# Audit Trail under the Companies Act and the Edit Log Rule in 2026

> Source: https://krystal7.com/insights/audit-trail-edit-log-accounting-software-india
> Publisher: Krystal7 Consultants (Krystal7 Innovations Private Limited), Gurugram, India
> Author: CA Nandini
> Published: 19 Jan 2026; updated 24 Oct 2026
> Summary: Since 1 Apr 2023, company accounting software must keep an edit log that cannot be disabled, reported under rule 11(g) and kept eight years.

*Written by CA Nandini Hasija, Krystal7 Consultants. Last updated 23 October 2026.*

## AI Overview Summary

- Since 1 Apr 2023, every company using accounting software must use software that logs each change to its books with the date, and nobody may disable the log (rule 3(1) proviso, Companies (Accounts) Rules, 2014).
- The statutory auditor reports under rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 whether the edit log existed, ran all year for every transaction, stayed untampered and was preserved.
- Section 128(5) of the Companies Act, 2013 keeps books for eight financial years, so the edit log for FY 2023-24 must stay readable until at least 31 Mar 2032.
- Books on a foreign hosted ERP must stay accessible in India at all times, with a daily backup on servers in India (rule 3(5)) and server details given to the ROC (rule 3(6)).
- A subsidiary on SAP, NetSuite or Oracle should switch on logging at application and database level and restrict global administrators. Otherwise the auditor modifies the rule 11(g) comment in the filed audit report.

**The audit trail rule sits in the proviso to rule 3(1) of the Companies (Accounts) Rules, 2014. From 1 Apr 2023, a company that keeps its books on accounting software must use software that logs each change with its date. Nobody may disable the log. The statutory auditor reports on it under rule 11(g) of the Companies (Audit and Auditors) Rules, 2014. Section 128(5) keeps the books, and so the log, for eight financial years.**

This page covers the rule text, the auditor's report, retention and the India backup and server rules. It then shows what a foreign owned subsidiary on a global ERP must change. It closes with a worked example, common mistakes and a checklist. INR 1,00,000 is one lakh (100,000).

## What is the audit trail rule under the Companies Act?

The audit trail rule is the proviso to rule 3(1) of the Companies (Accounts) Rules, 2014 (the Accounts Rules). It requires every company that uses accounting software to use software that records an audit trail of each transaction. The software must keep an edit log of each change with its date, and the log must not be capable of being disabled.

The power comes from section 128(1) of the Companies Act, 2013. Its second proviso lets a company keep books of account "in electronic mode in such manner as may be prescribed". Rule 3 of the Accounts Rules prescribes that manner. A breach of rule 3 is therefore a breach of section 128.

The Ministry of Corporate Affairs (MCA) inserted the proviso by the Companies (Accounts) Amendment Rules, 2021, G.S.R. 205(E) of 24 Mar 2021. After two deferrals, the proviso now reads:

> Provided that for the financial year commencing on or after the 1st day of April, 2023, every company which uses accounting software for maintaining its books of account, shall use only such accounting software which has a feature of recording audit trail of each and every transaction, creating an edit log of each change made in books of account along with the date when such changes were made and ensuring that the audit trail cannot be disabled.

The rule sits inside a wider set of duties on electronic books. The table lists them.

| Requirement | Provision | Applies from | Who answers for it |
|---|---|---|---|
| Edit log of each change, with date; cannot be disabled | Proviso to rule 3(1), Accounts Rules | Financial years from 1 Apr 2023 | Company, through the officer in charge under section 128(6) |
| Auditor's statement on the audit trail | Rule 11(g), Companies (Audit and Auditors) Rules, 2014, under section 143(3)(j) | FY 2023-24 reports onwards (our reading, see below) | Statutory auditor |
| Books accessible in India at all times | Rule 3(1), as amended by G.S.R. 624(E) | 5 Aug 2022 amendment | Company |
| Daily backup on servers physically in India | Proviso to rule 3(5), as amended by G.S.R. 624(E) | 5 Aug 2022 amendment | Company |
| Service provider, IP address, location and India controller given to the ROC | Rule 3(6) | Each year, with the financial statements | Company |
| Books kept for eight financial years | Section 128(5) | Always | Company |
| Log of every entry edited or deleted in GST records | Rule 56(8), CGST Rules, 2017 | Since GST began on 1 Jul 2017 | Registered person |

Our guide to [financial reporting for foreign subsidiaries in India](/insights/financial-reporting-for-foreign-subsidiaries-in-india-the-2026-founders-guide) places these rules inside the full annual cycle.

