Background

1. The Australian Prudential Regulation Authority (APRA) is the prudential regulator of Australia’s financial services industry. APRA supervises financial institutions across the deposit-taking, insurance and superannuation industries. APRA supervises a wide range of superannuation funds under the Superannuation Industry (Supervision) Act 1993.¹ Superannuation entities regulated by APRA are called registrable superannuation entities and include superannuation funds, approved deposit funds, pooled superannuation trusts and small APRA funds.² In June 2015 there were 155 licensed trustees³ responsible for 242 registrable superannuation entities with more than four members.

2. As at 30 June 2015, APRA-regulated funds controlled $1.2 trillion in superannuation industry assets. APRA’s role in undertaking superannuation regulatory activities is to ensure that superannuation entities manage risk prudently in order to meet the financial promises made to superannuation beneficiaries—that is, to protect the financial interests of superannuation fund members.

Audit objective and criteria

3. The objective of the audit was to assess the effectiveness of APRA’s processes for the prudential regulation of superannuation entities.

4. To form a conclusion on the audit objective the following high-level criteria were adopted:

• prudential and reporting standards are determined in accordance with legislation, in consultation with stakeholders, and having regard to risk;
• effective arrangements exist for the processing and consideration of superannuation entity licence applications, and registration of entities;
• risks to the interests of beneficiaries are identified, and arrangements are in place to guide APRA’s superannuation prudential regulation activities; and
• APRA effectively supervises superannuation entities to monitor their ability to meet the reasonable expectations of beneficiaries, and takes action where issues are identified.

Conclusion

5. APRA’s risk management arrangements and supervision framework provide a sound basis for supervising the superannuation industry, which has had few entity failures in recent years. APRA also has effective arrangements in place for setting prudential and reporting standards, providing guidance to assist superannuation entities in complying with the requirements of the standards, and processing licensing and registration applications for superannuation entities. However, there is scope for APRA to improve its management of supervision activities, to support superannuation entities to better manage prudential risks on behalf of beneficiaries. In recent years, similar superannuation entities have received varying levels of supervision and higher risk entities have not consistently been subject to more intense supervision. Further, many of the activities reviewed by the ANAO were late and not recorded in the issues and document management systems, and APRA has limited external reporting of its supervision of the superannuation industry.

Supporting findings

Standard setting

6. APRA determines prudential standards and reporting standards in accordance with the relevant requirements under the Superannuation Industry (Supervision) Act 1993, the Financial Sector (Collection of Data) Act 2001, the Superannuation Industry (Supervision) Regulations 1994 and the Corporations Act 2001. It also has effective internal policy development processes for the development of prudential standards and reporting standards.

7. APRA’s policy initiatives in relation to prudential and reporting standards are informed by government policy directions and relevant intelligence, and it undertakes detailed regulatory impact assessments and cost-benefit analyses of its proposed policy initiatives. In developing standards, APRA seeks to achieve an appropriate balance between the benefits of financial safety for superannuation beneficiaries and considerations of efficiency, contestability, competition and competitive neutrality. APRA’s standards development process complies with the requirements of the Office of Best Practice Regulation.

8. APRA consults effectively with internal and external stakeholders in the development of prudential and reporting standards. It also provides a range of guidance to support superannuation entities to comply with prudential and reporting standards. The guidance is clear and consistent with the relevant standards and APRA’s legislative powers.

9. APRA has undertaken reviews and amendments of its prudential standards, reporting standards and prudential practice guides when industry issues or risks were identified or there were changes in government policy. However, APRA has not yet established a review program or scheduled a point-in-time review of the effectiveness and appropriateness of its suite of standards and prudential practice guides since their implementation in 2013. The timeframe for undertaking such a review is approaching given that APRA specified that they would be reviewed three to four years after their implementation.

Licensing and registration

10. APRA provides appropriate forms and guidance to support the licensing and registration of superannuation entities. The application forms are aligned with legislative requirements for the licensing and registration of registrable superannuation entities, and support applicants to provide relevant information in their application. APRA also publishes suitable guidance material on its website to assist entities with the application process. Minor improvements could be made to the licence application form and related guidance material.

11. APRA assesses licence and registration applications in accordance with the requirements of the Superannuation Industry (Supervision) Act 1993 and superannuation prudential standards. The assessment of the applications is consistent with APRA’s internal guidance and procedures for licensing and registration. APRA’s decisions about licence and registration applications are documented, timely and subject to appropriate assurance processes.

Risk management arrangements and supervision framework

12. The design of APRA’s risk management arrangements supports its supervision of the superannuation industry, including a detailed risk assessment system for individual superannuation entities. However, there is scope to improve the implementation of these arrangements. In particular, APRA can more consistently undertake individual superannuation entity risk assessments and better manage identified industry-wide superannuation risks.

13. APRA’s supervision framework promotes a proportionate approach to undertaking supervision activities. It encompasses a minimum baseline level of activity determined by entity asset size (impact) and additional activity determined by assessed entity risk and size (supervisory stance). Within this framework, there were a number of instances where supervision had not been appropriately tailored to risk, including:

• entities with the same supervision stance were subject to varying levels of supervision activity;
• activities were sometimes undertaken in accordance with asset size rather than supervisory stance; and
• some entities were not subject to the baseline level of supervision activity.

Supervision activities and reporting

14. While undertaking a substantial number of supervisory activities that have made many proposals for improved performance by superannuation trustees, APRA has not managed supervisory activities for the superannuation industry as effectively as it could have. The ANAO’s analysis of 50 electronic trustee files found that only four per cent of the actions proposed in prudential reviews were recorded in APRA’s issues management system, which has limited APRA’s ability to monitor entities’ responses to outcomes and analyse trends from this information in its industry risk analysis. Further, more than half of the superannuation supervision activities completed by APRA from 1 July 2013 to 24 March 2016 were overdue and a large proportion of prudential reviews examined by the ANAO were not recorded electronically in line with internal guidance. While few in number, APRA has not routinely reviewed its supervision of entities subject to enforcement action to identify opportunities to improve its broader supervision approaches.

15. APRA does not have a quality assurance framework. It does not undertake independent reviews of supervisors’ work such as financial and qualitative analysis or interactions with entities.

16. There is limited oversight by APRA’s Executive of the implementation of supervision activities, and APRA can better specify its key performance indicators to measure the timeliness, quality and implementation of supervision activities. While APRA reports stakeholder survey results by industry, it does not report any other disaggregated performance information by industry in its annual reports. Consequently, there is limited performance information available externally to enable stakeholders to form a view as to whether APRA is effectively supervising the superannuation industry.

Recommendations

Summary of entity response

17. APRA’s summary response to the report is provided below, while its full response is in Appendix 1.

APRA is pleased to note the ANAO’s conclusions that:

• APRA has effective arrangements in place for setting prudential and reporting standards and providing guidance to assist superannuation entities to comply with the requirements of the standards;
• APRA has effective arrangements in place for processing licensing and registration applications for superannuation entities; and
• APRA’s risk management arrangements and supervision framework provide a sound basis for supervising the superannuation industry.

The Report contains four recommendations and a number of suggestions that, when implemented, will enhance the quality of APRA’s supervision of superannuation, as well as the other areas of the financial sector for which APRA has responsibility. Importantly, the recommendations and suggestions align with initiatives that APRA has already identified for action in our 2016-2020 Corporate Plan.

Our letter of reply provides a fuller response to some of the issues of detail contained within the Report.

Australian Prudential Regulation Authority

1.1 The Australian Prudential Regulation Authority (APRA) is a Commonwealth statutory authority in the Treasury portfolio. APRA was established on 1 July 1998 by the Australian Prudential Regulation Authority Act 1998, and sources its powers from this and other industry specific legislation including: the Banking Act 1959, the Insurance Act 1973, the Life Insurance Act 1995, and the Superannuation Industry (Supervision) Act 1993.

1.2 As the prudential regulator of Australia’s financial services industry, APRA is responsible for prudential supervision of individual financial institutions and for promoting financial system stability in Australia. In doing so, APRA assesses whether entities are at risk of failing to fulfil their obligations to beneficiaries by monitoring the financial position and governance of institutions. The entities that APRA regulates include:

• authorised deposit-taking institutions (banks, credit unions and building societies);
• general insurers, life insurers, private health insurers and friendly societies; and
• superannuation funds (excluding self-managed superannuation funds⁴ and exempt Public Sector Superannuation Schemes⁵).

