The Audit Trail Requirement for Companies: What Rule 3(1) Demands and What Your Auditor Must Report

Beyontecompliances Company Secretary Practice CORPORATE COMPLIANCE The Audit Trail Requirement for Companies: What Rule 3(1) Demands and What Your Auditor Must Report A requirement with no size exemption, an eight-year retention period, and a remark that goes on the public record. Beyonte Compliances • 18 August 2026 • India The audit trail requirement for companies is one of the few obligations under the Companies Act framework that carries no exemption for size, turnover or class. A two-founder private company in its first year is bound by it on exactly the same terms as a listed group. Any company whose accounts live on a computer is within it, which today means effectively all of them, and it has bound financial years starting on or from 1 April 2023. What makes it worth a founder’s attention is not the rule itself but its enforcement mechanism. Compliance is not assessed by an inspector who may or may not visit. It is assessed by your own statutory auditor, who is separately required to report on it in the audit report, and that report is filed with the Registrar and sits on the public record. A software shortcoming becomes a permanent, publicly visible remark on the company’s accounts. This article sets out what the rule requires, who it reaches, what the auditor must say, and how long the records must survive. 01 — The RuleWhat Is the Audit Trail Requirement for Companies Under Rule 3(1)? The obligation sits in the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014, made under Section 128 of the Companies Act, 2013 and notified by the Ministry of Corporate Affairs. For financial years commencing on or after 1 April 2023, a company that uses accounting software to maintain its books of account may use only software that carries a specific set of capabilities. The audit trail requirement for companies rests on three capabilities, stated together in the rule. The software must record an audit trail of each and every transaction. It must create an edit log of each change made in the books of account, along with the date on which that change was made. And it must ensure that the audit trail cannot be disabled. The third of these is what converts the requirement from a feature into a control: a log that an administrator can switch off provides no assurance about the period during which it was off. A definitional point matters more than it first appears. The rule attaches to software used for books of account, and books of account is itself a defined expression under the Act. Where a company runs several systems, and records falling within that definition are maintained in more than one of them, each such system comes within scope. A billing platform, an inventory system or a payroll application that feeds entries into the ledger is not automatically outside the requirement simply because nobody thinks of it as accounting software. Establishing the full inventory of in-scope systems is the first task in any audit trail services review we carry out. 02 — Who’s CoveredWhich Entities Does the Requirement Apply To? All of them, provided the accounts are kept electronically, and no size threshold applies. The table below sets out the position for the entity types we are most often asked about. Entity Type Covered? Position Private limited company Yes No exemption by size, turnover or capital; applies from the first financial year Small company Yes The small company relaxations elsewhere in the Act do not extend to this requirement One person company Yes Covered on the same terms as any other company Dormant company Yes Dormant status affects filing obligations, not the manner of keeping books Section 8 company Yes Charitable object makes no difference to the requirement Foreign company Yes Covered in respect of books maintained for its Indian operations LLP, firm, proprietorship, trust, society No Governed by other statutes; the Companies (Accounts) Rules do not reach them The exclusion of limited liability partnerships is genuine and often useful, but it should not be read as permanent planning. A business that converts from an LLP into a private limited company acquires the obligation on conversion, and it acquires it for the software it is already using. Where a conversion is contemplated, the audit under the LLP Act position and the post-conversion position are worth considering together rather than sequentially. 03 — Five TestsWhat Must the Software Actually Do to Comply? Five tests decide whether software meets the audit trail requirement for companies, and vendor marketing material will rarely answer all five. They are worth putting to a vendor in writing. Is the logging a built-in feature of the software itself? A log maintained manually, in a separate register or spreadsheet, does not satisfy the rule regardless of how carefully it is kept. Does it capture every change, not merely the creation of entries? The requirement is an edit log of each change made in the books, which means modifications and deletions as well as original entries. Is the date of each change recorded? The rule states this expressly, and a log without reliable dating cannot demonstrate when the books were altered. Can any user, including an administrator, disable the feature? If the answer is yes, the software does not meet the requirement as drafted, whatever its other capabilities. Does the logging extend to changes made directly at the database, bypassing the application? Where the books can be altered by that route, application-level logging alone will not capture it. 📋 Note — Where accounting software is hosted or supported by an external service provider, the company remains responsible for compliance. Management and the auditor may look to an independent assurance report obtained by that provider as evidence about the controls it operates, but the obligation itself does not transfer. This is worth confirming in the contract with any cloud accounting vendor rather than assuming it from a compliance page on their website. 04 — Rule 11(g)What Does Your Auditor