## Which companies and which software does the rule cover?

The rule covers every company registered in India that keeps its books on accounting software. Size does not matter. Private Limited companies, public companies, One Person Companies, small companies and wholly owned subsidiaries of foreign groups are all inside it. Only a company that keeps manual books falls outside the proviso.

Section 2(20) defines a company as one incorporated under the Companies Act, 2013 or an earlier company law. So the rule binds the Indian subsidiary, not the foreign parent. It does not reach an LLP, which keeps books under the LLP Act, 2008 and its own rules.

The harder question is what counts as accounting software. The rule does not define the term. Section 2(13) defines books of account to include records of:

1. All money received and spent, and the matters behind it.
2. All sales and purchases of goods and services.
3. The company's assets and liabilities.
4. Cost items prescribed under section 148, for companies in the cost records classes.

We read the rule by that definition. Software that holds any of these records is in scope when it feeds the ledger. Billing systems, payroll engines, inventory modules, fixed asset registers and expense tools often hold the first entry of a transaction. If someone can change an invoice in the billing tool before it posts, the ledger log never sees the change.

Spreadsheets are a common gap. A company that keeps its working books in Excel and posts summary journals has no edit log for the detail. The upload is logged, but the spreadsheet behind it is not. We move such records into a system with a log. Where that is not possible, we treat the posted journal as the book of prime entry and lock its support.

## What must the edit log record?

The rule asks for an audit trail of each transaction and an edit log of each change with its date. The trail must not be capable of being disabled, and the rule lists no fields. In practice the log must show what changed, who changed it, when, and the value before and after.

The rule text names only the date, but dates alone cannot show whether a change was proper. We set up logs with the fields below.

| Field | Why it matters | Basis |
|---|---|---|
| Date of change | The rule names it | Rule 3(1) proviso |
| Time of change | Places the change before or after the close and the backup | Practice |
| User ID | Shows who made the change and whether that user had the right | Practice; section 143(3)(i) controls |
| Record changed | Links the change to a voucher, invoice or ledger | "Each and every transaction" in the proviso |
| Old value and new value | Shows the effect of the edit | "Edit log of each change" in the proviso |
| Type of change | Creation, edit or deletion | Practice |
| Changes to the log settings | Shows whether anyone tried to switch it off | "Cannot be disabled" in the proviso |

Changes to master data need the same treatment when they change the books. A new tax code, a ledger mapping or a vendor bank account all alter what posts. We log them, because a wrong bank account is the start of many payment frauds.

## When did the audit trail rule start, and why did the dates move?

The audit trail duty started for financial years beginning on or after 1 Apr 2023. MCA first notified it on 24 Mar 2021 for 1 Apr 2021, then deferred it twice. The first reporting year for most companies was FY 2023-24. FY 2025-26 is the third year of reporting.

| Date | Instrument | What it did |
|---|---|---|
| 24 Mar 2021 | Companies (Accounts) Amendment Rules, 2021, G.S.R. 205(E) | Inserted the audit trail proviso to rule 3(1), from 1 Apr 2021 |
| 24 Mar 2021 | Companies (Audit and Auditors) Amendment Rules, 2021, G.S.R. 206(E) | Inserted rule 11(e), (f) and (g), with the audit trail statement in clause (g) |
| 1 Apr 2021 | Companies (Accounts) Second Amendment Rules, 2021, G.S.R. 247(E) | Moved the proviso to 1 Apr 2022 |
| 1 Apr 2021 | Companies (Audit and Auditors) Second Amendment Rules, 2021, G.S.R. 248(E) | Moved rule 11(g) to financial years from 1 Apr 2022 |
| 31 Mar 2022 | Companies (Accounts) Second Amendment Rules, 2022, G.S.R. 235(E) | Moved the proviso to 1 Apr 2023 |
| 5 Aug 2022 | Companies (Accounts) Fourth Amendment Rules, 2022, G.S.R. 624(E) | Added "at all times" to India access, made the India backup daily, added rule 3(6)(e) |

The two rules now carry different dates. Rule 11(g) still names financial years from 1 Apr 2022, while the duty it tests begins on 1 Apr 2023. An auditor cannot report a failure to meet a duty that did not yet exist. So auditors reported under rule 11(g) from FY 2023-24. The ICAI implementation guide on audit trail reporting (revised 2024, paragraph 14) agrees. It says the clause does not apply for FY 2022-23.

