PASS Securities Operations and Risk Management Examination Difficulty: Beginner 2 Questions   5 min read
📌 Chapter 8.8 — INTERNET BASED TRADING (IBT) & SECURITIES TRADING USING WIRELESS TECHNOLOGY (STWT)

Consider the moment your brokerage firm decides to roll out a new version of its mobile trading application. Before a single client can log in to place an order, your team has already spent weeks inside a User Acceptance Testing (UAT) environment that mirrors the actual NSE and BSE production servers.

This is not merely a formality for IT staff; it is an operational safeguard designed to prevent catastrophic glitches, such as erroneous margin calculations or incorrect order routing, which could lead to significant financial liability for the firm. When a developer changes a single line of code in the risk-check module, that change must undergo rigorous UAT to ensure that the system still blocks trades exceeding a client’s available collateral of, say, INR 5 lakhs.

Once the software is operational, the responsibility shifts to mandatory periodic audits. SEBI requires these audits to be conducted by CISA or DISA certified professionals at specific intervals to verify that your electronic audit trails, encryption standards, and two-factor authentication logs remain tamper-proof. Think of this as a regular health check for your infrastructure; just as you would verify a client’s KYC status before allowing them to trade, you must verify the ‘health’ of your software’s internal controls.

If a DISA auditor finds that your server is not capturing the correct IP address or that session timeouts are failing to execute, you are effectively operating in a blind spot, leaving the firm vulnerable to both regulatory penalties and potential cyber threats.

In practical terms, these audits are what protect you when a client disputes a trade. If a customer claims they never placed a volatile option order that resulted in a loss, your ability to produce an immutable, audited log—verified by a third-party report—is your only defense against an investor grievance.

By treating UAT and system audits as essential components of your daily risk framework rather than just ‘compliance paperwork’, you transition from a participant in the market to a guardian of its integrity. Always remember that software in the securities industry is not just code; it is a legal record of intent, risk, and responsibility.

Nuance

⚠️ Nuance
A common pitfall is the belief that UAT is solely an IT or development team function. In reality, an operations professional must be the one to define the ‘fail scenarios’—such as sudden connectivity loss or margin limit breaches—that the testing must validate. Candidates often forget that a software audit is not just about checking if the app works, but verifying that the system’s business logic aligns perfectly with current SEBI operational circulars.

Check Your Understanding

Practice Question 1

Your firm is planning to update its trading interface to include a new ‘Quick Trade’ button. As an operations manager, which of the following is the most critical step before the deployment of this feature?

Practice Question 2

Under SEBI regulations, how should a broking firm handle the mandatory system audit for its internet-based trading platform?

This is a companion read for Section 8.8 — INTERNET BASED TRADING (IBT) & SECURITIES TRADING USING WIRELESS TECHNOLOGY (STWT) from PASS Securities Operations and Risk Management Examination by Akhilesh Gururani, available on Amazon Kindle.

Copyright © 2026 `Akhilesh Gururani. All rights reserved.