News & Article

Beyontecompliances Company Secretary Practice CORPORATE COMPLIANCE ESOP Compliance for Private Limited Companies: A Complete Guide Employee stock options are one of the most powerful tools a private company has for attracting and retaining talent — but they are a regulated instrument, not an informal promise. Beyonte Compliances • India For a private limited company — especially a startup or growth-stage business competing for talent against larger, cash-rich rivals — an Employee Stock Option Plan (ESOP) can be a decisive advantage. It lets you reward and retain key people by giving them a stake in the company’s future, while conserving cash today. But ESOPs are not a handshake or a line in an offer letter. In India they are governed by the Companies Act, 2013, backed by procedural rules, approval requirements, filings, registers, valuation norms, and a two-stage tax regime. Get the compliance right and your ESOP becomes a clean, defensible part of your cap table that investors respect. Get it wrong and it becomes a liability that surfaces during due diligence, a fundraise, or a tax assessment. This guide walks a private company through the full lifecycle — what an ESOP is, the legal framework, who is eligible, the step-by-step compliance process, valuation, taxation, and the mistakes to avoid. 01 — The BasicsWhat Is an ESOP, in Practice? An ESOP gives an employee the right — not the obligation — to buy a set number of company shares at a fixed price after meeting certain conditions. The journey runs through four stages, and understanding them is essential before you touch the compliance. Grant — the company offers options to an employee through a grant letter setting out the number, exercise price, and vesting schedule. No shares change hands, and no tax arises. Vesting — the options become exercisable over time or on meeting milestones. A minimum one-year gap between grant and vesting is mandatory. Vesting itself is not a taxable event. Exercise — the employee pays the exercise price and receives actual shares. This is the first taxable event. Sale — the employee eventually sells the shares, triggering capital gains — the second taxable event. Until options are exercised, the holder has no shareholder rights — no voting, no dividends. They hold a right, not equity. 02 — Legal FrameworkWhich Law Governs ESOPs in a Private Company? ESOPs in a private (unlisted) company are governed by Section 62(1)(b) of the Companies Act, 2013, read with Rule 12 of the Companies (Share Capital and Debentures) Rules, 2014. Section 62(1)(b) provides the authority to issue shares to employees under a scheme; Rule 12 sets out the conditions and procedure. The Act uses the term “Employee Stock Option Scheme,” or ESOS, though everyone says ESOP. The additional layer of SEBI regulation applies only to listed companies, so a private company deals with the Companies Act framework alone. That framework applies to equity shares, and separate approval is needed if you extend options to employees of a holding, subsidiary, or associate company. 03 — EligibilityWho Can — and Can’t — Receive ESOPs? Rule 12 defines an eligible “employee” as a permanent employee working in India or abroad, or a director, whether whole-time or not. Certain people are specifically excluded — with one notable relaxation for startups. Category Eligible? Position Permanent employee (India or abroad) Yes Default eligible category under Rule 12 Director, whole-time or otherwise Yes Directors are included regardless of whether they are whole-time Independent director No Specifically excluded under Rule 12 Promoter / promoter group No Excluded — except a DPIIT-recognised startup, for its first 10 years Director holding >10% equity No Excluded — same startup exception applies 💡 The startup exception — the exclusion of promoters and 10%-plus directors does not apply to a DPIIT-recognised startup for the first ten years from its incorporation. This lets eligible startups grant options to founders and large-shareholding directors — a meaningful relaxation for early-stage companies. 04 — ProcessThe Step-by-Step Compliance Process Implementing an ESOP is a defined sequence. Missing a step — or a filing deadline — is where private companies most often slip. Draft the ESOP scheme. Prepare a scheme document setting out eligibility, the pool size, vesting schedule, exercise price and period, and treatment on exit, death, or disability — all compliant with Rule 12. Obtain Board approval. The Board approves the scheme and convenes a general meeting of shareholders. Obtain shareholder approval. Members approve the scheme by resolution. A private company not in default of its filings may use an ordinary resolution under the MCA exemption of 5 June 2015; many still pass a special resolution to be safe, since Rule 12 itself references one. File with the Registrar. File Form MGT-14 with the Registrar of Companies within 30 days of the resolution, along with the scheme. Grant options. Issue grant letters to eligible employees recording the terms. Vesting and exercise. Options vest after at least one year and become exercisable; employees exercise by paying the exercise price. Allot shares and file PAS-3. On exercise, allot shares and file Form PAS-3 (return of allotment) within 30 days; update the register of members and cap table. Maintain the register and disclose. Keep the Register of Employee Stock Options in Form SH-6, and disclose the required ESOP details in the Board’s Report each year. 05 — ConditionsKey Conditions to Build Into Your Scheme Beyond the process, Rule 12 imposes conditions that must be reflected in your scheme. A minimum vesting period of one year between grant and vesting. Options that are non-transferable, and cannot be pledged, hypothecated, or mortgaged. Options that can be exercised only by the employee — with defined treatment on death or disability. Freedom for the company to set the exercise price, subject to prevailing accounting standards. No shareholder rights until the options are exercised and shares issued. 06 — Forms & RegistersCompliance Forms and Registers at a Glance Form / Register Purpose Timeline MGT-14 File the shareholders’ resolution and scheme with the ROC Within 30 days of the

