Document ID: chunk:federal_register_of_legislation:F2023L01225:body:0:p6
Version: federal_register_of_legislation:F2023L01225
Segment Type: other
Provision Reference: 
Character Range: 14227–17356

and customer queries by telephone and internet.

Testing
    25.         An ADI must regularly review and test[3] its ability to:

       (a)          generate SCV data as required by this Prudential Standard;

       (b)          capture alternative ADI account data for an existing electronic banking account-holder as required by this Prudential Standard;

       (c)          generate and transmit payment instruction information to the RBA, or another paying agent nominated by APRA, as required by this Prudential Standard, in a way that maintains the confidentiality of account-holder information;

       (d)          generate and transmit the reports as required by this Prudential Standard; and

       (e)          comply with the communications requirements in this Prudential Standard.

    An ADI must test these requirements in accordance with a testing schedule that will be specified by APRA.

    26.         An ADI's FCS-related systems and processes must be revised to address any shortcomings identified as a result of the review and testing required under paragraph 25 of this Prudential Standard.

Audit
    27.         In accordance with Prudential Standard APS 310 Audit and Related Matters (APS 310), the appointed auditor must provide limited assurance that:

       (a)          the ADI has controls that are designed to ensure that SCV data, to the extent practicable, and FCS payment and reporting information can be relied upon as being complete and accurate and in accordance with this Prudential Standard; and

       (b)          these controls operated effectively when tested.

    28.         An ADI must ensure that the appointed auditor provides the assurance required by paragraph 27 of this Prudential Standard at the same time as assurance is required by APS 310, unless otherwise agreed by APRA.

    29.         Notwithstanding the requirements in paragraph 27 of this Prudential Standard, APRA may require an ADI to engage an auditor to undertake a reasonable or limited assurance engagement[4] of SCV systems and data, and the systems used to generate and transmit FCS payment and reporting information.

Attestation
    30.         It is the responsibility of the Board and senior management of an ADI to ensure that appropriate policies and procedures are in place to ensure the integrity of the operations, internal controls and information required by this Prudential Standard.

    31.         An ADI must, within three months of its annual balance date, provide APRA with an attestation from its CEO.[5]

    32.         The CEO must attest, for the financial year to which the declaration relates, that:

       (a)          the ADI has taken all necessary steps to ensure that it is compliant with the requirements set out in this Prudential Standard;

       (b)          the ADI has systems and processes that allow it to identify, to the extent practicable, each unique account-holder who holds a protected account;

       (c)          the ADI is able to calculate an SCV for each unique account-holder identified and transmit those data to APRA, or to a