1.3 APRA’s approach to regulation is based on the premise that the primary responsibility for financial soundness and prudent risk management rests with an entity’s own board of directors and senior management. Accordingly, APRA’s role is to promote prudent behaviour through a prudential framework to ensure that a regulated entity takes reasonable risks and is well managed. In doing so, APRA seeks a low incidence of failure as opposed to zero failure.⁶

1.4 In 2016–17, APRA’s total appropriation was $664.1 million—$532.7 million administered and $131.3 million departmental expenses. APRA’s estimated average staffing level for 2016–17 is 605 FTE, and approximately 77 of those are non-Executive staff directly responsible for supervising superannuation entities.⁷ APRA has industry cost recovery arrangements for its supervision activities and some licensing and registration activities.

Superannuation industry

1.5 As at 30 June 2015, Australian superannuation funds controlled total assets of $2.0 trillion.⁸ Superannuation funds are classified as corporate, industry, public sector, retail, or small. Table 1.1 provides an overview of each of these and their relative size within the industry.

Table 1.1: Superannuation industry as at 30 June 2015

Note a: Exempt Public Sector Superannuation Schemes make up $131.1 billion of public sector superannuation funds.

Note b: Self-managed superannuation funds are not regulated by APRA.

Note c: These are regulated under the Life Insurance Act 1995, not as superannuation entities.

Source: Australian Prudential Regulation Authority, Annual Superannuation Bulletin, APRA, 2016.

1.6 Superannuation entities regulated by APRA are called registrable superannuation entities and include superannuation funds, approved deposit funds, pooled superannuation trusts and small APRA funds.⁹ As at 30 June 2015, APRA-regulated funds controlled $1.2 trillion in superannuation industry assets.

1.7 In June 2015 there were 155 licensed trustees¹⁰ responsible for 242 registrable superannuation entities with more than four members. In 2014–15, the number of trustees and the number of registrable superannuation entities with more than four members declined by 14 and seven, respectively. Figure 1.1 illustrates the industry consolidation over the past decade, which APRA attributes to regulatory reform and a search for economies of scale. Over the same period, assets have more than doubled.

Figure 1.1: Number of APRA-regulated superannuation entities and their total assets

Note: Number of APRA-regulated entities excludes small APRA funds.

Source: ANAO analysis.

1.8 In 2011 and 2012, the Government introduced the Stronger Super reforms as a response to the 2010 Super System Review¹¹ into the governance, efficiency, structure and operation of Australia’s superannuation system.¹² The key elements of the reforms were: the introduction of MySuper, as a simple and cost‐effective default superannuation service in order to increase competition and decrease costs; a set of reforms, called SuperStream, aimed at improving the administration of superannuation entities; a range of measures with the objective of improving the governance and integrity of the superannuation system; and reforms to increase the integrity of self-managed superannuation funds. As part of the reforms, legislation was amended to allow APRA to create prudential standards—which APRA introduced in July 2013—that set out binding requirements that must be complied with by superannuation entities. APRA also introduced reporting standards to incorporate enhanced data collection and data publication requirements related to the Stronger Super reforms.

1.9 A key challenge facing the superannuation industry is the changing demographic of the Australian population. The change has resulted in a large number of members transitioning from the accumulation phase to the post-retirement phase, which is evidenced by benefit payments rising faster than contributions. This poses ongoing liquidity and investment risks for trustees in meeting their obligations to beneficiaries.

APRA’s regulation of the superannuation industry

1.10 APRA’s mission has two key aspects: to establish prudential standards and practices designed to ensure that, under all reasonable circumstances, financial promises made by institutions are met within a stable, efficient and competitive financial system; and to enforce those standards and practices.¹³ The first of these aspects is delivered through the prudential framework which is different for each industry that APRA regulates. The second is through APRA’s supervisory framework which is primarily the same across all regulated industries. Figure 1.2 provides an overview of the frameworks and how they relate to each other.

Figure 1.2: APRA’s regulatory responsibilities

Source: ANAO analysis of APRA information.

Superannuation prudential framework

1.11 The prudential framework for the superannuation industry is outlined in Figure 1.3.

Figure 1.3: Prudential framework for the superannuation industry

Note a: Superannuation Industry (Supervision) Act 1993, s. 34C.

Source: Australian Prudential Regulation Authority, Insight Issue One, APRA, 2012; and Australian Prudential Regulation Authority, Superannuation Prudential Framework [Internet], APRA, available from <http://www.apra.gov.au/Super/PrudentialFramework/Pages/superannuation-prudential-framework.aspx> [accessed 12 July 2016].

1.12 APRA has two divisions that are primarily responsible for supervising the superannuation industry:

• the Diversified Institutions Division supervises Australia’s large and complex financial groups; and
• the Specialised Institutions Division supervises predominantly standalone licensed entities, for example regional banks and credit unions, and also superannuation entities.

These divisions are supported by a number of teams including the Supervisory Framework team, Industry Analysis team, Policy and Advice Division and the Supervisory Support Division.

APRA’s supervisory framework

1.13 The supervisory framework through which APRA undertakes its prudential regulation has three key stages: licensing and registration; supervision; and enforcement.

Licensing and registration

1.14 APRA is responsible for licensing trustees of registrable superannuation entities, and registering these entities to help ensure that only those that meet the prudential requirements, and have the ability to meet their financial promises, are able to operate in Australia.

1.15 After a trustee has received a registrable superannuation entity licence, it may apply to register one or more registrable superannuation entities. Upon receipt of licence and registration, the licensee and entity are required to comply with licensee law and other ongoing requirements—as defined in the Superannuation Industry (Supervision) Act 1993.¹⁴

Supervision

1.16 Licensed entities are subject to ongoing supervision by APRA to: identify key risks that the entities are exposed to; ensure entities are adequately measuring, managing and monitoring risks; and assess the adequacy of their access to financial resources to withstand potential losses. The APRA Supervision Blueprint¹⁵ establishes the strategic direction of APRA’s supervisory framework, which encompasses all activities, supporting procedures, processes, systems and guidelines that are used by supervisors in forming risk assessments and supervision strategies.

1.17 The two main elements of APRA’s supervision model are the Probability and Impact Rating System and the Supervisory Oversight and Response System supervisory tools, created in 2002:

• the Probability and Impact Rating System assesses how likely an entity is to fail and the potential impact of failure. Applying the system, APRA develops probability and impact index ratings that together create the supervisory attention index rating, which assists APRA to determine the size of its supervisory task.
• the Supervisory Oversight and Response System is used to determine supervisory stances derived from the Probability and Impact Rating System. Once the supervisory stances have been determined, APRA supervisors develop supervisory action plans for each entity. The supervisory action plans take into account the key risks and issues from the Probability and Impact Rating System process and set out the key supervisory activities, as outlined in Figure 1.4, to be undertaken over the following 12 to 24 months to address the issues.

Figure 1.4: APRA’s supervisory activities

Note: These are examples of actions that can be undertaken and are not mandatory.

Source: Australian Prudential Regulation Authority, Supervisory Oversight and Response System [Internet], APRA, 2012, available from <http://www.apra.gov.au/CrossIndustry/Documents/SOARS-062012-External-version.pdf> [accessed 12 July 2016].

1.18 As at 31 March 2016, of the 138 trustees subject to supervisory activity: 68 had a normal stance; 66 had an oversight stance; and three were categorised as mandated improvement.¹⁶

1.19 Since 2009 there has only been one incidence of failure of an APRA-regulated superannuation trustee. Trio Capital, a registrable superannuation entity trustee, failed in 2009—a result of approximately $150 million of related-party investments lost or unrecovered. A review¹⁷ of the incident by the Treasury in 2013 found that APRA carried out its responsibilities appropriately. Investigation by APRA into the failure revealed that the key factors leading to the losses were: inadequate investment governance; failure to adequately manage conflicts of interest from dealings with related parties; and failure to have adequate controls to mitigate fraud-related investment risk.

Enforcement

1.20 In cases where APRA has serious prudential concerns about an entity it can intervene and take remedial enforcement action. As seen in Figure 1.4, APRA’s enforcement powers include enforceable undertakings, placing restrictions on business operations, and placing an entity into receivership or liquidation. Situations where enforcement action is required usually result in two possible outcomes: the entity will take sufficient action to reduce the risks and return to a high level of supervision; or APRA will help the entity to make a managed exit from the industry. Since 2009, APRA has commenced enforcement action towards two entities as of March 2016.

Audit approach

Audit objective, criteria and scope

1.21 The objective of the audit was to assess the effectiveness of APRA’s processes for the prudential regulation of superannuation entities.

1.22 To form a conclusion on the audit objective the following high-level criteria were adopted:

• prudential and reporting standards are determined in accordance with legislation, in consultation with stakeholders, and having regard to risk;
• effective arrangements exist for the processing and consideration of superannuation entity licence applications, and registration of entities;
• risks to the interests of beneficiaries are identified, and arrangements are in place to guide APRA’s superannuation prudential regulation activities; and
• APRA effectively supervises superannuation entities to monitor their ability to meet the reasonable expectations of beneficiaries, and takes action where issues are identified.