## What does the auditor report under rule 11(g)?

Rule 11(g) asks the auditor to state whether the company used accounting software with an audit trail (edit log) facility. The auditor also states whether it operated all year for all transactions, was not tampered with, and was preserved as record retention law requires. The statement appears in the audit report filed with AOC-4.

The clause reads:

> Whether the company, in respect of financial years commencing on or after the 1st April, 2022, has used such accounting software for maintaining its books of account which has a feature of recording audit trail (edit log) facility and the same has been operated throughout the year for all transactions recorded in the software and the audit trail feature has not been tampered with and the audit trail has been preserved by the company as per the statutory requirements for record retention.

Section 143(3)(j) lets the rules add matters to the audit report. Rule 11 is made under it and has no exemption for small companies or private companies. The exemptions people know from CARO 2020 do not apply here, because CARO is a separate order under section 143(11).

The statement breaks into four tests.

| Element | What the auditor checks | Evidence we prepare |
|---|---|---|
| The software has the feature | Whether each system holding books records an edit log | System inventory; vendor documents; configuration screens |
| It operated all year for all transactions | Whether logging was on from 1 April to 31 March, for every module and table that changes the books | Settings history; sample changes traced to the log |
| It was not tampered with | Whether anyone disabled, altered or deleted the log | Access list for administrators; log of setting changes; database logs |
| It was preserved | Whether earlier years' logs still exist and can be read | Retention policy; archive test; India backup records |

A failure on any element leads to a modified statement. The auditor describes the gap, the modules and the period. Some failures also feed the auditor's section 143(3)(b) opinion on whether proper books were kept. They can also affect the section 143(3)(i) report on internal financial controls, where that clause applies.

The report is public. The filed financial statements and audit report sit among the company's public documents on the MCA portal. Banks, investors and a buyer's diligence team read it. Our note on [AOC-4 and MGT-7 annual filing for foreign owned companies](/insights/aoc-4-mgt-7-annual-filing-foreign-owned-company) covers the filing.

## How long must a company keep the audit trail?

Rule 11(g) asks whether the company preserved the audit trail "as per the statutory requirements for record retention". For books of account, section 128(5) of the Companies Act, 2013 sets the period: the eight financial years before the current one. The edit log is part of the electronic books, so it follows the same period.

Section 128(5) keeps books "relating to a period of not less than eight financial years immediately preceding a financial year". A company younger than eight years keeps everything since incorporation. If the government orders an investigation under Chapter XIV, it may direct a longer period.

The earliest safe deletion dates for the first years of the rule are below.

| Financial year of the log | Still inside the eight preceding years during | Keep until at least |
|---|---|---|
| FY 2023-24 | FY 2031-32 | 31 Mar 2032 |
| FY 2024-25 | FY 2032-33 | 31 Mar 2033 |
| FY 2025-26 | FY 2033-34 | 31 Mar 2034 |
| FY 2026-27 | FY 2034-35 | 31 Mar 2035 |

Retention also means the log can still be read after an ERP upgrade. We test an archive restore once a year and keep the result on file.

## Where must the books, the backup and the audit trail sit?

Rule 3(1) requires electronic books to stay "accessible in India, at all times". The proviso to rule 3(5) requires a backup on servers physically located in India every day, even where the books sit outside India. Rule 3(6) requires the company to give the ROC its service provider's details each year.

MCA tightened all three on 5 Aug 2022 by G.S.R. 624(E). Before that, the backup could be periodic. Rule 3(6) asks for these details at the time the company files its financial statements:

1. The name of the service provider.
2. The internet protocol (IP) address of the service provider.
3. The location of the service provider, where applicable.
4. The address the provider gives, where the books sit on cloud.
5. Where the provider is outside India, the name and address of the person in control of the books in India.

The rules do not say in so many words that the backup must include the audit trail. We read the edit log as part of the books, because it records the changes to them. So the daily India backup should include the log tables. A backup of balances without the log would not let anyone in India rebuild the history.

In practice, a foreign hosted ERP needs live read access for the India finance lead and the auditor. It also needs a daily copy of the ledger and log tables on a server in India.

