Framework for Monitoring and Supervision of System Audit of Stock Brokers (SBs) through Technology based Measures
Summary
SEBI mandates stock exchanges to develop a web portal for monitoring and supervising the system audit lifecycle of stock brokers. The framework requires geo-location tracking, standardized reporting templates, and strict eligibility criteria for empaneling system auditors. These technology-based measures aim to strengthen audit integrity and will apply to the FY 2025-26 audit period.
Text
Stock Exchanges shall develop web portal/ web based platform and create technology based mechanisms to monitor and supervise the entire system audit lifecycle of a stock broker.
As part of the monitoring mechanism, exchanges shall capture the geo location of the auditor to ensure that physical visit is carried out by auditor in the premises of the stock broker.
Exchanges shall ensure that only the authorized auditor or person of the audit firm shall have access to the web portal while conducting audit through secure OTP mechanism.
SBs are mandated to provide following details through web portal before the commencement of system audit: Details of audit members, Date of appointment, Audit plan, SBs/TMs name, address, PAN, SEBI registration no. etc.
During every visit to the SBs’ premises, auditor shall log in to the web portal of the exchange from SBs’ location. The login into the web portal shall be enabled only to authorized auditor through secured mechanism such as OTP on mobile device of the auditor.
Web portal shall capture the geo location of the auditor to confirm physical visits by the auditor.
During audit, the auditor shall provide following details through online web portal: Audit start date, Date of visit, entry time, exit time, audit team members visited, person with whom interacted, details of systems covered, audit end date etc.
Exchanges shall conduct surprise visit to the premises of Qualified Stock Brokers (QSBs) to verify the audit being actually carried out by authorized auditor or authorize persons of audit firm. The exchanges may explore the possibilities of surprise visit to other SBs on a sample basis.
The system auditor shall carry out offsite assessments of the virtual assets provided by third party vendors (cloud services – SaaS, PaaS, IaaS etc.). SBs/TMs shall obtain SOC-II compliance from vendors and provide it to the auditor.
Stock Exchanges shall define standardized template for the system audit report in order to maintain uniformity of audit reports across SBs/TMs. The standardised template of the audit report shall be made available on the web portal which can be filled up by the auditor and submit it to SBs/TMs through the web portal.
The system audit report shall be comprehensive and shall include all areas pertaining to system and technology used by SBs including details of locations/sites covered, IT infrastructure/applications, systems covered during audit, ddistribution of critical and non-critical IT systems, internal and external systems, sample size chosen, criteria used to choose it, the percentage of the total that was chosen as a sample etc.
The system audit report and the Action Taken Report (ATR) shall be submitted to Exchanges through web portal. The ATR shall be validated by the same auditor who has carried out the system audit.
You have read the preview. Create a free account to read the full document and see every order that applied it.
Free accounts include 10 searches/day with full text access.
Source: SecMarx — Framework for Monitoring and Supervision of System Audit of Stock Brokers (SBs) through Technology based Measures. Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.