Executive Summary:
SEBI introduces a technology-based framework to strengthen the monitoring and supervision of system audits for stock brokers (SBs) due to the increasing complexities and risks associated with technology. Stock exchanges (SEs) are required to develop web portals to monitor the system audit lifecycle. The framework will be effective for the audit period of FY 2025-26, and exchanges must develop the web portal within six months of this circular's issuance.
Key Points / Main Content:
Monitoring and Supervision:
* Stock Exchanges (SEs) must develop web portals to monitor and supervise the system audit lifecycle of SBs.
* The portals must capture the geo-location of auditors to ensure physical visits to SB premises.
* Access to the web portal during audits is restricted to authorized auditors via secure OTP mechanisms.
Standardization of System Audit Process:
* SBs must provide auditor details, appointment dates, audit plans, and coverage of IT systems through the web portal before audits commence.
* Auditors must log into the web portal from the SB's location during each visit, providing details such as entry/exit times and systems covered.
* Auditors should carry out offsite assessments of virtual assets provided by third party vendors.
* SEs will conduct surprise visits to Qualified Stock Brokers (QSBs) to verify the audit execution.
* SEs must define a standardized template for system audit reports, to be completed and submitted via the web portal.
* System audit reports and Action Taken Reports (ATRs) must be submitted through the web portal, with ATRs validated by the original auditor.
* QSBs must submit audit reports and ATRs after approval from their Governing Board and Technology Committee; other SBs require approval from a responsible official through their SCOT or TC.
Empanelment of System Auditors:
* SEs are required to empanel system auditors based on prescribed eligibility criteria (qualification, experience, etc.).
* Auditors must be independent, with SEs setting appointment limits to address conflicts of interest.
* SEs, in consultation with SEBI, should issue guidelines for rationalizing system audit costs.
* A cooling-off period of 2 years is required after three consecutive years of audits before an auditor can be reappointed.
* Reassessment by the same auditor is required if gaps are found in critical audit areas.
* SEs will deempanel auditors found to be imprudent or repeatedly deficient, referring them to NFRA/ICAI/ISACA as applicable.
Enhanced Obligations on System Auditors:
* System auditors must verify the reporting of technical glitches, remedial steps taken, capacity planning, software testing, LAMA implementation, preservation of logs, server locations, and DR site compliance.
Other Due Diligence by Stock Exchanges:
* SEs must conduct due diligence to ensure the authenticity of system audit reports, validating them against previous submissions.
* SEs may discuss audit findings with auditors of QSBs after report submission.
* Financial disincentives will be prescribed for serious lacunae in the system audit process or non-closure of observations.
* SEs must prescribe document preservation periods (working papers, logs, etc.).
* SEs must submit a summary of system audits to SEBI on a half-yearly basis.
Implementation Timeline:
* The web portal must be developed within six months of the circular's issuance.
* The framework is effective for the audit period FY 2025-26.
Impact Analysis:
Stock Exchanges:
* Impact: Required to develop, implement, and maintain a web portal for monitoring system audits, empanel auditors, conduct due diligence, and ensure compliance.
* Action Required: Develop the web portal within six months, define eligibility criteria for empanelment, standardize audit report templates, and prescribe financial disincentives.
Stock Brokers:
* Impact: Subject to enhanced scrutiny of their systems and technology through mandatory system audits and reporting.
* Action Required: Provide necessary details to the web portal before the commencement of system audits and submit audit reports and ATRs after approval.
System Auditors:
* Impact: Subject to empanelment criteria, enhanced obligations during audits, and potential deempanelment for non-compliance.
* Action Required: Comply with the eligibility criteria for empanelment, conduct thorough audits, accurately report findings, and adhere to the prescribed guidelines.
SEBI:
* Impact: Receives summary reports from exchanges and oversees the implementation of the framework.
* Action Required: Monitor the implementation of the framework by stock exchanges and review summary reports.
Key Entities Referenced
Securities and Exchange Board of India (SEBI): The regulatory body for securities markets in India, responsible for protecting investors and regulating the securities market.
Stock Exchanges (SEs): Recognized stock exchanges in India that are responsible for developing and maintaining a web portal to monitor the system audit lifecycle of stock brokers.
Stock Brokers (SBs): Entities registered with Stock Exchanges that are subject to system audits and required to comply with the framework outlined in the circular.
Technical Advisory Committee (TAC): A committee of SEBI that was consulted in the development of the guidelines for the conduct of system audits of Stock Brokers.
Intermediary Advisory Committee (IAC): A committee that was consulted in the development of the guidelines for the conduct of system audits of Stock Brokers, with representatives from ICAI.
Institute of Chartered Accountants of India (ICAI): Professional accounting body in India, whose representative was invited to the Intermediary Advisory Committee (IAC).
System Audit: A comprehensive audit of the technology and systems used by stock brokers, designed to identify and mitigate technology risks. A framework for monitoring and supervision of system audit of stock brokers.
