It could cost some superannuation funds millions of dollars to implement new information security management standards being proposed by the Australian Prudential Regulation Authority (APRA) and hundreds of thousands of dollars a year to maintain them.
That is the cautionary note being sounded to APRA by the Association of Superannuation Funds of Australia (ASFA), which has told the regulator it has received anecdotal evidence from its members which suggests that “there would be significant one-off and recurrent costs in changing oversight and monitoring, reporting and other systems” resulting from the new requirements.
“One fund has estimated that the initial cost would be $3.2 million and the recurrent annual cost would be $500,000,” ASFA said.
It used a submission to APRA to state that the other consideration is that the detail for some of the requirements is not yet clear or available and it is therefore difficult to be definitive about the likely costs.
However, the ASFA submission said the organisation generally supported the introduction of a new prudential standard to strengthen the existing information security requirements for RSE licensees and welcomed any initiative that would help to protect member information.
It said a common observation made by its members was that it would take time to work out the practical effect of the new requirements and consequently it was difficult to estimate their impact on RSE licensees’ systems and resourcing.
“We have received some cost estimates from members which suggest that there will be significant immediate and recurrent costs,” ASFA said. “While this of itself provides no reason to question the proposal we urge APRA to consider the costs involved in conforming with the new information security regime and to minimise the impact wherever possible.”
“ASFA also recommends that consideration be given to the proposed compliance deadlines and that either flexibility or a staggered approach be adopted. A number of our members have suggested that the proposed timeframes will be difficult to achieve, particularly where third or related parties are involved.”