1.23 The audit focussed on APRA’s performance of its superannuation regulation responsibilities from 2013 to mid-2016, with historical context and comparisons undertaken as appropriate. The audit scope did not include: the variation or cancellation of licences; winding up of funds; supervision of small APRA funds, MySuper authorisation process and eligible roll-over funds.

Audit methodology

1.24 The major audit tasks included: reviewing relevant documentation, systems and processes; analysing APRA data where available and appropriate; sampling licensee files to examine consistency with the supervisory framework; and interviewing relevant agency staff and stakeholders.

1.25 The audit was conducted in accordance with the ANAO Auditing Standards at a cost to the ANAO of approximately $365 000.

Does APRA adhere to relevant legislation and guidance in determining prudential standards and reporting standards?

2.1 Superannuation prudential standards and reporting standards are legislative instruments within the meaning of the Legislation Act 2003 and are therefore legally enforceable. All the final prudential standards and reporting standards made by APRA must be registered on the Federal Register of Legislation to ensure that they are legally enforceable and enable APRA to appropriately exercise its powers.

2.2 APRA’s approach to developing prudential and reporting standards is illustrated in Figure 2.1. APRA has internal policies and procedures in place that provide a robust internal governance framework for developing these standards. For example, APRA’s ‘Red Guide’¹⁸ provides for: the mandatory process to meet the registration and tabling requirements for standards; and the mandatory review of the standards and their related policy documents by the Legal Group to ensure that they meet all legal requirements, reflect the policy intent and are consistent with APRA’s legal powers.

Figure 2.1: APRA’s processes for developing prudential and reporting standards

Source: ANAO analysis of APRA’s internal discussion papers, meeting minutes and agendas.

Developing prudential standards

2.3 Prudential standards set out the requirements in relation to prudential matters that must be complied with by APRA-regulated entities in order to promote good governance, risk management and sound financial administration. APRA publishes all 13 superannuation prudential standards on its website.¹⁹

2.4 The ANAO’s analysis of the superannuation prudential standards and their associated internal discussion papers found that APRA, when developing the superannuation prudential standards, had appropriately considered:

• relevant legislation including the Superannuation Industry (Supervision) Act 1993, the Superannuation Industry (Supervision) Regulations 1994 and the Corporations Act 2001;
• the Stronger Super requirements;
• relevant elements of its existing guidance material including reclassifying some existing requirements as mandatory obligations in the superannuation prudential standards; and
• the requirements in prudential standards for its other regulated industries and cross-industry prudential standards.

Developing reporting standards

2.5 Section 13 of the Financial Sector (Collection of Data) Act 2001 provides APRA with the power to issue reporting standards and collect financial information and statistical data from superannuation entities. APRA’s reporting framework has been in place since 2004 and was revised in 2012 to support the implementation of superannuation prudential standards and the Stronger Super requirements.²⁰ APRA publishes all 40 superannuation reporting standards on its website.²¹

2.6 A reporting standard includes the corresponding reporting form and reporting instructions. Any change to the reporting form and instructions is also a change to the reporting standard itself. All components of the reporting standard are legally enforceable legislative instruments.

2.7 The ANAO’s analysis confirmed that the reporting standards developed by APRA are based on the requirements under the relevant legislation including the Financial Sector (Collection of Data) Act 2001, the Superannuation Industry (Supervision) Act 1993, the Superannuation Industry (Supervision) Regulations 1994 and the Corporations Act 2001. The reporting standards are determined to enable superannuation entities to report information to APRA to meet the statutory requirements.

Does APRA consider the impact of proposals on entities and take a balanced and risk-based approach to determining standards?

2.8 The development of new policy or changes to existing policy may impose significant costs as well as lead to benefits to the superannuation industry. APRA must comply with external requirements and adhere to its internal governance framework in its consideration of the regulatory impact of proposed policies.

External requirements

2.9 As a Commonwealth regulator, APRA has to comply with best practice regulation requirements of the Office of Best Practice Regulation when developing prudential and reporting standards. Every regulatory policy proposal or substantive policy change must be accompanied by a Regulation Impact Statement.²² The Office of Best Practice Regulation assesses Regulation Impact Statements for compliance with best practice regulation requirements.

2.10 APRA’s Red Guide provides for the mandatory preparation of a preliminary assessment of the impact of a proposed policy during the standards development process. The preliminary assessment is to be submitted to the Office of Best Practice Regulation for review to determine whether a Regulation Impact Statement is required. A Regulation Impact Statement is usually required unless the proposed policy initiative is minor or machinery in nature. The finalised Regulation Impact Statement will be assessed by the Office of Best Practice Regulation and published on the corresponding websites of the Office of Best Practice Regulation and APRA.

2.11 There were two Regulation Impact Statements prepared by APRA for its introduction of the superannuation prudential standards and reporting standards in 2012 and 2013 respectively.²³ The Office of Best Practice Regulation assessed both statements as compliant with its requirements of best practice regulation.²⁴

2.12 Pursuant to the Legislation Act 2003, the Federal Register of Legislation requires APRA to prepare an Explanatory Statement for each prudential and reporting standard prior to its registration and tabling. The ANAO analysed all Explanatory Statements prepared for the final registered standards and found that APRA had considered whether the standards are in accordance with the human rights and freedom provisions under the Human Rights (Parliamentary Scrutiny) Act 2011.

Internal approach

2.13 APRA has a principle that changes to policy will only be made if the benefits clearly outweigh the costs. For example, to balance the introduction of prudential standards in 2012 aimed at protecting beneficiary’s interests, APRA developed principles-based requirements that would provide some flexibility in their application and reduce regulatory burden on superannuation entities. Also, APRA’s decision to introduce the suite of reporting standards in 2013 was made on the basis that the long-term benefits of the protection for superannuation beneficiaries as a result of the additional reporting requirements will likely outweigh the costs involved.

2.14 Policy initiatives relating to the development of prudential and reporting standards were added to APRA’s Policy Priority Matrix. The Policy Priority Matrix presents APRA’s prioritisation of policy projects based on their perceived urgency and strategic impact for APRA. It assists APRA in focusing its development of the prudential framework on priority areas for financial system safety and stability. It is presented to an Executive Board meeting for review and approval at least biannually.

Does APRA consult with stakeholders when determining standards and support superannuation entities to comply with standards?

2.15 Consultation is an important element of APRA’s policy development process. As previously shown in Figure 2.1, APRA consults with internal stakeholders in the development of policy proposals before it undertakes external consultation with industry stakeholders. Figure 2.2 illustrates APRA’s consultation process for the development of prudential and reporting standards.

Figure 2.2: APRA’s internal and external consultation process

Source: ANAO analysis of APRA documents.

2.16 The ANAO found that APRA provided a reasonable time of two to three months for external consultation for prudential and reporting standards that were significant in terms of volume and impact. Those standards with shorter external consultation timeframes (two weeks to one month) were less material in nature or subject to MySuper implementation timeframes.

2.17 APRA has a transparent approach to consultation and publishes all the discussion papers/consultation letters it has released, non-confidential stakeholder submissions and APRA’s responses to the submissions on its website. The total number of submissions received by APRA for each consultation is also published.

2.18 To ensure that all relevant views provided in stakeholder submissions are properly considered, APRA may hold several rounds of internal and external consultations before its final determination of the standards. APRA’s meeting minutes and internal papers illustrated that it analysed the issues raised in submissions, deliberated the issues further with internal stakeholders, refined the requirements proposed in the standards and made amendments to the requirements as appropriate. APRA’s response papers/letters to submissions acknowledged feedback received from external consultation processes and explained APRA’s reasoning for final or revised prudential and reporting standards.

Guidance for prudential standards

2.19 APRA provides prudential practice guides as guidance material to support superannuation entities to comply with prudential standards. Prudential practice guides outline APRA’s view on best practice in relation to particular areas of entities’ businesses. Prudential practice guides are not legislative instruments and do not create enforceable requirements.²⁵

2.20 APRA issues prudential practice guides on particular matters once the relevant prudential standards are finalised. APRA also issues new prudential practice guides or amends existing practice guides where there are changes in the specific prudential standards that the practice guide is supporting.²⁶

2.21 APRA’s internal subject matter experts provided input to the development of the prudential practice guides. The development of the prudential practice guides was also informed by internal and external consultations. During the external consultation process for prudential standards, APRA received feedback on additional areas where it might consider issuing guidance. APRA has incorporated that feedback, where relevant, into the development of prudential practice guides. APRA has been timely in issuing prudential practice guides to assist superannuation entities to meet prudential standard requirements, and issued 18 of its 19 superannuation prudential practice guides within six months of finalising the relevant prudential standards.

