Disclosure Records of Recognized Certification Authorities

Disclosure Record for Digi-Sign Certification Services Limited

(This is page 7 of the disclosure record for Digi-Sign Certification Services Limited ("Digi-Sign") maintained by the Government Chief Information Officer ("GCIO") under section 31(1) of the Electronic Transactions Ordinance (Cap. 553) ("Ordinance"). Click this link to go back to page 1 of the disclosure record.)

Assessment Report (1 June 2003 - 31 May 2004)

In accordance with section 43(3) of the Ordinance, the GCIO must publish in the disclosure record for Digi-Sign as a recognized certification authority ("CA") the date of and the material information in the assessment report on the CA services of Digi-Sign. Only those parts of the report containing material information are herewith published.

A. Date of the Report

• The date of the report is 10 June 2004.

B. Material Information

1. The assessment report was prepared by the assessor for the period between 1 June 2003 and 31 May 2004.

Recognized CA Practices

2. In the assessor's opinion, in all material respects,
   1. the management assertions in respect of Digi-Sign's compliance with the sections of the Code of Practice (Note 1) set out in Part A of Appendix 3 to Practice Note 870 (Note 2) for the period from 1 June 2003 to 31 May 2004 are reasonable. In particular, Digi-Sign has:
      1. disclosed its business practices in its CPS(s) (Note 3) in accordance with the Ordinance and the Code of Practice and provided its services in accordance with its disclosed business practices;
      2. complied with the requirements in respect of the use of a trustworthy system to support its operations in accordance with section 37 of the Ordinance and the Code of Practice; and
      3. complied with the requirements in respect of recognition of its certificates in accordance with sections 36, 38, 39 and 40 of the Ordinance and the Code of Practice;
   2. no information came to the attention of the assessor during the course of the assessment that would indicate that the management assertions in respect of Digi-Sign's compliance with the sections of the Code of Practice set out in Part B of Appendix 3 to Practice Note 870 for the period from 1 June 2003 to 31 May 2004 are not reasonable; and
   3. based on the conclusions drawn in paragraphs (a) and (b) above, the management assertions in respect of Digi-Sign's compliance with the provisions of the Ordinance applicable to a recognized CA for the period from 1 June 2003 to 31 May 2004 are reasonable.

Financial projections

3. In the assessor's opinion, in all material respects, the accounting policies upon which Digi-Sign's cashflow projections and financial position forecasts for the period from 1 May 2004 to 30 April 2005, and projection of operating costs for the period from 1 May 2004 to 31 July 2004, in respect of the CA's operations relevant under the Ordinance are based, are consistent with those normally adopted by Digi-Sign and conform with generally accepted accounting principles adopted in Hong Kong, and the financial projections have been properly compiled on the basis of the assumptions made by management of Digi-Sign.
4. It has been ascertained from Digi-Sign that the amount of net current assets (i.e. current assets less current liabilities) as shown in the unaudited management accounts of Digi-Sign for the period ended 30 April 2004 was in a positive net current assets position. The amount of net current assets exceeds the 90-days projection of operating costs of Digi-Sign from 1 May 2004.
5. The assessor has not carried out any verification work on the unaudited management accounts of Digi-Sign for the period ended 30 April 2004.

Potential liabilities

6. In the assessor's opinion, in all material respects, the management assertions that Digi-Sign has implemented and maintained appropriate procedures to determine and manage its potential liabilities in relation to the issue of certificates are reasonable.

Notes

1. Code of Practice for Recognized Certification Authorities (Version 1.0) issued under section 33 of the Ordinance.
2. Practice Note 870 "The Assessment of Certification Authorities under the Electronic Transactions Ordinance" issued by the then Hong Kong Society of Accountants.
3. Certification practice statement.
4. The above notes are disclosed in accordance with section 31(2) of the Ordinance.