DP Audit NSDL & CDSL: The Process, Start to Finish
The mechanics of DP Audit NSDL & CDSL are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the DP Audit NSDL & CDSL page.
What is a DP audit, in plain terms?
It is a periodic, independent check — performed by a practising Chartered Accountant, Company Secretary or Cost Accountant — of how a Depository Participant (a bank or broking firm offering demat accounts) handles client securities: opening accounts correctly, processing dematerialisation and transfers accurately, using Powers of Attorney or Demat Debit and Pledge Instructions (DDPI) within their permitted scope, and keeping proper records. The auditor reports findings to NSDL and/or CDSL in a prescribed format, and the DP must fix and report back on anything flagged.
In practice: Many DPs treat this as a routine paperwork exercise handed to whichever CA firm is convenient. Recurring exceptions across cycles can signal a control environment that is not improving.
How often does the DP audit need to be conducted?
The periodicity is prescribed by NSDL and CDSL bye-laws and circulars and has generally been on a half-yearly cycle for DP internal/concurrent audits (covering the half-years ended September 30 and March 31), though the exact cadence and reporting deadline should always be confirmed against the specific NSDL and CDSL circulars in force at the time — depositories do revise timelines and formats from time to time.
In practice: We do not rely on the periodicity from a prior year's engagement letter. Before scoping each cycle, we confirm the currently applicable circular so the client is never audited against an outdated timeline.
What is the difference between a DP audit and the DP's statutory financial audit?
The statutory financial audit, conducted under the Companies Act (or the applicable statute, for a bank DP), examines whether the DP's financial statements give a true and fair view. The DP audit is a separate, depository-mandated compliance and process audit that examines specifically how depository operations — account opening, transfers, pledges, and so on — are being conducted, independent of the entity's overall financial reporting.
In practice: We recommend clients keep these as clearly separated engagements in their compliance calendar, even when the same firm is engaged for both, because the scope, testing approach, and reporting format are entirely different.
What happens if exceptions are found during the audit?
Exceptions are classified by severity and reported to the depository in the prescribed format. The DP is typically required to submit an Action Taken Report (ATR) confirming what corrective action has been or will be taken, with a timeline for closure. Exceptions that remain unresolved into subsequent audit cycles attract closer depository — and potentially SEBI — attention.
In practice: We help draft ATRs with specific, owned, dated commitments rather than generic assurances. A vague ATR response is often flagged just as quickly as the original exception.
How is the audit sample selected — does the auditor check every account and transaction?
No. Given the transaction volumes most DPs process, the audit uses a risk-based sampling approach across account opening, transfers, pledges, and other tested areas, rather than a full population review. Sample sizes and selection criteria are documented so the basis for the audit opinion is defensible.
In practice: We weight sampling toward higher-risk areas — new branches, accounts with POA/DDPI mandates, high-value transfers — rather than sampling purely at random, because that is where process weaknesses are more likely to surface.
What happens during transmission of a demat account after the holder's death — and why does the audit check it closely?
Transmission is the process of transferring securities in a deceased account holder's demat account to the legal heir(s) or nominee, based on prescribed documentation (death certificate, succession documents or nomination, and identity/KYC of the claimant). It is a sensitive, document-heavy, and time-bound process, and errors or delays directly affect grieving families — which is why depositories expect it to be handled with particular care and the audit tests it specifically.
In practice: We sample transmission cases specifically for documentation completeness and turnaround time against the prescribed standard — this is one area where a paperwork gap has a real, immediate impact on a client, not just a technical compliance point.
How does PNPC keep up with changes in NSDL/CDSL audit circulars between cycles?
NSDL and CDSL periodically issue operating circulars that update audit checklists, formats, and timelines. PNPC's capital-market audit team tracks current circulars from both depositories as part of our practice discipline, and we confirm the applicable version before scoping each audit cycle rather than reusing a prior cycle's checklist by default.
In practice: One risk when a DP audit is done by a firm without regular capital-market audit exposure is testing against an outdated checklist that the depository has since superseded.
How does PNPC's DP audit differ from a generic CA firm just filling out the checklist?
We scope each engagement around your actual risk profile — branch mix, POA usage, e-DIS adoption, BSDA proportion — rather than mechanically ticking a generic checklist. We track open exceptions across cycles until genuinely closed, confirm the current depository circular before each engagement rather than reusing a prior format, and engage directly with your compliance officer through fieldwork rather than only at kickoff and report delivery.
In practice: The value of a DP audit compounds over cycles when the same firm carries institutional memory of what was flagged before and verifies it was actually fixed — that continuity is difficult to replicate if the audit is re-tendered to a different, unfamiliar firm every cycle.
Are authorised persons directly covered by the DP audit?
The DP audit obligation rests with the registered Depository Participant. Where the DP sources business through authorised persons, the audit tests the DP's oversight of those channels — how account-opening and KYC files sourced through them are reviewed and controlled by the DP itself — rather than auditing the authorised person as a separately regulated entity in its own right.
In practice: A DP that has expanded rapidly through an authorised-person network without correspondingly strengthening its own oversight and sampling of files from that channel is one of the more common risk patterns we look for.
Where this sits in the wider engagement
DP Audit NSDL & CDSL rarely arrives on its own. The statutory basis and the current requirements are set out on the DP Audit NSDL & CDSL service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On DP Audit NSDL & CDSL we take the work end to end — scoping against the current depository circulars, fieldwork, reporting to the depository in the prescribed format, and tracking Action Taken Reports through to closure.