Sebi unveils audit standard for systems, networks of MIIs

Markets regulator Sebi on Friday introduced a standardised format for system and network audit reports of market infrastructure institutions (MIIs) such as stock exchanges, clearing corporations, and depositories -- to enhance the audit efficiency. Under this, Sebi will assign unique IDs to each observation in a bid to simplify the tracking of both current and historical audit issues.

This new framework aims to improve data quality, ensure compliance with regulatory requirements, and streamline the monitoring of audit observations.

This will apply to audits conducted from the fiscal year 2024-25, or the second half of the fiscal year, depending on the audit frequency.

"The standardized format for system and network audit report would help to increase the data quality, capture of relevant information as per regulatory requirements in a streamlined and standardized manner across MIIs, monitor compliance requirements in a more focused manner, ease of traceability of current/historical open observations found during audit at the end of MII and Sebi by assigning a unique ID to each observation," Sebi said in its circular.

Presently, all MIIs are required to conduct system and network audit and each MII has adopted a different template for such reporting.

As per the circular, the standardized system and network audit report format include several key sections to ensure comprehensive reporting.

Going by the format, MIIs are required to disclose basic information such as name, address, and contact details of the auditee and audit team.

Furthermore, they need to disclose audit details such as period, methodology, and tools used.

The IT environment overview highlights major projects or developments undertaken during the audit period, providing insights into the technological landscape of the MII.

The scope of audit involves the compliance with relevant regulatory requirements and identifies any technical glitches encountered.

Sebi said observations and findings detail the issues discovered during the audit, with each observation assigned a unique ID to facilitate easy tracking and follow-up.

The compliance status section assesses adherence to Sebi mandates, including critical areas like disaster recovery drills, stress testing, and business continuity planning.

Additionally, the report includes a list of pending issues, detailing unresolved observations from previous audits along with reasons for their non-closure. The final notes cover any limitations of the audit, auditor comments, and a concluding assessment.