ADCM Audit Instructions

Zaoui

Description

INSTRUCTIONSfor test co-ordinators and auditorsconcerning the Amsterdam DerivativesClearing Migration to CLEARING 21®Internal Audit Services EuronextAmsterdam, 10 May 2003This report includes 14 pagesIAS.2003.R.014Contents1 Introduction 31.1 Types of tests and required reports 31.2 Scope 31.3 Objectives of the test instructions 41.4 Reporting parties 42 General planning of the Amsterdam Derivatives Clearing Migration 53 Activities of the test co-ordinator 53.1 Introduction 53.2 Requirements 63.3 Requirements with respect to the test co-ordinators reports 74 Activities auditor 94.1 Object of the examination 94.2 Objective and scope of the examination 94.3 Requirements with respect to the auditor’s report 95 Reporting to Euronext 95.1 Confirmation of receipt of instructions 95.2 Test report on V. 3.2 Monitored tests and Auditor’s report on examination 95.3 Test report on V. 3.2.5 test and Auditor’s report on examination 96 Timetable for reports to be sent to Euronext 107 Co-ordination 10Appendices1 Auditors’ report on examination2 Template Confirmation receipt instructions3 Test co-ordinator’s reportIAS.2003.R.014 / 21 IntroductionThe migration of the clearing members in Amsterdam to Derivatives CLEARING 21® is an importantstep in the process of creating a single clearing platform for Euronext derivatives transactions. Themigration to the CLEARING 21® platform will have major consequences for Euronext N.V. and allclearing members who ...

Informations

• Publié par: Mifog
• Nombre de lectures: 44
• Langue: English

Extrait

INSTRUCTIONS

for test co-ordinators and auditors

concerning the Amsterdam Derivatives Clearing Migration to CLEARING 21®

Internal Audit Services Euronext Amsterdam, 10 May 2003 This report includes 14 pages IAS.2003.R.014

Contents

1 Introduction 1.1 Types of tests and required reports 1.2 Scope 1.3 Objectives of the test instructions 1.4 Reporting parties 2 General planning of the Amsterdam Derivatives Clearing Migration 3 Activities of the test co-ordinator 3.1 Introduction 3.2 Requirements 3.3 Requirements with respect to the test co-ordinators reports 4 Activities auditor 4.1 Object of the examination 4.2 Objective and scope of the examination 4.3 Requirements with respect to the auditor’s report 5 Reporting to Euronext 5.1 Confirmation of receipt of instructions 5.2 Test report on V. 3.2 Monitored tests and Auditor’s report on examination 5.3 Test report on V. 3.2.5 test and Auditor’s report on examination 6 Timetable for reports to be sent to Euronext 7 Co-ordination

Appendices 1   Auditors’ report on examination 2   Template Confirmation receipt instructions 3   Template Test co-ordinator’s report

IAS.2003.R.014 / 2

3 3 3 4 4 5 5 5 6 7 9 9 9 9 9 9 9 9 10 10

1  Introduction The migration of the clearing members in Amsterdam to Derivatives CLEARING 21® is an important step in the process of creating a single clearing platform for Euronext derivatives transactions. The migration to the CLEARING 21® platform will have major consequences for Euronext N.V. and all clearing members who currently use the Dynamic/Futuristic derivatives clearing system. The Clearnet Steering Committee supervises this migration process. Internal Audit Services of Euronext will organise reviews of testing at the parties involved and will report on this. The Clearnet Steering Committee will use our report to inform the Managing Board of Euronext and its regulators about the results of these tests and subsequently about the migration readiness of Euronext and the Clearing member firms. In order to be able to carry out the review of the test within the set period, we have opted to use the test reports of the test co-ordinators provided with auditor’s reports issued by a certified (IT) auditor (hereinafter referred to as: auditor). The auditor can be an internal auditor or an externally assigned individual or organisation. Every party involved must therefore assign a test co-ordinator. The test co- ordinator is responsible for the design, implementation and reporting on the Amsterdam Derivatives Clearing Migration tests. The auditor is responsible for the examination of the test reports. These instructions contain information concerning the design, implementation and reporting of the Amsterdam Derivatives Clearing Migration tests for the test co-ordinator and auditor. The receipt of these instructions must be confirmed according to the procedure as described in section 5.1. 1.1   Types of tests and required reports Clearnet has chosen the following test approach to determine the migration readiness: §   Member connection (including connectivity tests) to the EUA (External User Acceptance) platform; §   Free testing with CLEARING 21® V. 3.2 without SWITCH; §   V. 3.2 Monitored tests on the EUA platform with CLEARING 21® V. 3.2 and end-to-end testing with SWITCH; §   Free testing with the upgraded CLEARING 21® V. 3.2.5. For detailed information on the content and scope of these tests we refer to the Clearnet migration project team or the Clearnet SA website. See also chapter 2 of this report. We require a test co-ordinator’s report and an auditor’s report on examination after both the V. 3.2 Monitored tests and the V. 3.2.5 test. Actions taken on reported open issues, shortcomings, bottlenecks or uncertainties that are mentioned in the V. 3.2 Monitored tests report, should be included in the V. 3.2.5 test report . 1.2   Scope The Clearing Steering Committee has decided that the scope of the tests will include the testing of all critical business systems and interfaces which will be technically and functionally adapted as a consequence of the implementation of CLEARING 21®. Business critical systems are defined as those systems, which are essential to primary business processes.

