It is the responsibility of the appointed auditor to make the ADI aware, as soon as practicable, of any identified material misstatements in ADI Reporting Forms, material deficiencies and/or deviations in internal controls and instances of material non-compliance arising from the prudential reporting engagement.

Such communications are made as soon as practicable, either orally or in writing. The appointed auditor’s decision whether to communicate orally or in writing ordinarily is affected by factors such as the nature, sensitivity and significance of the matter to be communicated and the timing of the communications. If the information is communicated orally, the appointed auditor needs to document the communication.

When, in the appointed auditor’s judgement, those charged with governance do not respond appropriately within a reasonable period of time, the appointed auditor considers whether to modify the auditor’s annual prudential assurance report.

It is important that the appointed auditor understands their additional statutory responsibilities to report certain matters to APRA under the Banking Act. Failure to notify APRA as required represents criminal offences, which attracts criminal penalties.^[103]

Material findings (misstatements, control deficiencies and/or deviations and non-compliance) are reported to APRA and the ADI’s Board (or Board Audit Committee) as modifications to the appointed auditor’s assurance report.

Under Auditing Standard ASA 260 Communication with Those Charged With Governance, ASA 265 Communicating Deficiencies in Internal Control to Those Charged with Governance and Management and ASAE 3000, the appointed auditor communicates relevant matters of governance interest arising from the engagement to those charged with governance on a timely basis. Examples of such matters may include:

• The general approach and overall scope of the engagement, or any additional requirements.
• Fraud or information that indicates that fraud may exist.
• Significant deficiencies and/or deviations in internal controls identified during the engagement. A significant deficiency is a deficiency or combination of deficiencies in internal control relevant to the engagement that, although not material, in the appointed auditor’s professional judgement is of sufficient importance to merit the attention of those charged with governance.
• Disagreements with management about matters that, individually or in aggregate, could be significant to the engagement.
• Expected modifications to the auditor’s prudential assurance report.

The appointed auditor informs those charged with governance of the ADI of those uncorrected misstatements, other than clearly trivial amounts, aggregated by the appointed auditor during and pertaining to the engagement that were considered to be immaterial, both individually and in the aggregate, to the assurance engagement.

Under APS 310 and 3PS 310, if requested by APRA, the appointed auditor submits directly to APRA all assessments and other material associated with the auditor’s report, such as management letters issued by the appointed auditor to the ADI which contain material findings relating to the auditor’s prudential assurance report(s).