2.22 In some circumstances, APRA issues FAQs and letters to the superannuation industry to address specific issues that do not require amendments to the prudential standards or prudential practice guides. The issuance of FAQs and letters to industry enables APRA to provide guidance promptly prior to any changes to a prudential standard or practice guide. Once the prudential matters have been incorporated in the final prudential standards or prudential practice guides, APRA will archive the FAQs previously issued in relation to those matters. As at 29 March 2016, there were 23 current FAQs and 67 archived FAQs in relation to prudential standards.

2.23 Prudential practice guides, FAQs and letters to industry are all published on APRA’s website.²⁷ APRA also provides a link to all archived superannuation guidance material on its website so that entities know which material has been superseded.

Guidance for reporting standards

2.24 To assist superannuation entities in the completion of reporting forms, APRA provides guidance on the reporting requirements on its website.²⁸

2.25 APRA usually issues letters to industry to ensure that changes and clarification on superannuation reporting matters are communicated to the superannuation entities in a timely manner. On the occasion that APRA revised reporting standards, it issued an accompanying letter to industry to advise and explain the changes made. In addition, APRA issued letters to industry for each reporting period to outline general reporting-related information to help registrable superannuation entity licensees in submitting superannuation data to APRA.

2.26 Since the release of the suite of reporting standards between 2013 and 2015, APRA has received industry feedback and requests for clarification and guidance on the interpretation of the reporting standards. As a result of the reporting issues raised by industry, APRA released an extensive suite of FAQs on its website. The FAQs clarified the reporting issues and provided timely guidance to help superannuation entities comply with their reporting obligations. APRA’s practice is to incorporate the FAQ guidance into the final reporting standards where it is appropriate to do so. The superannuation industry was notified of these amendments via letters to industry and APRA subsequently archived the relevant FAQs on its website. As at 24 March 2016, there were 27 current FAQs and 90 archived FAQs for reporting standards.

2.27 As part of APRA’s internal governance process, all revised reporting standards and prudential practice guides, letters to industry, FAQs and other relevant guidance material are reviewed by the Legal Group to ensure they reflect the policy intent, are consistent with APRA’s legal powers, and use clear and appropriate language.

2.28 There is an opportunity for APRA to consider other sources to inform revisions of guidance, including prudential review actions and reviews of entities subject to enforcement actions (refer to Chapter 5).

Does APRA review the appropriateness of prudential standards, reporting standards and prudential practice guides?

2.29 According to APRA’s Red Guide, a review of prudential standards, reporting standards and prudential practice guides should be scheduled post-implementation as part of the policy development process. The Red Guide provides that a short-term review of the standards and prudential practice guides should be scheduled within six to 12 months of implementation where the policy change is significant; while a longer-term review of the standards and prudential practice guides is usually scheduled two to three years following implementation depending on their nature and complexity.²⁹ In addition, the Red Guide provides that the standards and prudential practice guides should be amended as and when changes occur regardless of any scheduled reviews.

2.30 APRA stated in the Regulation Impact Statements prepared for superannuation prudential standards³⁰ and reporting standards³¹ that they would be reviewed after their implementation and on an ongoing basis to ensure that they are relevant, effective and continue to reflect sound practice. APRA also stated in the Regulation Impact Statements that there would be a point-in-time review of the appropriateness and effectiveness of the entire suite of superannuation prudential and reporting standards three to four years after their implementation.

2.31 To date, APRA’s review of superannuation standards and prudential practice guides has been driven by changes in government policy and issues identified by industry or APRA supervisors. As outlined in paragraph 2.26, APRA made minor revisions to some of its reporting standards since their introduction as a result of matters raised by industry. In the last 12 months, APRA reviewed two elements of its superannuation prudential framework, which relate to:

• proposed changes to the governance arrangements for registrable superannuation entity licensees announced by the Australian Government in June 2015, which APRA addressed by proposing amendments to an existing standard and guide, and introducing a new standard and guide.³² The proposed legislative changes have not yet been passed in Parliament, and accordingly the proposed changes to the prudential standards and guides have been put on hold; and
• updating the existing guidance material in the circulars for successor fund transfers and wind-ups by incorporating them in the form of a prudential practice guide, which APRA has envisaged releasing in the second half of 2016.

2.32 Although review and amendments of standards and prudential practice guides have been undertaken as changes and issues were identified, APRA has not yet scheduled a longer-term review of its standards and guides since their implementation. APRA’s justification for this is that the usual timeframe for considering a review has not yet passed given that the standards and prudential practice guides were only implemented in 2013. APRA is currently exploring ways to establish a review program in line with its existing Red Guide requirements.

2.33 APRA should ensure that it undertakes a point-in-time review of the appropriateness and effectiveness of its suite of superannuation prudential standards, reporting standards and prudential practice guides as soon as practicable. Further, APRA should ensure that it establishes a program to support the ongoing review of standards and prudential practice guides at periodic intervals.

Does APRA provide appropriate forms and guidance in relation to the licensing and registration of superannuation entities?

3.1 Trustees of all registrable superannuation entities must have been granted a registrable superannuation entity licence by APRA to be able to register a registrable superannuation entity.³³ APRA provides application forms and instruction guides in relation to licensing and registration, and other relevant superannuation guidance material on the Superannuation Licensing, Registration & Authorisations webpage of its website. The licence and registration application forms are also available on APRA’s Forms for Superannuation Entities webpage.³⁴

3.2 The application forms for licensing and registration both require the applicants to provide relevant information consistent with the provisions of the Superannuation Industry (Supervision) Act 1993. The applicants are also required to provide, as part of their applications, a list of supporting documentation and/or statements to demonstrate their likely compliance with the legislative requirements and the prudential standards determined under the Superannuation Industry (Supervision) Act 1993.

3.3 There are instruction guides for the licensing and registration application forms to assist entities in the completion of the forms. In addition, applicants are able to refer to the suite of guidance material that is published on APRA’s Superannuation Licensing, Registration & Authorisations webpage for further support. The guidance material available includes superannuation legislation, prudential standards, prudential practice guides, circulars, frequently asked questions and material in relation to additional licence conditions.³⁵

3.4 The application forms and guidance in relation to licensing and registration are appropriate and aligned with the requirements of the Superannuation Industry (Supervision) Act 1993. However, the ANAO suggests that APRA make minor improvements to the licence application form and guidance as outlined in Table 3.1.

Table 3.1: Suggested improvements to licence application form and guidance

Note a: RSE stands for Registrable Superannuation Entity.

Source: ANAO analysis of APRA’s documentation and webpage.

Does APRA assess licence and registration applications in accordance with relevant requirements?

Application assessment

3.5 APRA’s internal procedures provide appropriate guidance to supervisors responsible for the assessment of licence and registration applications. There are separate procedures for licensing and registration of registrable superannuation entities respectively. The procedures make reference to the relevant requirements under the Superannuation Industry (Supervision) Act 1993 that have to be considered when processing an application. The procedures also provide information to supervisors on relevant guidance material and modules available to assist them in assessing an applicant’s compliance with the prudential standards prescribed within the Superannuation Industry (Supervision) Act 1993.

Assessment of licence applications

3.6 The supervision team is required to assess the initial application material received against applicable requirements and expected prudential practices. The licensing process can be long and iterative, and often involves frequent engagement with the applicant by the supervision team and the redrafting of parts of the material submitted by the applicant. The supervision team may conduct an onsite prudential review if the applicant has existing business operations in Australia. The supervision team’s assessment process for licence applications is illustrated in Figure 3.1.

Figure 3.1: Supervisor assessment process for licence applications

Note a: Licensing Group is made up of representatives from Supervision, Legal and relevant Supervisory Support Division risk specialists. APRA management appoints the Chair of the Licensing Group.

Note b: At least two meetings are required.

Note c: The Decision Maker is usually the Executive General Manager of the relevant APRA division—the Diversified Institutions Division or Specialised Institutions Division.

Source: APRA internal document.

3.7 There has only been one registrable superannuation entity licence application granted since 1 July 2013. The ANAO reviewed APRA’s assessment of this licence application that was granted on 1 April 2014 and found that the application was assessed against relevant requirements in the Superannuation Industry (Supervision) Act 1993 and the prudential standards. APRA’s assessment of the licence application was consistent with its licensing procedures. The supervision team’s assessment as outlined in the submission to the Licensing Group indicated that additional information was requested from the applicant to assist the supervision team in making a complete assessment of the application.

Assessment of registration applications

3.8 An assessment template is available for supervisors to use in analysing the documents that are provided in the registrable superannuation entity registration application.³⁶ The key documentation that is assessed is: the governing rules/trust deed; and the statements and/or documents that demonstrate the entity’s likely compliance with the prudential standards determined under the Superannuation Industry (Supervision) Act 1993. Figure 3.2 illustrates the supervision team’s assessment process for registration applications.

