ASIC expects AFS licensees to maintain an internal audit or review program that provides independent, risk-based assurance over compliance systems and controls, with documented testing, findings, and remediation to demonstrate that obligations are effectively monitored and managed.
Expanded Answer
ASIC does not prescribe a specific internal audit structure but expects licensees to have arrangements that test and verify the effectiveness of their compliance and risk management systems. An internal audit program should be risk-based, targeting higher-risk areas such as advice quality, breach reporting, AML/CTF, and governance. The program must be able to identify control weaknesses and systemic issues, not just confirm process completion.
In practice, an effective internal audit program includes a documented audit plan, defined scope, and regular testing cycles (often annual or rolling). Reviews should assess whether controls are designed appropriately and operating effectively, using file reviews, data analysis, and control testing. Independence is critical—this may be achieved through separate internal functions or external reviewers. Findings must be clearly documented, rated, and linked to remediation actions, with progress tracked and reported to senior management or the board.
Regulatory scrutiny increases where audit programs are superficial, checklist-driven, or fail to drive change. ASIC expects evidence that issues identified through audit are escalated, addressed, and re-tested. For practical expectations, see Compliance 101: reviews and audits and A practical guide to high-level file reviews for licensees and advisers.
Why it matters
A weak internal audit program fails to detect systemic issues and exposes licensees to regulatory action. ASIC increasingly focuses on whether licensees test and verify their controls, not just document them.
Unsure how this applies to you?
Get a clear answer in a 15-minute call with a compliance specialist. Book your call.
Practical guidance
- Develop a risk-based audit plan that prioritises high-risk areas such as advice quality, breaches, and AML/CTF controls.
- Ensure audit independence and depth by separating reviewers from operational roles or using external assurance where needed.
- Track and evidence remediation, including clear ownership, timelines, and re-testing of previously identified issues.
Further reading
Preparing for a compliance review: key considerations
From samples to signals: a smarter approach to AFSL surveillance