National Financial Reporting Authority (NFRA): An authority to which stock exchanges may refer auditors who have not conducted audits prudently or have gaps/deficiencies in their audit reports.
CIRCULAR
SEBI/HO/MIRSD/TPD/CIR/2025/10 January 31, 2025
To,
All recognised Stock Exchanges
All registered Stock Brokers through Recognized Stock Exchanges
Dear Sir / Madam,
Sub: Framework for Monitoring and Supervision of System Audit of Stock
Brokers (SBs) through Technology based Measures.
1. SEBI vide Master Circular No. SEBI/HO/MRD2/PoD-2/CIR/P/2023/171 dated
October 16, 2023 in Clause 8.2 of Chapter 2 has specified the comprehensive
framework for System Audit for Stock Brokers (SBs)/Trading Members (TMs).
Considering the complexities of technology and system used by stock brokers and
emanating technology risk thereof, there is a need to further strengthen the system
audit framework. Therefore, it has been decided to introduce technology based
mechanism to monitor and supervise the way in which the system audits are
conducted and to prescribe eligibility criteria for the empanelment of auditors to
ensure that audits are conducted in a stipulated manner.
2. Based on the discussions with Stock Exchanges (SEs) and Technical Advisory
Committee (TAC) of SEBI as well as in Intermediary Advisory Committee (IAC)
wherein representative of ICAI was also invited, the following guidelines shall be
prescribed for the conduct of system audit of SBs.
3. Monitoring and Supervision of System Audit process through online
mechanism:
3.1 Stock Exchanges shall develop web portal/ web based platform and create
technology based mechanisms to monitor and supervise the entire system audit
lifecycle of a stock broker.
3.2 Stock Exchanges shall monitor process of carrying out of system audit of SBs
through online monitoring mechanism. As part of the monitoring mechanism,
exchanges shall capture the geo location of the auditor to ensure that physical visit
is carried out by auditor in the premises of the stock broker.
Page 1 of 63.3 The web based monitoring & supervision framework shall be accessed by the
auditor during the audit. Exchanges shall ensure that only the authorized auditor
or person of the audit firm shall have access to the web portal while conducting
audit through secure OTP mechanism.
4. Standardization System Audit Process and Audit Report:
Pre audit requirements:
4.1 In order to ensure that the appointed auditor conducts the audit, Stock Exchanges
shall monitor the process of carrying out of system audit through web portal in
following manner:
4.2 SBs are mandated to provide following details through web portal before the
commencement of system audit:
- Details of audit members such as name, address, registration no.,
membership no., PAN, qualification, mobile number etc.
- Date of appointment of auditor, period of audit, copy of auditor appointment
letter.
- Audit plan including proposed dates for physical visit by auditor, list of
proposed coverage of IT systems/processes,
- SBs/TMs name, address, PAN, SEBI registration no. etc.
Requirements during the audit:
4.3 During every visit to the SBs’ premises, auditor shall log in to the web portal of
the exchange from SBs’ location. The login into the web portal shall be enabled
only to authorized auditor through secured mechanism such as OTP on mobile
device of the auditor.
4.4 Web portal shall capture the geo location of the auditor to confirm physical visits
by the auditor.
4.5 During audit, the auditor shall provide following details through online web
portal:
- Audit start date, Date of visit, entry time, exit time, audit team members
visited, person with whom interacted, details of systems covered, audit end
date etc.
Page 2 of 6- Evidence shall be collected by inspecting physical assets,
records/documents, testing of relevant systems, system generated reports
etc.
4.6 Exchanges shall conduct surprise visit to the premises of Qualified Stock Brokers
(QSBs) to verify the audit being actually carried out by authorized auditor or
authorize persons of audit firm. The exchanges may explore the possibilities of
surprise visit to other SBs on a sample basis.
4.7 The system auditor shall carry out offsite assessments of the virtual assets
provided by third party vendors (cloud services – SaaS, PaaS, IaaS etc.). SBs/TMs
shall obtain SOC-II compliance from vendors and provide it to the auditor.
Exchanges may also prescribe suitable certification/compliance to be obtained
from third-party vendors and maintained by SBs/TMs.
Post audit requirements:
4.8 Stock Exchanges shall define standardized template for the system audit report in
order to maintain uniformity of audit reports across SBs/TMs. The standardised
template of the audit report shall be made available on the web portal which can
be filled up by the auditor and submit it to SBs/TMs through the web portal.
4.9 The system audit report shall be comprehensive and shall include all areas
pertaining to system and technology used by SBs including details of
locations/sites covered, IT infrastructure/applications, systems covered during
audit, ddistribution of critical and non-critical IT systems, internal and external
systems, sample size chosen, criteria used to choose it, the percentage of the total
that was chosen as a sample etc.
4.10 The system audit report and the Action Taken Report (ATR) shall be
submitted to Exchanges through web portal. The ATR shall be validated by the
same auditor who has carried out the system audit.
