, by means of an emphasis of matter paragraph required by ASA 706 (refer example at Appendix 1).

As this Guidance Statement relates to Australian legislative requirements, there is no equivalent International Standard on Auditing or International Auditing Practice Statement to this Guidance Statement.