SEBI Compliance Audit (CSCRF)

Finally, all the information and understandings are compiled in a well-documented scope, determining the boundaries and applicability of the SEBI Cyber Security & Cyber Resilience Framework for Regulated Entities (CSCRF) audit, referring to the pain point and the requirements of the stakeholders. The Scope encompasses the work systems, number of departments and location of the organization.

Once the scope, objective and criteria for the audit have been defined, the board members must draft an audit plan.
The board members (auditee) along with auditors should streamline the nature, timing and extent of tests of controls and substantive procedures, along with examining the network security measures.

After defining what and what not has to be audited, a proper audit schedule must be published with the approval of both parties. The audit schedule includes a proper timeline suggesting which departments must be audited within a time range.

Once the audit schedule is published, the auditors will examine the pre-implemented documents and controls in the auditee’s organization. The purpose of the audit is to determine if there are any discrepancies or certain observations in the depository’s organization.

After conducting the audit, the auditing body will nail down their observations, areas of improvement, and minor and significant Non-conformities against the departments which were being audited. All of these observations will be further compiled in a summary report along with the standard checklist that had been followed.