Every Indian company that keeps its books of account in accounting software must use software that records an audit trail, keeps an edit log of every change and cannot have that trail switched off. The requirement has applied from financial years commencing on or after 1 April 2023, and the statutory auditor reports on it every year. This guide sets out what the law requires, which companies and records it covers, what the auditor reports under Rule 11(g), and a checklist management can use to be ready for that report.
The legal requirement in one place
Three provisions work together, as explained in ICAI's article on audit trail requirements and responsibilities in The Chartered Accountant journal (March 2026):
| Provision | Who it binds | What it requires |
|---|---|---|
| Proviso to Rule 3(1), Companies (Accounts) Rules, 2014 | The company and its management | For financial years commencing on or after 1 April 2023, accounting software used for books of account must record "an audit trail of each and every transaction", create "an edit log of each change made in the books of account, along with the date when such changes were made", and ensure "that the audit trail cannot be disabled". |
| Section 143(3)(j), Companies Act, 2013 read with Rule 11(g), Companies (Audit and Auditors) Rules, 2014 | The statutory auditor | Report whether the software has the audit trail feature, whether it operated throughout the year for all transactions, whether it was tampered with, and whether the trail has been preserved as required for record retention. |
| Section 128, Companies Act, 2013 | The company | Books of account, and with them the audit trail, must be kept for not less than eight financial years. |
The auditor's Rule 11(g) reporting was deferred so that it starts from the same date as the management obligation: financial years commencing on or after 1 April 2023. For a company with an April to March year, FY 2023-24 was therefore the first year of both compliance and reporting, and FY 2025-26 accounts audited in 2026 are the third cycle.
What an audit trail must capture
ICAI's article describes an audit trail as a record of "who made the change", "when it was made" and "what fields were changed". A last-modified date on a voucher is not enough. For each change, the log should let a reviewer see the original value, the new value, the user and the date. The table below shows what a usable edit-log extract looks like for a single journal.
| Voucher | Field | Old value | New value | User | Date and time |
|---|---|---|---|---|---|
| JV/2026/0412 | Amount | ₹4,50,000 | ₹5,40,000 | fin.user3 | 2 April 2026, 18:42 |
| JV/2026/0412 | Cost centre | Admin | Projects | fin.user3 | 2 April 2026, 18:43 |
| JV/2026/0412 | Posting date | 31 March 2026 | 31 March 2026 (unchanged) | fin.user3 | 2 April 2026, 18:43 |
In this illustration, a year-end professional fees accrual was increased by ₹90,000 and moved to another cost centre two days after the year closed. The final ledger may be correct, but the trail is what lets management and the auditor see that the entry was changed after year end, by whom, and whether the change was approved. If an administrator could erase those rows or turn logging off for a period without leaving evidence, the company has a compliance failure and the auditor has a reporting issue, even with correct balances.
Which companies and records are covered
The requirement is not linked to size or listing. The ICAI article confirms it applies to every class of company using accounting software for its books: one person companies, section 8 companies, private companies, public companies and foreign companies.
The test is whether a record is a book of account maintained in accounting software. The article lists what falls outside: manual records, Excel workings maintained without accounting software, fixed asset registers, paysheets, and "books and papers" within the meaning of section 2(12). A spreadsheet schedule used to compute a provision is therefore not itself subject to the edit-log rule, but the journal that posts the provision into the software is.
That boundary is not a reason to keep ledgers in spreadsheets. Workings remain audit evidence, and moving books of account out of the software to avoid the rule defeats the purpose of section 128.
Outsourced bookkeeping
Where a third-party service provider maintains the company's books on its own platform, the requirement extends to that provider's software. Responsibility stays with the company. Management should obtain evidence about the provider's audit trail configuration, who can change it, how logs are retained and how they can be retrieved for eight years, rather than relying on a brochure description of the product.
Changes made directly in the database
An application-level log does not record changes made straight into the underlying database. ICAI's article points to the risk of "changes made at data base level without the aid of the accounting application" and expects auditors to "verify the edit logs of the databases to ensure no direct modifications are made on the raw data". Management should therefore select software, and configure the database, so that both layers are logged, and restrict back-end access to a small, named group.
What the auditor does and reports
According to the article, the auditor's work includes evaluating "the controls implemented by the management to prevent unauthorised access", testing transactions "for evidence of operating effectiveness of the audit trail feature", and checking database edit logs for direct changes. The conclusion is reported in the "Report on other legal and regulatory requirements" section of the auditor's report under SA 700 or SA 705.
Detailed procedures and reporting scenarios are in ICAI's Implementation Guide on Reporting on Audit Trail under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 (Revised 2024 Edition), listed on the Auditing and Assurance Standards Board's implementation guide page. Auditors should use the revised edition rather than the earlier guide listed on the same page.
Because the auditor must say whether the feature "operated throughout the year", a feature that was enabled only in February, or disabled for a system upgrade and not re-enabled for two months, will be visible in the report. Evidence of continuous operation matters as much as the feature itself.
Management readiness checklist
- List every system that holds books of account: general ledger, sub-ledgers for sales, purchase and inventory, payroll postings that flow to the ledger, and any outsourced platform.
- Confirm the feature at both levels: application audit trail and database logging, with evidence from the vendor and from your own configuration screens.
- Test create, edit and delete: post a test voucher, change it, delete it, and confirm the log shows old value, new value, user and time for each step.
- Remove shared user IDs: a log that shows "admin" or "accounts" cannot answer who made the change.
- Control who can change logging settings: document who has administrator rights, and log changes to the logging configuration itself.
- Monitor continuity: review monthly that logging stayed on, especially around upgrades, migrations and year-end closing.
- Plan retention for eight years: include audit trail data in backup and archival, and test that a log from three years ago can actually be retrieved and read.
- Cover outsourced systems: obtain written confirmation and evidence from the service provider on configuration, access and retention.
- Keep an evidence file for the auditor: system inventory, configuration screenshots or reports, test results, access lists, monitoring reviews and any remediation.
Mistakes that lead to adverse Rule 11(g) comments
- Assuming the rule applies only to listed or large companies.
- Treating a last-modified timestamp as an edit log.
- Enabling the feature in the application while leaving the database open to direct changes.
- Using shared logins for data entry or approvals.
- Switching logging off during a migration and not proving when it was switched back on.
- Keeping only the current year's log when books must be kept for eight financial years.
- Assuming an outsourced accountant's software is someone else's responsibility.
Updated on 27 September 2026: retitled; merged the separate compliance checklist article; added the Rule 3(1), Rule 11(g) and section 128 requirements from ICAI's March 2026 journal article, the exclusions list, database-level expectations, report placement under SA 700/705, the revised 2024 Implementation Guide and a worked edit-log example.
