AesirX ComplianceOne | Circular 19/2025/TT-BKHCN E-Signature Audit

Circular 19 sits under the Law on Electronic Transactions No. 20/2023/QH15. The Law sets the legal baseline for electronic transactions, signatures and trust services. Circular 19 adds the technical audit of the systems and service-delivery processes behind them.

In ComplianceOne, your audit records link to the Law and to the neighbouring decree and circulars. The Law's own obligations are not copied into the circular, and each instrument keeps its own status.

You run the technical audit Circular 19 requires, from scope and control records to findings, remediation and review. Circular 19 prescribes no official form of its own, so these are internal audit-readiness records, each labelled as an AesirX working document.

Nothing from Circular 19 is presented as an official filing. Where audit evidence later supports a Decree 23 or Circular 53 filing, ComplianceOne helps you build that instrument's own package for the authority or an auditor.

Circular 19 sets no trust services list and no submission channels of its own. The certificates, providers and verification checks an audit tests are recorded under Decree 23. So an audit finding points at a named credential, with its own issue, suspension, revocation and expiry history, not at a status in a spreadsheet.

Built for E-Signature Technical Audit Compliance Operations

No invented forms. Circular 19 prescribes no official form, and ComplianceOne does not make one up. Scope, findings and remediation stay in internal records labelled as AesirX working documents.

Evidence that links both ways. Audit evidence links back to the Decree 23 certificate and signature records it tests. It links forward to Circular 53's data-message certification evidence where the same trust-service systems are in scope.

Audit cycles you can follow. Circular 19 sets a first audit within one year of certification (Article 4(3)) and periodic audits every two years after that (Article 4(2)). Providers already operating when it took effect have their own first audit (Article 15(2)), and voluntary audits are allowed (Article 2(2)). Each audit is tracked as its own event, so a reviewer can see when the last one closed and when the next is due.

Status on the day that mattered. A finding about a certificate points at that credential's history. An auditor reads its status on the date in question, not its status today.