CS Professional:Secretarial Audit Compliance Management and Due Diligence [Ch-11 Concepts/Principles of Other Audits]

Reg. 18 of SEBI (LODR)= every listed co. shall constitute a qualified and independent audit committee

Corporate Governance provisions under the erstwhile listing agreement popularly known as the Clause 49 requirements have been overhauled by the Companies Act 2013, recent adoptions of SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (“LODR Regulations”) particularly in Schedule II.

ILLUSTRATIVE CHECKLIST FOR AUDITING CORPORATE GOVERNANCE SYSTEMS in a COMPANY

• Accountability
• Fairness
• Transparency
• Responsibility
• Shareholder Interests

The Compliance certificate shall be given either the practicing company secretaries or auditors regarding compliance of conditions of corporate governance which shall be annexed with the directors’ report.

CORPORATE GOVERNANCE-DUE DILIGENCE AREAS

1. Board Independence & Governance
2. Board Systems/Procedure
3. Board Committees
4. Transparency/Disclosures Compliances
5. Consistent Shareholder/Stakeholder Value enhancement (net worth/dividend/EPS)
6. CSR

SECRETARIAL Audit 

• for non-financial aspects 
• S.204 read with Rule 9 of the Companies (Appointment and Remuneration of Managerial Personnel) Rules, 2014
• MR-3 within 60 days from FY end

INTERNAL Audit

• responsible for audit within an org
• assess the effectiveness and efficiency of the organization’s operations, the reliability of financial reporting, and compliance with laws and regulations.
• Internal auditors also identify areas of potential risk and recommend improvements to the organization’s internal controls and processes.
• for adding value and improving operations
• wide scope covering compliance systems
• control systems
• compliance
• risk mgmt.
• identifying waste, inefficiency and duplication of effort
• reducing fraud
• Rule 13 of Co. (accounts) Rules, 2014

CS can also act as an internal auditor

CSR Audit

• includes the way company treats and proactively contributes to its community, promotes fair working conditions and a non-discriminatory environment, conveys transparent and honest accounting reports, and generally earns a reputation of trust and integrity in the society.
• Applicability: S.135- during immediately preceding FY
• Net Profit of ≧ 5 crores
• Net Worth of ≧ 500 crores
•  Turnover of ≧ 1000 crores
• CSR Committee (3 out of which 1=independent,if required)
• CSR policy/Roadmap
• spend every FY,2% of avg. Net Profit in 3 immediately preceding year
• METHODOLOGY
• Review policy,committee,governance structure,strategy,projects
• interact with beneficiaries,project team,mgmt,stakeholders
• budget,allocation,outcomes,monitoring and reporting
• expenditure (directs/indirect)
• annex CSR report with board's report per co. act,2013

TAKEOVER Audit

• related to Pricing, Open Offer and compliance verification of takeover under co. act/SEBI (SAST) 2011.
• acquirer/PAC;timely disclosures;holdings of promoter (Group);timely intimation to stock exchanges;timely reports
• failure to comply might result In penalties laid out in SEBI Act/Regulations
• furnishing a cost-benefit analysis for a durable long term investment 
• awareness of all prospects of the proposed business deals and understanding used to negotiate price.

INSIDER TRADING Audit

• initial trading disclosures by promoter/KMPs/Directors
• continual disclosures of trades >10 lakhs over a calendar quarter and notify exchanges within 2 trading days
• trading plans
• appointing compliance officer
• trading pre-clearance
• codes of fair disclosures and conduct
• The role of designated person
• method of UPSI dealing

illustrative checkpoints for SEBI(PIT) compliance In the book itself

INDUSTRIAL & LABOUR Law Audit

• detecting non-compliance of labour/employment and taking corrective measures to avoid unwarranted actions.
• promoting cordial relations + better governance/value creation
• systematic record scrutiny and reporting by a professional
• differs as per business/country as considers human values/workman rights
• A secretarial audit also involves observing compliance under Industrial/Labour laws
• Illustrative Checklist (For detailed checklist,check Study Material)
• Factories Act,1948
• Industrial Disputes Act,1947
• Payment of Wages Act,1936
• Minimum Wages Act,1948
• ESIC,1948
• EPF and Misc. Provisions Act,1952
• Payment of Bonus Act,1965
• Payment of Gratuity,1972
• Contract Labour (Regulation and Abolition) Act,1970
• Maternity benefit act,1961
• The Child and Adolescent Labour (Prohibition and Regulation) Act, 1986
• The Industrial Employment (Standing Orders) Act, 1946
• The Employees’ Compensation Act, 1923
• Equal Remuneration Act, 1976
• The Employment Exchange (Compulsory Notification of Vacancies) Act, 1959

CYBER Audit

minimizing financial loss,damage to rep from IT failure;assessing operative effectiveness of cyber security policies and procedures and sub-processes like asset mgmt.,awareness training,data security,resource planning and communications to identify internal control and regulatory deficiencies.

