Document ID: chunk:federal_register_of_legislation:F2024C01258:schedule:1:p1
Version: federal_register_of_legislation:F2024C01258
Segment Type: schedule
Provision Reference: sch 1 (pt 1/2)
Character Range: 341058–344136

Schedule 1—Default conditions on accreditations

Part 1—Preliminary

1.1  Purpose of Schedule
  This Schedule sets out the default conditions on accreditations, for rule 5.9 of these rules.

Part 2—Default conditions on accreditations

2.1  Ongoing reporting obligation on accredited persons without streamlined accreditation
 (1A) This clause applies to an accredited person other than one with streamlined accreditation under rule 5.5.
 (1) In this clause:
ASAE followed by a number means the standard with that number issued by the Auditing and Assurance Standards Board of the Australian Government (AUASB).
approved means approved for the purposes of this clause in guidelines issued by the Data Recipient Accreditor.
assurance report means:
 (a) for a person with unrestricted accreditation—a report that is made in accordance with:
 (i) ASAE 3150; or
 (ii) an approved standard, report or framework; and
Note: See the accreditation guidelines, which could in 2023 be downloaded from https://www.cdr.gov.au.
 ASAE 3150 could in 2023 be downloaded from the Auditing and Assurance Standards Board's website (https://www.auasb.gov.au/admin/file/content102/c3/Jan15_ASAE_3150_Assurance_Engagements_on_Controls.pdf).
 (b) for a person with sponsored accreditation—an assessment of its capacity to comply with Schedule 2 that is made in accordance with any approved requirements;
that does not include the information that must be provided in an attestation statement.
attestation statement means:
 (a) for a person with unrestricted accreditation—a statement in the form of a responsible party's statement on controls and system description that is made in accordance with ASAE 3150; and
 (b) for a person with sponsored accreditation—a statement about its compliance with Schedule 2 that is made in accordance with any approved requirements.

Attestation statements
 (2) The accredited person must provide an attestation statement to the Data Recipient Accreditor within 3 months after the end of:
 (a) the first reporting period; and
 (b) every second reporting period thereafter;
  that covers the reporting period.

Assurance reports
 (3) The accredited person must provide an assurance report to the Data Recipient Accreditor within 3 months after the end of:
 (a) the reporting period after the first reporting period; and
 (b) every second reporting period thereafter;
  that covers the reporting period.

Reporting periods
 (4) In this clause, subject to subclause (5), a reporting period for an accredited person is either a financial year or a calendar year, as determined for the accredited person by the Data Recipient Accreditor.
 (5) However the first reporting period for an accredited person is taken to be the period that:
 (a) if the accreditation decision takes effect within 3 months before the end of a reporting period—starts on the day the accreditation takes effect and ends on the last day of the following reporting period; and
 (b) otherwise—starts on the day the accreditation decision takes effect and ends on the last day of that reporting period.