Government of pakistan securities and exchange commission of pakistan notification

  
(B) 
Internal control, compliance policies and procedures: A credit rating company 
shall.-
  
(a) 
have internal control procedures or policies and financial and operational 
capabilities which can be reasonably expected to protect its operations, its 
customers;
(b) 
develop a human resource policy encompassing the recruitment, selections 
compensation, promotions, , trainings, and other human resource related 
matters;
(c) 
establish a human resource committee headed by an independent director of 
the credit rating company, to ensure implementation of human resource 
policy and manual for its employees;
(d) 
establish and maintain comprehensive risk management systems and 
controls to enable it to identify, assess, mitigate, control and monitor risks 
arising from its activities;
(e) 
frame policies and procedures to ensure its own and its employees’ 
compliance with the regulatory requirements and inculcate a culture of 
compliance of the regulatory requirements through ongoing education and 
training of its employees;
(f) 
establish policies, procedures and controls which should require proper 
disclosures by employees and directors regarding their actual or potential 
conflict of interest to the compliance officer or the credit rating company;
(g) 
establish policies and procedure governing investments and trading in 
securities by its employees and for monitoring the same to prevent insider 
trading, market manipulation or any other market abuse; 
(h) 
establish policies and procedures for an analyst who intends to join an entity 
of which he/she was been part of the rating process;
(i) 
frame and implement a whistle-blower protection policy encouraging all 
employees to intimate the compliance officer of any unethical practice or 
26
Substituted for the text “obtain prior approval from the Commission for” vide S.R.O.582(I)/2020 dated June 29, 2020. 

---

Page 14 of 54 
misconduct relating to the credit rating, by another employee of the credit 
rating company that came to his knowledge;
(j) 
ensure that all policies are duly approved by its board of directors and shall 
define clear lines of responsibility, authority and tasks that are adequately 
assigned to employees;
(k) 
ensure that all policies are widely disseminated for compliance by all 
employees and is reviewed for appropriateness and sufficiency by the 
competent authority at least once every year;
27
[(l) ensure that a periodic or annual review of risk management systems and 
controls of the credit rating company is carried out:
(i) 
by the internal audit department, which reports directly to the board 
of directors or its audit committee; or
(ii) 
through outsourced firm of Chartered Accountants, which has been 
assigned a satisfactory Quality Control Review rating by the 
Institute of Chartered Accountants of Pakistan;]
(m) 
promptly investigate, in the event of a misconduct or a breach of the 
policies, procedures and controls, and take appropriate steps to rectify any 
weaknesses to prevent any recurrence along with suitable punitive action 
against the responsible employee(s);
(n) 
ensure that all reported events are investigated promptly by the compliance 
officer in accordance with the provisions provided in the whistle-blower 
policy; and
(o) 
ensure that all investigations are completed within the time period specified 
in the whistle-blower policy.