Certifying Authorities, issue directives, from time to time. It shall be a duty of the Certifying Authority to comply with such directives. 25. The Controller may delegate power: The Controller may, in order to perform the function to be performed by him/her delegate to any officer subordinate to him/her to exercise all or any of his/her powers under this Act or the Rules framed thereunder. 26. The Controller may investigate: (1) The Controller may, if he/she believes that this Act or the Rules framed hereunder are not complied with by the Certifying Authority or by other concerned person, conduct him/herself or cause any officer to conduct necessary investigation in that regard. (2) It shall be a duty of Certifying Authority to assist the investigations, referred to in Sub-section (1). (3) The procedure to be followed by the Controller or any other officer in respect to investigation referred to in Sub-section (1) shall be as prescribed. 27. Performance Audit of Certifying Authority: (1) The Controller may conduct or cause to be conducted performance audit of the Certifying Authority in each year. (2) The Controller may, for the purpose of the performance audit referred to in Sub-section (1), appoint any recognized auditor, who has expertise in computer security or any computer expert. (3) The Controller shall publish the report of the performance audit in the electronic form made under Sub-section (1) by maintaining in his/her computer database. (4) The qualification of the performance auditor or remuneration and the procedures of such audit shall be as prescribed. 16