Figure 3.2: Supervisor assessment process for registration applications

Source: APRA internal document.

3.9 Since 1 July 2013, there have been 164 registrable superannuation entity registrations granted. Of these registrations, 158 were for small APRA funds which are excluded from the scope of this audit. The ANAO reviewed APRA’s assessment of the six remaining registrable superannuation entity registrations that were for a fund type other than small APRA fund and found that APRA’s assessment of the six registration applications was consistent with its internal procedures and guidance. In all instances, the supervisor’s assessment of the application was against the relevant legislative requirements. APRA also considered all available information and requested additional information, if relevant, via a formal written notice pursuant to section 29LA of the Superannuation Industry (Supervision) Act 1993. Where further information was requested, APRA provided a reasonable timeframe for the provision of the information.

Application decision-making

3.10 For licence and registration applications, the APRA delegate is required to consider the recommendation and assessment of the supervision team in determining whether to approve applications. The delegate’s decision to approve a licence or registration application is formally made in a legislative instrument. APRA is required to advise the applicant in writing regarding the decision to approve, or not approve a registrable superannuation entity licence or registration.

Decision on licence applications

3.11 The ANAO’s review of APRA’s assessment of the licence application granted on 1 April 2014 confirmed that the decision to grant the registrable superannuation entity licence was documented and made in accordance with the provisions of the Superannuation Industry (Supervision) Act 1993. APRA’s decision to grant the licence was made in the ‘Decision to grant an RSE licence’ document that subsequently enabled the registrable superannuation entity licence instrument to be formally generated. APRA then issued a cover letter to the applicant to advise the granting of the licence. APRA also provided the licensee with the registrable superannuation entity licence instrument, the ‘Decision to grant RSE licence’ instrument and a Statement of Reasons relating to the imposition of additional conditions on the registrable superannuation entity licence.

3.12 Pursuant to section 29CC of the Superannuation Industry (Supervision) Act 1993, APRA must make a decision on a licence application within 90 days after receiving the final application, with provision for an extension of a further 30 days. The ANAO’s analysis found that the registrable superannuation entity licence application granted by APRA in April 2014 was determined within the prescribed legislative timeframe.

Decision on registration applications

3.13 The ANAO’s review of APRA’s assessment of the six registrable superannuation entity registration applications confirmed that the decisions to grant the registrations were made in accordance with the provisions of the Superannuation Industry (Supervision) Act 1993. APRA’s decisions to grant the registrable superannuation entity registrations were each formally made in a ‘Decision to register a registrable superannuation entity’ instrument. APRA issued a cover letter with the registrable superannuation entity registration instrument to advise the licensee that the fund has been registered.

3.14 Pursuant to section 29LB of the Superannuation Industry (Supervision) Act 1993, APRA must decide a registrable superannuation entity registration application within 21 days after receiving the final application or, where APRA has requested further information from the applicant, within 21 days after receiving all the information requested.³⁷ The ANAO’s analysis found that the six registrable superannuation entity registration applications were all determined by APRA within the prescribed statutory timeframe.

Assurance processes on licensing and registration

3.15 The ANAO’s analysis found that APRA’s assessment processes of the licence and registration applications were subject to review and sign-off by the appropriate delegates in accordance with its internal decision-making procedures. The appropriate delegates re-examined the assessment of the supervision team to confirm the decision reached. Documents such as the Memo to Decision Maker, Statement of Reasons, registrable superannuation entity licence instruments and registrable superannuation entity registration instruments were also reviewed and approved by the Legal Group to ensure that the decision and processes followed are legally robust.

Do APRA’s risk management arrangements support its supervision of the superannuation industry?

Risk assessment of individual superannuation entities

4.1 One principle underlying APRA’s supervision approach is to be risk-based.³⁸ As discussed in Chapter 1, to assist supervisors assess prudential risks associated with specific entities, APRA has had a risk assessment tool in place since 2002—the Probability and Impact Rating System (PAIRS).³⁹ The main objective of PAIRS is to measure the probability that an entity will fail and the impact of the potential consequences of that failure.

4.2 In conducting a risk assessment, supervisors are required to evaluate specified categories⁴⁰ of a superannuation entity’s operations by assigning a rating.⁴¹ APRA combines the probability rating with an impact rating, which is a score that reflects the consequence of an entity failing. Impact ratings are generally based on the value of entities’ assets.⁴²

4.3 The ANAO analysed APRA’s application of the PAIRS assessment model by examining the distribution of PAIRS scores by risk category for 484 PAIRS assessments prepared in relation to 138 trustees over the period 1 July 2013 to 23 March 2016 to determine whether the scores were consistent with PAIRS guidance and observations. This analysis found that the risk scores of trustees’ administration were consistent with key elements of the PAIRS assessment model. For example, the model indicates that smaller trustees have lower inherent operational risk⁴³ as they have simple business flows and fewer transactions, and as illustrated in Figure 4.1, smaller trustees had lower scores for inherent operational risk. Further, larger trustees had lower scores for the management and control⁴⁴ of operational risk because, as outlined in the assessment model, they are more likely to have dedicated operational risk management functions.⁴⁵

Figure 4.1: Distribution of PAIRS scores for operational risk of superannuation trustees, July 2013 to March 2016

Note: The solid horizontal lines in the boxes represent the median value of the PAIRS scores, and the bottom and top of the boxes represent the first and third quartiles (interquartile-range), respectively. The vertical lines extending from the rectangle show the maximum and minimum values—the lines are limited to being the length of 1.5 times the size of the interquartile-range and will extend to the furthest point within that distance from the first and third quartiles. The dots above or below the extended lines represent data points that are further than 1.5 times the interquartile-range (outliers).

Source: ANAO analysis of the distribution of APRA’s scores for inherent risk and management and control for operational risk by entity impact rating in 484 applicable PAIRS assessments.

4.4 APRA’s guidance indicates that the PAIRS should be updated when significant issues, events or analysis indicate that a trustee’s risk assessment should be revisited, following an onsite prudential review, and at a minimum, every 12 months. The ANAO tested if the PAIRS assessments for the 138 trustees had been updated within the past 12 months (March 2015 to March 2016) and only four assessments had not been—41 days was the most overdue.

4.5 The ANAO’s testing also found that entities supervised by staff in APRA’s Specialised Institutions Division were allocated higher scores for PAIRS categories than entities supervised by staff in the Diversified Institutions Division—even when controlling for size by assessing only high and extreme impact entities. APRA advised the ANAO that this variation in scores is not necessarily unexpected due to the difference in risk profiles and level of sophistication of the entities supervised within each division. However, as illustrated in Figure 4.2, the mean scores for inherent risk and management and control were higher for every risk sub category for trustees supervised by the Specialised Institutions Division than those supervised by the Diversified Institutions Division. These results are inconsistent with APRA’s PAIRS guidance (refer paragraph 4.3), which indicates that the smaller, standalone entities typically supervised in the Specialised Institutions Division will have lower ratings for inherent operational risk than the larger conglomerate groups supervised by the Diversified Institutions Division.

Figure 4.2: Mean PAIRS scores for inherent risk and management and control for five risk categories, by supervision of superannuation trustees by APRA Division, July 2013 to March 2016

Source: ANAO analysis of the mean scores for inherent risk and management and control for five risk categories.

4.6 Other inconsistencies identified by the ANAO’s testing among supervisors in preparing PAIRS assessments included:

• There was no clear relationship between an entity’s supervision stance and the frequency of updating PAIRS assessments. As shown in Figure 4.3, the number of PAIRS assessments undertaken was:
  • similar for trustees with a normal and oversight supervision stance; and
  • higher for trustees with a normal and oversight supervision stance than those with a mandated improvement stance.⁴⁶
• In some instances, PAIRS assessments were completed for all associated registrable superannuation entities as well as trustees. APRA’s guidance states that PAIRS assessments should only be undertaken at the trustee level and that the trustee PAIRS assessment should reflect any problematic entities.⁴⁷ For some PAIRS assessments there were differences between the trustee and registrable superannuation entities’ PAIRS ratings, suggesting that supervisors had prepared separate PAIRS assessments to reflect differing risk characteristics.⁴⁸

Figure 4.3: Distribution of PAIRS assessments by SOARS stance, superannuation trustees, July 2013 to March 2016

Note: In total, four trustees had six PAIRS assessments; three had seven assessments; and one had eight assessments. The median number of PAIRS assessments was the same for trustees with a normal and oversight stances (three), while trustees with a mandated improvement stance had four PAIRS assessments completed during the period.

Source: ANAO analysis of the number of PAIRS assessments completed per entity by SOARS stance from July 2013 to March 2016.

