FAR Accountability: Is Your APRA Reporting Capability Fit for the Scrutiny Ahead?

At RegCentric, we are often asked what is next for APRA reporting. Our short answer: APRA is investing in its capability to interrogate the information it receives. Regulated entities need to ask whether they are investing enough in their capability to produce, govern and explain it.

For many executives, implementing the Financial Accountability Regime meant considerable effort on accountability statements and maps. But the more important question for an Accountable Person is now:

Can I demonstrate that I have taken reasonable steps to ensure the areas for which I am accountable are appropriately governed, controlled and resourced?

A more active, more data-driven supervisor

APRA has described its current approach as one of increased supervisory intensity, and since 2024 has made broad use of licence conditions, enforceable undertakings, directions, capital overlays, independent reviews and mandated remediation. Weaknesses in governance, controls, risk management and data are a recurring theme. Under FAR, APRA and ASIC can also disqualify an Accountable Person who breaches their obligations.

At the same time, APRA’s data capability is growing. In its 2026-27 Corporate Plan, APRA notes that the risk environment in which APRA operates has fundamentally shifted – and to remain an effective regulator, APRA’s objective is to become an AI-enabled regulator, identifying risks earlier, building richer insights and increasing their effectiveness.

Regulatory data is becoming supervisory data. It can be analysed across periods, across returns and against peers, making inconsistencies and unexpected movements easier to identify.

A correct return can still carry significant risk

Many reporting processes have worked for years on spreadsheets, manual transformations, undocumented adjustments and a few key individuals. Such a process can produce a correct return while carrying significant underlying risk, and it makes it much harder to demonstrate that reporting risk is being managed.

CPS 230, which has applied to banks, insurers and RSE licensees since 1 July 2025, reinforces this. It requires entities to embed, monitor and test controls over operational risk and to remediate weaknesses in a timely way. A fragile reporting process is an operational risk in its own right. CPS 230 sets expectations for how that risk is controlled; FAR establishes who is personally accountable for making sure it happens.

What does “reasonable steps” look like?

There is no single checklist, but an Accountable Person responsible for regulatory reporting should be able to answer questions such as:

• Do I understand how our major returns are produced, and where judgement is applied?

• Where do we depend most on manual processing and individual knowledge?

• Can we trace material reported figures back to source?

• Are controls built into the process, or applied only at final review?

• Could we reproduce or explain a return six months after lodgement?

• Are issues raised by audit or risk being permanently resolved, or managed again each cycle?

Repeatedly accepting known weaknesses will be increasingly difficult to reconcile with an obligation to take reasonable steps.

Investment in reporting capability is a governance decision

This does not mean every process must be automated. The objective is proportionate investment, whether that is better documentation and controls, clearer data ownership, improved lineage or automating repetitive manual steps. What matters is that the decision is deliberate. Maintaining a heavily manual process should be a conscious risk decision, not the default because it has always worked.

That changes the business case. It is no longer only “how many hours can we save?” but “how much regulatory, operational and personal accountability risk are we carrying?” Stronger capability delivers better data quality and traceability, reduced key-person dependency, stronger evidence for approvals and faster responses to regulatory queries.

Accountability needs capability behind it

An accountability statement and a place on the accountability map do not, by themselves, make the underlying process robust. As APRA becomes more data-driven, investment in reporting capability needs to keep pace.

Because when a regulator asks how an organisation arrived at a number, how an issue was controlled or why a known weakness was allowed to persist, the question may no longer be directed only to the regulatory reporting team. Increasingly, it may be directed to the person whose name appears on the accountability map.

About RegCentric

RegCentric is a specialist APRA reporting consultancy and software provider. We help APRA-regulated entities assess, strengthen and automate their regulatory reporting, from reviewing processes and controls to implementing technology that improves lineage, consistency and auditability. If you would like to understand how your reporting capability measures up against FAR and CPS 230, we would welcome a conversation.