Document ID: chunk:federal_register_of_legislation:F2024L01251:clause:2_23:p2
Version: federal_register_of_legislation:F2024L01251
Segment Type: clause
Provision Reference: sch 2 cl 23 (pt 2/6)
Character Range: 127984–130791

to assess compliance with the obligations referred to in subsection (2).
Note: Credit reporting bodies have obligations to ensure that audits of credit providers are conducted in relation to the quality and security of credit reporting information: see subsections 20N(3)(b) and 20Q(2)(b) of the Act.

Requirements for auditors of credit providers
 (4) Subject to subsections (5) and (6), any of the following may be used in audits as part of a credit reporting body's auditing program for the purposes of paragraph (3)(d) above:
 (a) a body's compliance or auditing team;
 (b) consultants engaged by the body;
 (c) consultants engaged by the credit provider, where the body is satisfied of the consultant's independence and expertise; or
 (d) an industry funded organisation where the body is satisfied as to that organisation's independence and expertise.
 (5) For the purposes of the Act, an auditor is independent of a credit provider (and therefore eligible to conduct audits of that provider under Part IIIA of the Act and programs described in this section) if:
 (a) the auditor is not a director or employee of the provider and does not have a significant financial interest in the provider; and
 (b) the auditor has not at any time during the previous 12 months had a relationship or interest described in paragraph (a); and
 (c) where the auditor is an employee of a credit reporting body – the body's organisational structure and supervision arrangements achieve functional independence for the auditor; and
 (d) where the auditor is an employee of an industry-funded organisation – the organisation's governance and supervision arrangements achieve functional independence for the auditor; and
 (e) the auditor does not have any other association that would impair the perception of the auditor's independence; and
 (f) the auditor has not at any time during the previous 12 months had an association described in paragraph (e).
 (6) A credit reporting body must take reasonable steps to ensure that a person who conducts an audit of a credit provider as part of the body's auditing program referred to in subsection (3) has sufficient expertise for the role including:
 (a) knowledge of the requirements of Part IIIA of the Act, the Regulations and this CR Code; and
 (b) knowledge of audit methodology and previous experience in conducting audits; and
 (c) credit reporting system experience.
 (7) A credit reporting body must take reasonable steps to ensure that its audit oversight, including reporting arrangements, is sufficient to enable the body to form a view as to whether the credit provider is complying with the obligations referred to in subsection (2).
 (8) A credit provider must permit a person who conducts an audit of the provider as part of a credit reporting body's auditing