www.lawcommission.gov.np throughout the year. (2) The Controller shall, after the receipt of details referred to in Sub-rule (1), have to comply with the following procedures while conducting audit of the performance of the Certifying Authority:(a) to observe the security procedure adopted by the Certifying Authority to secure its electronic record; (b) to observe the physical security procedure to be connected to an electronic record; (c) to evaluate the information technology quality standard being used by the Certifying Authority; (d) to examine the services rendered to the subscribers by the Certifying Authority; (e) to analyze the entire certification practices of the Certifying Authority; (f) to evaluate into the matter as to whether or not the terms of agreement and understanding reached between a subscriber or other concerned party and the Certifying Authority are followed; (g) to evaluate the matter as to whether or not the directions given from time to time by the Controller under the laws in force, and the terms referred to in the licence are followed; (3) The auditor shall, after making evaluation under Sub-rule (2), have to submit the report thereof to the Controller within a period of Three months from the date of commencement of the business by 20 www.lawcommission.gov.np