A company that keeps its books of account in accounting software must use software that records an audit trail of every transaction, keeps an edit log of every change with its date, and cannot be switched off. The statutory auditor must report on whether that happened, in the audit report under "Report on Other Legal and Regulatory Requirements". Two rules work together: the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 puts the duty on the company, and Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 puts the reporting duty on the auditor.
Last reviewed: 17 October 2026. Facts checked. We read the text of ICAI's Implementation Guide on Reporting on Audit Trail under Rule 11(g) (Revised Edition, January 2024), which reproduces both rules and the notification history. We did not open the MCA notifications themselves, and we did not check for amendments or ICAI updates after January 2024. Confirm the current text before you rely on it.
The two rules in plain words
| Company (Rule 3(1) proviso) | Auditor (Rule 11(g)) | |
|---|---|---|
| Who | Every company that uses accounting software for its books | The statutory auditor |
| What | Use only software that records an audit trail of each transaction, creates an edit log of each change with the date, and cannot have the audit trail disabled | Report whether the company used such software, whether the audit trail was operated throughout the year for all transactions, whether it was tampered with, and whether it was preserved as the record-retention rules require |
| From when | Financial years starting on or after 1 April 2023 | Financial years starting on or after 1 April 2022 |
The dates differ, so ICAI's guide notes that for FY 2022-23 the company had no compliance requirement, and the auditor would likely not be able to report under Rule 11(g).
How the dates arrived
ICAI's guide gives this history:
- 24 March 2021: the Rule 11(g) reporting requirement came in through G.S.R. 206(E), and the company requirement through G.S.R. 205(E).
- 1 April 2021: both were deferred, the reporting requirement by G.S.R. 248(E) and the company requirement by G.S.R. 247(E).
- 31 March 2022: the company requirement was deferred again, to financial years starting on or after 1 April 2023, by G.S.R. 235(E).
What counts as accounting software
ICAI's guide says any software used to maintain books of account is covered. Its example: if sales are recorded in a separate sales system and only monthly totals go into the general ledger software, the sales system also needs the audit trail, because sales invoices are part of the books of account under section 2(13) of the Companies Act.
The guide also covers software wherever it runs: on your premises, in the cloud, as a subscription service, in India or abroad, or at a service provider that processes records for you.
What the audit trail has to capture
The rule asks for an edit log of each change made in the books of account, with the date. ICAI's guide lists what management should ensure, including:
- Each change to each transaction is captured: when it was made, who made it and what data changed.
- The audit trail is always on and cannot be disabled.
- It is enabled at the database level too, where users could change data directly.
- It is protected from modification.
The guide draws a line around what counts. Creating a new user in the software is not a change to the books. Adding or changing a journal entry is.
How long to keep it
ICAI's guide points to section 128(5) of the Companies Act, which requires books of account to be preserved for a minimum of eight years. On that basis, the guide says the audit trail also needs to be kept for at least eight years, counting from when the rule applied (1 April 2023).
Who is covered
- All companies that use accounting software, including section 8 companies, according to ICAI's guide, and foreign companies to whom the audit provisions apply.
- Companies that keep books entirely by hand are outside the audit trail work. The auditor states that as a fact in the report.
- Consolidated financial statements: the parent's auditor reports based on the reports of the component auditors of Indian subsidiaries, associates and joint ventures that are companies under the Act. Components outside India or that are not companies are not required to report.
What auditors check
Per ICAI's guide, auditors verify four things:
- Whether the audit trail feature can be switched off or tampered with.
- Whether it was on throughout the year.
- Whether it covers all transactions recorded in the software.
- Whether the audit trail was preserved as required.
Where a service provider runs the software, the guide says management and the auditor may use an independent report on the provider's controls (for example a SOC 2 or SAE 3402 report), provided it specifically covers the audit trail requirement. IT general controls matter here too. For background, see our ITGC guide.
A short checklist
For management:
- List every system that holds books of account, not only the main ledger.
- Confirm each one records an edit log with date, user and what changed.
- Check that no administrator can switch the audit trail off, or that disabling is blocked and logged.
- Check whether people can change data directly in the database, and whether that is logged.
- Decide where audit trail data is stored and who can touch it.
- Set a retention period of at least eight years and test that old logs can be retrieved.
- If a vendor hosts the system, ask for the independent control report and read what it covers.
Our audit trail compliance checklist puts these into a Word form with space for evidence.
Frequently Asked Questions
What does the audit trail rule require?
Companies that use accounting software must use software that records an audit trail of each transaction, keeps an edit log of each change with its date, and cannot have the audit trail disabled. This applies to financial years starting on or after 1 April 2023.
Does the auditor have to report on it?
Yes. Rule 11(g) requires the statutory auditor to report on it in the audit report under "Report on Other Legal and Regulatory Requirements".
How long must the audit trail be kept?
ICAI's implementation guide reads this through section 128(5) of the Companies Act and says a minimum of eight years.
Does it apply if the books are kept by hand?
The audit trail requirement applies to the extent a company uses accounting software. Where books are entirely manual, the auditor states that as a fact.
Is a cloud or outsourced system covered?
Yes. Software hosted in the cloud, subscribed to as a service or run by a service provider is covered. ICAI's guide says an independent control report from the provider can help, if it covers the audit trail.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error