• sensitive data/IP
• networks to which multiple resources are connected
• Responsibility & Accountability
• SCOPE
  
• Data Security Policies
• Data Loss Prevention measures
• Effective network access Controls
• Detection/prevention Systems
• Security Controls
• Incident Response Program
• DIMENSIONS
• mgmt
• risk mgmt guided by Cyber security Officer
• risk state
• risk addressing and mitigating its affects
• Internal audit
• ILLUSTRATIVE CHECKLIST
  
• Personnel Security
• Physical Security
• Account & Password Manager
• Data Confidentiality
• Compliance and Audit

ENVIRONMENT Audit

evaluating efficacy of resources utilisation and identifying risks & liabilities or weaknesses in mgmt. system and problems in compliance with directives of regulatory agencies with special attention towards:

1. initiatives to prevent/abate/remedy the damage to the environment
2. resources conservation
3. consequences of legal violation
4. consequence of vicarious liability

Types

• Environmental Compliance Audits
• Air Pollution
• Water Pollution
• Radiation
• Pesticides
• Miscellaneous
• Environmental Mgmt. Systems Audit
• ISO 14001 (voluntary)

Process

1. understand industrial activity and pre Audit/Planning
2. On-site/Field audit
3. assessing impact/Post Audit
4. Follow-up/Review

Checklist

• Environmental Policy
• Environmental Aspects (emissions,pollution,impact,disposal)
• legal/other requisites

INFO SYSTEMS Audit

evaluate controls,collect evidence to determine safeguarding and a comprehensive exam of a targeted system.

component evaluation in the following areas:

1. systems architecture review
2. Business Process mapping (dependency on IT)
3. End User Id mgmt
4. operating systems configurations
5. app security controls
6. database access controls
7. anti-virus/anti-malware controls
8. network controls
9. logging/AUDITING Systems/processes
10. IT privilege access control
11. backup/restore procedures

Illustrative Checklist

• Mgmt Controls
• Security policy/Standards
• Steering Committee
• Business Continuity Planning
• systems Development Methodology
• Operation Controls
• Physical Assets
• adequate environmental controls
• org control
• app control

FORENSIC Audit

tool to combat corruption,financial crimes and frauds through investigation and resolving allegations of fraud/embezzlement.may be conducted to determine negligence.

"Forensic"=applying science to crime concerns/permissible to use in court

Forensic audit is highly specialized and requires detailed knowledge of fraud investigation techniques+legal framework along with identifying substance over form.

1. investigation and assessing defects
2. litigation/research assistance

Purpose

1. Corruption
• conflict of interest
• bribery
• extortion
2. Asset Misappropriation
3. Financial Statement Fraud

Procedure

• accepting investigation by independent firms/groups and examining case/business/parties
• planning investigation
• Fraud Symptoms
• internal indicators
• final categories of reporting
• gather evidence
• analytical procedure
• discussions/interviews
• substantive techniques
• Forensic Data Analysis
• reporting evidence summary/conclusion/event trail
• court proceedings

ILLUSTRATIVE CHECKLIST

1. mgmt level/employee level
2. MO
3. internal check
4. designated officer?
5. fraud nature
6. accounting of transactions
7. Fraud Triangle/Risk
8. Forensic Audit Reporting Particulars

SOCIAL Audit

for social/ethical performance and narrowing gap among vision/goal with reality.it creates impact upon governance and strengthens accountability/responsibility.

focus on social responsibility and requires transparency by enforcing the right to info.evaluating social/environmental impact.

Objectives

• gaps between needs and resources
• awareness among beneficiaries
• efficiency/effectiveness
• scrutiny of policy/decisions
• estimation of opportunity costs
• info
• community development
• proper documentation
• punitive action

examines issues in internal practices/policies or how they affect society. completely voluntary so no disclosures necessary and maybe used purely to improve upon existing vulnerabilities.

Steps/Checklist

1. identify stakeholders
2. performance indicators
3. regular review meetings
4. follow-up
5. establishing a group of trusted people
6. sharing with all stakeholders
7. policies clarity/suitability
8. scrutiny of fulfillment
9. necessary actions taken?
10. minority considered?

CS Professional:Secretarial Audit Compliance Management and Due Diligence [Ch-4 Search & Status Report]

INTRODUCTION TO SEARCH & STATUS REPORT

loan requirements have to be met frequently and by a number of individuals which brought forward Pari-Passu ranking.

charge created when security on property conferred on another person. in a value transaction,both parties evidence an intention of making assets available as security. the co. act,2013 provides for such charge registration with ROC and ROC in turn issues a certificate which is conclusive proof that charge creating doc is properly registered.

a charge duly recorded in MCA,acts as a red herring for prospective property acquirers.

