India’s shift from paper-based bookkeeping to ERP systems, cloud platforms, and integrated accounting software has introduced a new set of legal obligations around financial record integrity. An audit trail is a chronological, tamper-evident record of every transaction and change made within an accounting system. It captures who made a change, what was changed, when the change was made, and what the previous value was. Every modification to a financial record is logged automatically and timestamped, creating a complete, verifiable history that can be examined by management, internal audit, and statutory auditors at any point. Since 1 April 2023, the audit trail requirement is mandatory for every company using accounting software in India, with reporting obligations falling on both companies and their statutory auditors.
Download the Pierag POV: Audit Trail and Financial Integrity (PDF)
The Legal Requirement: Rule 3(1) and Rule 11(g)
Both obligations originate from MCA amendments notified on 24 March 2021, effective from 1 April 2023.
Rule 3(1) of the Companies (Accounts) Rules, 2014 requires every company using accounting software to use software that records an audit trail of every transaction, creates a timestamped edit log of each change, and ensures the audit trail cannot be disabled. [1] This obligation sits with management and applies to all Indian companies regardless of size or sector, including private companies, listed entities, Section 8 non-profits, standalone and consolidated financial statements, and Indian subsidiaries of foreign companies. [2] ERP systems, cloud platforms, web portals, and any other software used for financial record-keeping must all meet the requirement.
Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 places a separate obligation on the statutory auditor to report whether the audit trail feature was operational throughout the year for all transactions, whether it was tampered with, and whether it has been preserved in accordance with statutory retention requirements. [3] From FY2024-25 onwards, all four elements of Rule 11(g) are routinely reported on. A qualified comment creates direct regulatory and investor exposure for the company.
Three Technical Requirements Your Software Must Meet
Compliance requires all three conditions to be met simultaneously. [1]
Complete transaction recording. The software must record an audit trail of every transaction, not just selected categories or modified entries. Partial coverage does not satisfy the requirement.
Timestamped edit logs. Every change to a recorded transaction must generate a log entry capturing the previous value, the new value, and the precise date and time the change was made.
A non-disableable feature. The audit trail cannot be switched off by any user, including system administrators. If the feature can be overridden for any period, the software does not comply. Organisations using ERP systems, cloud platforms, or web portals must verify that their specific software version and configuration meet all three requirements simultaneously.
Retention and Data Localisation
Two additional obligations accompany the core requirement. Under Section 128(5) of the Companies Act 2013, the audit trail must be retained for a minimum of eight years from 1 April 2023. [4] Companies maintaining books electronically must also keep daily backups on servers physically located in India, including where the primary accounting system is cloud-hosted outside India. [4] Organisations using international ERP providers or cloud accounting platforms must confirm that Indian data residency and daily backup requirements are satisfied.
What Finance Teams and Audit Committees Must Do
Finance teams must ensure audit trail functionality is configured for every transaction category, every user role, and every period throughout the year. Any software upgrade or migration must be evaluated for its impact on audit trail continuity. A gap of even one day can create a Rule 11(g) reporting issue.
Audit committees should include audit trail status in their pre-audit readiness review. A qualified Rule 11(g) comment attracts regulatory attention and raises governance questions that boards must be prepared to address. [3]
Pierag’s Business Risk Advisory practice supports organisations in assessing audit trail implementation against legal requirements and preparing documentation for statutory auditor review.
Frequently Asked Questions
Is the audit trail mandatory for all Indian companies?
Yes, from 1 April 2023, for all companies using accounting software regardless of size or sector, including Section 8 non-profits and subsidiaries of foreign companies. [1]
What does the auditor report under Rule 11(g)?
Whether the audit trail was active throughout the year for all transactions, whether it was tampered with, and whether it has been preserved per statutory retention requirements. A failure on any point requires a qualified comment. [3]
Does the requirement apply to cloud-based software?
Yes, including platforms hosted outside India, with the additional obligation to maintain daily backups on India-based servers. [4]
How long must the audit trail be retained?
A minimum of eight years under Section 128(5) of the Companies Act 2013, from 1 April 2023. [4]
References
[1] NASSCOM. (n.d.). MCA submission requesting clarity in audit trail provisions. Retrieved from https://community.nasscom.in/communities/public-policy/mca-submission-requesting-clarity-provisions-requiring-companies-adopt
[2] India Briefing. (2024, December 17). India mandates audit trail compliance for all companies. Retrieved from https://www.india-briefing.com/news/india-mandates-audit-trail-compliance-for-all-companies-explainer-key-obligations-34837.html/
[3] TaxGuru. (2023, April 8). Auditor’s responsibility in respect of audit trail effective from 1 April 2023. Retrieved from https://taxguru.in/company-law/audit-trail-feature-accounting-software-1st-april-2023.html
[4] TaxGuru. (2024, January 30). Audit trail under Companies Act 2013 with effect from 1 April 2023. Retrieved from https://taxguru.in/company-law/audit-trail-companies-act-2013-wef-01-04-2023.html