## What does the rule mean for a subsidiary on SAP, NetSuite or Oracle?

A subsidiary on a global ERP must meet the Indian rule inside a system the group controls. The group usually sets logging for its own needs. The Indian company must confirm that every table and module holding its books logs changes. It must also confirm that nobody abroad can switch logging off and that logs survive eight years.

Each large ERP keeps change history in its own way. The table gives the places we look first. Configuration names change between versions, so confirm each item with the vendor documents for the version you run.

| System | Where change history usually sits | What we check |
|---|---|---|
| SAP ECC or S/4HANA | Change documents for business objects; table logging for configuration tables; database audit policies on HANA | Table logging switched on in the client; who can edit tables directly; whether database auditing covers the Indian company code; archiving rules for change documents |
| Oracle NetSuite | System notes on records | Coverage of custom records and fields; CSV imports and scripts run by administrators; how long system notes are kept |
| Oracle EBS or Fusion Cloud | Audit settings that an administrator enables per object | Which objects carry audit settings; who can change them; retention of audit data |
| Microsoft Dynamics 365 | Database log set up per table | Tables chosen for logging; cleanup jobs that delete old log entries |
| Indian packages such as TallyPrime or Zoho Books | Edit log features built for this rule | That the company runs the edit log version or setting, and no user can turn it off |

Four problems recur on group systems:

1. **Logging at application level only.** A change made straight in the database skips the application log. Fix: switch on database logging for the Indian tables, or show that no one can write at database level.
2. **Global administrators.** A support team abroad can often change log settings. Fix: restrict that right, log every use of it, and give the Indian auditor the list of holders.
3. **Archiving and cleanup jobs.** Group policies often delete change history after a few years to save space. Fix: set an eight year floor for the Indian company code.
4. **A SOC report that misses the point.** The vendor's SOC 1 or SOC 2 report may skip audit trail settings or cover a different period. Fix: ask for a report that covers both, plus a bridge letter to 31 March.

Our guide to [controlling your Indian subsidiary through reporting and audit](/insights/indian-subsidiary-control-reporting-audit) covers the governance side of the same problem.

## Who is responsible, and what are the penalties?

The board is responsible for proper books. Section 128(6) names the officers who answer for a breach. It covers the managing director, the whole time director in charge of finance, the Chief Financial Officer or any person the board charges with compliance. Each faces a fine of INR 50,000 to INR 5,00,000.

The section 128(6) text on the Income Tax Department's copy of the Act provides a fine only. The fine falls on each person in default, not on the company. Where both the managing director and the CFO are in default, the exposure doubles.

The board also signs the directors' responsibility statement in its report under section 134(5). That statement says the directors took proper and sufficient care to maintain adequate accounting records. A missing audit trail sits badly with that statement.

For a foreign owned subsidiary, the bigger cost is often the public audit report. A modified rule 11(g) statement stays on the MCA record for that year. It raises questions in a funding round, a bank credit review or a sale of the business.

We recommend a board resolution naming one officer in India as the person charged under section 128(6). That officer should receive the system evidence from group IT.

## How does the audit trail rule fit with GST and income tax records?

GST law has had its own edit log rule since 1 Jul 2017. Rule 56(8) of the CGST Rules, 2017 says entries must not be erased or overwritten. Where records are kept electronically, "a log of every entry edited or deleted shall be maintained". Section 36 of the CGST Act, 2017 keeps records for 72 months from the annual return due date.

The GST rule applies to the registered person, which for most subsidiaries is the same company. One system log can meet both rules if it covers the GST records and lasts long enough. Take FY 2025-26: the GSTR-9 annual return falls due on 31 Dec 2026, so 72 months runs to 31 Dec 2032. The Companies Act period runs to 31 Mar 2034, so it is the longer one.

Income tax law sets its own rules on books and how long to keep them. We plan the retention policy to the longest period that applies across the three laws. In most years that is the Companies Act period, unless a tax assessment or dispute keeps a year open longer.