S&S report helps lenders to assess the company's exact position in terms of compliance/ loan service history/charges created on co. property/registration status with ROC and potential standing @ liquidation.

it is a report furnished based on info gathered by a search of specific records available for inspecting in a public office. it isn't merely verbatim but also supplemented by observations/comments by a person furnishing reports/professionals which help throw additional light on certain points.

"search" involving physical inspection and "status" consisting of info reporting acting as a "progress report" giving ready reference

generally,banks demand search reports as they provide master data and assurance of not being defaulters in earlier loans/borrowings.

PURPOSES/OBJECTIVES

• traces property history
• charged/mortgaged assets
• extent of borrowed funds
• making lending/investment decisions
• overview on control/mgmt
• helps to make informed decisions
• insight into co.
• credit history
• rationale for quantum/security sufficiency/nature
• past charges

SCOPE AND IMPORTANCE

depends upon requirements and helps to take conscious decisions regarding loan/credit facility ensuring credit-worthiness.

1. BANKS
• basic tools to know customer viability
• knowing the current position of pledged assets
• date of loan taken
• charge holders
• loan amount
• property charged/pledged
• T&C of loan
2. DIRECTORS
• present directors
• assets and liabilities
• complete history per ROC records
3. SHAREHOLDERS
• status of co.
• status of shares
• directors
• complete history per ROC records
4. GOVT. AUTHORITIES
5. CUSTOMERS/SUPPLIERS

CHARGES under co. act,2013

Section 77 forms

• CHG-1=other than debentures
• CHG-9=debentures 
• on fee payment within 30 days of creation or as prescribed in co.(registration offices/fees) rules, 2014
• CHG-2=registration certificate
• CHG-3=charge modification
• [77(3)] only registered charges considered by liquidators
• [82] give intimation to ROC of payment/satisfaction within 30/300 days with fee CHG-4
• CHG-7=register of charges

SEARCH REPORT UNDER CO. ACT 2013

1. EXAMINATION OF PUBLIC DOCS REGISTERED ON MCA-21 PORTAL
• viewed only within 7 days after payment confirmation
• available for only 3 hours after the user has started viewing
2. inspection/cross-verification of various docs

apart from above,it also requires:

• thorough study of particulars relating to charge and related T&C
• security analysis
• charge comparison
• exact details of particulars of docs creating charges/modifications/satisfactions
• forms under co. act,2013
• The amount secured is duly mentioned
• mention the properties offered as securities per sanction
• lender details clearly mentioned
• doc affecting modification
• search report prep/compilation
• some banks/FI insist that search reports be given in their own format and that hes to be obliged with.

SEARCH REPORT UNDER IPR LAWS

WIPO=world intellectual property org.,divides IP into:

1. Industrial property, which includes inventions (patents), trademarks, industrial designs, and geographic indications of source
2. Copyright, which includes literary, artistic, dramatic and musical works such as novels, poems, lyrics, plays, films, drawings, paintings, photographs, etc. Rights related to copyright include those of performing artists in their performances, producers of phonograms in their recordings, and those of broadcasters in their radio and television programs.

conduct due diligence as tremendous worth is associated with intangible assets and potentially related risks

PROCEDURE FOR SEARCH:

• Preparing a checklist:info required to understand co. business and existing protected/protectable IP rights
• segregating relevant IP assets
• analysing all docs carefully
• verifying facts and confirming info
• drafting status and search report

KEY AREAS TO ANALYSE:

1. domestic/foreign/pending patents
2. appropriate steps to protect IP
3. material exceptions from assignments
4. registered/common law trademarks and service
5. copyrighted products and materials used/controlled/owned
6. co. business depends on maintenance of trade secrets and preservation
7. company infringing on 3rd party IP or vice-versa
8. involvement in IP litigation/disputes/received offers to license/demand letters

PROPERTY TITLE SEARCH

retrieving property rights history from the original owner and determining relevant interests. mandatory for developers to annex this copy in "agreement to sell" as it tells about the following:

• ownership
• deed copy
• legal description
• chain docs
• possession
• right of way
• leases/mortgages
• tax payment/bankruptcy
• municipal service liens
• restrictions
• plot map
• property zoning
• civil court record
• power of attorney/special assessment
• spousal/child support lien search

DOC EXAMINATION FROM REGULATOR'S WEBSITE

REGULATORS=MCA 21,SEBI,RBI,STOCK EXCHANGES AND OTHERS

general process to do inspection of public docs as under:

