Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p13
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 13/17)
Character Range: 171884–174751

July 2026; and
 (b) gives the nomination, in writing, to the Digital ID Regulator on or before 30 January 2025.
 (2) If a transitioned accredited entity has nominated a first annual review date in accordance with subrule (1), the reporting period for that entity is:
 (a) for the entity's first reporting period—the period beginning on the day the Act commenced and ending on the first annual review date nominated by the entity in accordance with subrule (1); and
 (b) for subsequent reporting periods—each 12‑month period after the period mentioned in paragraph (a).
 (3) The reporting period for a transitioned accredited entity not covered by subrule (2) is:
 (a) for the entity's first reporting period—the period beginning on the day the Act commenced and ending 12 months after that date; and
 (b) for subsequent reporting periods—each 12‑month period after the period mentioned in paragraph (a).
Example: An entity which must complete its first annual review by 1 December 2025 must complete subsequent annual reviews by 1 December of each subsequent year.

Other accredited entities
 (4) The reporting period for an accredited entity not covered by subrule (2) or (3) is:
 (a) for the entity's first reporting period—the 12‑month period starting on the day the entity's accreditation comes into force and ending 12 months after that date; and
 (b) for subsequent reporting periods—each 12‑month period after the period mentioned in paragraph (a).

6.3  Scope of annual review

Review of changes
 (1) An accredited entity must, for each reporting period, identify any changes to the entity's accredited services and DI data environment that may affect the entity's ability to comply with its obligations under the Act, these rules or the Accreditation Data Standards.
 (2) The accredited entity must:
 (a) for each change identified:
 (i) consider the impact of the change on the entity's accredited services and DI data environment;
 (ii) consider whether the change, and all changes considered cumulatively, might affect the entity's ability to comply with the requirements of the Act, these rules or the Accreditation Data Standards; and
 (iii) assess whether the change is a material change; and
 (b) update the entity's statement of scope and applicability to address each material change identified; and
 (c) provide the updated statement of scope and applicability to each assessor conducting an assurance assessment or system testing for the entity.
Response to material changes
 (3) For any material change identified, the accredited entity must:
 (a) conduct an assurance assessment or systems testing to the extent required:
 (i) to assess or test the effect of the material change; and
 (ii) to ensure and demonstrate that the entity continues to be able to comply with the controls and requirements under the Act, these rules or the Accreditation