Audit Trail in Accounting Software: Companies Act Checklist

The audit trail requirement for accounting software under the Companies Act has applied since 1 April 2023, yet many companies still treat it as a software setting rather than a control. Auditors now report on it every year, and qualified comments on audit trail have become common in audit reports of smaller companies. The rule itself is short: if you keep books of account in electronic form, the software must record an audit trail of every transaction, create an edit log of every change with the date, and the audit trail must not be capable of being disabled. This guide explains what the rule requires, what auditors check, how it interacts with backups and retention, the gaps companies commonly have, and a practical checklist.

What the audit trail rule says

The proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014, applicable for financial years beginning on or after 1 April 2023, requires that every company using accounting software for maintaining its books of account shall use only such software which has a feature of:

• recording an audit trail of each and every transaction,
• creating an edit log of each change made in the books of account along with the date when such changes were made, and
• ensuring that the audit trail cannot be disabled.

Separately, Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 requires the statutory auditor to report whether the company has used accounting software with this feature, whether it operated throughout the year for all relevant transactions, whether there was any instance of the audit trail being tampered with, and whether the audit trail has been preserved as per statutory requirements for record retention.

The rule applies to all companies, including private and small companies. LLPs and other entities are not covered by this specific rule, but the same practice is a sound internal control for any business.

What counts as "books of account"

This is broader than many assume. If any software is used to maintain records that form part of the books of account, it is in scope. That can include:

• The core accounting system or ERP.
• Separate billing or invoicing software whose entries feed the books.
• Payroll software where salary entries are posted to accounts.
• Inventory or POS systems that generate sales and stock records used for accounts.
• Fixed asset registers maintained in software.

Spreadsheets used to compute entries that are then posted are a grey area; the safer approach is to ensure the posted entries are in software with an audit trail and the working files are retained.

What a compliant audit trail should capture

Element	Example
What changed	Invoice INV-2026-0418, line 2 rate changed
Old and new values	Rate ₹1,250 changed to ₹1,180
Who made the change	User ID of the person logged in
When	Date and time of the change
Type of action	Create, modify, delete, cancel
Coverage	Transactions and, as good practice, masters that affect transactions (ledgers, tax rates, prices)

The audit trail must be in place for the whole year, for every transaction. A log that was switched on in October, or that covers sales but not journals, does not meet the requirement.

What auditors check in practice

Following ICAI guidance, auditors typically:

1. Identify all software used to maintain books of account, including peripheral systems.
2. Confirm the audit trail feature exists and cannot be disabled by users, including administrators.
3. Check that it was enabled from the first day of the financial year to the last.
4. Test samples of edits and deletions to see that they appear in the log with old and new values.
5. Check whether direct database changes are possible and controlled (for example, by the vendor or IT team), since changes made directly at the database level may bypass the application's log.
6. Confirm that audit trail data is preserved for the statutory retention period.

Where these conditions are not met, the auditor reports the exception. Repeated or significant gaps can also feed into the auditor's assessment of internal financial controls.

Retention and backups

• Retention: under Section 128(5), books of account and relevant vouchers must be preserved for at least eight financial years immediately preceding the current year. Audit trail data should be preserved for the same period.
• Backups in India: Rule 3(5) requires the backup of books of account and other relevant papers maintained in electronic mode, including at a place outside India, to be kept on servers physically located in India on a daily basis.
• Accessibility: books in electronic form must remain accessible in India at all times so that they can be used for subsequent reference.

When you switch software, the old system's data and audit trail must remain retrievable for the retention period. Do not cancel the old licence and lose access.

Common gaps companies have

• Old software versions without an edit log, or with the log optional and switched off.
• Admin users who can disable or purge logs.
• Peripheral systems (billing, payroll, POS) without audit trails, feeding summary entries into a compliant accounting system.
• Direct database edits by IT staff or vendors to "fix" data, without logging.
• Shared user IDs, so the log shows "admin" for everything and individual accountability is lost.
• Logs not retained after a software change or data purge.

Audit trail as a business control, not only compliance

An edit log helps beyond the audit report. Suppose a hypothetical Hyderabad trading company notices that gross margin dropped by 2 percentage points in one quarter. The edit log shows that 140 sales invoices had rates reduced after creation, all by one user ID, mostly for three customers. Without a log, this would look like a pricing problem; with it, management can see who changed what and when, and ask why.

Useful reviews to run monthly:

1. Edits to posted invoices and receipts, by user.
2. Deletions and cancellations, with reasons.
3. Back-dated entries into closed periods.
4. Changes to master data such as bank details of vendors (a known fraud pattern), tax rates and price lists.

Designing processes that reduce edits

A long edit log is not a compliance problem in itself, but it often signals weak processes. Reduce unnecessary edits by:

• Using approval workflows before posting high-value documents.
• Correcting with credit notes, debit notes and reversal entries rather than editing posted documents.
• Locking periods after month-end close.
• Restricting master data changes to designated roles, with approval for sensitive changes such as vendor bank accounts.
• Keeping the chart of accounts disciplined; our guide on designing a chart of accounts covers ownership of ledger creation.

Questions to ask your software vendor

• Does the edit log record old and new values for every field change, or only that a record was changed?
• Are deletions logged with the full content of the deleted record?
• Can any role, including the vendor's support team, disable or purge the log?
• How are changes made by your support team through scripts or database access logged?
• How long is audit trail data retained, and can it be exported for the auditor?
• Where are daily backups stored, and are they in India?

Ask for the answers in writing and keep them in your audit file. Auditors increasingly ask for vendor confirmations, and a written record avoids a scramble at year end.

Audit trail compliance checklist

#	Check	Owner
1	List every software used to maintain books of account, including billing, payroll and inventory	Finance head
2	Confirm each has an edit log that records old and new values, user and timestamp	Finance head with vendor
3	Confirm the log cannot be disabled by any user, including administrators	IT or vendor
4	Confirm it was active from the first day of the financial year	Finance head
5	Remove shared user IDs; one ID per person	IT
6	Control and log any direct database access	IT or vendor
7	Daily backup on servers in India; test restore quarterly	IT or vendor
8	Retention plan for eight years, including after software change	Finance head
9	Monthly review of edits, deletions and back-dated entries	Finance controller
10	Written confirmation from software vendors on audit trail features	Finance head

Frequently Asked Questions

Is audit trail mandatory for private limited companies?

Yes. The requirement applies to every company that uses accounting software to maintain its books of account, from financial years beginning on or after 1 April 2023, regardless of size.

Does the audit trail rule apply to LLPs and partnership firms?

The specific rule is under the Companies (Accounts) Rules and applies to companies. LLPs and firms are not covered by it, but maintaining an edit log is still good practice and may be expected by lenders or investors.

Can we use Excel to maintain books of account?

Spreadsheets generally do not provide a non-disableable edit log of every change, so using them as the primary books makes compliance difficult. Use accounting software with an audit trail for the books.

How long must audit trail data be kept?

Books of account must be preserved for at least eight financial years, and audit trail data should be preserved for the same period so the auditor can confirm preservation.

What happens if the audit trail was disabled for part of the year?

The auditor will report it under Rule 11(g). Correct the setting immediately, document the period affected and compensating controls, and discuss disclosure with your auditor.

How Fininvo Helps

Fininvo's workflow module lists approval workflows, role-based rules and an audit trail, alongside the accounting module. Confirm the specifics with our team against your auditor's checklist, and see pricing.