1. access MCA portal and login
2. click on "my documents"
3. company names displayed for which users have already paid
4. click on "view link" under status field
5. docs grouped under 5 categories,arrange name/date wise

this enables viewing public docs on fee payment

Section 85 : INSPECTION OF CHARGE REGISTER

mandatorily required to keep a charges register CHG-7 at Regstd. office and required to keep a copy open for inspection during business hours:

1. member/creditor without fee payment
2. another person with fee payment as prescribed subject to reasonable restrictions

DOC VERIFICATION

per rule 3(4) of co. (charge registration) rules,2014,following docs:

1. instrument/deed relates to property outside india,copy verified by certificate issued under co. seal by director/CS/unauthorized officer/charge holder
2. instrument/deed in India
3. particulars
• registration date
• doc date/nature creating charge
• charge amount
• property particulars
• nama/address of a person in whose favor
• modification effect
• satisfaction date
4. charge index prepared

general format=ANNEXURE 1

table for verifying CHG-1,4,9

SEARCH REPORT UNDER SEBI,RBI,STOCK EXCHANGES

procedure:

key docs analysed while preparing a report in case of PUBLIC ISSUES/RIGHT ISSUES/DEBT

TAKEOVERS/MUTUAL FUNDS/BUYBACKS/InvIT issues: offer docs/offer letters/ memorandums

STOCK EXCHANGE SEARCH REPORT

NSE is india's leading and fourth largest in world by equity trading volume in 2015 according to World Federation of Exchanges (WFE).it began operations in 1994 and ranked at largest stock exchange in terms of total/average daily turnover.

BSE is the first and largest indian securities market and established in 1875 as Native Share and Stock Brokers' Association.

KEY DOCS:

1. corporate announcements/actions
2. financial results
3. Board/Shareholders' Meetings docs
4. voting results
5. results calendar
6. shareholding patterns
7. corporate governance
8. disclosures
9. offer docs
10. info memos
11. pledge data
12. sustainability reports
13. buyback/redemption
14. public notice-compulsory delisting

check out ICSI study material for ANNEXURE 1 and other examples!

CS Professional:Secretarial Audit Compliance Management and Due Diligence [Ch-3 Documentation and Record Maintenance]

CS's primary responsibility:

1. prepare & maintain secretarial,critical corporate and other records--what and how?
2. ensure confidentiality and if requiring any further action or check for conflicts/violations.
3. storing/maintaining/retrieving/certifying/retaining/overseeing/advising and explaining.

DOCUMENTATION PURPOSES

Guiding Principles for Good Documentation (docs): Clear; Concise; Complete; Contemporary; Consecutive; Correct; Comprehensive; Collaborative; Client; Centric; Confidential.

• records completed when activity completed
• superseded documents retained for longer
• concise,legible,accurate and traceable
• picture is worth 1000 words
• clear examples
• no assumptions

ELECTRONIC REPOSITORY

1. doc mgmt.=storing/managing and tracking through an electronic/physical source of docs of paper based info captured by a scanner.
2. Doc Mgmt System (DMS) works by using a computer software
3. ADVANTAGES
• tracking
• locking/unlocking
• editing
• version control
• rollback/retrieve options
• easy audit trail
• annotation/stamps
• cost/labor effective
• searchability
• portability
4. DISADVANTAGES
• software risk
• format risk
• reliability/access
• misplacement/deletion

 Section 120 of the Companies Act, 2013 read with Rule 27 & 28 of Companies (Management and Administration) Rule, 2014 

• provides for inspection/maintenance in electronic form
• Rule 27 provides for every listed co. having 1000 or more shareholders,debenture holders and other security holders may maintain records in electronic form.
• Section 2(36) defines "document"
• records maintained in electronic form as the Board thinks fit and:
1. provided in act & rules
2. adequately recorded
3. readable,retrievable & reproducible
4. capable of being Dated & Signed digitally
5. not capable of being edited or altered once finalized
6. capable of recording every update
• Rule 28 -- Security
• MD/CS/other as per appointed by board responsible for;
• adequate protection/validation/reproduction
• ensure against loss
• The signatory doesn't repudiate the signed records
• systems can discern invalid & altered records
• accurate,accessible,authentic,complete & reproducible
• non-writable & non-erasable
• ensure at least 1 backup with authentication & dates
• limit access
• arrange & index permitting easy location,access and retrieval
• ensure security,integrity & confidentiality

PHYSICAL REPOSITORY

central place where data is stored & maintained and location which is directly accessible to the user without having to travel across a network.

