CRA-5.2.1

Licensees must have a clear and well-structured approach for the implementation and upgrade of systems and software.

CRA-5.2.2

Licensees must also have well-established policies and procedures for the regular and thorough testing of any system currently implemented or being considered for use (e.g., upgrades to a matching engine or opening of a new Application Programming Interface ("API") with a third party). Licensees must ensure that the implementation of new systems, or upgrading of existing systems, is thoroughly checked by multiple members of technology staff.

CRA-5.2.3

Licensees must ensure that any changes made to a codebase in use are tracked and recorded, with a clear audit trail for appropriate internal checks and sign-offs.

CRA-5.2.4

For the purposes of Rule CRA-5.2.3, the use of version control software which allows for the accurate timestamping and identification of the user responsible for relevant changes must be considered.

CRA-5.2.5

Licensees must maintain a clear and comprehensive audit trail for system issues internally, including security issues and those with third parties, and their resolution.

IT System Audit