Industry-wide superannuation risks

4.7 APRA has an Industry Risk Management Framework in place to assist it to identify and manage heightened industry-wide risks; that is, common risks that are considered to have high possibility of significant adverse prudential consequences on any of the financial industries that it regulates (including superannuation).⁴⁹ A key feature of the framework is APRA’s Heightened Industry Risk Register (Register) and Watch List. Risks recorded on the Register are those where there is a concern over business practices or other issues that pose industry-wide risks or affect many entities. Risks recorded on the Watch List are those risks that are not considered to be heightened risks but warrant ongoing attention.

4.8 The Superannuation Industry Group Chair is responsible for the risks recorded in the Register and Watch List that relate to superannuation entities.⁵⁰ A comprehensive review of the risks is conducted annually by the Superannuation Industry Group, supported by a paper submitted by APRA’s Industry Analysis team that outlines existing risks as well as potential emerging risks.⁵¹

4.9 The framework encourages recording few risks on the Register to help ensure those listed receive appropriate supervisory focus. From 2013 to mid-2016, APRA had three to four risks recorded at any time on the Register and Watch List. The ANAO reviewed APRA’s management of three risks recorded on the Register: liquidity, data integrity and insurance.⁵² While APRA effectively identifies and defines risks, it has an ad-hoc approach to managing and monitoring risks.

4.10 Risks recorded on the Register are assigned an owner who is required to present a scoping paper to the Superannuation Industry Group that describes the risk, and outlines the activities expected to be undertaken to mitigate the risk, including who will undertake the activities, when they will be undertaken and the expected outcomes.

4.11 The ANAO’s analysis found that risks were listed on the Register for periods between three and 15 months before scoping papers were provided to the Superannuation Industry Group for approval. In three of the four papers, activities had been initiated in response to the risk prior to the approval of the scoping paper. None of the papers identified delivery dates and responsible officers for all activities. Without clear strategies and plans for managing heightened industry risks that identify outcomes, delivery dates and responsible officers, it is possible that relevant actions are not undertaken to address risks and that APRA is unable to assess its progress in managing risks.

4.12 As required, risk owners provide progress reports to the Superannuation Industry Group in relation to scoping papers at least twice a year. The Superannuation Industry Group also receives information on activities to address risks from other teams, such as the Learning and Development team and Industry Analysis team. Nevertheless, the Superannuation Industry Group does not have oversight of how supervisors address industry risks through activities as this information can only be obtained through a manually-intensive review of supervisory action plans.⁵³

4.13 APRA could adopt a more structured approach to managing industry-wide superannuation risks. Scoping papers should be presented for approval to the Superannuation Industry Group as soon as practicable after a risk is identified and meet all the requirements of the framework, including identifying delivery dates and officers responsible for the delivery of identified responses. This would enable APRA to better focus its efforts on managing risks in a systematic and timely manner. More frequent updates that include reporting on indicators of effectiveness would also enable APRA to measure its success in addressing risks and provide insights for future risk management approaches. APRA should also introduce a process, such as a quality assurance review, that provides some transparency in relation to supervisors’ management of heightened industry risks (Chapter 5). In accordance with its risk management framework, the ANAO suggests that APRA improve the timeliness and completeness of risk management strategies for heightened superannuation industry risks and consider requiring more regular and detailed progress updates to the Superannuation Industry Group in relation to these risks.

Enterprise risk management

4.14 APRA has an enterprise risk management framework that establishes APRA’s risk appetite and the key principles and minimum requirements for managing risks. Within APRA’s enterprise risk management framework, eight core risk areas were identified; of which three were directly relevant to APRA’s supervision of superannuation entities: supervision analysis and review; supervision response; and prudential framework.

4.15 APRA’s risk appetite statement is consistent with the principle of taking a proportionate, risk-based approach that is part of its prudential framework. For example, in relation to the supervision analysis and review risk, APRA’s statement outlines its tolerance for aspects of supervision such as a moderate tolerance for less frequent interaction with smaller and/or lower risk entities with no known issues—consistent with APRA’s supervision approach.

4.16 To mitigate some of the sub-risks within the supervision analysis and review, and supervision response risk categories, APRA identified mitigation controls including: application of its decision-making protocol; frontline supervision skills, experience and resourcing; quality assurance activities; and the consistent approach provided by APRA’s supervision framework. The ANAO’s analysis found that these measures do not ensure: consistency among supervisors (paragraphs 4.5 and 4.6) or appropriate coverage of heightened industry risks in supervision approaches (paragraph 4.12); and, do not provide assurance as to the quality of work undertaken by supervisors (Chapter 5). To this end, APRA should consider whether these activities mitigate these risks to the extent expected.

Does APRA’s supervision framework support its supervision of the superannuation industry?

4.17 APRA’s supervision approach as outlined in its blueprint⁵⁴, requires supervisors to identify entities’ risks and tailor supervision activities to determine whether the risks are being adequately managed. APRA’s Supervisory Oversight and Response System (SOARS), which has been in place since 2002, is designed to assist supervisors with implementing a risk-based and consistent approach across the financial industries it supervises, including superannuation.

Supervisory Oversight and Response System

4.18 SOARS is used to determine the supervisory stance to be applied to entities based on their PAIRS risk assessment, as illustrated in Figure 4.4.

Figure 4.4: Determination of supervision stance to apply to entities

Source: APRA internal document.

4.19 Entities with a higher supervision stance should be subject to more intensive supervision.⁵⁵ APRA promotes SOARS as its key tool for achieving a similar treatment for like entities.

4.20 The SOARS guide provides APRA staff with guidance about typical supervision activities by type of stance, for example indicating that entities with an oversight stance should have more frequent prudential reviews, and collection and analysis of data and reports than entities with a normal stance. APRA undertakes five key supervisory activities within its supervision framework, as outlined in Table 4.1.

Table 4.1: APRA’s supervision activities

Source: ANAO analysis.

4.21 To test the consistency of supervision of like entities, the ANAO examined 2803 completed supervision activities for 138 superannuation trustees by SOARS stance for the period 1 July 2013 to 24 March 2016. This analysis illustrated that entities with the same SOARS stance have been subject to varying levels of scrutiny by APRA and that entities with higher SOARS stances have not been receiving more intensive supervision in all activity categories (Table 4.2). In particular, there is no clear graduated increase in the number of some supervision activities, such as prudential consultations and other supervisory activities, undertaken in relation to entities with higher SOARS stances.

Table 4.2: Level of supervision activity by SOARS stance, superannuation trustees, 1 July 2013 to 24 March 2016

Note: ‘High’ refers to the largest number of activities recorded for an entity and ‘low’ refers to the least number of activities recorded for an entity.

Source: ANAO analysis of the 2803 completed supervision activities relevant to superannuation trustees undertaken from 1 July 2013 to 24 March 2016.

Baseline supervision requirements

4.22 APRA has established a baseline level of supervision activity considered necessary to identify key risks and issues within entities, as illustrated in Table 4.3.

Table 4.3: Baseline supervision requirements for entities regulated by APRA

Note a: Relevant to foreign owned entities.

Source: Australian Prudential Regulation Authority, Supervisory Oversight and Response System [Internet], APRA, 2012, available from <http://www.apra.gov.au/CrossIndustry/Documents/SOARS_Final_May_2008_ External_Version.pdf> [accessed 22 September 2016].

4.23 While entities’ SOARS stances are driven by their impact and probability ratings, baseline activity is determined by an entity’s impact rating (asset size). APRA’s supervision blueprint indicates that impact provides an objective basis to carry out supervision activities with the purpose of assessing entities’ key risks. However, once entity risks have been assessed and supervisors have prepared supervisory action plans, the blueprint indicates that baseline requirements remain the minimum level of activity that can be undertaken by supervisors. It is incongruous that the two methods for determining supervisory activity have alternative bases, and APRA should align the baseline requirements to SOARS to better reflect a risk-based supervision approach.

4.24 APRA’s guidance for supervisors in relation to baseline activity indicates that while activities should be conducted consistently across entities, the depth and frequency of analysis may vary depending on the size or impact of an entity. The ANAO analysed whether the baseline level of activity had been implemented for the 138 trustees from 1 July 2013 to 31 March 2016. This was largely the case for prudential reviews, where all but two trustees had at least the minimum level (78 entities) or higher level (58 entities) of prudential review activity recorded. However, there were meaningful proportions of trustees not subject to the baseline level of prudential consultation and quarterly risk review. For prudential consultations, 13 entities⁵⁶ with extreme or high impact ratings were not subject to the baseline activity requirements and four entities with extreme or high impact ratings were subject to a greater level of supervision.

