Last updated: 08 October 2026 · Written and reviewed by CA Meet Dhrangadhariya, CSM & Co LLP
Quick summary
- Every company that keeps its books in accounting software must use software that records an audit trail of each transaction, keeps an edit log of every change with its date, and cannot have the audit trail switched off.
- The rule applies from the financial year beginning on or after 01/04/2023 (FY 2023-24), after two deferments.
- The statutory auditor must report on it in the audit report under Rule 11(g): whether the feature existed, operated all year for all transactions, was not tampered with, and was preserved as the law requires.
- Books of account are kept for eight financial years under section 128, and the audit trail has to be preserved for the same statutory period.
An audit trail is a time-stamped record that shows who entered or changed a transaction and when. For companies, having it in the accounting software is no longer a best practice but a legal requirement, and the statutory auditor must say in the audit report whether the company complied.
The rule for companies
The proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 says that, for a financial year beginning on or after 01/04/2023, every company which uses accounting software for maintaining its books of account shall use only such software which:
- has a feature of recording an audit trail of each and every transaction,
- creates an edit log of each change made in the books of account along with the date when the change was made, and
- ensures that the audit trail cannot be disabled.
The date was first 01/04/2021 and was deferred twice, finally to 01/04/2023 by the Companies (Accounts) Second Amendment Rules, 2022. For a company with a March year-end, the first year covered was FY 2023-24.
Who is covered
Every company that uses accounting software, which includes private limited companies, OPCs, Section 8 companies, and Government companies. If the books are kept entirely on paper, the rule has nothing to operate on. Accounting software can be on-premise, on the cloud, a SaaS product, hosted in India or abroad, or run by a service provider for the company. Where a separate system (say a billing or payroll tool) generates entries that become part of the books, that system needs the feature too, because its records form part of the books of account.
What the auditor reports: Rule 11(g)
Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014, read with section 143(3), requires the audit report to state in the section on other legal and regulatory requirements whether the company has used accounting software which:
- has a feature of recording audit trail (edit log), and that feature has been operated throughout the year for all transactions recorded in the software, and
- the audit trail has not been tampered with, and
- the audit trail has been preserved by the company as per the statutory requirements for record retention.
The ICAI Implementation Guide expects the auditor to check whether the feature can be configured or switched off, whether it was enabled for the whole year, whether every transaction is covered, and whether the records have been kept for the statutory period. Where the books are entirely manual, the auditor states that as a fact.
How long to keep it
Section 128(5) requires books of account and the related vouchers to be kept for not less than eight financial years immediately preceding the current year (or all years, if the company is younger than eight years). The audit trail is preserved for that period, which means log storage, backup and the ability to produce the data on request.
Penalty
Section 128(6) provides that the managing director, the whole-time director in charge of finance, the Chief Financial Officer or any other person the Board has charged with complying with section 128, is liable to a fine of at least Rs 50,000 and up to Rs 5 lakh if the section is contravened. The imprisonment limb that earlier appeared in that section was omitted by an amendment effective 21/12/2020.
What a company should do
- Ask the software vendor in writing whether the audit trail is on by default, whether any user, including an administrator, can disable it, and how long logs are kept.
- Check the settings once a year and note the date of the check.
- Do not delete, trim or overwrite log data to save space before the retention period ends.
- Keep a single list of every system that feeds the books, with its audit trail status.
- Discuss any gap with the auditor before the year closes, because a gap is reported in the audit report.
Points to check
- This post is based on the text of the Rules as described in ICAI material, and on section 128 as reported by legal databases. Check the current text on the MCA website and in the latest ICAI guidance before you rely on it for a particular case.
- The 2024 ICAI guide deals with detailed audit queries, such as database-level logging; follow it for your own audit file.
Frequently asked questions
Who must use accounting software with an audit trail?
Every company, including a private limited company, OPC and Section 8 company, that maintains its books of account in accounting software. Where books are kept entirely manually, the rule has nothing to apply to and the auditor reports that fact.
From when does it apply?
From the financial year beginning on or after 01/04/2023, which is FY 2023-24. The original 2021 date was deferred twice.
What must the software do?
Record an audit trail of each and every transaction, create an edit log of each change made in the books with the date of the change, and ensure that the audit trail cannot be disabled.
What does the auditor report?
Under Rule 11(g), in the report on other legal and regulatory requirements, whether the company used software with an audit trail feature, whether it operated throughout the year for all transactions, whether it was tampered with, and whether the audit trail was preserved as per statutory requirements.
How long should the audit trail be kept?
The books of account and the vouchers must be kept for at least eight financial years under section 128(5), and the audit trail is to be preserved in line with that statutory period.
Does it apply to a partnership firm or LLP?
The rule is made under the Companies Act, 2013 and applies to companies. A firm or LLP is not covered by it.
What is the penalty?
Section 128(6) provides a fine of Rs 50,000 to Rs 5 lakh on the managing director, whole-time director in charge of finance, the CFO or the person the Board has charged with complying with section 128. The words providing imprisonment were omitted in December 2020.
Official sources
Disclaimer
This article is for general informational purposes only and should not be considered professional advice. Please consult a qualified expert for advice tailored to your specific situation. The author and website owner are not liable for any errors or actions based on this content.
