auditor, the Controller shall within the time specified in sub regulation (4) notify the applicant giving reasons for the rejection. 31. Qualifications for compliance auditors For a person to qualify to conduct compliance audits under the Act or these Regulations, that person shall (a) have evidence of international recognition as a security professional or certification as a public accountant; (b) be familiar with digital signature technology and practices; and (c) be knowledgeable about the requirements of the Act, these Regulations and any other law relating to electronic transactions. 32. Revocation of registration of auditor (1) The Controller may revoke the registration of a compliance auditor where – (a) the international recognition or certification in respect of that auditor is withdrawn, suspended, cancelled or revoked; (b) the auditor contravenes the Act or these Regulations. (1) Before revoking the registration under this regulation, the Controller shall give notice requiring the auditor to show cause, within fourteen days, why the registration should not be revoked. 33. Auditing of certification, repository and date and time stamp providers (1) Every certification service provider, repository and date and time stamp service provider shall engage a registered auditor at least once a year to conduct an annual audit for compliance with the Act and these Regulations. (2) The audit under sub regulation (1) shall be conducted at least one hundred and eighty days before the expiry of the licence, registration or recognition of the provider. (3) The Controller may also engage an auditor to conduct audits on a licensed or recognized certification service provider, repository or date and time stamp provider, with or without notice to the relevant service provider.