For Indian companies, an accounting-system audit trail is no longer just a good internal-control feature. Where a company uses accounting software to maintain its books of account, the Companies (Accounts) Rules require software with an audit-trail or edit-log capability. The practical objective is straightforward: changes to accounting records should leave a trace showing what changed, when it changed and who made the change.
ICAI's professional guidance on audit-trail requirements explains that the requirement applies for financial years commencing on or after 1 April 2023 and covers companies using accounting software for books of account. ICAI also maintains a dedicated implementation-guide page that includes its revised guide on auditor reporting under Rule 11(g).
What must the accounting software be able to do?
The core requirement is more specific than merely having a history screen. The software should record an audit trail for transactions, create an edit log for changes made in the books together with the date of the change, and the audit-trail feature should not be capable of being disabled in a way that defeats the statutory requirement.
ICAI's current professional material describes a useful minimum data set for an effective trail: the change made, the time or date of the change, the user responsible and the transaction reference or data affected. The software should also be capable of producing the trail when required for review or audit.
Which companies are covered?
The requirement is not restricted to listed or large companies. ICAI's guidance explains that it applies to companies using accounting software for maintenance of books, including private, public, one-person and Section 8 companies. The relevant question is therefore not turnover or paid-up capital; it is whether books of account are maintained with the aid of accounting software.
The underlying company-law framework can be checked in the Companies Act, 2013 on India Code. Section 128 requires companies to keep proper books of account and permits them to be maintained electronically in the prescribed manner.
Does every Excel file need an audit trail?
No. The important boundary is whether the record is itself a book of account maintained through accounting software. ICAI explains that supporting workings maintained electronically, such as calculations or schedules in ordinary spreadsheets outside the accounting software, do not automatically fall within the software audit-trail requirement merely because they are electronic. However, accounting entries ultimately recorded in the accounting software are within the relevant system trail.
This distinction should not be used to bypass proper record keeping. A spreadsheet may still be important audit evidence or a company record even where the specific accounting-software edit-log rule does not apply to that spreadsheet.
What if accounting is outsourced?
Outsourcing does not remove management's responsibility. If a third-party service provider maintains the company's books using its own accounting platform, ICAI's guidance states that the audit-trail requirement extends to that accounting software. Management should therefore obtain enough information about the service provider's system, configuration, retention and controls rather than assuming the vendor's standard package is automatically compliant.
For material outsourced systems, auditors may also consider relevant service-organisation assurance reports and the requirements of SA 402. The evidence needed will depend on how much of the accounting process and system environment is controlled by the service provider.
How long should the audit trail be retained?
ICAI links audit-trail retention to section 128's record-retention framework. Section 128 generally requires books of account and relevant vouchers to be kept for not less than eight financial years immediately preceding a financial year, subject to a longer period where directed in connection with an investigation. A company should therefore design storage, backup and archival policies so that historical edit logs remain retrievable rather than keeping only the current year's live log.
What does the statutory auditor report on?
Rule 11(g) reporting focuses on whether the accounting software used for maintaining books has the audit-trail feature, whether it operated throughout the year for transactions recorded in the software, whether the feature was tampered with and whether the trail was preserved in accordance with the statutory retention requirement. ICAI's implementation material is the appropriate first-party reference for detailed audit procedures and reporting scenarios.
This reporting obligation makes the issue different from an ordinary IT-control recommendation. The auditor needs evidence about actual operation of the feature, not merely a management statement that the ERP vendor advertises an audit-log module.
Practical example: ERP journal edited after posting
Assume a finance user posts a year-end journal for professional fees and later changes the amount and cost centre. A compliant trail should allow the company and auditor to identify the original record, the subsequent modification, when the change occurred and the user associated with it. If an administrator can erase that history or disable logging for part of the year without leaving reliable evidence, the company has a compliance and audit-reporting problem even if the final ledger balance is correct.
Management readiness checklist
- Map every accounting application: identify the general ledger, sub-ledgers and other software actually used to maintain books of account.
- Confirm logging coverage: test creation, modification and deletion scenarios rather than relying only on a vendor brochure.
- Review user identification: shared IDs weaken the ability to establish who made a change.
- Check configuration rights: determine who can disable, alter or purge logging and whether configuration changes themselves are controlled.
- Consider database-level changes: assess whether direct backend changes could bypass the application trail.
- Test retention and retrieval: confirm that older logs can actually be produced and are included in backup and archival arrangements.
- Assess outsourced systems: obtain evidence about the service provider's audit-trail functionality and controls.
- Document management's assessment: preserve system inventories, screenshots or reports, test results, vendor confirmations and remediation records for audit.
Common mistakes to avoid
- Assuming the rule applies only to large or listed companies.
- Equating a last-modified timestamp with a complete edit log.
- Allowing shared accounting user IDs that make changes difficult to attribute.
- Checking only the application interface while ignoring possible database-level changes.
- Assuming outsourced bookkeeping transfers the statutory responsibility to the service provider.
- Keeping logs for only one year even though the underlying books have a longer statutory retention requirement.
- Testing the feature only at year-end instead of monitoring whether it operated throughout the year.
Practical takeaway
Audit-trail compliance is a combination of software capability, configuration, user discipline, retention and evidence. A company should know which systems maintain its books, ensure edits leave a reliable and non-disableable trail, preserve that trail with its accounting records and periodically test that the evidence can actually be retrieved. For auditors, the question is not whether an audit-log button exists; it is whether the required trail operated throughout the year and can support the statutory reporting conclusion.