4.25 For quarterly risk reviews, Table 4.4 illustrates that almost one-third (45) of entities were not subject to the baseline level of quarterly risk review activity (highlighted in blue). The 46 entities with a level of activity that exceeded the baseline (highlighted in grey) are the result of the completion of 2012–13 quarterly financial analysis within the 2013–14 financial year. This is consistent with the ANAO’s review of APRA licensee files that found instances of ‘clustering’ of quarterly risk reviews (Chapter 5).

Table 4.4: Quarterly risk review activity for superannuation trustees, July 2013 to March 2016

Note a: The ANAO examined the case with the highest number of quarterly risk reviews (15) and found that some of the reviews related to previous quarters, for example, April to June 2013, and were recorded as completed during the period reviewed by the ANAO.

Source: ANAO analysis of the level of quarterly risk review activity for each trustee in relation to baseline requirements.

4.26 The ANAO’s analysis indicates that, in some instances, impact also determines the level of supervision activity undertaken at the supervisor’s discretion⁵⁷—that is, beyond the baseline level of activity. As illustrated in Table 4.5, the three entities with the more serious SOARS stance of mandated improvement, which would be expected to have a higher number of associated supervision activities, had between 11 and 30 recorded supervision activities. However, six entities with SOARS stances of normal and oversight but extreme and high impact ratings had over 41 activities recorded. The largest number of activities recorded for a single entity was 77 and that entity had a SOARS stance of normal but an impact rating of extreme.

Table 4.5: Number of activities by SOARS stance and impact rating as at 24 March 2016

Source: ANAO analysis.

4.27 While APRA’s supervision framework provides for a proportionate supervision approach based on risk with a required minimum level of activity, this approach is not consistently applied in practice. As noted in APRA’s risk appetite statement, a risk-based supervision approach should enable APRA to deploy its workforce in a targeted and cost effective manner.

Does APRA effectively manage supervisory activities?

5.1 Supervisors use APRA’s supervision information technology system, Q, to plan and manage supervisory activities. Introduced in December 2013, Q automatically generates business-as-usual supervision activities, such as lodgement analyses and quarterly risk reviews. Supervisors enter other activities such as prudential reviews and consultations, and other supervision activities. Tasks are automatically generated for larger activities such as prudential reviews and consultations and can also be manually recorded by supervisors. Q will change the status of activities to complete once all of the associated tasks have been completed.

5.2 The ANAO analysed a data extract of all APRA superannuation supervision activities recorded in Q for the period 1 July 2013 to 24 March 2016. In total, 3866 activities were recorded for superannuation trustees as illustrated in Table 5.1. The ANAO also conducted an electronic file review of 50 trustee files over the same period to assess the recording of actions arising from these activities and the completeness of the conduct of the activities.

Table 5.1: Superannuation trustee supervision activities and status, July 2013 to March 2016

Source: ANAO analysis of trustee activities undertaken from July 2013 to March 2016 by status.

Recording of actions arising from superannuation supervision activities

5.3 Prudential reviews can result in APRA directing entities to undertake a number of actions, including through: requirements, recommendations, suggestions and requests for information.⁵⁸ APRA’s guidance requires supervisors to record all requirements and requests for information in its information technology system, the Activities and Issues Management System (AIMS). The guidance also ‘encourages’ supervisors to record recommendations and suggestions in AIMS. While not considered to be as significant as requirements and requests for information, APRA should consider requiring supervisors to record recommendations and suggestions to enable it to better identify common areas for improvement across the superannuation industry.

5.4 The ANAO’s electronic file review of 50 trustee files included reviewing whether the actions from the prudential reviews had been recorded in AIMS. The ANAO’s file review identified 1148 actions from 82 prudential reviews⁵⁹ for the period of 1 July 2013 to 24 March 2016; of which only 46 actions (four per cent) had been recorded (Table 5.2).

Table 5.2: Recording of actions arising from prudential reviews of superannuation trustees, 1 July 2013 to 24 March 2016

Source: ANAO analysis of data extract from AIMS of open issues and issues closed since 1 July 2013, and the results of the ANAO’s review of 50 electronic trustee files, including 87 completed prudential reviews with accompanying documentation.

5.5 AIMS also records breaches reported by entities. APRA-regulated entities that become aware that they have breached, or will breach, a prudential requirement and the breach is ‘significant’⁶⁰, are required to provide a report relating to the breach to APRA within ten business days of becoming aware of the breach. The ANAO analysed an AIMS data extract that included open items and items closed since 1 July 2013. As illustrated in Table 5.3, breaches represented the majority of items recorded. This may be because breaches reported through APRA’s online breach reporting system are automatically recorded in AIMS.

Table 5.3: Number and status of issues recorded, July 2013 to March 2016

Note a: APRA advised that issues can be recorded as not applicable for a range of reasons including if they do not require specific actions or are a follow-up action from an initial breach notification.

Source: ANAO analysis of the status of open issues and issues closed since July 2013 recorded in AIMS.

5.6 Accurately recording the actions of prudential reviews enables supervisors to monitor whether entities have completed the actions required by APRA—particularly relevant where the issue relates to a significant prudential regulation matter—and can signal when an issue should be escalated for resolution. This information would also be relevant to APRA’s: consideration of industry-wide risks as issues are recorded by PAIRS category; and review of prudential standards and associated guidance to assist in determining whether additional information or guidance may be required or if existing guidance requires amendment.

Completeness of supervision activities

5.7 The ANAO conducted an electronic file review of 50 trustee files to examine the extent to which the documentation required in APRA’s guidance for prudential reviews had been completed, as well as the completion rate for quarterly risk reviews. Ahead of the implementation of its new information management system, APRA’s record keeping policy is that hardcopy files remain the record of work performed. Nevertheless, it was agreed with APRA that the ANAO would test electronic records due to the cost and difficulty associated with accessing the hard copy files. Subsequent to this testing, APRA interrogated its hard copy files to identify records that were not stored in Q.

5.8 The ANAO examined 117 prudential reviews that were recorded in Q⁶¹, for the period 1 July 2013 to 24 March 2016. The trustee files were examined for documentation required by APRA’s internal supervision guidance.

5.9 APRA’s guidance on managing core prudential review documentation is inconsistent as it requires signed prudential review assessments and reports to be filed electronically while scoping documents are to be signed but not electronically filed. Nevertheless, the ANAO’s electronic file review found that some supervisors electronically file all relevant prudential review documentation while others file none.

5.10 For thirty reviews (25.6 per cent), there was no documentation on the relevant trustee files—indicating that the reviews had not been completed or that the documentation had not been filed electronically.⁶² Fifty of the remaining 87 reviews (57.5 per cent) had incomplete documentation, mainly review assessments and scoping documents.⁶³

5.11 As part of the trustee file review, the ANAO also reviewed 492 quarterly risk reviews with a completed status; of which, 46 had not been completed⁶⁴, and 183 reviews had either been:

• completed late and as part of a cluster; that is, multiple quarterly risk reviews were completed on the same day rather than being completed following the relevant quarter; or
• copied from previously completed quarterly risk reviews with no change.

5.12 As illustrated in Figure 5.1, the worst instance of clustering was seven reviews being completed on the same day for an entity with an oversight SOARS stance—indicating that this entity had not had quarterly risk reviews completed for almost two years.⁶⁵

Figure 5.1: Instances of quarterly risk review clustering

Source: ANAO analysis of 50 trustee files, including 492 completed quarterly risk reviews.

5.13 The ANAO’s analysis identified shortcomings with APRA’s record-keeping, including that key supervision activity outcomes were not recorded (paragraphs 5.3 to 5.6) and key supervision documentation was not stored electronically. APRA advised its record keeping policy is that hardcopy files remain the record of work performed. This position is inconsistent with the Australian Government Digital Transition Policy⁶⁶ that required government agencies to manage digitally created information in digital formats from 1 January 2016. The ANAO notes that, with offices geographically located around Australia, there would be benefit to APRA in adopting an electronic records management approach to enable information to be shared readily and without significant costs.

Timeliness of supervision activities

5.18 As outlined in paragraph 5.2, the ANAO analysed APRA superannuation supervision activities recorded in Q for the period 1 July 2013 to 24 March 2016, to assess the timeliness of these activities. All except one of the 1693 completed lodgement analyses and quarterly risk reviews had due dates recorded (as these are generated by Q)⁶⁷; of which, 764 (45.1 per cent) were recorded as completed earlier than or on the same day as the recorded due date, and 928 (54.8 per cent) were recorded as completed after the due date.

5.19 The ANAO also compared the planned and completed dates for prudential reviews and consultations and other supervisory activities with completed statuses.⁶⁸ Of these 1098 activities⁶⁹, 721 activities (65.7 per cent) were completed after the planned dates, with 611 activities (84.7 per cent) of these completed within six months of the planned date. The ANAO also analysed the planned dates for 284 activities with an overdue status.⁷⁰ Most of these activities (192) were overdue by 180 days or less.

