What must I do with the compliance audit report once it is done?
In force
Three things, and two of them are public.
Publish the status of the compliance audit report on your website.
Publish any adverse findings on your website too, together with the action you took about them.
Give the compliance audit report to your clients, on request.
Getting the audit done is only half of it. The publication duty is where most practices stop short.
What SEBI says, word for word
Master Circular, ¶1.14(d)“RA/research entity shall publish the status of the compliance audit report on its website and shall also publish the adverse findings of audit, if any, along with the action taken thereof on its website. RA/research entity shall provide the compliance audit report to its clients.”Source: SEBI Master Circular No. HO/38/12/11(1)2026-MIRSD-POD/I/4360/2026, dated February 6, 2026, originally SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2025/004 dated January 8, 2025 Open document ↗
More on Governance
- Do I need to appoint a compliance officer?
- What are the rules if I use AI tools in my research process?
- Who can conduct my annual compliance audit — does it have to be ICAI or ICSI?
- Do I need an accessibility audit of my website? (deadline 31 January 2027)
- Does the cyber security framework (CSCRF) apply to me?
- Do I need written internal policies, and what must they cover?
- What may I outsource, and what stays my responsibility?