CODING & NOMENCLATURE

1. naming and adopting good file naming convention and that files would work with different operating systems.
2. DESCRIPTIVE FILE NAMES: small,well-defined project with existing identification schemes with less index and sorting errors.
3. NON-DESCRIPTIVE FILE NAMES: system-generated/system-based,sequential,numerical string & for large scale digitization projects and may employ digital ID number with less chance of repeated/non-unique file names within a data structure.
4. BASIC RULES
• avoiding extra long/complex folder names and instead use info-rich filename
• put sufficient elements for easy retrieval
• use ( _ /-) as delimiter instead of spaces/special symbols
• capitalize the first letter of each element
• ordered from general to specific
• order of importance rule
• family names first
• abbreviate whenever possible
• version control=v followed by 2 digits placed at last to distinguish between versions
• prefix name of  pertinent sub-folders to shared files
5. imp. case law=14.07.2020//Arjun Panditrao Khotkar vs. Kailash Kushanrao Gorantayal and Ors.//Supreme Court of India

DOCUMENTS CIRCULATION

control issuance such as instructions,procedures and drawings including changes thereto affecting quality. reviewed for adequacy and approved for release and used @ prescribed activity's location. reviewed by the same authority as the original.

RECORDS SAFETY/RETRIEVAL

1. Operating Logs: names of people working on the document
2. Reviews Results: record suggested changes and rejection basis
3. Inspections: individuals  having access/inspection rights
4. easy Monitoring Work Performance to whom files are shared.
5. ease in Info Analytics and File Tracking
• consistent with applicable regulatory requirements
• protection for both administration and evidential
• professional approach for record caring
• keeping together according to original order
• ensure life cycles so long as they have continuing value as archives
• current phase
• semi-current phase
• non-current phase
• record preservation: enhance/prolong/storage/handle usable life
• Regulation 9 for SEBI (LODR) 2015 depending upon
• permanent
• not less than 8 years after transaction completes
• Regulation 30 (8)
• website disclosures for minimum 5 years
• policy statement relating to preservation and archival considering facotrs such as:
• analysis/restructure existing systems
• organize/control records
• providing physical protection
• manage in records centre
• managing archives
• supporting/sustaining program
• litigation docs where co. is a party preserved/destroyed as per court/tribunal/judicial orders or else preserved for 8/more years of conclusion.

MODEL POLICY [Regulations 9 and 30(8)]

1. employee's responsibility
2. periodical review
3. no disposal in case of litigation/claims
4. as per any other statutory requirements
5. web archival policy

SETTING UP A RECORD ROOM: at a convenient location and separate from other admin. units and large enough. accommodation must be secure & well-maintained. considering the following factors: humidity,temperature and light.

RECORD CONTROL/PRIVACY: personal/confidential info needs to be protected with protocols, firewalls and passwords and other security measures.

IDENTIFICATION/DESTRUCTION OF CONFIDENTIAL INFO

• Customer/Employee info
• office plans,IDs, and Internal Procedure Manuals
• contracts/commercial documents and trade secrets

STEPS FOR PROTECTING CONFIDENTIAL INFO

every organization should describe information and procedures to handle confidential info such as:

1. All confidential documents should be stored in locked file cabinets or rooms accessible only to those authorized.
2. All electronic confidential information should be protected via firewalls, encryption and passwords.
3. Employees should clear their desks of any confidential information before going home.
4. Employees should refrain from leaving confidential information visible on their computer monitors when they leave.
5. All confidential information, whether contained on written documents or electronically, should be marked as “confidential.”All confidential information should be disposed of properly.
6. Employees should refrain from discussing confidential information in public places.
7. Employees should avoid using e-mail to transmit certain sensitive or controversial information.
8. Limit the acquisition of confidential client data and restrict access on a “need-to- know’ basis.
9. Before disposing of an old computer, use software programs to wipe out the data.

PERSONAL DATA PROTECTION BILL, 2019

introduced in Lok Sabha by minister of Electronics & info Tech, Mr. ravi shankar prasad on 11/12/2019 and established a data protection authority.

• applied to personal data processed by 
• Govt.
• co. incorporated in india
• foreign co.
• data fiduciary decides the means/purpose of processing personal data subject to a certain specific/lawful purpose,collection and storage limitations.
• implementing security safeguards
• grievance redressal mechanisms
• age verification/parental consent for minors
• individual rights
• processing happens  only if consent is provided and used if:
• required by state
• legal proceedings
• respond to medical emergency
• social intermediaries
• data transfer outside India must be specifically consented to while being stored in India except for critical personal data.
• CG can exempt agencies if satisfied of necessity or direct to provide info
• OFFENCES
• bill violation=fined with 15 crores/4% annual turnover; whichever is HIGHER.
• failure to conduct data audit=5 crores/2% annual turnover; whichever HIGHER
• without consent punishable with 3 years imprisonment/fine OR both
• bill seeks to amend IT act, 2000 to delete compensation provision that directs co. to pay for protection failure.
• Expert Committee chaired by Mr. Kris Gopalakrishnan constituted by the Ministry of Electronics and Information Technology had published a draft report for public consultation. The Committee observed that non-personal data should be regulated to: (i) enable a data-sharing framework to tap the economic, social, and public value of such data, and (ii) address concerns of harm arising from the use of such data. Based on the feedback received from this consultation, the Committee released a revised version of the draft for public consultation in December 2020. A Draft Report by the Committee of Experts on Non-Personal Data Governance Framework was also published on 16.12.2020. 