## What evidence do auditors ask for?

Auditors ask for proof that the feature exists, ran all year, was not tampered with and was preserved. Expect requests for a system list, configuration evidence, administrator access lists and logs of setting changes. Cloud systems add a SOC report and proof of the daily India backup. Prepare the pack before 31 March.

| Evidence | Who prepares it | When |
|---|---|---|
| List of every system that holds books, with module, owner and host location | India finance lead with group IT | Before the year starts; update each quarter |
| Vendor document or screens showing the edit log and that users cannot disable it | Group IT or vendor | Once per version; again after upgrades |
| History of changes to log settings during the year | Group IT | At 31 March |
| List of users with administrator or database rights | Group IT | Each quarter |
| SOC 1 or SOC 2 report covering audit trail controls, with a bridge letter to 31 March | Vendor or shared service centre | At year end |
| Daily India backup logs and a restore test | Group IT or hosting provider in India | Each month, with a yearly restore test |
| Rule 3(6) details: provider, IP address, location, India controller | India finance lead | Before AOC-4 |
| Retention policy setting eight years for the Indian company | Finance with group IT | Once; review each year |

Our [statutory audit guide for a foreign owned Indian subsidiary](/insights/statutory-audit-foreign-owned-indian-subsidiary) places this pack in the full audit timetable.

## What can a company do when the audit trail was off for part of the year?

A company cannot recreate a log for a period when logging was off. It should switch logging on at once, record the gap and its cause, and review the transactions entered or changed during the gap. The auditor will then modify the rule 11(g) statement for that year, describing the period and the systems.

A clean record of the gap limits the damage. We follow these steps:

1. Switch logging on and capture evidence of the date and time.
2. Find the start of the gap from setting histories, release notes or support tickets.
3. List the transactions created, edited or deleted during the gap.
4. Review the higher risk ones: manual journals, credit notes, write offs and master data changes.
5. Record the review and the results in a note to the board.
6. Give the auditor the note before fieldwork.

Do not build a substitute log after the event and present it as the system log. The auditor will treat it as tampering. A backfilled log damages trust far more than an honest gap does.

Keep the gap documents with the eight year archive, because later reports still ask whether earlier logs were preserved.

## What changed in 2026

We trace no change to the audit trail provisions in 2026. The latest amendment to rule 3 of the Accounts Rules that we can find is G.S.R. 624(E) of 5 Aug 2022. For rule 11(g) it is G.S.R. 248(E) of 1 Apr 2021. The ICAI implementation guide on audit trail reporting, revised in 2024, cites nothing later.

MCA keeps the official list of notifications. Check its entries for the Accounts Rules and the Audit and Auditors Rules before you rely on this. The changes around the rule are below.

| Item | Old position | New position | Date | Instrument |
|---|---|---|---|---|
| Small company limits | INR 4 crore paid up capital, INR 40 crore turnover | INR 10 crore paid up capital, INR 100 crore turnover; no effect on rule 11(g) | 1 Dec 2025 | G.S.R. 880(E) |
| Income tax law | Income Tax Act, 1961 | Income Tax Act, 2025; tax audit report becomes Form 26 under section 63 | 1 Apr 2026 | Act 30 of 2025; Income Tax Rules, 2026 |
| Company law reform | Companies Act, 2013 as it stands | Corporate Laws (Amendment) Bill, 2026 with a Joint Committee; not law | Introduced 23 Mar 2026 | Bill No. 85 of 2026 |
| Audit trail rule | Proviso to rule 3(1); rule 11(g) | No change that we can trace | None | None |

### What has happened since

This page was first published on 19 Jan 2026. Since then:

1. The Income Tax Act, 2025 came into force on 1 Apr 2026. It is a separate statute and does not touch the audit trail rule under the Companies Act.
2. The Corporate Laws (Amendment) Bill, 2026 went to Lok Sabha on 23 Mar 2026 and then to a Joint Committee. It was not law on 23 Oct 2026, so treat any proposal in it as pending.
3. AGMs for FY 2025-26 fell due by 30 Sep 2026. Those audit reports carried the third year of rule 11(g) statements. They were the first to test preservation of two earlier years of logs.

## Worked example

Take a hypothetical Indian subsidiary of a European group. It runs on the group's SAP S/4HANA instance, hosted outside India, with its own company code. It posts about 2,40,000 journal lines a year at an even rate.

### The logging gap

Group IT finds that table logging for some configuration tables was off from 1 Apr 2025 to 15 Aug 2025. Change documents for posted entries were on all year.

1. Days in the gap: April 30, May 31, June 30, July 31 and August 15, a total of 137 days.
2. Share of the year: 137 divided by 365 is 37.5 percent.
3. Journal lines posted in the gap at an even rate: 2,40,000 times 137 divided by 365 is about 90,082 lines.

The posted lines carry change documents, so the gap does not touch them directly. It touches configuration: tax codes, account determination and posting rules. A change there alters how later lines post, without a trace. The finance team lists every configuration change in the gap from transport records and reviews each one.