IAS.2003.R.014 / 3

Business critical systems can be regarded as all types of applications and the corresponding interfaces used for - among other things - financial and operational processes, such as software for clearing and registration of securities transactions, client position records, loan transactions and risk management systems. In addition information related to historical data needs also to be addressed. 1.3   Objectives of the test instructions The objective of the test instructions is to enhance the adequacy with which Clearnet and Euronext (and the regulators) can form an opinion on the reliability and continuity of clearing at Clearnet Amsterdam and parties involved after the migration in relation to critical business systems and interfaces of the securities industry. To form an overall opinion it is essential to review the design, implementation and evaluation of the several tests. 1.4   Reporting parties Regarding the migration to the new CLEARING 21® system it is important to know which parties have to report. The migration testing and reporting procedure concerns all clearing members who will migrate to the new CLEARING 21® system. These instructions are related to the Amsterdam based clearing members, as the testing for the other Euronext locations is performed on a local basis. The involvement of ISV’s (Independent Software Vendors) during the tests and reporting to the members upon the results of the tests is the responsibility of the clearing members themselves. Parties involved that will only make use of a Clearnet Clearing Workstation (a ‘CCW’) could apply for a partial dispensation of the required reporting cycle as mentioned in paragraph 1.1. Please contact Internal Audit Services of Euronext, should this be the case.

IAS.2003.R.014 / 4

2  General planning of the Amsterdam Derivatives Clearing Migration Euronext has planned a number of test periods during which parties involved will be able to test the operation of business critical systems with regard to the transition to the CLEARING 21® platform. Tests are scheduled as followed:

Milestones March April  May June July August Sept Ø G e n e r a l   M e m b e r   M e e t i n g 9 th 13 th Ø P h a s e   1 :   • Receptionof order forms • Roll-out of equipment • FT Parameterisation • Account structure parameterisation • Free testing C21V3.2 without SWITCH • Monitored tests with C21 V3.2 W/SWITCH • Free testing C21 v3.2 with SWITCH Ø P h a s e   2 :   • Upgrade of C21V3.2.5 on the EUA • Free testing with C21 V3.2.5 • Additional Monitored tests Ø Launch C21V3.2 5

September 29 th

Figure 1: ADCM planning as distributed in the General Member Meeting of 13 May 2003

Clearnet and Euronext will regularly inform the parties involved of the details of the tests. The auditor is advised to ask the test co-ordinator of the party involved, to hand over Clearnet and Euronext’s most recent documentation for testing. Documentation already published is available on the website of Clearnet SA. Any missing publications can be requested from Clearnet (see Chapter 7).

3  Activities of the test co-ordinator 3.1   Introduction Each party involved should designate an internal test co-ordinator who is ultimately responsible for the design, implementation and evaluation of the tests. This internal test co-ordinator should provide guidelines and information for that purpose, e.g. information and guidelines on the organisational design

IAS.2003.R.014 / 5

of the tests, the requirements for the test cases, the implementation of the tests and method of evaluation. Furthermore the internal test co-ordinator should be responsible for writing the test report. This section highlights further points of attention for the test co-ordinator in relation to the tests and reporting. These points of attention are also of importance to the auditor as they enable him or her to examine the reliability of the test co-ordinator’s reports. 3.2   Requirements 3.2.1   General The following overview of points of attention is not exhaustive and may also contain points which are not relevant to the specific situation of a party involved or which are not considered to be feasible in practice. 3.2.2   Points of attention regarding test requirements General attention points With regard to the project organisation there should be sound quality guarantees corresponding to, among other things, the following quality aspects: ·   Central co-ordination and evaluation of CLEARING 21® tests in progress; ·   Design of the tests at the party involved that complies with the objective and scope of the tests as stated in paragraph 1.3; ·   Application of both internal guidelines as well as Clearnet and Euronext guidelines which have already been published (see chapter 7 for our web-sites) and those which have yet to be published; ·   Use of an appropriate method for determining relevant business critical systems and interfaces; ·   Use of written test plans; ·   Use of additional Clearnet and Euronext manuals for the CLEARING 21® tests; ·   Use of a test environment which is representative of the production environment and the user organisation; ·   Written evaluation of the tests, including conclusions on the tests; ·   Formal approval of detailed test plans and evaluation of test results by owners of systems and interfaces; ·   Contracts with ISV formalised in a Service Level Agreement. Attention points test plans The test plans should pay attention to, among other things, the following matters: ·   Recording and substantiating the test in writing or by electronic means; ·   Storing the test cases and the test files as well as the outcome of the test (retention period of records should be sufficient for audit purposes); ·   Identifying and implementing the CLEARING 21® test criteria; ·   Testing critical system functionalities; ·   Checking the accuracy and completeness of critical hardcopy system output and electronic recorded output that is essential to the user organisation; ·   Checking the accurate and complete processing of test data during the tests on the basis of guidelines drawn up and approved by the internal organisation and guidelines published by Clearnet and Euronext.

