Build trust with GS 007 in 2024

The Guidance Statement 007 (GS 007) is an Australian reporting framework designed for financial services. It includes defined control objectives related to Investment Management, Fund Administration, Registry, and Custody, that you can optionally include in a report to build trust with your customers. These cover the ways investments are managed in compliance with relevant client agreements to build trust that their investments and requirements are safeguarded.

At this stage AssuranceLab's services and product, Pillar, support GS 007 Sections A: Custody, B: Asset Management, E: Investment Administration, and F: Registry. Pillar conducts the initial readiness assessment to map your systems, processes and controls to the objectives, and identifies any gaps for consideration to prepare for the audits.

A Type 1 report attests to your compliance by design. It’s a snapshot in time that can be achieved by showing you have the right systems and processes in place to satisfy the GS 007 control objectives. 

A Type 2 report attests to your compliance by both design and operation over a period of time. It covers a period between 3-12 months to show your systems and processes have been operated consistently to satisfy the GS 007 control objectives. 

Usually, a Type 1 report is issued first to baseline compliance. That marks the start of the live and recurring Type 2 audit periods for reports issued annually. That is the industry standard but the SOC standards have flexibility to choose the report dates and periods as desired (usually driven by customers’ expectations that drives that industry
standard approach).

Yes, there is a large degree of overlap. All GS 007 reports need to cover the security and operational management of the underlying systems used. That is very similar to the focus of a SOC 1 or SOC 2 report that are commonly required for security compliance by large enterprise customers. These also have a lot of overlap with ISO 27001 certification, however this SOC reporting approach varies in the way it looks at the systems, processes and controls in comparison to the ISO standards looking at the management system with a more prescribed view of the controls.