The appointed auditor evaluates the evidence obtained in conducting the assurance engagement as the basis for the auditor’s opinion/conclusions as required under APS 310, 3PS 310 and APS 910, as applicable.

If the appointed auditor:

1. concludes that a material misstatement, internal control deficiency or deviation, and/or non-compliance exists; or
2. is unable to obtain sufficient appropriate assurance evidence to conclude whether a material misstatement, internal control deficiency or deviation, and/or non-compliance may exist,

the appointed auditor modifies the auditor’s opinion/conclusions, and includes a clear description of the reasons in the assurance report, in accordance with the requirements of, as appropriate, ASA 705 and other applicable AUASB Standards.^[104]

As required under APS 310, 3PS 310 and APS 910, the appointed auditor of an ADI and ADI Group generally reports simultaneously to APRA and the ADI’s Board (or Board Audit Committee)^[105], within three^[106] months of the end of the financial year of the ADI.

In accordance with the requirements of APS 310 and 3PS 310, where an ADI is the head entity of a Level 2 or Level 3 group, the auditor issues either separate reports for, as applicable, Level 1, Level 2 and Level 3, or a combined report for the ADI (head entity) and the group. The auditor’s report must make it clear where the auditor is referring to matters relating to the ADI (head entity) or the group.

To avoid the possibility of the assurance report being used for purposes for which it was not intended, the appointed auditor ordinarily indicates in the auditor’s report the purpose for which the report is prepared and any restrictions on its distribution and use.

The appointed auditor prepares the prudential assurance report(s) in accordance with the relevant AUASB Standards applicable to each part of the engagement. AUASB Standards do not prescribe a standardised format for reporting on all assurance engagements. Instead, these Standards identify the basic elements required to be included in the assurance report. The ‘short form’ auditor’s report ordinarily includes only the basic elements. In relation to reasonable and limited assurance subject matters of this Guidance Statement, APRA has prescribed the form of the assurance report.

When expressing an opinion on historical financial information prepared in accordance with a compliance framework, ASA 805 would ordinarily require the auditor's opinion to state that the subject matter is prepared, in all material respects, in accordance with the applicable reporting framework.^[107] However, as APRA’s Prudential Standards mandate that the appointed auditor must provide an opinion on whether the financial information included in the Part A Specified ADI Reporting Forms is reliable and in accordance with the relevant APRA Prudential Standards and Reporting Standards, this form of opinion has been adopted in the Appendix 4 assurance report.

ASA 805 also requires that application of the financial reporting framework result in a presentation that provides adequate disclosures to enable the intended users to understand the information conveyed in the report.^[108] The general concept of reliability would not ordinarily be adequate to satisfy the requirements of ASA 805. However, as set out in paragraphs 93-97 of this Guidance Statement, APRA has specified a frame of reference for the auditor to evaluate the concept of reliability for the purposes of forming an opinion on the Part A Specified ADI Reporting Forms.

The principles set out in paragraphs 281 and 282 also apply to the appointed auditor’s conclusion on the financial information included in the Part B Specified ADI Reporting Forms, where the auditor is required to provide limited assurance, in accordance with the reporting requirements of ASRE 2405^[109], that such information is reliable and in accordance with the relevant APRA Prudential and Reporting Standards.

APRA has agreed the prescribed form of the assurance report for the purposes of APS 310/3PS 310 and APS 910. In particular as it pertains to Part C and the application of ASAE 3150 requirements, as it may not be practicable for the appointed auditor to fully identify the controls subject to Part C of the APS 310/3PS 310 engagement in the assurance report to the level of detail specified in ASAE 3150, the prescribed form does not require these elements of ASAE 3150^[110]. ASAE 3000 and ASAE 3150 permit an alternative form of assurance report where this is prescribed by regulation and the intended users would not misunderstand the alternative form.^[111] As APRA has agreed the prescribed form and is also the intended user, the form of the assurance reports set out in Appendices 4 and 5 is taken to be in accordance with the requirements of ASAE 3000 and ASAE 3150.

Assurance reports are tailored to the specific assurance engagement circumstances. Although not specifically required, the appointed auditor may consider it appropriate to include other information and explanations that do not directly affect the auditor’s opinion/conclusions, but provide additional useful information to the users (that is, a ‘long form’ style of reporting).^[112] The inclusion of this information depends on its significance to the needs of the intended users. The following are examples of additional information that may be considered for inclusion:

• Disclosure of materiality considerations (materiality levels) applied.
• Significant findings or exceptions relating to aspects of the assurance engagement.
• Recommendations.

The appointed auditor needs to ensure that this additional information is clearly separated from the auditor’s opinion/conclusions, and worded in a manner to ensure that it does not affect the opinion/conclusions. This can be achieved, for example, by including any additional information in a:

1. separate appendix to the auditor’s short form assurance report; or
2. separate section of the auditor’s short form assurance report, under an appropriate heading.^[113].

This will enable users to clearly distinguish this additional information from the auditor’s responsibility to report on the matters identified in APS 310/3PS 310 and APS 910, if applicable.

Refer to Appendix 4 of this Guidance Statement for an illustrative example of the auditor’s annual prudential assurance report, prepared pursuant to APRA’s APS 310 and 3PS 310 annual reporting requirements. The format and content of this report has been approved by APRA as adequate for the purpose of reporting under APS 310/3PS 310.

APS 910 Assurance Report

APRA requires the timing of the annual APS 910 engagement to be aligned with the annual APS 310 engagement. Although there will be some overlap between APS 310/3PS 310 and APS 910 engagements, APRA’s preference is that separate reports be prepared for the APS 310/3PS 310 and APS 910 engagements. APRA indicated that this would facilitate clearer communication with respect to APS 910 matters. The requirement is for these reports to be submitted to APRA at the same time.

Therefore, all APS 910 requirements (compliance and controls) are aggregated into a separate APS 910 auditor’s report and, to avoid duplication, are excluded from the APS 310 report.

Where the APS 910 auditor’s report is modified, this is referred to in the APS 310/3PS 310 auditor’s report and may lead to a modification of the APS 310/3PS 310 auditor’s report.

Refer to Appendix 5 of this Guidance Statement for an illustrative example of the auditor’s annual prudential assurance report, prepared pursuant to APRA’s APS 910 annual reporting requirements. The format and content of this report has been approved by APRA as adequate for the purpose of reporting under APS 910.