IAS.2003.R.014 / 6

Attention points test implementation The following matters, among other things, require attention during the implementation of the test by the party involved: ·   Monitoring processes during the tests; ·   Monitoring the accuracy, completeness and the recording of activities described in the detailed test plans; ·   Verifying the accuracy, completeness and timeliness of the hardcopy system output and electronic recorded output for which deliverables have been defined; ·   Availability of personnel and sufficient involvement of users; ·   Written records of problems arising during the test and the solutions found for the problems; ·   Where applicable, checks of the test output by other parties involved (e.g. ISV’s). Attention points internal reporting on the tests There should be installed a proper reporting cycle on the tests that includes: ·   A proper analysis and evaluation of the test; ·   Any identified open issues, shortcomings or uncertainties; ·   A conclusion. 3.3   Requirements with respect to the test co-ordinators reports The test co-ordinator draws up two reports: one following the V. 3.2 Monitored test and one following the V. 3.2.5 test. Open issues, shortcomings, bottlenecks or uncertainties that are mentioned in the V. 3.2 Monitored test report, should be addressed and - if possible - clarified in the V. 3.2.5 test report. The V. 3.2 Monitored test report could be seen as a first status overview. If elements are not tested or analysed before the deadline of the V. 3.2 Monitored test report as given in chapter 6, it is required to mention this in the V. 3.2 Monitored test report and to report on the follow up in the V. 3.2.5 test report. The V. 3.2.5 test report could be seen as the final test report. Where possible, parties involved, which are affiliated on a corporate level, should draw up a consolidated final test report for the group. All reports of the test co-ordinator should be drawn up in English. The following requirements apply to structuring the contents of the test co-ordinator’s reports. A template report is presented in appendix 3. A   Scope and method of testing The following information should be included in this paragraph: ·   The name and member code(s) of the party/parties involved included in the final report (especially important if the report is a consolidated report. Please disclose all affiliated organisations); ·   The scope of the performed test; ·   The organisation and the method of testing; ·   The method used to obtain assurance concerning the operation of business critical systems and interfaces after the migration. If previous tests are used, please include an explanatory note concerning the method of evaluation.

IAS.2003.R.014 / 7

B  Findings This section should contain further information on matters such as major uncertainties identified during testing, shortcomings and possible bottlenecks, which may threaten electronic data processing after the migration. For the purpose of the evaluation we recommend that the following table is included in the test reports. System/ Interface Conclusion based on Identified shortcoming Impact of Action test Shortcomings on Continuity and Reliability Application A Application works with Order not accepted Has to be modified Modify module XXXXX the exception of: see shortcoming

……

……

…… ……

……

Inspection transaction code Module

C Conclusion of the test co-ordinator In this section   the test co-ordinator should make his or her final (consolidated) conclusion on the results of each test using the wording below. Conclusion for the [name the test performed] 1 : “On the basis of the [name the test performed] 1 and the requirements laid down by Euronext in the instructions concerning the Euronext migration tests for the securities industry, for test co-ordinators and auditors, dated [day month] 2003, we 1.   [have found no uncertainties, shortcomings and/or bottlenecks] OR 2. [have found uncertainties shortcomings and/or bottlenecks as described in part B of the test co- ordinato ’ rt.] 2 r s repo   which would prevent the migration to the CLEARING 21® platform for [name of the party involved] .” 1   “CLEARING 21® V. 3.2 Monitored test”or “CLEARING 21® V. 3.2.5 test” 2 Remove the incorrect text block

D Signature The report should be dated and signed by the test co-ordinator.

