Short answer: SEBI has not told companies to replace Excel or adopt continuous controls monitoring (CCM). What the chairman did signal, at the Financial Express Modern BFSI Summit 2026, is a regulatory direction of simpler rules, technology-supported supervision and safeguards that work by design rather than through a manual check on every transaction. For finance, risk and internal audit leaders, the practical question is whether controls that depend on spreadsheets and annual samples can still produce credible evidence at today’s transaction volumes.
This article summarises what was said, separates it from what was not, and sets out a practical way to test your own control environment. It is analysis for risk and audit teams, not legal advice.
What SEBI’s Chairman Said on October 15
Speaking in Mumbai on Thursday, October 15, 2026, Tuhin Kanta Pandey set out SEBI’s next priorities as “simpler rules, deeper markets, responsible innovation and wider access,” according to The Tribune’s report. Three points stand out for governance professionals.
Safeguards by design. The Tribune quotes him: “We cannot add a manual check for every new transaction. Safeguards must work by design.” Kalinga TV’s ANI-based report adds that he favoured pre-emptive oversight through digital systems, with intensity matched to risk, the instrument and the sophistication of the participant.
An AI sandbox. SEBI is exploring a controlled sandbox in which AI applications can be tested, their risks assessed and safeguards developed before wider use.
Simpler compliance. SEBI has begun a comprehensive review of the Listing Obligations and Disclosure Requirements (LODR) framework and proposed stronger monitoring of how funds raised through public issues are used. It is also reviewing the SME IPO framework.
Watch: What This Means for Internal Controls
In this short video we ask whether traditional Excel-based controls and periodic audits can keep pace, and why enterprises are looking at automated controls, continuous monitoring and AI-supported governance.
What This Does Not Mean
It is worth being precise. The remarks reflect a direction of travel for SEBI’s own supervision and for market infrastructure. They do not establish a rule that listed companies, banks or NBFCs must retire spreadsheets or deploy CCM, and nothing reported sets a deadline. Existing obligations, including those in the SEBI cybersecurity and resilience framework for third-party risk, continue as they are.
The relevance is indirect but real. When a regulator says manual checks cannot scale and that safeguards belong inside systems, boards and audit committees will reasonably ask whether their own control environment follows the same logic. The same theme appears in our analysis of how regulatory speed is pushing towards continuous control monitoring and of building AI governance before regulation arrives.
Why Scale Strains Spreadsheet Controls and Periodic Audits
Directors of listed companies in India must state that adequate internal financial controls exist and are operating effectively, and statutory auditors report on those controls. The word that matters is operating. A design review shows a control exists; evidence of operation requires testing it repeatedly. A control tracker in Excel, supported by a sample tested once or twice a year, shows a fraction of what happened and arrives months after the event.
CCM changes the evidence, not the accountability. It applies automated rules to full populations of transactions or system settings, flags exceptions closer to the time they occur, and keeps a record of what was tested and how each exception was resolved. Our overview of continuous controls monitoring with agentic AI explains the mechanics, and monitoring the financial close shows how it applies to a Controller’s month-end controls.
Seven Things Automation and AI Can Support
- Transaction-level control testing across full populations rather than samples.
- Detection of unusual transactions and control exceptions.
- Risk-based classification and prioritisation of what needs attention first.
- Corrective action assignment and tracking through to closure.
- Continuous monitoring of financial and operational controls.
- AI-assisted interpretation of exceptions and audit findings, reviewed by people.
- Management dashboards and audit-ready evidence that show what was tested and when.
Automation recommends and records. Accountable owners decide, and internal audit keeps its independence.
Human oversight is not optional. AI-assisted conclusions need review, and agent actions need a log, as covered in why AI agents need audit trails. For the shift in audit method itself, see from sampling to continuous assurance.
An illustrative example
This is a hypothetical scenario, not a customer case study. A listed manufacturer tracks payment approvals and vendor bank-detail changes in a monthly spreadsheet, with internal audit testing 25 items a quarter. A rule that flags any bank-detail change followed by a payment within a few days, or any payment above an approval limit without a recorded approver, would test every case daily. Exceptions go to the finance owner with a due date, and the closure evidence feeds the audit file. The audit team spends its time on the exceptions rather than on assembling samples.
Where to Start: A Six-Step Plan
Map Where the Controls Actually Live
List your key financial and compliance controls and note which run on spreadsheets, email approvals or manual tick-offs. That map shows where evidence is thinnest.
Pick Three to Five High-Volume Controls
Start where volume is high and rules are clear, such as payment approvals, vendor bank-detail changes, manual journals and access to financial systems.
Write the Exception Rules Down
Turn each control into a testable rule with a threshold and an owner. A rule that cannot be written down cannot be monitored.
Connect the Source Systems
Feed ERP, payments and access data into the monitoring logic so tests run on full populations rather than samples. Check data completeness first.
Route Exceptions to Owners With Deadlines
Every exception needs an owner, a due date, a status and a closure record. Unassigned alerts become noise within weeks.
Run in Parallel, Then Report
Compare automated results with your existing periodic testing for a cycle, agree accuracy thresholds, and report exception trends to the audit committee.
Crest.Digital is building this capability on the same foundation as its third-party risk platform. Its Agentic GRC solution is designed for continuous control testing, exception handling and audit-ready evidence, while the TPRM platform covers vendor risk. For regulation-specific monitoring, see domain-specific regulatory compliance agents.
Talk to Crest.Digital about piloting continuous monitoring for IFC and internal audit, with remediation tracked through to closure.
The Big Question for Your Next Audit Committee
- Volume: Do your transactions run continuously while your control testing runs quarterly?
- Evidence: Could you show operating effectiveness from more than a sample?
- Ownership: Does every exception have an owner, a deadline and a closure record?
Frequently Asked Questions
No. The chairman’s remarks, as reported, describe a direction towards simpler compliance and technology-supported supervision. They do not create a new obligation to adopt CCM or to retire spreadsheets. Existing duties under the Companies Act and the listing rules continue to apply, and companies decide how to meet them.
CCM uses automated rules and analytics to test whether business controls are operating, on an ongoing basis rather than at periodic intervals. It checks transactions or system settings against defined conditions, flags exceptions soon after they occur and keeps a record of what was tested and what was done about it.
A periodic audit tests a sample at a point in time and reports afterwards. CCM tests the full population, or a much larger share of it, continuously and surfaces exceptions earlier. It does not replace internal audit. Auditors still design the risk-based plan, judge the exceptions and form the opinion.
Under the Companies Act, 2013, directors of listed companies must state that adequate internal financial controls exist and are operating effectively, and statutory auditors report on them. Operating effectiveness is hard to evidence with spreadsheets and annual samples, so continuous monitoring can strengthen the evidence behind that statement. Take advice from your auditors on your specific obligations.
Yes, with oversight. AI can classify exceptions, summarise findings and prioritise by risk, but a named person should review material conclusions, and every agent action should be logged. Sandboxes and governance expectations are still developing, so keep an inventory of AI use and test outputs against known cases before relying on them.
Sources: The Tribune, October 15, 2026; Kalinga TV (ANI), October 15, 2026; Financial Express coverage of the Modern BFSI Summit 2026, which could not be opened directly.