APRA Prudential Standards Documentation
APRA-regulated entities must maintain extensive prudential documentation. Learn the key documentation requirements and how to keep them audit-ready.
The Australian Prudential Regulation Authority (APRA) is the prudential regulator of the Australian financial services industry. It oversees authorised deposit-taking institutions (ADIs, including banks, credit unions, and building societies), general and life insurers, private health insurers, and registrable superannuation entity (RSE) licensees. APRA's prudential framework consists of prudential standards, prudential practice guides, and reporting standards that collectively require regulated entities to maintain substantial documentation.
Documentation is not a secondary concern for APRA-regulated entities. APRA's supervisory approach relies heavily on documented evidence of governance, risk management, capital adequacy, and operational resilience. When APRA conducts supervisory reviews or issues directions, it expects entities to demonstrate compliance through contemporaneous, accurate documentation.
Core Prudential Documentation Requirements
Governance and Risk Management
APRA's governance standards apply across all regulated industries. The key documentation requirements include:
| Prudential Standard | Documentation Required | Applies To |
|---|---|---|
| CPS 510 Governance | Board charter, committee charters, fit and proper assessments, board performance reviews | All APRA-regulated entities |
| CPS 220 Risk Management | Risk management framework, risk appetite statement, risk register, ICAAP/ORSAP | All APRA-regulated entities |
| CPS 520 Fit and Proper | Fit and proper policy, assessments for responsible persons, ongoing monitoring | All APRA-regulated entities |
| CPS 510 Remuneration | Remuneration policy, board remuneration committee charter, remuneration governance arrangements | All APRA-regulated entities |
Operational Resilience
APRA has progressively strengthened operational resilience requirements:
| Prudential Standard | Documentation Required |
|---|---|
| CPS 230 Operational Risk Management | Operational risk framework, business continuity plan, service provider management policy, material service provider register, tolerance levels for disruptions |
| CPS 234 Information Security | Information security framework, information asset classification, security controls documentation, incident response plan, testing records |
| CPS 231 Outsourcing | Outsourcing policy, material outsourcing register, due diligence records, contractual requirements documentation |
Capital and Financial Requirements
ADIs, insurers, and superannuation trustees must maintain documentation supporting their financial soundness:
- Capital management: Internal Capital Adequacy Assessment Process (ICAAP) for ADIs; Own Risk and Solvency Assessment Process (ORSAP) for insurers
- Stress testing: Stress testing framework, scenario documentation, results analysis, and board reporting
- Recovery planning: Recovery plan documenting options available in severe stress scenarios
- Reporting: Regular prudential returns to APRA, audited financial statements, actuarial reports (insurers and super funds)
Industry-Specific Requirements
Superannuation (RSE Licensees)
RSE licensees face additional documentation requirements under the SIS Act 1993 and related prudential standards:
- Member outcomes assessment: Annual outcomes assessment documentation comparing performance, fees, and services against alternatives
- Investment governance: Investment governance framework, investment strategy documentation, investment management agreements
- Insurance in super: Insurance management framework, insurance strategy documentation, insurer due diligence
- Expenditure: Expenditure governance framework documenting how expenditure decisions serve members' financial interests
Insurance
Insurers have additional prudential documentation requirements:
- Pricing and underwriting: Underwriting management framework, pricing governance documentation
- Claims management: Claims management framework, claims procedures documentation
- Reinsurance: Reinsurance management strategy, reinsurance arrangements documentation
- Actuarial: Appointed Actuary reports, actuarial valuations, financial condition reports
Common APRA Findings
APRA's supervisory activities consistently identify documentation weaknesses across regulated entities.
Risk appetite statements that lack specificity are a frequent finding. APRA expects risk appetite statements to be specific, measurable, and linked to the entity's strategy. Statements that use generic language without quantifiable metrics or clear boundaries fail to meet APRA's expectations.
Governance documents that do not reflect practice create compliance gaps. Board and committee charters that describe responsibilities not actually performed, or that omit responsibilities that are performed, are problematic. APRA expects governance documents to accurately reflect how the entity actually operates.
Incomplete CPS 234 documentation remains common. Information security frameworks that do not cover all information assets, testing records that are incomplete or ad hoc, and incident response plans that have not been tested are areas where APRA frequently identifies gaps.
Outsourcing and service provider documentation under CPS 230/231 is another area of common weakness. Entities must document their material service provider arrangements, conduct due diligence, and maintain ongoing monitoring records. Many entities have material outsourcing arrangements without adequate contractual documentation or monitoring evidence.
Maintaining Audit-Ready Documentation
Establish a Prudential Documentation Register
Map every applicable prudential standard to the specific documents that evidence compliance. Include:
- Document title and owner
- Applicable prudential standard(s)
- Review frequency and last review date
- Approval authority (board, committee, or management)
- Next scheduled review date
Implement a Review Cycle
- Board-approved documents: Review annually and present to the board for re-approval
- Risk management documentation: Review at least annually and after any material risk event or business change
- Operational resilience documentation: Review annually and test regularly (CPS 230 requires specific testing frequencies)
- Reporting documentation: Update each reporting period
- Policies and procedures: Review annually and after any regulatory change
Quality Standards for Prudential Documentation
APRA expects documentation to be:
- Current: Reflecting the entity's present circumstances, not historical
- Specific: Tailored to the entity, not generic templates
- Actionable: Describing what the entity actually does, not aspirational statements
- Consistent: Aligned across related documents (risk appetite aligns with strategy, which aligns with capital planning)
- Approved: Signed off by the appropriate authority within required timeframes
How Content Review Tools Support Prudential Documentation
APRA-regulated entities maintain hundreds of policy documents, frameworks, plans, and reports. Keeping this documentation current, consistent, and compliant across multiple prudential standards is a significant operational challenge, particularly for entities undergoing organisational change or responding to new prudential requirements.
Content review platforms can help prudential documentation teams by checking for consistency across related documents, flagging outdated references to superseded standards or guidance, verifying that documentation meets the specificity APRA expects, and identifying gaps where required elements are missing. By configuring review criteria based on specific prudential standards and uploading APRA guidance into a knowledge base, teams can systematically review documentation before supervisory engagements.
This supports but does not replace qualified prudential and legal review. APRA's expectations are principles-based, requiring professional judgement about what constitutes adequate compliance for a specific entity. AI-assisted review provides a consistent quality check that helps catch documentation gaps and inconsistencies before APRA does.
This article provides general information about APRA prudential documentation requirements and is not regulatory or legal advice. Always consult APRA for current prudential standards and seek qualified advice for your specific situation.