IAS.2003.R.014 / 8

4  Activities auditor 4.1   Object of the examination The object of the examination is the test co-ordinator’s report on the V. 3.2 Monitored tests and the V. 3.2.5 test at the party/parties involved. 4.2   Objective and scope of the examination The objective of the examination is to obtain additional assurance as to the reliability of the test co- ordinators final report on the V. 3.2 Monitored test and the V. 3.2.5 test. As part of the examination of the reliability of this report, the following aspects should be examined as a minimum: ·   The general design of the test organisation; ·   The design of the test; ·   The implementation of the test; ·   The results of the internal test (already) carried out; ·   The evaluation of the test. The review requirements relating to the previous mentioned aspects and the test co-ordinator’s report are the professional responsibility of the auditor concerned. 4.3   Re quirements with respect to the auditor’s report The auditor should issue separate reports on examination to the board of directors or management of the parties involved on the test co-ordinator’s reports concerning the ‘V. 3.2 Monitored test’ and the ‘V. 3.2.5 test’. The test co-ordinators’ reports need to be initialled for identification purposes only.

5  Reporting to Euronext 5.1   Confirmation of receipt of instructions Internal Audit Services of Euronext requires a written confirmation of the receipt of these instructions. Appendix 2 includes a template confirmation form. 5.2   Test report on V. 3.2 Monitored tests and Auditor’s report on examination The board of directors or management of the party involved should sign the test co-ordinator’s report and ensure that certified copies of it and the auditor’s report on examination are sent to Internal Audit Services of Euronext by the deadline stated in section 6. 5.3   Test report on V. 3.2.5 test and Auditor’s report on examination The board of directors or management of the party involved should sign the test co-ordinator’s report and ensure that certified copies of it and the auditor’s report on examination are sent to Internal Audit Services of Euronext by the deadline stated in section 6.

IAS.2003.R.014 / 9

6  Timetable for reports to be sent to Euronext Critical Date Report Immediately Confirmation of receipt of instructions One week after close V. 3.2 Monitored test * Final report of the test co-ordinator and Auditors’ report on examination concerning the V. 3.2 Monitored test Two weeks before the Migration date * Final report of the test co-ordinator and Auditors’ report on examination concerning the V. 3.2.5 test

All reports and letters addressed to Euronext should be in English. *) The exact data for reporting deadlines will be published on the Clearnet website www.clearnetsa.com > projects CLEARING 21® derivatives for all locations ) as well as disseminated through the Clearnet > Info Flashes.

7  Co-ordination The co-ordination of the test evaluation is the responsibility of Euronext. If you have any questions about the auditor’s investigation, please contact Arjan Man or Paul Riemens of Internal Audit Services at Euronext N.V. The address to which correspondence and reports should be sent is: Euronext N.V. Internal Audit Services Migration CLEARING 21® team Damrak 70 P.O. Box 19163 1000 GD AMSTERDAM Telephone: [phone] (Arjan Man, [e-mail]) ([phone] (Paul Riemens, [e-mail]) Fax: [phone] An electronic version of this report is available on request and will be published on the website. If you have any specific questions about the tests or about other migration related issues, please call the CLEARING 21® communication officer (Monique Lokkerbol) on ([phone] or consult our website ( www.clearnetsa.com > projects > CLEARING21® derivatives for all locations).

IAS.2003.R.014 / 10

Appendix 1

Auditors’ report on examination To: Addressee [management or board of directors] This report on examination is provided for the examination of the [name of the test performed] 1 at [name of the party involved] and can only be used by Clearnet and Euronext N.V. as part of their supervisory tasks and their responsibility towards the regulatory authorities. Introduction In accordance with your instructions we have examined the final reports of the test co-ordinator regarding 1 the [name of the test performed] of [name of the party involved] , established at [statutory seat] , which has been initialled by us for identification purposes only. The final report of the test co-ordinator is the responsibility of the management of [name of the party involved] . Our responsibility is to issue a report on our examination of this final report. Scope We conducted our examination in accordance with the instructions issued by Clearnet and Euronext N.V. concerning the Clearnet and Euronext migration tests for the securities industry, for test co-ordinators and auditors, dated [ date ]. Our examination is limited primarily to inquiries of company personnel and examining on a test basis of the design, implementation and evaluation of the [name of the test performed]   1 . We did not examine whether or not the test dates and test sets used by the internal organisation were sufficient to guarantee CLEARING 21® compliance. Moreover, even tests that are well organised and executed cannot guarantee that a tested program is without error. Matters affecting our opinion (optional) On the basis of our work, we established, among other things, that: ·   ….. Opinion Based on our examination in accordance with the instructions issued by Clearnet and Euronext N.V. concerning the Clearnet and Euronext migration tests for the securities industry, for test co-ordinators and auditors, dated [ date ], nothing has come to our attention, except for …., which causes us to believe that the attached certified final report of the test co-ordinator does not give a true and fair view of the design, implementation and results of the [name the test performed] 1 at [name party involved] . Place, date Signature

1 ’CLEARING 21® V. 3.2 Monitored test’ or ‘CLEARING 21® V. 3.2.5 test’

IAS.2003.R.014 / 11