Portfolio Auditing and Compliance

Compliance in private markets is not a one time checkbox. It is an ongoing obligation that compounds with every new investment you make. Every deal you close triggers a fresh set of requirements: • KYC verification • PAN checks • GSTIN validation • DIN lookups • Regulatory filings such as PAS-3 and MGT-14 • Audit trails that need to be maintained for years And compliance does not end once the investment is made. The same records become critical during follow-on rounds, exits, audits, due diligence reviews, and regulatory inspections. What starts as manageable with a handful of investments quickly becomes difficult to sustain as a portfolio scales, with multiple timelines and dependencies running in parallel. India's private market ecosystem is maturing. SEBI's oversight is expanding, and institutional capital entering the space is asking sharper questions about how portfolios are being managed. Informal recordkeeping that worked five years ago is becoming a liability. At nucleo, compliance is built into the investment workflow. Every verification, filing, and audit trail is automated and maintained continuously, helping investors stay compliant without the operational overhead that typically comes with it. The cost of getting compliance right is time. The cost of getting it wrong is everything that follows.

After reviewing over 500 IT contracts across doemstic and international suppliers, I've identified the single compliance gap that consistently costs organizations millions in preventable expenses. The path to building an audit-ready IT contract compliance playbook requires a systematic, multi-layered approach that addresses both immediate risks and long-term governance needs. Key structural elements must include: ➖ Automated contract monitoring systems that flag renewal dates, compliance requirements, and usage thresholds ➖ Standardized approval workflows with clear accountability matrices ➖ Regular internal audits of license utilization and compliance metrics ➖ Documentation protocols for all contract modifications and amendments Beyond the technical framework, successful implementation demands: → Cross-functional alignment between IT, Finance, and Legal teams → Clear escalation paths for compliance issues → Regular training programs for stakeholders → Vendor relationship management protocols The most critical - yet often overlooked - component is establishing a proactive compliance culture. This means moving beyond reactive audit responses to implementing preventive measures that: • Identify compliance risks before they materialize • Create standardized processes for contract reviews • Maintain detailed audit trails • Enable data-driven decision making Our experience shows that organizations implementing these frameworks typically achieve: - 30% reduction in audit-related expenses - 40% decrease in non-compliance incidents - 25% improvement in contract renewal outcomes - Significant reduction in unexpected true-up costs The key is maintaining consistency in execution while adapting to evolving compliance requirements. This requires regular playbook updates and stakeholder engagement to ensure sustained effectiveness. Remember: A robust compliance playbook isn't just about avoiding penalties - it's about creating sustainable value through better contract management and risk mitigation. For organizations ready to transform their compliance approach, the time to act is now. The cost of inaction far exceeds the investment required to build and maintain an effective compliance framework.

FDA Warning Letter snippet: Facility has areas not maintained and in a state of decay. QMR identified significant gaps in training which were not addressed effectively. Sterile operations were not maintained with basic requirements being ignored and willfully violated. What can you do about these issues: The GxP compliance process of Align, Apply, and Adapt is a structured approach to ensuring that GxP standards are effectively integrated into an organization’s operations. Here’s how this framework works: 1. ALIGN – Establishing Compliance Foundations This phase ensures that the company’s policies, procedures, and systems are aligned with regulatory expectations and industry best practices. Key Activities: ✔ Regulatory Landscape Assessment – Identify applicable FDA guidelines. ✔ Gap Analysis – Assess current systems against regulatory requirements and industry benchmarks. ✔ Quality & Compliance Framework Development – Establish or refine SOPs, policies, and quality systems. ✔ Stakeholder Buy-In – Ensure leadership and teams understand compliance priorities and objectives. 📌 Outcome: A clear compliance roadmap that aligns business operations with regulatory expectations. 2. APPLY – Implementation & Execution Focuses on applying compliance principles into daily operations to ensure processes are followed consistently and effectively. Key Activities: ✔ Training & Competency Development – Conduct role-specific GMP training for employees. ✔ Process Integration – Embed compliance into manufacturing, quality control, and clinical operations. ✔ Data Integrity & Documentation – Ensure ALCOA+ principles are met. ✔ Routine Monitoring & Self-Inspections – Conduct internal audits and quality reviews to identify gaps before regulatory inspections. 📌 Outcome: Compliance becomes part of the company’s operational culture, not just a checkbox activity. 3. ADAPT – Continuous Improvement & Risk Management Since regulations and business environments evolve, organizations must continuously adapt their compliance approach to remain inspection-ready and competitive. Key Activities: ✔ Regulatory Change Management – Monitor FDA updates and enhance policies accordingly. ✔ Process Optimization – Leverage insights from deviations, CAPAs, and audit findings to improve compliance efficiency. ✔ Technology & Automation – Implement digital compliance tools to enhance data integrity and reduce human error. ✔ Culture of Compliance – Foster a mindset where compliance is proactive rather than reactive. 📌 Outcome: A resilient, future-proof compliance program that evolves with regulatory changes and business needs. Why This Approach Matters 🔹 Prevents last-minute compliance scrambles before inspections. 🔹 Reduces regulatory risk and ensures inspection readiness at all times. 🔹 Increases operational efficiency by integrating compliance into day-to-day processes. 🔹 Supports scalability, ensuring compliance remains strong as the company grows.

