Section 31(3) in The Information Technology (Certifying Authorities) Rules, 2000
(3)The Certifying Authority shall submit copy of each audit report to the Controller within four weeks of the completion of such audit and where irregularities are found, the Certifying Authority shall take immediate appropriate action to remove such irregularities.
