Sebi revises annual system audit rules for market participants

Revising the rules for the annual system audit of stock exchanges and depositories, market regulator the Securities and Exchange Board of India (Sebi) today said an auditor can perform a maximum of three successive audits only.

"Based on discussions with the stock exchanges and depositories and recommendations of Technical Advisory Committee, the present system audit framework has been reviewed encompassing the system audit process, auditor selection norms, terms of reference and audit report guidelines," it said in a circular.

The Sebi had in 2008 mandated that exchanges and depositories have to conduct an annual system audit by a reputed independent auditor.

"Stock exchange/depository may negotiate and the board of the stock exchange/depository shall appoint the auditors... The auditors can perform a maximum of three successive audits," it said, adding that the proposal from auditor must be submitted to Sebi for records.

"Audit schedule shall be submitted to Sebi at least two months in advance, along with scope of current audit and previous audit. The scope of the Audit may be extended by Sebi, considering the changes which have taken place during last year or post previous audit report," it said.

The audit report should have specific compliance and non-compliance issues, observations for minor deviations as well as qualitative comments for scope for improvement. Besides, the report should also take previous audit reports in consideration.

"Follow-on audit, if any, has to be scheduled within three months of the audit to ensure that the corrective actions have been taken. If follow-on audit is not required, the auditee management has to submit a report of actions taken and evidence of corrections to the auditors and Sebi within three months," it said.

An auditor must have minimum three years of experience in IT audit of securities industry participants like stock exchanges, clearing houses and depositories.

"The systems audit reports and compliance status should be placed before the governing board of the stock exchanges/ depositories and the system audit report along with comments of stock exchanges/depositories should be communicated to Sebi," it said.

Sebi further added: "Along with the audit report, stock exchanges/depositories are advised to submit a declaration from the Managing Director/Chief Executive Officer certifying the security and integrity of their IT Systems."