• Reference. https://static.mygov.in/rest/s3fs-public/mygov_160975438978977151.pdf https://prsindia.org/policy/report-summaries/revised-draft-non-personal-data-governance-framework 

CS Professional:Secretarial Audit Compliance Management and Due Diligence [Ch-2 Compliances]

Compliance Process includes: compliance program,compliance audit,compliance reporting etc. to avoid non-compliances and to effect controls.

it includes research & analysis+investigation to determine potential issues and getting a realistic view for a positive image as well as customer trust.

COMPLIANCE MANAGEMENT FRAMEWORK

1. identification: under various legislations applicable consulting with functional heads
2. ownership: described function/individual wise along with primary/secondary
3. awareness: meetings/trainings or with manuals containing compliance details
4. reporting: status communicated annually to concerned by compliance officer for appropriate corrective action
5. reported periodically in MIS

PROCESS OF CORPORATE COMPLIANCE REPORTING

COMPLIANCES

1. ACTIVITY-WISE 
2. ENTITY-WISE
3. SECTOR-WISE
4. INDUSTRY SPECIFIC
5. STATE/LOCAL LAWS

co. act,2013 provided specific exemptions  through notifications/amendments

 UNDER CO. ACT, 2013 

• PVT. CO.
1. (184) & rule 9 of co. (Board meetings and powers) rules,2014
• director discloses interest= MBP-1 
• at first meeting in every FY or subsequent to each modification
• kept at Regstd. office upto 8 years from FY end concerned
2. (164[2]) & rule 14[1] co. (director appointment/qualification) rules,2014
• director disqualification= DIR-8
• before appointment/re-appointment
3. (92[1,4]) & rule 11[1] of co. (mgmt. and administration) rules,2014
• annual return= MGT-7
• within 60 days of AGM
• (92[3]) & 134[3][a] & rule 12[1] placing on website
4. (137) & rule 12[1] co. (accounts) 2014
• financial statements= AOC-4/(CFS)
• within 30 days of AGM
5. (92[2]) & rule 11[2] co. (mgmt. and administration)
• MGT-8
• listed co's annual return certified by PCS
• or a co. with PUC=10 cr./more OR turnover=50 cr./more
6. (134) & rule 8 co. (accounts)
• board's report
• attached with statements and signed by "chair or 2 directors, one of whom is MD/CEO/CFO/CS, if appointed
7. (136) circulation of financial docs and other relevant docs
• at least 21 clear days before the AGM
8. (101) & rule 18 co. (mgmt. and admin.); SS-2
• AGM NOTICE 
• sent to all directors,members,auditors,legal representatives of any deceased member and insolvent's assignee
9. (173[3]) & SS-1 
• board meeting notice
• not less than 7 days in writing 
• less than 7 days with respect of presence/ratification of independent directors
10. (139[1]) & rule 4[2] co. (audit and auditors)
• auditor appointment= E-ADT-1
• notice within 15 days of appointment meeting
• specified IFSC pvt may file within 30 days
11. (203) & rule 8A co. (appointment/remuneration)
• CS appointment
• every listed and pvt. having PUC=10cr./more
12. (88) & rule 3 co. (mgmt. and admin.)
• MGT-1/2 
• registers of  members/debentureholders/other securityholders

• SMALL CO. -- 1,2,3,4,6,7,8,9,10 & 12 same as pvt. co.
• OPC -- 1,2,3,4,6,9(unless an only director) & 10 + no need to prepare a cash flow statement & exempt form auditors' rotation

 LLP COMPLIANCES UNDER LLP ACT,2008 

• change in partnership shall not affect existence,rights or liabilities
• partnership agreement
• registrar of co. manages LLPs
• one partner must be Indian
• (33) partner contri per subscription sheet
• in case of excess contri

• COMPLIANCE REQUIREMENT UNDER ACT/RULES
1. (32) & rule [23(1)]:contribution accounted for/disclosed in accounts
• [23(2)]: contri. brought by agreement/contract of services valued by practising CA
2. (34): maintain accounts @ RO for 8 years
• rule [24(2)]: containing finances,assets & liabilities,statement of goods purchased
• [24(3)]: 8 yrs.
• (34[3]) and rule [24(4)]: file statement of account and solvency {signed y designated partners} in Form 8 within 30 days from 6 months of FY end.
• (34[4]) and rule [24(8)]: audit for TURNOVER>40 lakhs OR CONTRI.>25 lakhs
• rule [34(4)]: foreign LLP statement of accounts
3. (35): annual return within 60 from FY end in Form 11
4. rule [25(2)]: additional certificates when Turnover<5 crore or CONTRIBUTION<50 lakhs; Otherwise a certificate from PCS
5. rule [27]: document preservation

 EXEMPTIONS OF SECTION 8 CO. 

