CS Professional Secretarial Audit, Compliance Management and Due Diligence Syllabus

How must the Board respond to qualifications in the Secretarial Audit Report?

Under Section 134(3), the Board's Report must include explanations or comments by the Board on every qualification, reservation, adverse remark or disclaimer made by the Secretarial Auditor.

What is Due Diligence?

A systematic, investigative process of examining and verifying the affairs, records, assets, liabilities and compliance of a business before entering into a transaction, to assess risks, value and to make an informed decision.

Name the main types of due diligence.

Legal, financial, secretarial/corporate compliance, tax, environmental, human resource, commercial/operational, technical, and information/cyber due diligence.

What is the purpose of legal due diligence in M&A?

To verify legal title, contracts, litigation, statutory compliances, intellectual property, regulatory approvals and liabilities so the acquirer understands legal risks and can structure indemnities, conditions precedent and pricing accordingly.

What is a 'data room' in due diligence?

A secure repository (physical or virtual) where the target company makes documents and records available for the acquirer's advisers to review during the due diligence exercise.

What is a Compliance Framework?

The structured system of policies, processes, controls, roles, responsibilities and tools that an organisation establishes to identify, manage, monitor and report compliance with applicable laws, regulations and internal standards.

What are the essential components of an effective Compliance Framework?

Compliance policy, identification of applicable laws (compliance universe), assignment of ownership/responsibility, controls and processes, monitoring mechanism, reporting and escalation, training/awareness, and periodic review and updation.

What is a 'compliance universe' or compliance map?

A comprehensive inventory of all laws, rules, regulations and obligations applicable to the organisation across its activities, locations and functions — the foundation of the compliance framework.

What is the 'three lines of defence' model in compliance?

First line: operational management who own and manage risks/controls; Second line: risk and compliance functions that oversee and set frameworks; Third line: internal audit providing independent assurance to the board.

What is a Compliance Management System (CMS)?

An integrated set of processes, tools and controls (often technology-enabled) to ensure timely identification, tracking, performance, monitoring and reporting of all statutory and regulatory compliances across an organisation.

What is Compliance Monitoring?

The ongoing process of tracking, testing and reviewing whether compliance controls and obligations are being met, through periodic checks, dashboards, exception reporting and audits to detect and correct deviations.

Differentiate compliance monitoring from compliance audit.

Monitoring is continuous, real-time tracking of compliance performance by the business/compliance function; a compliance audit is a periodic, independent, in-depth examination and assurance of the adequacy and effectiveness of the compliance system.

What is a compliance dashboard?

A consolidated visual reporting tool that displays the real-time status of compliances (completed, pending, overdue) across laws, units and owners, enabling management oversight and timely action.

What are 'key compliance indicators' (KCIs)?

Measurable metrics (e.g., percentage of on-time filings, number of overdue items, recurring defaults) used to assess the health and effectiveness of the compliance function and to flag emerging risks.

What is the role of the Board in the compliance framework under the Companies Act?

Under Section 134(5), the directors' responsibility statement must confirm that the directors devised proper systems to ensure compliance with all applicable laws and that such systems were adequate and operating effectively.

What is Compliance Reporting?

The systematic communication of the status, findings and exceptions of compliance to management, the board, committees and regulators, enabling oversight, accountability and corrective action.

What is the periodic compliance report/certificate placed before the Board?

Under Listing Regulations and good governance, a compliance certificate (often quarterly) confirming the status of compliance with all applicable laws is placed before the board so directors can monitor and approve corrective steps.

Under SEBI (LODR), what compliance reports must a listed entity submit to stock exchanges?

Quarterly compliance reports on corporate governance (Reg 27), shareholding pattern (Reg 31), statement of investor grievances (Reg 13), annual Secretarial Compliance Report (Reg 24A), and various event-based and periodic filings.

What is an Annual Return and which form is it filed in?

A yearly statement of a company's particulars (capital, shareholding, directors, indebtedness, compliance, etc.) under Section 92, filed in Form MGT-7 (MGT-7A for OPC/small companies).

Which companies must annex the Annual Return certification by a PCS in Form MGT-8?

Every listed company, and every company with paid-up capital of Rs. 10 crore or more or turnover of Rs. 50 crore or more, must have its annual return certified by a PCS in Form MGT-8.

What is the difference between event-based and time-based (periodic) compliances?

Time-based compliances recur on fixed dates (e.g., annual return, financial statements, board meetings), while event-based compliances are triggered by specific occurrences (e.g., allotment of shares, change of directors, charge creation).

What does a clean (unqualified) Secretarial Audit Report indicate?

That, based on the examination and the information furnished, the company has complied with the applicable laws, rules, regulations, secretarial standards and procedures during the audit period without any reportable non-compliance.

What is the significance of Secretarial Standards SS-1 and SS-2 in Secretarial Audit?

SS-1 (Board Meetings) and SS-2 (General Meetings) are mandatory standards under Section 118(10); the Secretarial Auditor verifies adherence to them as part of compliance examination and reports deviations.

What is a 'risk-based approach' to compliance?

Prioritising compliance efforts and monitoring intensity according to the likelihood and impact of non-compliance, focusing greater resources on high-risk laws, processes and entities.

What is escalation in a compliance reporting framework?

A defined mechanism by which non-compliances or risks are reported upward through hierarchical levels (owner to compliance head to board/committee) based on severity, ensuring timely senior-management attention.

What is the purpose of due diligence checklist in a transaction?

To ensure a comprehensive, structured review of all relevant areas (corporate, legal, financial, tax, regulatory) so no material risk or liability is overlooked before completing the transaction.

What are 'conditions precedent' identified through due diligence?

Specific approvals, rectifications or actions (e.g., obtaining consents, clearing defaults, regulatory clearances) that must be completed before a transaction can be closed, identified from due diligence findings.

What is a due diligence report?

The formal document summarising the scope, findings, risks, red flags, deviations and recommendations from the due diligence exercise, used by the client to negotiate, price, indemnify or decide on the transaction.

What is the role of a Company Secretary in compliance management?

To act as the compliance officer/governance professional who identifies applicable laws, designs and operates the compliance framework, monitors and reports compliance, advises the board, and ensures timely statutory filings and corrective action.

What is the consequence of recurring or unresolved non-compliances noted in audit follow-up?

They may attract regulatory penalties, prosecution, qualified reports, reputational damage and adverse impact on credit/listing standing, and require disclosure with board explanations under Section 134(3).

What is meant by 'reasonable assurance' in the context of Secretarial Audit?

The auditor obtains a high but not absolute level of assurance, through test verification and professional judgment, that the company has adequate systems and has complied with applicable laws — it is not a guarantee against every undetected non-compliance.