Internal Audit Checklist 1. Planning and Preparation ✅ Define audit objectives and scope ✅ Identify applicable policies, procedures, and regulations ✅ Gather previous audit reports and risk assessments ✅ Notify relevant stakeholders about the audit 2. Governance and Compliance ✅ Review corporate governance policies and structures ✅ Verify compliance with applicable laws and regulations ✅ Ensure adherence to company policies and procedures ✅ Assess the effectiveness of internal controls 3. Financial Controls ✅ Review financial statements for accuracy and completeness ✅ Ensure proper authorization of transactions ✅ Verify segregation of duties in financial processes ✅ Check for compliance with accounting standards 4. Operational Efficiency ✅ Evaluate key business processes for efficiency ✅ Assess resource utilization and cost-effectiveness ✅ Identify bottlenecks and areas for improvement ✅ Review quality control measures 5. Risk Management ✅ Identify key risks faced by the organization ✅ Assess the effectiveness of risk mitigation strategies ✅ Verify the existence of a risk management framework ✅ Ensure timely reporting and resolution of identified risks 6. Information Technology (IT) and Security ✅ Assess IT security policies and procedures ✅ Review access controls and data protection measures ✅ Verify cybersecurity protocols and response plans ✅ Check for compliance with IT governance frameworks 7. Human Resources and Payroll ✅ Verify employee records and contracts ✅ Ensure compliance with labor laws and employment policies ✅ Assess payroll processing for accuracy and fraud risks ✅ Review employee training and development programs 8. Procurement and Vendor Management ✅ Ensure vendor selection follows approved procedures ✅ Verify contract compliance and performance monitoring ✅ Assess procurement processes for fraud risks ✅ Check inventory management and supply chain controls 9. Ethical and Fraud Controls ✅ Assess whistleblower policies and reporting mechanisms ✅ Review past fraud incidents and preventive measures ✅ Check compliance with the organization’s code of conduct ✅ Identify potential conflicts of interest 10. Management Team Review ✅ Evaluate leadership effectiveness and decision-making processes ✅ Review management’s response to past audit findings ✅ Assess strategic planning and goal-setting effectiveness ✅ Ensure accountability for business performance and risk management ✅ Verify communication and transparency within the organization ✅ Evaluate management’s support for ethical practices and corporate culture 11. Audit Reporting and Follow-up ✅ Document audit findings and observations ✅ Rate the severity of identified issues ✅ Provide recommendations for corrective actions ✅ Establish a follow-up process to ensure implementation ✅ Conduct post-audit review with management and key stakeholders

The 7-Step Audit Process (Detailed) A structured audit ensures accuracy, compliance, transparency, and trust within an organization. It provides assurance that financial, operational, and regulatory processes are functioning as intended. 1️⃣ Planning – Set Objectives & Identify Risks ▫️Purpose: To establish the foundation of the audit. ▫️Key Activities: Define the scope, objectives, and type of audit (financial, compliance, operational, etc.). Identify key risks and areas of concern. Develop a comprehensive audit plan, including timelines and resource allocation. Review past audits and organizational policies. ▫️Outcome: A clear and approved audit plan. 2️⃣ Risk Assessment – Evaluate Controls ▫️Purpose: To understand and evaluate the internal control environment. ▫️Key Activities: Identify potential risk areas (financial misstatements, process inefficiencies, compliance gaps). Evaluate existing control systems and their effectiveness. Prioritize high-risk areas for detailed testing. ▫️Outcome: A risk-based audit approach focusing on critical processes. 3️⃣ Substantive Testing – Verify Records ▫️Purpose: To gather evidence supporting the accuracy of financial and operational data. ▫️Key Activities: Perform test of details (checking invoices, receipts, and documents). Conduct analytical procedures (comparing data trends, ratios, and variances). Verify transactions, balances, and entries. ▫️Outcome: Verified and reliable audit evidence. 4️⃣ Analysis – Investigate Variances ▫️Purpose: To analyze results and identify discrepancies or inconsistencies. ▫️Key Activities: Compare actual results with budgets, standards, or prior periods. Investigate unusual trends or deviations. Identify the root cause of errors or inefficiencies. ▫️Outcome: Insight into operational weaknesses and areas for improvement. 5️⃣ Review – Validate Findings ▫️Purpose: To ensure that audit evidence supports conclusions. ▫️Key Activities: Reassess findings for accuracy and completeness. Conduct peer reviews or managerial reviews for validation. Prepare a summary of key observations and recommendations. ▫️Outcome: A validated and quality-checked audit result. 6️⃣ Reporting – Communicate Results ▫️Purpose: To present audit findings clearly to management and stakeholders. ▫️Key Activities: Draft the audit report, including findings, risks, and recommendations. Highlight areas of non-compliance, inefficiency, or control weakness. Suggest corrective actions and assign responsibilities. ▫️Outcome: A professional audit report that drives organizational improvement. 7️⃣ Completion – Follow Up on Actions ▫️Purpose: To ensure corrective measures are implemented effectively. ✅ Benefits of a Well-Executed Audit Promotes accountability and transparency. Enhances operational efficiency. Reduces fraud, error, and compliance risks. Strengthens governance and decision-making. Builds stakeholder confidence.