The auditor modifies the FY 2025-26 rule 11(g) statement. It names the configuration tables and the period from 1 Apr 2025 to 15 Aug 2025.

### The retention shortfall

The group archiving policy deletes change documents after five years.

1. Under that policy, FY 2025-26 change documents go after 31 Mar 2031.
2. Section 128(5) needs them until at least 31 Mar 2034.
3. The shortfall is three years. The group sets an eight year floor for the Indian company code.

### The penalty exposure

Section 128(6) fines each person in default INR 50,000 to INR 5,00,000. If the board had charged both the managing director and the CFO, the top of the range across the two is INR 10,00,000. The fine is a cost to the individuals, and it is the reason most Indian CFOs push hard for the evidence pack.

### The backup count

The India backup runs daily, so FY 2025-26 needs 365 backup records. The team keeps the backup logs for the year and one restore test with the audit file.

## Common mistakes

1. **Treating the group ERP as the group's problem.** The rule binds the Indian company. Fix: name an Indian officer under section 128(6) and get group IT to deliver the evidence pack each quarter.
2. **Logging the ledger but not the subledgers.** Billing, payroll and inventory tools often hold the first entry. Fix: list every system that holds books under section 2(13) and confirm each one logs changes.
3. **Leaving the database open.** Direct database edits skip the application log. Fix: switch on database logging or remove write rights at that level, and show the auditor which.
4. **Letting administrators switch logging off without trace.** Fix: restrict the right, log its use and review the log each quarter.
5. **Deleting history too early.** Fix: set eight financial years as the floor for the Indian company in every archiving and cleanup job.
6. **Keeping the India backup weekly, or outside India.** Fix: run a daily backup to a server physically in India, including the log tables.
7. **Relying on a SOC report that does not cover the audit trail.** Fix: check the scope and the period. Ask for a bridge letter to 31 March.
8. **Forgetting the rule 3(6) details.** Fix: keep the provider, IP address, location and India controller on file before AOC-4.
9. **Building a log after the event.** Fix: report the gap as it is, review the period and give the auditor a board note.
10. **Assuming small company status brings relief.** Fix: apply rule 11(g) to every company, and remember a subsidiary is never a small company.

## Checklist

1. List every system that holds the Indian company's books, with module, owner and host location.
2. Confirm in writing that each system records an edit log of every change, with date, user and old and new values.
3. Check that no local or global role can disable logging without leaving its own trace.
4. Switch on database logging for the Indian company's tables, or remove database write rights.
5. Set an eight financial year retention floor in every archiving and cleanup job.
6. Run a daily backup of the ledger and log tables to a server physically located in India.
7. Test a restore from the archive and the India backup once a year and file the result.
8. Record the rule 3(6) details before the AOC-4 filing.
9. Obtain the vendor's SOC report covering audit trail controls and a bridge letter to 31 March.
10. Review administrator access and log setting changes each quarter.
11. Pass a board resolution naming the officer in charge under section 128(6).
12. Share the evidence pack with the statutory auditor before fieldwork starts.

Our [accounting and bookkeeping service](/services/accounting-bookkeeping.html) runs this checklist for foreign owned subsidiaries. Our note on the [year end closing checklist for an Indian subsidiary](/insights/year-end-closing-checklist-indian-subsidiary-31-march) places it in the 31 March close. For the format of the accounts, see our note on [Schedule III financial statements](/insights/schedule-iii-financial-statements-format-india).

To have us review your ERP set up, email business@krystal7.com with the system list and the last audit report.

