System Audit ToR for CTCL/API-Based Trading Members — What Gets Reviewed
The Terms of Reference for system audit of CTCL and API-based trading members cover system controls, software change management, risk management, network security, and back office data integrity. The ToR is designed to ensure that brokers using technology to connect to the exchange have robust systems and controls in place. This article explains what gets reviewed during a Type II system audit.
The Regulatory Basis
The system audit framework prescribed under SEBI Circular CIR/MRD/DMS/34/2013 dated November 6, 2013 includes detailed Terms of Reference (ToR) for Type II Brokers — those who trade through API-based trading terminals like CTCL (Computer-to-Computer Link) or IML (Intermediate Messaging Layer) or IBT/DMA/STWT or SOR facility. The ToR has been standardised across exchanges to ensure uniformity.
System Controls and Capabilities
Order Tracking
The system auditor must verify system process and controls at CTCL / IML terminals and CTCL/IML servers covering order entry, capturing of IP address of order entry terminals, modification / deletion of orders, status of current order / outstanding orders and trade confirmation.
Order Status / Capture
The auditor must check whether the system has capability to generate / capture order id, time stamping, order type, scrip details, action, quantity, price and validity, etc.
Rejection of Orders
The auditor must verify whether the system has capability to reject orders which do not go through order level validation at CTCL servers and at the servers of respective Stock Exchanges.
Communication of Trade Confirmation / Order Status
The auditor must check whether the system has capability to timely communicate to Client regarding the Acceptance / Rejection of an Order / Trade via various media including e-mail and facility of viewing trade log.
Client ID Verification
The auditor must verify whether the system has capability to recognize only authorized Client Orders and mapping of Specific user Ids to specific predefined location for proprietary orders.
Order Type Distinguishing Capability
The auditor must check whether the system has capability to distinguish the orders originating from CTCL / IML / IBT / DMA / STWT.
Software Change Management
The system auditor must check whether proper procedures have been followed and proper documentation has been maintained for:
- Processing / approval methodology of new feature request or patches.
- Fault reporting / tracking mechanism and process for resolution.
- Testing of new releases / patches / modified software / bug fixes.
- Version control — History, Change Management process, approval etc.
- Development / Test / Production environment segregation.
- New release in production — promotion, release note approvals.
- Production issues / disruptions reported during last year, reasons for such disruptions and corrective actions taken.
- User Awareness.
The auditor must also check whether critical changes made to the CTCL / IML / IBT / DMA / STWT / SOR are well documented and communicated to the Stock Exchange.
Risk Management System
Online Risk Management Capability
The auditor must check whether a system of online risk management including upfront real-time risk management is in place for all orders placed through CTCL / IML / IBT / DMA / STWT.
Trading Limits
The auditor must verify whether a system of pre-defined limits / checks such as Order Quantity and Value Limits, Symbol wise User Order / Quantity limit, User / Branch Order Limit, Order Price limit, etc., are in place. No user or branch in the system should have unlimited limits on these parameters.
Order Alerts and Reports
The auditor must check whether the system has capability to generate alerts when orders are placed above the limits and has capability to generate reports relating to margin requirements, payments and delivery obligations.
Order Review
The auditor must check whether the system has capability to facilitate review of such orders that were not validated by the system.
Back Testing for Effectiveness of RMS
The auditor must check whether the system has capability to identify trades which have exceeded the pre-defined limits and also exceed corresponding margin availability of clients. Deviations should be captured by the system, documented and corrective steps taken.
Log Management
The auditor must check whether the system maintains logs of alerts / changes / deletion / activation / deactivation of client codes and logs of changes to the risk management parameters. The system should allow only authorized users to set the risk parameter in the RMS.
Smart Order Routing (SOR)
The system auditor must check whether proper procedures have been followed and proper documentation has been maintained for:
- Best Execution Policy: System adheres to the Best Execution Policy while routing the orders to the exchange.
- Destination Neutral: The system routes orders to the recognized Stock Exchanges in a neutral manner.
- Class Neutral: The system provides for SOR for all classes of investors.
- Confidentiality: The system does not release orders to venues other than the recognized Stock Exchange.
- Opt-out: The system provides functionality to the client to specify for individual orders for which the clients do not want to route order using SOR.
- Time stamped market information: The system is capable of receiving time stamped market prices from recognized Stock Exchanges.
- Audit Trail: Audit trail for SOR should capture order details, trades and data points used as a basis for routing decision.
- Server Location: The order routing server is located in India.
- Alternate Mode: An alternative mode of trading is available in case of failure of SOR Facility.
Password Security
- Organization Access Policy: Whether the organization has a well documented policy that provides for a password policy as well as access control policy.
- Authentication Capability: Whether the system authenticates user credentials by means of a password before allowing the user to login, and whether there is a system for authentication of orders originating from Internet Protocol by means of two-factor authentication.
- Password Best Practices: Whether there is a system provision for masking of password, system prompt to change default password on first login, disablement of user id on entering multiple wrong passwords, periodic password change mandate, strong parameters for password, deactivation of dormant user id, etc.
Network Integrity
- Seamless connectivity: Whether a backup network link is available in case of primary link failure with the exchange.
- Network Architecture: Whether the web server is separate from the Application and Database Server.
- Firewall Configuration: Whether appropriate firewall is present between stock broker's trading setup and various communication links to the exchange.
Access Controls
- Access to server rooms: Whether adequate controls are in place for access to server rooms and proper audit trails are maintained.
- Additional Access controls: Whether the system provides for two-factor authentication mechanism to access to various CTCL or IML components.
Backup and Recovery
- Backup and Recovery Policy: Whether the organization has a well-documented policy on periodic backup of data.
- Log generation and data consistency: Whether backup logs are maintained and backup data is tested for consistency.
- System Redundancy: Whether there are appropriate backups in case of failures of any critical system components.
Back Office Data
- Data consistency: Whether aggregate client code data available at the back office of broker matches with the data submitted / available with the Stock Exchanges.
- Trail Logs: Whether logs of Client Code data are maintained to ascertain whether editing or deletion of records have been properly documented and recorded.
How We Help
At Anuj Desai & Associates, we help CTCL and API-based trading members prepare for system audits, ensure compliance with the ToR, and address any findings identified during the audit. If you need assistance with system audit compliance, reach out to our regulatory compliance desk.