Section 3(10)(c) in The Information Technology (Recognition of Foreign Certifying Authorities not Operating under any Regulatory Authority) Regulations, 2013
(c)The Recognized Foreign Certifying Authority shall submit copy of each audit report to the Controller within a period of four weeks of the completion of such audit and where irregularities are found, the Certifying Authority shall take immediate appropriate action to remove such irregularities.