## Key terms

- **Audit trail (edit log)**: A dated record of every change to accounting entries that accounting software must keep under the proviso to rule 3(1) of the Companies (Accounts) Rules, 2014. Nobody may disable it, and the statutory auditor reports on it under rule 11(g) of the Companies (Audit and Auditors) Rules, 2014. (https://krystal7.com/glossary#audit-trail-edit-log)
- **Rule 11(g) reporting**: The statement in a company's audit report, required by rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 under section 143(3)(j) of the Companies Act, 2013, on whether the accounting software had an audit trail that ran all year, was not tampered with and was preserved. (https://krystal7.com/glossary#rule-11-g-reporting)
- **Books of account**: Records a company keeps of money received and spent, sales and purchases of goods and services, assets and liabilities, and prescribed cost items, as defined in section 2(13) of the Companies Act, 2013. Section 128 requires them on accrual basis and double entry, kept for eight financial years. (https://krystal7.com/glossary#books-of-account)
- **Statutory audit**: The annual audit of an Indian company's financial statements by a chartered accountant under sections 139 and 143 of the Companies Act, 2013, with no turnover threshold. The board appoints the first auditor within 30 days of incorporation, and the members then appoint an auditor for a five year term at the first annual general meeting. (https://krystal7.com/glossary#statutory-audit)
- **Daily backup in India (rule 3(5))**: The requirement in the proviso to rule 3(5) of the Companies (Accounts) Rules, 2014 that a company keeping books in electronic mode, even at a place outside India, keeps a backup of them on servers physically located in India, taken every day. (https://krystal7.com/glossary#daily-backup-in-india-rule-3-5)
- **Service Organisation Control (SOC) report**: An independent assurance report on the controls of a service provider, such as a cloud ERP vendor or a group shared service centre. Indian auditors use it under Standard on Auditing 402 to rely on controls they cannot test directly, including audit trail settings. (https://krystal7.com/glossary#service-organisation-control-report)

## Frequently Asked Questions

### Is an audit trail mandatory for a Private Limited company in India?

Yes. The proviso to rule 3(1) of the Companies (Accounts) Rules, 2014 applies to every company that uses accounting software, including every Private Limited company. Since financial years starting on 1 Apr 2023, the software must record an edit log of each change with its date. Nobody may disable it, and the auditor reports on it under rule 11(g).

### Does the audit trail rule apply to small companies and One Person Companies?

Yes. Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 has no exemption for size or type. G.S.R. 880(E) of 1 Dec 2025 raised the small company limits to INR 10 crore capital and INR 100 crore turnover. That status removes CARO 2020 reporting, not the audit trail statement. A subsidiary of a body corporate is never a small company under section 2(85).

### From which financial year does audit trail reporting apply?

The duty under the rule 3(1) proviso started for financial years beginning on or after 1 Apr 2023. Rule 11(g) still names 1 Apr 2022, but the auditor reports on a duty that began a year later. So the first reports with an audit trail statement covered FY 2023-24. For FY 2022-23, the clause had nothing to test.

### What details must the edit log contain?

The rule 3(1) proviso names an audit trail of each transaction, an edit log of each change and the date of each change. Auditors also expect the user ID, the time, the record changed and the old and new values. Without those fields, nobody can show whether a change was authorised, so the rule 11(g) statement may be modified.

### Can a company switch off the audit trail during the year end close?

No. The proviso to rule 3(1) requires software that ensures the audit trail cannot be disabled. A switch off during the close, even for speed, breaks the rule for that period. The auditor reports it under rule 11(g) as a period in which the feature did not operate for all transactions.

### How long must a company keep its audit trail?

Rule 11(g) refers to the statutory retention period. For books of account, section 128(5) of the Companies Act, 2013 sets eight financial years. The log for FY 2023-24 must stay readable until at least 31 Mar 2032. A government investigation under Chapter XIV can extend the period.

### Does the audit trail apply to master data changes?

The rule speaks of each change made in books of account. Master data changes such as tax codes, ledger mappings and vendor bank accounts alter what posts to the books. We log them for that reason, and auditors usually test them under rule 11(g) and section 143(3)(i) internal financial controls.

### Our ERP server is outside India. Is that allowed?

It is allowed if the company meets three conditions. Rule 3(1) of the Companies (Accounts) Rules, 2014 requires the books to stay accessible in India at all times. The proviso to rule 3(5) requires a daily backup on servers physically located in India. Rule 3(6) requires the provider's name, IP address, location and the India controller to be given to the ROC each year.

### Does the daily India backup have to include the audit trail?

The rules do not say so in terms. We read the edit log as part of the electronic books under rule 3. So the daily backup on Indian servers under rule 3(5) should include the log tables. A backup without them would not let anyone in India rebuild the history of the books.

### Who in a foreign owned subsidiary answers for a missing audit trail?

Section 128(6) of the Companies Act, 2013 names the managing director, the whole time director in charge of finance and the CFO. It also names any person the board charges with compliance. Each faces a fine of INR 50,000 to INR 5,00,000. The board also signs the section 134(5) statement on adequate accounting records.

