Annual System Audit
Summary
This circular mandates Market Infrastructure Institutions to conduct an Annual System Audit by a reputed independent auditor to ensure market integrity. It supersedes the previous 2011 circular and outlines revised frameworks for audit scope, auditor selection, and reporting timelines. The document requires MIIs to submit audit reports, compliance declarations, and details of non-compliances to SEBI within specified periods. This section outlines the mandatory qualifications, certifications, and independence requirements for auditors conducting system audits. It establishes guidelines for the content, structure, and submission of audit reports to SEBI, including a specific issue log format. The document further details the Terms of Reference (TOR) covering IT environment, governance, business controls, security, and disaster recovery. This section outlines the remaining checklist items for IT governance, covering disaster recovery drills, asset management, vendor selection, and HR policies. It includes Annexure 3, which provides a format for monitoring compliance with SEBI technology circulars. Additionally, Annexure 4 details the exception observation reporting format for major an
Text
MIIs are advised to conduct an Annual System Audit as per the framework enclosed as Annexure 1 and Terms of Reference (TOR) enclosed as Annexure 2.
MIIs are also advised to maintain a list of all the relevant SEBI circulars/ directions/ advices, etc. pertaining to technology and compliance thereof, as per format enclosed as Annexure 3 and the same shall be included under the scope of System Audit.
MIIs are advised to submit information with regard to exceptional major Non-Compliances (NCs)/ minor NCs observed in the System Audit as per format enclosed as Annexure 4 and are advised to categorically highlight those observations/NCs/suggestions pointed out in the System Audit (current and previous) which remain open.
The Systems Audit Report including compliance with SEBI circulars/ guidelines and exceptional observation format along with compliance status of previous year observations shall be placed before the Governing Board of the MII and then the report along with the comments of the Management of the MII shall be communicated to SEBI within a month of completion of audit.
This circular supersedes the abovementioned Circular no. CIR/MRD/DMS/13/2011 dated November 29, 2011.
This circular is being issued in exercise of the powers conferred by Section 11(1) of Securities and Exchange Board of India Act, 1992 to protect the interest of investors in securities and to promote the development of, and to regulate the securities market.
The Audit shall be conducted according to the Norms, Terms of Reference (TOR) and Guidelines issued by SEBI.
The Governing Board of the Market Infrastructure Institution (MII) shall appoint the Auditors based on the prescribed Auditor Selection Norms and TOR.
An Auditor can perform a maximum of 3 successive audits. However, such auditor shall be eligible for re-appointment after a cooling-off period of two years.
Further, during the cooling-off period, the incoming auditor may not include: (i) Any firm that has common partner(s) with the outgoing audit firm; and (ii) Any associate / affiliate firm(s) of the outgoing audit firm which are under the same network of audit firms...
The period of Audit shall not be for more than 12 months. Further, the Audit shall be completed within 2 months from the end of the Audit Period.
In the Audit report, the Auditor shall include its comments on whether the areas covered in the Audit are in compliance with the norms/ directions/ advices issued by SEBI, internal policy of the MII, etc. Further, the report shall also include specific non-compliances (NCs), observations for minor deviations and suggestions for improvement.
You have read the preview. Create a free account to read the full document and see every order that applied it.
Free accounts include 10 searches/day with full text access.
Source: SecMarx — Annual System Audit. Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.