4.11 QSBs are mandated to submit the system audit report and the ATR to Stock
Exchanges after approval from their respective Governing Board and Standing
Committee on Technology (SCOT) or equivalent Technology Committee (TC).
Other SBs/TMs are mandated to submit the system audit report and the ATR to
Stock Exchanges on approval of Proprietor/Partner or equivalent responsible
official through SCOT or TC.
Page 3 of 65. Framework for Empanelment of System Auditors:
5.1 Appointment of Auditor: Stock Exchanges are required to empanel system
auditors. The eligibility criteria for such empanelment shall be prescribed such as
qualification, experience, minimum no. of partners required in an audit firm,
minimum experience of conducting audits required for the auditor, minimum no.
of skilled employees required etc. and norms for de-empanelment. The eligibility
criteria shall emphasized on the experience and qualification of auditors rather
than only on the experience of the audit firm. The list of the empaneled auditors
shall be made available on the web portal.
5.2 Stock exchanges shall ensure that auditor so appointed shall be independent and
do not have any conflict of interest with stock brokers. To address the conflict of
interest and to ensure quality in the audit report, exchange shall put in place
maximum ceiling on the appointment or reappointment of an auditor.
5.3 Exchanges in consultation with SEBI, shall issue broad guideline to ensure
rationalization and standardization of the cost of conducting system audit from
empaneled system auditor based on certain parameters such as no. of clients,
turnover, IT infrastructure etc.
5.4 Exchanges shall prescribe the additional criteria for empanelment of system
auditor for QSBs.
5.5 Re-appointment of auditor: After carrying out the audits of three consecutive
years, cooling off period of 2 years may be prescribed for reappointment of the
auditor/audit firm. Monitoring of compliance of this provision shall be done by
stock exchanges through web portal.
5.6 Reassessment of audit: Exchanges shall define the critical audit area and place
them in the online web portal. The reassessment shall be carried out by the same
system auditor if gaps/deficiencies are found in such critical areas of system audit.
Further, such reassessment shall also be carried out by such auditor in case of
other stock brokers where he has conducted the audit.
5.7 De-empanelment: In case it is observed by stock exchanges that auditor has not
done audit prudently or gaps/deficiencies are found in audit report repeatedly,
exchanges shall de-empanel such auditor and also refer such matters to the
National Financial Reporting Authority (NFRA)/ICAI/ISACA, as applicable for
appropriate action against such auditor.
Page 4 of 66. Enhanced obligation on the system auditor:
6.1 Considering the extensive use of technology by the stock brokers, the system
auditor shall verify the following aspects during the audit:
- Reporting of all technical glitches occurred in the system of SBs to the
exchanges as per the requirements.
- Remedial steps taken by SBs to resolve technical glitches occurred in past
1 year
- Capacity planning in proportion to increase in clients/turnover etc.
- Software testing and change management/patch management as per
prescribed guidelines (including OMS/RMS systems provided by vendors)
- Implementation of Logging and Monitoring Mechanism (LAMA) to detect
technical glitches as prescribed by exchanges in the technical glitch
framework dated December 16,2022. Preservation of logs of LAMA
parameters for the prescribed period
- Servers/applications used for placing the orders or routing such orders to
exchange are located at SBs’ premise.
- Compliance with the requirements of DR site and conducting live DR drill
etc.
7. Other due diligence by Stock Exchanges:
7.1 Exchanges shall carry out due diligence to ensure authenticity of the system audit
report. In addition to the same, the system audit report submitted by SB/TM shall
be validated against the last submitted report.
7.2 Exchanges may discuss the findings of the system audit of QSBs with the auditor
after submission of audit report.
7.3 Stock Exchanges shall prescribe financial disincentive on SBs for instances where
serious lacunas found in the system audit process and/or non-closure of
observations found during the audit within defined timelines.
7.4 Exchanges shall prescribe the period for preservation of documents such as
working papers, logs, screenshots, records of visit to the premises of the entity
and other evidence in support of the audit.
Page 5 of 67.5 Stock Exchanges are mandated to submit summary of system audits of SBs/TMs
to SEBI on half yearly basis giving details of stock brokers who have carried out
the audit, action taken on non-compliant stock brokers, details of surprise visits
carried and findings thereof, action taken on the auditor if any etc.
8. The web portal shall be developed by stock exchanges within six months from the
issuance of this circular. Exchanges to ensure availability of adequate resources in
terms of technology and manpower for implementation, adherence and support of
requirements.
9. The proposed framework for Monitoring and Supervision of the System Audit of the
Stock Brokers (SBs) through technology based measures shall come into force for the
audit period FY 2025-26.
10. This circular is being issued in exercise of the powers conferred by Section 11(1) of
Securities and Exchange Board of India Act, 1992 to protect the interest of investors
in securities market and to promote the development of, and to regulate the securities
market.
Yours faithfully,
Vishal Padole
General Manager
Market Intermediaries Regulation and Supervision Department
Email: vishalp@sebi.gov.in
*************************************
Page 6 of 6