### Does CARO 2020 cover the audit trail?

No. CARO 2020 is an order under section 143(11) of the Companies Act, 2013 and has no audit trail clause. The audit trail statement comes from rule 11(g) of the Companies (Audit and Auditors) Rules, 2014, made under section 143(3)(j). A company exempt from CARO 2020 still gets a rule 11(g) statement.

### Can the auditor rely on the ERP vendor's SOC report?

Yes, under Standard on Auditing 402, if the report covers the audit trail controls and the company's financial year. A SOC 1 or SOC 2 report on general security alone is not enough for rule 11(g). Where the report period ends before 31 March, the auditor needs a bridge letter for the remaining months.

### Does the audit trail rule apply to an LLP?

No. The proviso sits in rule 3 of the Companies (Accounts) Rules, 2014, made under the Companies Act, 2013, and binds companies only. An LLP keeps books under the LLP Act, 2008 and its rules. An LLP registered for GST still has to keep the edit log under rule 56(8) of the CGST Rules, 2017.

### What happens if the audit trail was off for part of the year?

The company cannot recreate the missing log. It should switch logging on, record the gap and its cause, review transactions changed during the gap and give the auditor a board note. The auditor then modifies the rule 11(g) statement, naming the systems and the period, in the report filed with AOC-4.

### Does GST law have its own audit trail rule?

Yes. Rule 56(8) of the CGST Rules, 2017 bars erasing or overwriting entries. For electronic records, it requires a log of every entry edited or deleted. Section 36 of the CGST Act, 2017 keeps records for 72 months from the annual return due date. One system log can meet both laws if it lasts long enough.

## Sources

- Companies (Accounts) Rules, 2014, G.S.R. 239(E) of 31 Mar 2014, with amendments to G.S.R. 624(E) of 5 Aug 2022 (rule 3), High Court of Tripura rules library, https://thc.nic.in/Central%20Governmental%20Rules/Companies%20(Accounts)%20Rules,%202014..pdf
- Companies (Audit and Auditors) Rules, 2014 as first notified, G.S.R. 246(E) of 31 Mar 2014 (rule 11 before the 2021 additions), High Court of Tripura rules library, https://thc.nic.in/Central%20Governmental%20Rules/Companies%20(Audit%20and%20Auditors)%20Rules,%202014..pdf
- Ministry of Corporate Affairs, Notifications: G.S.R. 205(E) and G.S.R. 206(E) of 24 Mar 2021; G.S.R. 247(E) and G.S.R. 248(E) of 1 Apr 2021; G.S.R. 235(E) of 31 Mar 2022; G.S.R. 624(E) of 5 Aug 2022; G.S.R. 880(E) of 1 Dec 2025, https://www.mca.gov.in/content/mca/global/en/acts-rules/ebooks/notifications.html
- Income Tax Department (Companies Act, 2013 text), Section 128, books of account, accessed 23 Oct 2026, https://www.incometaxindia.gov.in/w/section-128-81
- Income Tax Department (Companies Act, 2013 text), Section 143, powers and duties of auditors, accessed 23 Oct 2026, https://www.incometaxindia.gov.in/w/section-143-80
- Income Tax Department (Companies Act, 2013 text), Section 2, definitions including clauses 13, 20, 85 and 87, accessed 23 Oct 2026, https://www.incometaxindia.gov.in/w/section-2-148
- India Code, Companies Act, 2013, https://www.indiacode.nic.in/handle/123456789/2114
- Central Board of Indirect Taxes and Customs, CGST Rules, 2017 as amended up to 30 Aug 2017 (rule 56), https://cbic-gst.gov.in/hindi/pdf/CGST-Rules-as-amended-upto-30082017.pdf
- Central Board of Indirect Taxes and Customs, CGST Act, 2017 as updated to 30 Sep 2020 (section 36), https://cbic-gst.gov.in/pdf/CGST-Act-Updated-30092020.pdf
- Institute of Chartered Accountants of India, Implementation Guide on Reporting on Audit Trail, revised 2024 (paragraphs 14 and 19; cited only for the profession's view on the first reporting year), https://www.eirc-icai.org/uploads/background_materials/Revised%202024_Implementation%20Guide%20on%20Reporting%20of%20Audit%20Trail%20(1)_1712114860.pdf

---
Krystal7 Consultants, business@krystal7.com, +91 94657 30130. HTML version: https://krystal7.com/insights/audit-trail-edit-log-accounting-software-india