System Audit framework for Mutual Funds / Asset Management Companies (AMCs)

SEBI/HO/IMD/DF2/CIR/P/2019/57 · 2019-04-11 · SEBI Investment Management Department

Summary

This circular establishes a revised system audit framework for Mutual Funds and Asset Management Companies to standardize technology-driven asset management activities. It mandates that these entities conduct annual systems audits by independent qualified auditors and implement necessary systems for compliance. The document outlines specific audit scopes, reporting requirements to the Technology Committee and SEBI, and provides detailed checklists for IT governance and environment assessment. This section outlines IT governance requirements including risk management frameworks, policies, organizational structures, and IS audit procedures. It details information security mandates covering dedicated functions, comprehensive policies, risk management processes, and cyber security compliance with SEBI circulars. The text further specifies requirements for security awareness training and the establishment of documented privacy policies. This section details information security controls covering human resources, digital technologies, and third-party vendor management. It establishes requirements for access management policies, privileged access controls, and administration procedures. T

Text

Requirement of system audit for mutual funds was introduced vide SEBI Circular SEBI/IMD/CIR No.9/176988/2009 dated September 16, 2009.

Considering the importance of systems audit in technology driven asset management activity and to enhance and standardize the systems audit, revised guidelines in this regard are placed at Annexure 1. These guidelines are indicative and not exhaustive in nature. On the date of issuance of this circular, SEBI Circular SEBI/IMD/CIR No.9/176988/2009 dated September 16, 2009 shall stand rescinded.

The aforementioned audit should be encompassing audit of systems and processes, inter alia, related to examination of integration of front office system with the back office system, fund accounting system for calculation of net asset values, financial accounting and reporting system for the AMC, Unit-holder administration and servicing systems for customer service, funds flow process, system processes for meeting regulatory requirements, prudential investment limits and access rights to systems interface.

Mutual Funds / AMCs are advised to conduct systems audit on an annual basis by an independent CISA / CISM qualified or equivalent auditor to check compliance of the provisions of this circular.

Mutual Funds / AMCs are further advised to take necessary steps to put in place systems for implementation of this circular. The exception report as per Annexure 2 should be placed before the Technology Committee for review. The Technology Committee after review shall place the same before the AMC & Trustee Board. Thereafter, exception observation report along with trustee comments starting from the financial year April 2019 – March 2020 should be communicated to SEBI within six months of the respective financial year. Further, System Audit Reports shall be made available for inspection.

This circular is issued in exercise of powers conferred under Section 11 (1) of the Securities and Exchange Board of India Act, 1992, read with the provisions of Regulation 77 of SEBI (Mutual Funds) Regulations, 1996, to protect the interests of investors in securities and to promote the development of, and to regulate the securities market.

Whether a defined and documented IT policy exists and is approved by the BOD? Is the current state of IT architecture documented? Whether defined and documented procedures exist for all components including IT Assets Acquisition, Logical access management, Change management, Backup and recovery, Incident management, Problem management, Data Center Operations, Operating systems and database management, Network and communication management, End user computing, Acceptable use of IT assets?

Whether a defined organization structure exists with defined authorities, reporting lines and responsibilities related to IT governance including a designated Chief Information Officer (CIO)/ Chief Technology Officer (CTO), Chief Information Security Officer (CISO) and heads for key IT teams managing IT operations, IT applications, IT infrastructure, IT risk management/ reviews? Are roles and responsibilities of IT Organization defined?

Is there a defined IS audit framework including process and responsibilities to be followed for IS audits, IS audit calendar, scope definition, review, reporting process and monitoring progress against non-compliances? Are IS audit plans, reports, findings and action plans reported management and audit committee of board as appropriate?

Whether an information security function exists distinct from IT function with dedicated responsibility of defining and monitoring implementation of information security policies and controls? Is there a designated CISO responsible for overseeing the information security function and for ensuring information security procedures are defined and implemented? Does the information security function include representations from departments and operations across the organization including internal and client facing functions and including all organization locations?

Whether a defined and documented information security policy exists and is approved by the BOD? Whether the information security framework ensures security requirements are in-built into key IT architecture, operations and other non-IT aspects, including but not limited to: Access management - Physical and Logical, Infrastructure and applications change management, Backup and recovery, automated batch jobs, Incident management (including security incidents), Problem management, Data center Operations, Operating systems and database management, Network and communication management, End user computing, Security Operations - logging and monitoring? Whether defined and documented procedures exist for the following: Hardening procedures, standards and guidelines for operating systems, databases, servers and network devices, Use of cryptography, Third Party Security, Human Resource controls for information security, Information classification guidance and process including mechanisms for storage, transmission and disposal of information? Whether the information security framework/ policy is reviewed on an yearly basis at a minimum?

Whether a defined process exists and is followed for Information Security (IS) risk management on an annual basis, at a minimum? Whether the IS risk management is performed in line with the organization and IT risk management framework? Whether the risk assessment is performed for new functions, processes, teams and locations. Whether relevant risk mitigation and monitoring actions are implemented as per the defined framework?

Source: SecMarx — System Audit framework for Mutual Funds / Asset Management Companies (AMCs). Verbatim text is public record; SecMarx structuring (linkage to applying orders) is cited to us.