Submission of the Internal Audit Report and Concurrent Audit Report of risk prone areas of Depository Participant

Central Depository Services Limited, vide Circular No. CDSL/OPS/DP/POLCY/2026/244 dated April 08, 2026, has announced an important update regarding Submission of the Internal Audit Report and Concurrent Audit Report of risk prone areas of Depository Participant operations for the half year ended March 31, 2026.

Key Details of the Update –
• Depository Participants are required to submit the Internal Audit Report (IAR) for the half year ended March 31, 2026, in accordance with CDSL Bye-law 16.3.1, which mandates internal audit of participant operations relating to CDSL by a qualified Chartered Accountant / Company Secretary / Cost Accountant holding a valid certificate of practice.
• The communiqué encloses the revised scope, objectives, and checklist applicable to the Internal Audit / Concurrent Audit for the relevant half-year in Annexure A. Where the internal auditor and concurrent auditor are different, the Concurrent Audit Report (CAR) of risk prone areas must also be submitted in the prescribed format as an attachment to the Internal Audit Report, as provided in Annexure B.
• Submission of the IAR and CAR must be made online only through the procedure prescribed in the earlier communiqué dated April 28, 2017. The circular expressly states that physical submission will not be accepted and will be treated as non-submission, which makes electronic filing mandatory.
• A system enhancement has been incorporated in the Audit Application for the Internal Audit Report, as detailed in Annexure C, and certain fields have been made mandatory for completion by both the Auditor and the Depository Participant.
• Depository Participants activated during the half year ended March 31, 2026 are also required to submit the audit report, covering the period from the date of activation till the end of the half year.
• The audit report must include a declaration that at least one person conducting the internal and/or concurrent audit is NISM certified. Any audit report signed by auditors who do not satisfy the NISM qualification requirement will not be accepted and will be treated as non-submission.
• The communiqué gives special importance to verification of implementation of the Online Dispute Resolution (ODR) mechanism for Depository Participants. Internal auditors are specifically required to verify proper implementation of the ODR mechanism and ensure that all related website compliances are checked before submitting the IAR. Failure to verify these may result in action against both the DP and the auditor.
• Compliance officers are directed to bring the communiqué to the notice of the Internal Auditors and Concurrent Auditors and ensure compliance. The circular also states that CDSL may require a participant to change its auditor if the quality of the report is unsatisfactory or the audit is not conducted as per guidelines. Additionally, DPs are advised to appoint or rotate internal auditors to break continued long-term association of an audit firm or partner with DP management.

Actions if Any –
• Depository Participants must submit the Internal Audit Report and, where applicable, the Concurrent Audit Report of risk prone areas, for the half year ended March 31, 2026, through the prescribed online Audit Application process only.
• Depository Participants must ensure that the audit report contains the required NISM certification declaration and that the audit is conducted by eligible professionals meeting the prescribed qualification conditions.
• Internal auditors must verify implementation of the Online Dispute Resolution mechanism and related website compliances before submission of the audit report.
• Compliance officers must inform the Internal and Concurrent Auditors of this communiqué and ensure timely and proper compliance.
• Depository Participants are advised to appoint or rotate internal auditors in line with the guidance referred to in the communiqué to avoid continued long-term association.

Compliance Deadline –
The Internal Audit Report and, where applicable, the Concurrent Audit Report for the half year ended March 31, 2026 must be submitted online on or before May 15, 2026. Depository Participants activated during the relevant half year must submit the report covering the period from the date of activation up to March 31, 2026. Physical submission will not be accepted and will be treated as non-submission.