The requirement, in our words
Ahead of putting a Trading System to use in a Market, the Trading Participant runs an Initial Certification Review. The review must assess whether the controls, arrangements and resources allow compliance with 5.5.2 together with Part 5.6; review the policies, procedures, design documents and other material; review how changes to the system are approved and released; and test the controls, arrangements and resources. The review must be conducted by a person suitably qualified and experienced to review them. The methodology, scope, results and any recommended changes applied are documented and kept for at least seven years.
What the rule is trying to do
The review is the gate before first use, and it is broader than a functional test. It covers the documentation and the change process as well as the controls. The reviewer competence is an express condition, and the methodology and scope must be retained so the review can be re-performed.
What good practice looks like
Write a review template that covers the four required elements and the evidence for each. Use a reviewer independent of the development team and record the competence basis. Test the controls in an environment that represents production. Record the recommended changes, whether they were applied, and the residual risk. Re-run the review after a material change.
What changed in the instrument
Item 70 replaces Rule 5.6.4. The old rule required a review for the purposes of the Rule 5.6.6 certification and focused on policies and documentation. The new rule adds the assessment, the change process review, the testing, the reviewer competence and the seven year record, and gives the review its own defined term.
Evidence an auditor or ASIC asks for
| Category | Record to keep | Retention |
|---|---|---|
| Review report | The Initial Certification Review report covering the assessment, documentation review, change process review and testing, with the methodology and scope. | At least seven years. |
| Reviewer competence | The qualifications and experience of the reviewer, and the basis for independence from the development team. | At least seven years. |
| Test evidence | The test plan, environment, cases, results and defects for the controls, arrangements and resources. | At least seven years. |
| Change record | Each recommended change, whether it was applied, the approval and the residual risk. | At least seven years. |
Common gaps
- The review is a vendor questionnaire with no testing of the participant controls.
- The reviewer is the developer, with no competence or independence record.
- The methodology and scope are not retained, so the review cannot be repeated.
- The change implementation process is not reviewed at all.
What to do before 17 March 2028
- Write the four part review template.
- Choose a suitably qualified reviewer and record the competence basis.
- Test the controls in a production-like environment.
- Retain the methodology, scope, results and changes for seven years.
Dates and cross-references
Commences: 17 March 2028 (Rule 2 of F2026L01223 and the registration date). Retention: At least seven years.
Read with: 5.5.2, 5.6.3, 5.6.6, 5.6.8.
Source
This page reads ASIC Market Integrity Rules (Securities Markets) Amendment Instrument 2026/574 (F2026L01223), Schedule 1, item 70, against the current compilation Compilation No. 6 (F2024C01108). Retrieved 2026-10-19. The requirement above is our own statement, not the instrument's wording. Not legal advice; does not certify.