• (2[24): appoint qualified CS
• (2[68,71]): minimum paid-up share cap inapplicable
• (96[2]): AGM not on national holiday
• (101/136[1]): "21 days" to "14 days"
• (118): minutes circulations except if mentioned in AoA
• (149,150,152[5],165[1],178)
• (160): except where AoA provides director election by ballot
• (173[1]): At least 1 board meeting within 6 calendar months
• (177[2]): no independent directors necessary
• (184[2],189): if exceeds 1 lakh
• (186[7]): inapplicable if 26%/more held by govt.

1. SEBI (LODR) COMPLIANCE: refer Ch-2 of ICSI study material

CS Professional:Secretarial Audit Compliance Management and Due Diligence [Ch-1 Compliance Framework]

1. Compliance with laws and regulation is an integral part of a corporate strategy.so, establishing a compliance management system (CMS) with which facilitates the risk management system (RMS) will reduce compliance risks.
2. participation of senior management for reviewing effectiveness and so that it remains updated/relevant according to the regulatory regime.
3. a CMS includes compliance Program,compliance Reporting,compliance Audit.
• compliance Programming consists of  policies and procedures
• compliance Auditing=independent testing of compliance level
4. Corporate CM involves a brief research,analysis,investigation and evaluation to determine potential issues and get past and future performances with CS playing a core role.
5. corporate CM depends on various factors affecting the business and should be drawn as necessary.

CORPORATE COMPLIANCE MANAGEMENT

1. compliance Chart
• mention applicable laws and explains how compliance risk mitigation activities embedded in business processes.
• helps the business in meeting it's compliance obligations towards customers, regulators, shareholders and employees because it provides a centralize compliance information on a single chart.
• reflects key activities and compliance calendar to manage compliance risks.
2. compliance Advisory
• advice on compliance
3. compliance Scorecard
• to analyse the organisation's position in compliance
4. compliance Dashboard
• single enterprise-wide dashboard for all users to track and trend compliance events
• easily viewable and interactive
• auditors and officers can make decisions on compliance status
5. compliance Policy/Procedures
• conformity with ever-changing rules and regulations is a critical requirement
• well-designed document management system
• driven by collaborative tools like creation, review, approval and release process of policy documents and Standard Operating Procedures (SOPs) that provide core document management functionality.
6. compliance Rules and Regulations
• continuously stay in sync 
• various departments notified proactively through emails to critically change policies and procedures for adherence to new rules and regulations.
• as tracking down a few regulations may be feasible but tracking down state-wide, nation-wide or world-wide regulations may be error prone
7. compliance Audit
• facilitated through a real time system
• not an annual activity
• appropriate evidence of internal audits becomes critical in defending compliances.
8. Quality Management
• quality initiatives to industry mandates like six sigma or ISO 9000
• part of a well designed CMS
• compliance and quality are two sides of the same coin
9. Compliance Training
• evidence of employee training for complete knowledge and procedures to avoid hefty and penalties.
10. Compliance Task Management
• plan to manage and report status of all activities
• automated updates by respective modules to be seen by concerned authorities

