System and Network Audit of Market Infrastructure Institutions (MIIs)
Summary
This circular mandates Market Infrastructure Institutions to conduct annual System and Network Audits by independent auditors. It requires the submission of audit reports, joint declarations from senior management, and details of non-compliances to SEBI. The framework outlines specific auditor selection norms, cooling-off periods, and timelines for corrective actions. This section outlines the mandatory norms for selecting auditors, including specific experience and certification requirements. It details the guidelines for audit reports, requiring certification of network conformity and submission of detailed findings to SEBI. The text concludes with Annexure 2, which defines the Terms of Reference for system and network audits covering IT governance, policies, and business controls. This section outlines specific audit requirements for software development, network controls, security, and access policies. It details procedures for business continuity planning, disaster recovery testing, and IT asset management. The text further mandates audits for human resources, network infrastructure, vendor selection, and email systems. This section defines the Exception Observation Reporting
Text
stock exchanges, clearing corporations and depositories should conduct an Annual System Audit by a reputed independent auditor.
MIIs are required to conduct System and Network Audit as per the framework enclosed as Annexure 1 and Terms of Reference (TOR) enclosed as Annexure 2.
MIIs are also required to maintain a list of all the relevant SEBI circulars/ directions/ advices, etc. pertaining to technology and compliance thereof... included under the scope of System and Network Audit.
MIIs are also required to submit information with regard to exceptional major Non-Compliances (NCs)/ minor NCs observed in the System and Network audit as per format enclosed as Annexure 4...
The Systems and Network audit Report... shall be placed before the Governing Board of the MII and then the report along with the comments of the Management of the MII shall be communicated to SEBI within a month of completion of audit.
MIIs are required to submit a Joint declaration from the Managing Director(MD)/Chief Executive Officer(CEO) and Chief Technology Officer (CTO) certifying a) the security and integrity of their IT Systems. b) correctness and completeness of data provided to the Auditor...
This circular supersedes the abovementioned Circular no. SEBI/HO/MRD1/ICC1/CIR/P/2020/03 dated January 07, 2020.
The provisions of the Circular shall come into force with immediate effect.
This circular is being issued in exercise of the powers conferred by Section 11(1) of Securities and Exchange Board of India Act, 1992 read with Regulation 51 of Securities Contracts (Regulation) (Stock Exchanges and Clearing Corporations) Regulations, 2018 and Section 19 of the Depositories Act, 1996 read with Regulation 97 of Securities and Exchange Board of India (Depositories and Participants) Regulations, 2018...
The Audit shall be conducted according to the Norms, Terms of Reference (TOR) and Guidelines issued by SEBI.
The Governing Board of the Market Infrastructure Institution (MII) shall appoint the Auditors based on the prescribed Auditor Selection Norms and TOR.
An Auditor can perform a maximum of 3 successive audits. However, such auditor shall be eligible for re-appointment after a cooling-off period of two years.
You have read the preview. Create a free account to read the full document and see every order that applied it.
Free accounts include 10 searches/day with full text access.
Source: SecMarx — System and Network Audit of Market Infrastructure Institutions (MIIs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.