Audit Trail in Accounting Software: What Companies Must Log and What Auditors Report
From financial years starting on or after 1 April 2023, a company that keeps books in software must use software that records an audit trail of every transaction, logs each edit with its date, and cannot be disabled. The trail is kept for eight years like books of account, and the auditor reports on it under Rule 11(g).
Many small companies switched on the edit log in their accounting software in 2023 and never looked at it again. Then the auditor asks whether it ran for the whole year, whether the separate billing tool has one, and why there is a gap in July. This post explains what the rules require, what the auditor reports and what to check before the audit.
The rule
The proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 says that a company keeping its books of account in electronic mode must use only accounting software that:
- records an audit trail of each and every transaction;
- creates an edit log of each change made in the books, along with the date of the change; and
- ensures the audit trail cannot be disabled.
It applies to financial years commencing on or after 1 April 2023, after two deferrals. It covers every company, including private companies, one person companies and Section 8 companies. Partnership firms and proprietors are not covered, because the rule sits under the Companies Act.
Separately, the same rules require the backup of books kept electronically to be maintained on servers physically located in India on a daily basis.
What the log should capture
The rules do not list fields. The ICAI's guidance and practice treat a usable log as answering four questions:
| Question | Example |
|---|---|
| Who made the change | User ID "accounts2" |
| When | 14 July 2026, 18:42 |
| What changed | Sales invoice INV-0412, amount ₹4,72,000 to ₹4,27,000 |
| Type of change | Created, modified or deleted |
It covers changes to the books of account, not to master settings such as user rights. But any system that feeds the ledger counts: a separate billing tool, an inventory system or a payroll tool whose journals post into the books needs its own edit log.
Retention and penalties
The audit trail is treated as part of the books of account under Section 128, so it must be kept for at least eight financial years preceding the current year. Logs for FY 2023-24 (which ended on 31 March 2024) must therefore be kept until at least 31 March 2032.
If the books are not kept as required, the managing director, the CFO or the person charged with the duty can face a fine of ₹50,000 to ₹5 lakh under Section 128(6).
What the auditor reports under Rule 11(g)
Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 requires the statutory auditor to state whether:
- ✓the accounting software has the audit trail (edit log) feature;
- ✓it operated throughout the year for all relevant transactions;
- ✓it was not tampered with; and
- ✓it was preserved as required for record retention.
Any "no" goes into the audit report, where shareholders, lenders and the registrar can read it. The ICAI's Implementation Guide on reporting under Rule 11(g) (revised 2024 edition) sets out how auditors test this.
A checklist for small companies
| Check | What to look for |
|---|---|
| Version | Does your edition support an edit log? Older versions may not. For example, Tally's edit log needs TallyPrime Edit Log, not Tally ERP 9 |
| Switched on from day one | Log active from 1 April for every company file, not from the date someone noticed |
| Cannot be disabled | No user, including the admin, can turn it off |
| Feeder systems | Billing, inventory, payroll, e-commerce connectors that post to the ledger |
| Database access | Who can change data directly in the database, bypassing the log |
| Migration | If you changed software mid-year, export and keep the old system's log |
| Backups | Daily backup on servers in India, and a test restore each quarter |
| Retention | Logs for eight years, readable even if you change software |
A worked example
A Nashik packaging company with ₹14 crore turnover uses accounting software for its books, a separate billing app for sales invoices and Excel for payroll, posting a monthly salary journal.
- Accounting software. The edit log is on and cannot be disabled. A review shows invoice INV-0412 was changed from ₹4,72,000 to ₹4,27,000 on 14 July 2026, a reduction of ₹45,000. The log shows who did it and when, and the file has a matching credit note request from the customer. Fine.
- Billing app. It posts invoices into the ledger but has no edit log. The company has two choices: move invoicing into a tool with a log, or get the vendor to enable one. Until then, the auditor is likely to report that the feature did not operate for those transactions.
- Payroll in Excel. The spreadsheet is a working paper, not the books. The salary journal posted into the accounting software is captured by its log, so this is acceptable.
- Retention. Logs from FY 2023-24 onward are archived. With FY 2026-27 under way, the company needs FY 2023-24, 2024-25 and 2025-26 logs preserved, and each new year added. The FY 2023-24 logs stay until at least 31 March 2032.
Frequently asked questions
Does a small company with one accountant still need an edit log?
Yes. The rule applies to every company that keeps books in software, with no turnover or size exemption.
Can we keep books manually to avoid the rule?
The rule applies only to electronic books. Manual books are allowed under the Companies Act, but they are impractical for GST, e-invoicing and audit, and few companies do this.
Does the log have to show the old and new values?
The rules say "each change" must be logged with its date. Logs that show only "edited" without the before and after values make it hard for the auditor to say the trail is complete.
What if the log was off for part of last year?
Switch it on now, document the gap and the reason, and expect the auditor to report it for that year.
Sources
- ✓Audit Trail: Requirements and Responsibilities, The Chartered Accountant journal (ICAI)
- ✓Demystifying the audit trail (edit log), TaxGuru
This is a summary, not legal advice. Confirm the current rule text on the MCA website and your reporting position with your statutory auditor.
Written by
Founder, Airwix Technologies (Sleet)
Vatsal Sutariya is the founder of Airwix Technologies in Ahmedabad, the company that builds Sleet: SleetHR for HR and payroll, and Sleet Accounting for GST billing and books. He writes about GST, invoicing, business tax and choosing software for Indian businesses, and checks each rule against the official notification before it is published.
LinkedIn profile →