Section 21 in AADHAAR (AUTHENTICATION AND OFFLINE VERIFICATION) REGULATIONS, 2021
21. Audit of requesting entities, Authentication Service Agencies and Offline Verification Seeking Entities.—
(1)The Authority may undertake audit of the operations, infrastructure, systems and procedures, of requestingentities, including their Sub-AUAs and Sub-KUAs, Authentication Service Agencies and OfflineVerification Seeking Entities, either by itself or through audit agencies appointed by it, to ensure that suchentities are acting in compliance with the Act, rules, regulations, policies, procedures, guidelines issued bythe Authority.(2)The Authority may conduct audits of the operations and systems of the entities referred to in sub-regulation (1), either by itself or through an auditor appointed by the Authority. The frequency, time and manner ofsuch audits shall be as may be notified by the Authority from time to time.(3)An entity subject to audit shall provide full co-operation to the Authority or any agency approved and/orappointed by the Authority in the audit process, and provide to the Authority or any agency approvedand/or appointed by the Authority, complete access to its procedures, records and information pertaining toservices availed from the Authority. The cost of audits shall be borne by the concerned entity.(4)On identification of any deficiency by the Authority, the Authority may require the concerned entity tofurnish necessary clarifications and/or information as to its activities and may also require such entity eitherto rectify the deficiencies or take action as specified in these regulations.(5)Notwithstanding anything contained in clause (4), and without prejudice to any action which may be takenunder the Act, the Authority may initiate action under Regulation 25(1A) on identification of anydeficiency pursuant to the audit conducted.