 COMPLIANCE CHART PREPARATION 

• prepared after considering operations/structure of co. as it's subjective to each co.
• role of CS operates after considering:
• applicable laws/rules/regulations:
1. as per the concerned business model along with respective environmental,health and safety aspects and data security requirements.
2. periodical review of compliance requirements with regulatory updates.
3. kept up to date for reflecting compliance obligations and associated risks.
4. prerequisites and restrictions to be reflected.
5. in case of conflict between internal/external Or between self-imposed/legal obligations, the more stringent ones would prevail.
• risk assessment:
1. management has ultimate accountability for risk control
2. done according to changes in business profile ,i.e, as soon as a new change occurs.
3. categorized into Critical,High,Medium or Low
• HIGH LEVEL RISK ASSESSMENT
• DETAILED RISK ASSESSMENT
4. assessment reports discussed and signed off according to risk management procedures.
5. combo of desk assessments/interviews/workshops but aligned with risk management standards.
• compliance risk mitigation:
1. developing and implementing rules to prevent/minimize risks
2. local policies made to be implemented and communicated in ways that are accessible to all employees.
3. RISKS OF NON-COMPLIANCE
• cessation of business activities
• civil action by authorities
• punitive actions such as fines
• imprisonment
• public embarrassment
• reputation damaged
• attachment of bank accounts 
• compliance monitoring-ownership/allocation
1. function wise/individual wise
2. clear primary/secondary ownership
• PRIMARY-responsible for compliance
• SECONDARY-primary's supervisor, supervises compliance
3. under various managements
• TOP-understanding obligations/changes;approvals;motivation and incentive
• LEGAL-reforming; communication to respective owner/executor; review/assessment; resolutions/clarity
• SR. MGMT/FNCTN Heads-analysis/research; formation; guidance; tracking
• OFFICERS/subordinate STAFF -- performing obligations; updating performance into chart; risk and conflict ID-ing/intimation
• compliance reporting:
1. for apt corrective action by person responsible
2. like automated escalated emails in case of non-compliance;pop-ups for due dates.
3. a brief process as adapted by company-
• reporting by functional heads according to ownership by collecting/classifying relevant info and consolidate in a report.
• report shall affirm that info is based on inputs received from various units/depts. and mention all compliances/non-compliances as circulated.
• each report forwarded to CS/MD
• upon suitable inputs from CS, MD will consolidate and present a comprehensive compliance report to BoD for info/advice and noting
4. allows to assess if compliance risks exceed the company's risk appetite and it's discussion and communication.
5. PERIODICAL COMPLIANCE MANAGEMENT INFO SYSTEM (MIS)-at least quarterly,reports to be discussed at risk management committee meetings.
6. CYCLICAL/INCIDENTAL REPORTING
• CS as a compliance manager supposed to create a compliance framework for translating regulatory requirements into management actions.
• CONTENT
1. detailed compliance procedure according to applicable laws, regulations, industry standards & compliance policies;
2. concise statements containing obligations and related risks;
3. inherent and managed risk levels of obligations;
4. business process/people linked to the compliance obligations;
5. specified compliance risk mitigation activities complete with compliance risk monitoring/tracking;
6. reporting authorities (whom and how);
7. clear hierarchy outlined
8. practical and concise on role and responsibilities of management/Compliance Officer

                 

COMPLIANCE RISK-REVIEW/UPDATION

• testing whether risk mitigation activities work
• documented/reviewed and updated annually if necessary
• compliance risk monitoring plan must include:
• concise statements capturing relevant obligations and risks
• business processes 
• specific compliance risk mitigation activities
• first line tracking (routinely), second line (health check), third line assurance (independent review)
• brief description of performance
• tracking frequency
• report recipients

FOLLOWING ADOPTED FOR ACCESSING COMPLIANCE MECHANISM:

1. risk/cultural assessment
• employee surveys
• interview
• document reviews
• ethics and compliance validation
2. program design/update-review of guideline documents
3. policies and procedure
4. communication,training and implementation
5. on-going self assessment,monitoring and reporting

TRAINING AND IMPLEMENTATION

• to create awareness and made privy to requirements of:
• company framework
• roles and responsibilities outlined in policies
• critical and high compliance obligations in compliance chart
• process of addressing compliance issues/reporting concerns
• consequence of failure to meet obligations
• meetings,training,communication,manuals containing compliance details
• annual plan developed and updated as required indicating target audience and delivery method.
• plans must include:
• concise statements capturing relevant obligations and risks
• business processes
• brief description
• target audience
• frequency of activities

COMPLIANCE AUDIT

1. planned,performed and reported separately on regular basis.
2. as per CAG auditing standards- an independent assessment of compliance with applicable authorities identified as criteria.
3. concerned with:
• REGULATORY-adherence to formal criteria
• PROPRIETY-observation of general principles governing sound financial management and public officials' ethical conduct.
4. SIGNIFICANCE OF CORPORATE COMPLIANCE MANAGEMENT
• foundation for control environment
• avoiding monetary/imprisonment penalties
• healthy returns through employer/customer liability and public respect transitioning into stronger market cap
• safety valve
• cost saving
• better brand image/goodwill
• enhanced credibility/creditworthiness
• recognition as a civilian

TYPES OF COMPLIANCE

• APPARENT COMPLIANCE
1. disguised non-compliance such as generating documents for improbable events.
2. inadmissible
• ADEQUATE COMPLIANCE
1. compliance in letter without getting in the spirit.
2. like box ticking practices
• ABSOLUTE COMPLIANCE
1. in line with spirit as well as intent of law.
2. such as demonstrating shareholder's democracy as reflected in law.
3. to be striven for.
• gains public confidence
• enhanced investor-relations
• increased brand value

ROLE OF CS IN COMPLIANCE MANAGEMENT