System Audit for Algorithmic Trading Brokers — The Additional Scrutiny Explained

Stock brokers offering algorithmic trading facilities must undergo a half-yearly system audit with additional scrutiny focused on algo logic, risk controls, and audit trails. The audit is designed to ensure that algorithmic trading systems comply with SEBI's requirements and do not pose risks to market integrity. This article explains the additional scrutiny and the specific areas that auditors review.

The Regulatory Requirement

SEBI Circular CIR/MRD/DP/16/2013 dated May 21, 2013 mandates that stock brokers / trading members that provide the facility of algorithmic trading shall subject their algorithmic trading system to a system audit every six months. The audit is intended to ensure that the requirements prescribed by SEBI / stock exchanges with regard to algorithmic trading are effectively implemented.

Auditor Qualifications

Such system audit of algorithmic trading system shall be undertaken by a system auditor who possess any of the following certifications:

• CISA (Certified Information System Auditors) from ISACA.
• DISA (Post Qualification Certification in Information Systems Audit) from Institute of Chartered Accountants of India (ICAI).
• CISM (Certified Information Securities Manager) from ISACA.
• CISSP (Certified Information Systems Security Professional) from International Information Systems Security Certification Consortium (ISC)².

Reporting and Corrective Action

• Immediate Reporting: Deficiencies or issues identified during the process of system audit of trading algorithm / software shall be reported by the stock broker / trading member to the stock exchange immediately on completion of the system audit.
• Corrective Action: The stock broker / trading member shall take immediate corrective actions to rectify such deficiencies / issues.
• Serious Deficiencies: In case of serious deficiencies / issues or failure to take satisfactory corrective action, the stock exchange shall not allow the stock broker / trading member to use the trading software till deficiencies are rectified.

Additional Scrutiny Areas for Algorithmic Trading

Change Management

The system auditor must check whether any changes (modification/addition) to the approved algos were informed to and approved by Stock Exchange. The inclusion / removal of different versions of algos should be well documented.

Online Risk Management Capability

The CTCL or IML server should have capacity to monitor orders / trades routed through algo trading and have online risk management for all orders through algorithmic trading. The auditor must ensure that Price Check, Quantity Check, Order Value Check, Cumulative Open Order Value Check are in place.

Risk Parameters Controls

The system should allow only authorized users to set the risk parameter. The System should also maintain a log of all the risk parameter changes made.

Information / Data Feed

The auditor must comment on the various sources of information / data for the algo and on the likely impact (run away / loop situation) of the failure of one or more sources to provide timely feed to the algorithm. The system auditor must verify that the algo automatically stops further processing in the absence of data feed.

Check for Preventing Loop or Runaway Situations

The system auditor must check whether the brokers have real-time monitoring systems to identify and shutdown / stop the algorithms which have not behaved as expected.

Algo / Co-location Facility Sub-letting

The system auditor must verify if the algo / co-location facility has not been sub-letted to any other firms to access the exchange platform.

Audit Trail

The system auditor must check the following areas in audit trail:

• Whether the audit trails can be established using unique identification for all algorithmic orders.
• Whether the broker maintains logs of all trading activities.
• Whether the records of control parameters, orders, trades and data emanating from trades executed through algorithmic trading are preserved / maintained.
• Whether changes to the control parameters have been made by authorized users as per the Access Matrix.
• Whether the system captures the IP address from where the algo orders are originating.

Systems and Procedures

The system auditor must check and comment on the procedures, systems and technical capabilities of the stock broker for carrying out trading through use of Algorithms. The system auditor should also identify any misuse or unauthorized access to algorithms or the system which runs these algorithms.

Reporting to Stock Exchanges

The system auditor must check whether the stock broker is informing the Stock Exchange regarding any incidents where the algos have not behaved as expected. The system auditor should also comment upon the time taken by the stock broker to inform the Stock Exchanges regarding such incidents.

Key Risk Controls for Algorithmic Trading

• Price Check: Algo orders shall not be released in breach of the price bands defined by the exchange for the security.
• Quantity Check: Algo orders shall not be released in breach of the quantity limit as defined by the exchange for the security.
• Order Value Check: Algo orders shall not be released in breach of the 'value per order' as defined by the stock exchanges.
• Cumulative Open Order Value Check: The individual client level cumulative open order value check may be prescribed by the broker for the clients.
• Automated Execution Check: An algo shall account for all executed, unexecuted and unconfirmed orders, placed by it before releasing further order(s).

Common Pitfalls

• Failure to inform stock exchange of algo changes. Any modification to approved algos must be informed to and approved by the stock exchange.
• Inadequate real-time monitoring. Brokers must have real-time monitoring systems to identify dysfunctional algos.
• Sub-letting of algo / co-location facility. This is strictly prohibited.
• Incomplete audit trail. All algo orders must be tagged with a unique identifier for audit trail purposes.

How We Help

At Anuj Desai & Associates, we help algorithmic trading brokers prepare for half-yearly system audits, ensure compliance with SEBI's requirements, and address any findings identified during the audit. If you need assistance with algorithmic trading compliance, reach out to our regulatory compliance desk.