Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p14
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 14/17)
Character Range: 174518–177472

required:
 (i) to assess or test the effect of the material change; and
 (ii) to ensure and demonstrate that the entity continues to be able to comply with the controls and requirements under the Act, these rules or the Accreditation Data Standards, affected by the material change;
Note 1: A full assurance assessment or system testing is not required if the material change does not affect all controls. The assessment or testing can be limited to those controls that may be affected.
Note 2: If a material change is a high privacy risk project, the accredited entity is required to conduct a privacy impact assessment before making the change—see rule 4.37 which applies the Privacy (Australian Government Agencies- Governance) APP Code 2017 to accredited entities that are not agencies under the Privacy Act. That Code requires a privacy impact assessment for high privacy risk projects.
 (b) conduct technical testing to the extent that the material change relates to one of the requirements specified in subrule 2.5(2), to ensure the entity's information technology system continues to have the functionality necessary to meet those requirements, and record in respect of that testing each of the matters specified in subrule 2.5(3); and
 (c) if the accredited entity is an ISP that conducts biometric binding or authentication using biometric information—conduct testing of the presentation attack detection technology, the biometric matching algorithm, source biometric matching or the eIDVT in respect of the activities affected by the material change.
 (4) For each reporting period, the accredited entity must review any condition imposed by the Digital ID Regulator relating to the collection and disclosure of restricted attributes by the entity to determine if the condition continues to be required.

6.4  Assurance assessments

Fraud assessment
 (1) An accredited entity must conduct a fraud assessment in the reporting period after its first reporting period and thereafter in every alternate reporting period.

 (2) Despite subrule 3.6(2), the fraud assessment may be conducted by an assessor who does not meet the additional requirements in that rule if:
 (a) in the previous 2 years, a fraud assessment has been conducted;
 (b) the assessor who conducted the most recent fraud assessment meets the requirements in subrule 3.6(2);
 (c) that assessor prepared a report for the most recent fraud assessment in accordance with rule 3.17; and
 (d) that assessor stated in their report that the entity's fraud management capability is sufficiently mature, including that the entity's personnel are sufficiently experienced in managing that capability, such that the entity's personnel can complete the next fraud assurance assessment.

Protective security assessment
 (3) An accredited entity must conduct a protective security assessment in the reporting period after its first reporting period and thereafter in every alternate reporting