Audit trail Rule 11(g) is now in its third reporting year, and it is still one of the most frequently modified paragraphs in Indian audit reports. Every company that keeps its books of account in accounting software must use software that records an edit log of every change and cannot be switched off. The statutory auditor then has to say, in the audit report, whether that actually happened throughout the year and whether the log has been preserved.
For FY 2025-26 audits, the preservation question applies in full, and auditors are looking beyond the accounting application to databases, privileged users and third-party systems. This guide sets out what the law requires, the four points the auditor reports, the most common reasons for modified reporting, and a checklist finance teams can run before the auditor asks.
The two rules that work together
Company's obligation: proviso to Rule 3(1), Companies (Accounts) Rules, 2014
For financial years beginning on or after 1 April 2023, every company that uses accounting software to maintain its books of account must use only software that:
records an audit trail of each and every transaction; creates an edit log of each change made in the books of account, along with the date the change was made; and ensures the audit trail cannot be disabled.
There is no exemption for small companies, section 8 companies, banks or NBFCs. ICAI's Implementation Guide is explicit on this point. Companies that keep their books entirely by hand are outside the requirement, and the auditor states that as a fact.
Auditor's obligation: Rule 11(g), Companies (Audit and Auditors) Rules, 2014
The auditor reports whether the company has used accounting software for maintaining its books of account which has a feature of recording audit trail (edit log) facility, whether it has operated throughout the year for all transactions recorded in the software, whether the audit trail feature has not been tampered with, and whether the audit trail has been preserved by the company as per the statutory requirements for record retention.
What the auditor reports: four questions
| # | Question in Rule 11(g) | What it means in practice |
|---|
| 1 | Does the software have an audit trail (edit log) feature? | Every application holding books of account — ERP, payroll, billing, consolidation tool — needs the feature, not just the main ledger |
| 2 | Did it operate throughout the year for all transactions? | No gaps by date, module, user or entity. A feature switched on in June does not cover April and May |
| 3 | Has the feature been tampered with? | No evidence of it being disabled, edited, or bypassed by direct database changes |
| 4 | Has the audit trail been preserved as required? | Logs for earlier years are retained and retrievable. ICAI treats this as reportable from the second year, i.e. from FY 2024-25 |
ICAI's revised Implementation Guide on Reporting on Audit Trail (February 2024) says the audit trail should show when a change was made (date and time), who made it (user ID), and what was changed (the transaction or field affected).
Preservation: eight years, and backup is not enough
Under section 128(5) of the Companies Act, 2013, books of account must be kept for at least eight financial years. ICAI's guidance applies the same period to the audit trail, counted from the year the requirement started (FY 2023-24). So the edit logs for FY 2023-24, FY 2024-25 and FY 2025-26 must all be available and readable today.
Three points that catch companies out:
A backup is not an audit trail. ICAI's guide says a backup of data cannot substitute for the edit log itself. Daily backup in India. Rule 3(5) of the Companies (Accounts) Rules requires books kept electronically to be backed up daily on servers physically located in India, and ICAI's guide applies this to the audit trail records too. Software changes break the chain. Migrating to a new ERP, upgrading versions, splitting a company file or letting a cloud subscription lapse can leave the old log unreadable. Plan the export and retention before the switch, not after.
Why so many audit reports are modified
KPMG's review of audit trail reporting for the top Nifty companies found that 55 of 93 companies (about 59%) had a modified Rule 11(g) comment for FY 2024-25 — almost unchanged from the year before. The common reasons were:
1. Privileged users — audit trail not enabled for changes made by administrators or database users.
2. Database level — the application logs changes, but direct changes to the underlying database are not logged.
3. Application gaps — certain fields or master data not covered.
4. Third-party service providers — no independent assurance report (such as a SOC 2 or SAE 3402 report) covering audit trail for the full year.
ICAI's guide says changes made directly at the database level affect the books of account, so where applicable the audit trail should be enabled at database level too. Where a service organisation runs the system, the auditor can rely on its assurance report only if the report specifically covers audit trail maintenance in line with the Act, and covers the company's reporting period. A management representation alone is not enough.
Consequential reporting
A modified Rule 11(g) comment rarely stands alone. ICAI's guide says the auditor must also consider its effect on reporting under section 143(3)(b) (whether proper books of account have been kept) and section 143(3)(h) (any qualification or adverse remark relating to the maintenance of accounts). The auditor also evaluates whether the gap points to an internal financial controls issue, though a missing audit trail does not automatically mean a material weakness.
Penalty exposure for the company
If books of account are not kept as required, section 128(6) makes the managing director, the whole-time director in charge of finance, the CFO or any other person the Board has made responsible liable to a fine of not less than ₹50,000, extending to ₹5 lakh.
A note for Tally users
Tally is the most widely used accounting software among Indian private companies, so a few points are worth stating:
| Software | Edit log | Meets the audit trail requirement? |
|---|
| TallyPrime Edit Log (release 2.1 onwards) | Always on — cannot be disabled | Yes, according to Tally Solutions |
| TallyPrime (standard, release 2.1 onwards) | Available, but can be enabled or disabled by the user | Tally states only the Edit Log edition meets audit trail compliance |
| Tally.ERP 9 | Edit log was introduced in TallyPrime 2.1; not available in Tally.ERP 9 | No |
The Edit Log in TallyPrime tracks the creation, alteration and deletion of vouchers and masters such as ledgers, stock items and groups. If a client moved from Tally.ERP 9 or standard TallyPrime to the Edit Log edition partway through FY 2025-26, the period before the switch is a gap that should be reflected in the Rule 11(g) comment.
What auditors should keep in the file
A list of all accounting software and the period each was used. Evidence the edit log was enabled for the full year: configuration screenshots, system logs of any enable/disable events, and vendor confirmations. Results of sample testing — edited and deleted entries traced through the log. Service organisation reports and the auditor's assessment of their coverage. Evidence that prior-year logs are preserved and retrievable. The working on consequential reporting under section 143(3)(b) and (h).
For related audit-season reading, see our guide to Form 3CD clause 22 on MSME payments and the update on the ICAI tax audit limit and UDIN. Upcoming dates are on our compliance calendar.