*** Capital Markets Business Analyst Knowledge Sharing Week - Day1 *** *** Analyzing Functional Architecture of Portfolio Compliance System and Drafting Requirements*** ✍ Portfolio Compliance systems are designed to ensure that investment portfolios adhere to regulatory requirements, investment policy statements, and internal policies of the asset management firm 👉 𝗝𝗼𝗶𝗻 𝗼𝘂𝗿 𝗕𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗔𝗻𝗮𝗹𝘆𝘀𝘁 𝗪𝗼𝗿𝗸𝘀𝗵𝗼𝗽, 𝗴𝗲𝘁 𝗿𝗲𝗮𝗹-𝘄𝗼𝗿𝗹𝗱 𝗽𝗿𝗼𝗷𝗲𝗰𝘁 𝗲𝘅𝗽𝗲𝗿𝗶𝗲𝗻𝗰𝗲  👈 🙌 Functional Architecture of a Portfolio Compliance Platform: - 𝗗𝗮𝘀𝗵𝗯𝗼𝗮𝗿𝗱 provides a real-time view of compliance status, alerts, and key metrics. - 𝗥𝘂𝗹𝗲 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗜𝗻𝘁𝗲𝗿𝗳𝗮𝗰𝗲 allows users to create, modify, and manage compliance rules. - 𝗥𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗠𝗼𝗱𝘂𝗹𝗲 enables the generation of compliance reports and audit trails. - 𝗘𝘅𝗰𝗲𝗽𝘁𝗶𝗼𝗻 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 Interface facilitates the review and resolution of compliance violations. - 𝗥𝘂𝗹𝗲 𝗣𝗿𝗼𝗰𝗲𝘀𝘀𝗶𝗻𝗴 𝗘𝗻𝗴𝗶𝗻𝗲 - Evaluates transactions and holdings against defined compliance rules, and supports pre-trade and post-trade compliance checks. - 𝗔𝗹𝗲𝗿𝘁 𝗮𝗻𝗱 𝗡𝗼𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗦𝘆𝘀𝘁𝗲𝗺 - Generates alerts for rule violations. Notifies relevant stakeholders of any breaches and the exception management interface is used to resolve issues. - 𝗠𝗮𝗿𝗸𝗲𝘁 𝗗𝗮𝘁𝗮 𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗼𝗻 - Integrates with external sources for real-time and historical market data. - 𝗥𝗲𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗗𝗮𝘁𝗮 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 - Maintains reference data such as security master, benchmarks, and pricing data. - 𝗗𝗮𝘁𝗮 𝗦𝘁𝗼𝗿𝗮𝗴𝗲- Stores historical compliance data for reporting and analysis. - 𝗢𝗿𝗱𝗲𝗿 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗦𝘆𝘀𝘁𝗲𝗺 (OMS) Integration to receive trade orders and execute pre-trade compliance checks. - 𝗣𝗼𝗿𝘁𝗳𝗼𝗹𝗶𝗼 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗦𝘆𝘀𝘁𝗲𝗺 (PMS) Integration to access portfolio holdings and transactions for post-trade compliance checks. - 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗼𝗿𝘆 𝗥𝘂𝗹𝗲 𝗟𝗶𝗯𝗿𝗮𝗿𝘆 - Pre-configured rules for various regulatory requirements. - 𝗣𝗼𝗹𝗶𝗰𝘆 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗠𝗼𝗱𝘂𝗹𝗲- Allows firms to define and manage internal compliance policies. - 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗥𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗠𝗼𝗱𝘂𝗹𝗲 - Supports the generation of reports required by regulatory bodies, Generates periodic and ad-hoc compliance reports. - 𝗜𝗗𝗔𝗠 - Manages user access through role-based access controls. Audit Log - Maintains logs of user activities and system changes for audit purposes.