5.20 APRA should consider whether undertaking supervision activities within set timeframes is an important factor in managing the delivery of its work and if so, establish a framework to monitor the timeliness of supervision activities.

Enforcement action

5.21 APRA may take remedial action in instances where it has concerns in relation to an entity’s ability or willingness to rectify weaknesses that threaten its financial viability or safety. APRA has a Resolution and Enforcement team in place whose role is to advise and assist supervisors with applying APRA’s enforcement powers and to carry out enforcement action if necessary.

5.22 As illustrated in Figure 5.2, APRA’s enforcement principles are based on applying enforcement actions, available under the Superannuation Industry (Supervision) Act 1993, commensurate with the prudential regulation threat.

Figure 5.2: APRA’s enforcement principles and powers

Source: ANAO analysis of APRA’s enforcement powers.

5.23 APRA’s Enforcement Steering Group is responsible for overseeing proposed and actual enforcement activities. From July 2013 to March 2016, the Enforcement Steering Group monitored significant enforcement actions against four entities, receiving monthly updates in relation to these entities.⁷¹ Some of these entities have been subject to enforcement action for a number of years as implementation of actions, such as court actions, can be lengthy and complex. APRA’s enforcement response in relation to these entities has varied according to their circumstances, including: removing and replacing trustees; enforceable undertakings; court action; and advising the Minister on ‘Part 23’ financial assistance applications.⁷²

5.24 APRA’s Enforcement Steering Group has undertaken a review of its management of one of the four entities—14 years after the entity was first subject to enforcement action. Reviews of APRA’s management of these types of entities, potentially at various points including before, during and at the conclusion of enforcement action, would assist APRA to identify areas for improvement in its supervision approach. In particular, the circumstances relevant to the most recently identified entity should be reviewed by APRA to determine whether its supervision approach, training and guidance material, and/or guidance for entities, needs to be improved.

Does APRA have an effective quality assurance framework?

5.25 APRA does not have a quality assurance framework for its supervision activities, although it does undertake two activities aimed at improving the consistency of approach to preparing PAIRS assessments and supervisory action plans among supervisors: benchmarking sessions with supervisors; and Executive review of a selection of supervisory action plans.

5.26 Since 2013, APRA has undertaken four superannuation benchmarking sessions with supervisors. The sessions involve around five to seven (of 77) supervisors relevant to a common industry peer group⁷³, who discuss their approaches to PAIRS assessments, priority PAIRS categories and developing supervisory action plans. Outcomes of these sessions are made available on APRA’s intranet, and quarterly reports are provided to the Executive of the Specialised Institutions Division and Diversified Institutions Division on whether participants have completed any resultant required actions. APRA advised the ANAO that informal benchmarking sessions are also conducted within the two divisions—the last one being held by the Diversified Institutions Division in 2013.

5.27 APRA’s Executive⁷⁴ hold sessions to review the supervisory action plans for three to four entities selected by the Executive. Two of these sessions specific to superannuation have been held during the period reviewed by the ANAO—one in September 2013 and one in March 2016. Selection of supervisory action plans is ad-hoc and without a documented process. Supervisors attend these sessions and are required to respond to the Executive’s queries, for example, explaining how the supervisory action plans address key risks. APRA advised that the outcomes of these sessions are reported to divisions by the respective Executive General Managers.

5.28 APRA also considers its sign-off protocol as a quality assurance mechanism. However, as noted in paragraph 5.9, the ANAO’s file review found that documents are not consistently filed or signed off. Other risks associated with relying on a sign-off protocol as a quality assurance mechanism are that it does not: measure consistency across work areas⁷⁵; or address instances where there is misinformation or misunderstanding within a line of command. For example, as noted in Chapter 4, APRA’s review of supervisory action plans in 2015 found that activities identified by supervisors to address data integrity issues had not been tailored to individual entities as was expected by the Industry Analysis team.

5.29 In August 2016, APRA’s Management Committee considered a paper on establishing a quality assurance framework, commencing with a pilot. The paper recognised that APRA’s quality assurance activities ‘are not where they need to be and fall short of industry and better practice’. The framework is expected to, among other things, provide assurance that outcomes reflect consistent application of standards and practices; inform management decisions, including resource allocation; and identify areas that may benefit from further investment. APRA’s quality assurance framework should include structured, risk-based quality assurance processes that in addition to examining whether supervisors follow documented procedures, examine the quality of work undertaken and the nature of interactions with supervised entities. Such a program would help APRA to detect and address inconsistent practices among supervisors as well as provide assurance to APRA’s Executive as to the quality of supervision work being undertaken.

Does APRA effectively report internally and externally on the performance of its superannuation supervision activities?

Internal reporting

5.33 The Specialised Institutions and Diversified Institutions Divisions prepare quarterly performance reports that are provided to the Executive and include operational priorities in addition to reporting against key performance indicators (KPIs). Of 16 KPIs relevant to superannuation, the Specialised Institutions and Diversified Institutions Divisions share five: proactive supervision time; PAIRS and supervisory action plans that are greater than 12 months old; and two prudential review KPIs.⁷⁶

5.34 The Specialised Institutions Division monitors the number of some activities undertaken and aspects of compliance with baseline requirements. The Diversified Institutions Division has a greater focus on implementation of supervisory action plans, however, APRA is unable to measure this KPI through Q and instead it is informed by qualitative assessments carried out by the Diversified Institutions Division General Managers. The Diversified Institutions Division does not have KPIs to measure the level of baseline activity.

5.35 The KPIs for the Specialised Institutions and Diversified Institutions Divisions do not focus on supervision activity timeliness, completeness, targeting or accordance with SOARS stance. APRA is also unable to reliably measure whether supervisory action plans are implemented. The ANAO suggests that APRA reviews internal KPIs of supervisory activities to better reflect the timeliness, quality and implementation of supervision activities.

External reporting

5.36 APRA reports externally on its supervision performance in annual reports, as illustrated in Table 5.4, which also include supervisory and regulatory activities by industry. APRA’s performance results are reported at an aggregate level across all of the industries that APRA supervises⁷⁷, and provide little insight into the effectiveness of APRA’s supervision efforts within individual industries, including superannuation.

Table 5.4: APRA’s performance reported in 2013–14 and 2014–15 annual reports

Note a: The Performing Entity Ratio is an indicator of the incidence of failure for regulated entities. The Money Protection Ratio is an indicator of the incidence of loss in the financial sector. A higher ratio indicates a lower incidence of failure or loss. The annual Performing Entity Ratio and Money Protection Ratio have averaged 99.92 per cent and 99.96 per cent respectively since APRA’s inception in 1998.

Note b: The SOARS transition matrix illustrates movements of APRA-regulated entities through supervision stances.

Note c: Only shows the results for the top five and bottom five rated items from APRA’s 2013 and 2015 biennial stakeholder surveys.

Source: ANAO analysis of APRA Annual Reports for 2013–14 and 2014–15.

5.37 APRA also reports the results of its biennial surveys of regulated entities on its website⁷⁸, which reflects stakeholder feedback on its performance. The 2015 Stakeholder Survey results show that superannuation trustees rated APRA strongly in relation to its prudential approach and conduct of supervisory activities.

5.38 For 2015–16, APRA has revised performance reporting requirements, including:

• publishing its first report on the validated self-assessment outcomes against the Australian Government’s Regulator Performance Framework⁷⁹; and
• developing an annual performance statement as required under the Public Governance, Performance and Accountability Act 2013.⁸⁰

5.39 APRA’s performance information should help industry, beneficiaries and stakeholders, including Parliament, to form a judgement on whether it is achieving its purposes.⁸¹ Including the stakeholder survey results at the industry level in its annual report provides a measure of the effectiveness of APRA’s activities in the superannuation industry. However, APRA should include additional performance information for the superannuation industry to complement these results and provide a more meaningful representation of its achievements. Additional information could include: the number and type of activities undertaken; the actions resulting from those activities; information relating to its enforcement actions; and extension of the current external performance reporting disaggregated to the superannuation industry (Performing Entity Ratio, Money Protection Ratio and the number of entities that moved out of mandated improvement and restructure stances, as per Table 5.4).⁸² This information would more transparently reflect APRA’s supervision efforts in relation to the superannuation industry; the effectiveness of those activities; and the relative ‘health’ of the industry.

Appendix 1 Australian Prudential Regulation Authority response

ANAO comment

Paragraph numbers have changed in finalising the report. Paragraph 5.17 is now 5.20, paragraph 5.21 is now 5.24,.and paragraph 5.31 is now 5.35.