Who can conduct my annual compliance audit — does it have to be ICAI or ICSI?
In force
As of March 25, 2026, the pool of eligible auditors widened: your annual compliance audit can now be conducted by a member of ICAI, ICSI, or ICMAI (Institute of Cost Accountants of India) — previously only ICAI/ICSI members qualified.
The audit must be completed within 6 months of the end of each financial year, and the compliance audit report submitted to RAASB/SEBI within 1 month of the audit report date, but not later than October 31 of each year for the previous financial year.
You must publish the status of the compliance audit report on your website, and separately publish any adverse findings plus the corrective action taken on your website too. You're also required to give the compliance audit report to your clients on request.
What SEBI says, word for word
Circular, ¶4 (replacing Master Circular ¶31)“research analyst or research entity shall conduct annual audit in respect of compliance with RA regulations and circulars issued thereunder from a member of Institute of Chartered Accountants of India or Institute of Company Secretaries of India or Institute of Cost Accountants of India within six months from the end of each financial year and submit a compliance audit report to RAASB/ SEBI within a period of one month from the date of the audit report but not later than October 31st of each year... RA/research entity shall publish the status of the compliance audit report on its website and shall also publish the adverse findings of audit, if any, along with the action taken thereof on its website. RA/ research entity shall provide the compliance audit report to its clients.”Source: SEBI Circular No. HO/38/12/12(1)2026-MIRSD-SEC-FATF/I/7934/2026, dated March 25, 2026 (amending Paragraph 31, Chapter VI of the Master Circular dated Feb 6, 2026) Open document ↗
More on Governance
- Do I need to appoint a compliance officer?
- What are the rules if I use AI tools in my research process?
- Do I need an accessibility audit of my website? (deadline 31 January 2027)
- Does the cyber security framework (CSCRF) apply to me?
- Do I need written internal policies, and what must they cover?
- What must I do with the compliance audit report once it is done?
- What may I outsource, and what stays my responsibility?