FC-GPR Filing After FDI: A Step-by-Step Process for Startups Receiving Foreign Investment Beyonte Compliances  ·  FEMA, RBI & ROC Compliance info@beyontecompliances.com Home/Blog/FEMA & RBI Compliance/FC-GPR Filing FEMA & RBI Compliance FC-GPR Filing After FDIA Step-by-Step Process for Startups Receiving Foreign Investment You’ve closed a round with a foreign investor and the money is in the bank. The clock is now ticking on a filing many founders miss — and missing it can freeze your next round. Here’s exactly how to get FC-GPR right. Filing window: 30 days from allotment Author  Beyonte Compliances Published  11 September 2026 Category  FEMA & RBI Compliance In short Every time an Indian company issues equity shares, CCPS, CCDs, or share warrants to a foreign investor, it must report the issue to the RBI in Form FC-GPR on the FIRMS portal. Two clocks run: allot the shares within 60 days of receiving the money, then file FC-GPR within 30 days of allotment. Register the Entity Master and Business User on FIRMS first, keep the FIRC, KYC, valuation, and board resolution consistent, and if you miss the window, regularise it through the Late Submission Fee before the three-year limit runs out. Raising capital from an overseas investor is a milestone. But under Indian law, receiving foreign direct investment (FDI) triggers a reporting obligation with the Reserve Bank of India (RBI) that has a hard deadline and real consequences if missed. That filing is Form FC-GPR. It is not optional paperwork. Until the FC-GPR is filed and accepted, your allotment of shares to the foreign investor is not fully recognised from a regulatory standpoint — which can complicate future funding rounds, remittances, and other foreign-exchange transactions. Late or defective filings can also expose the company and its officers to penalties under the Foreign Exchange Management Act (FEMA). This guide walks a startup through the entire process — what FC-GPR is, the two deadlines that matter, what to prepare, the step-by-step filing on the RBI’s FIRMS portal, the documents required, what a late filing costs, and the wider set of FEMA filings every foreign-funded startup should know about. Beyonte Compliances supports startups from company incorporation through every foreign-investment filing that follows. 01What Is FC-GPR, and When Is It Required? FC-GPR stands for Foreign Currency – Gross Provisional Return. It is the form an Indian company files with the RBI each time it issues eligible capital instruments to a person resident outside India — in other words, whenever you bring inbound FDI onto your cap table. The filing records the inflow and updates the company’s foreign shareholding in the RBI’s database. It applies to the fresh issue of equity instruments under FDI, namely: Equity shares issued to a non-resident investor. Compulsorily convertible preference shares (CCPS). Compulsorily convertible debentures (CCDs). Share warrants. Some instruments follow separate forms — for example, convertible notes issued by startups and options granted to non-resident employees — which are covered later in this guide. 02What Is the Legal Framework Behind FC-GPR? FC-GPR sits within India’s FEMA framework. The reporting obligation flows from the Foreign Exchange Management Act, 1999, read with the Non-Debt Instruments Rules, 2019 and the Mode of Payment and Reporting of Non-Debt Instruments Regulations, 2019. All filings are made online through the RBI’s FIRMS portal (Foreign Investment Reporting and Management System) under the Single Master Form (SMF). Paper and email submissions are not accepted. 03Which Two Deadlines Matter for FC-GPR? Founders most often trip on timing, because two separate clocks run — and the FC-GPR deadline runs from allotment, not from when the money arrived. Clock Starts From Deadline 1. Allotment Receipt of the inward remittance Allot the shares within 60 days 2. FC-GPR filing Date of allotment — not receipt of funds, not the board resolution File Form FC-GPR within 30 days ⚠ Two clocks: 60 days, then 30 days First, you must allot the shares within 60 days of receiving the inward remittance. Second, you must file Form FC-GPR within 30 days from the date of allotment — not the date the funds hit your account, and not the date of the board resolution. Miss either window and it is a FEMA contravention. In practice, treat Day 15 after allotment as your internal deadline to leave a buffer for AD bank processing. 04What Must Be in Place Before You File? You cannot file FC-GPR cold. A few registrations and documents must be in place first. Entity Master Form (EMF): a one-time registration of your company on FIRMS, capturing CIN, PAN, sector, and existing foreign investment. Do this before your first filing. Business User registration: your compliance officer or company secretary registers as a Business User on FIRMS; the registration is verified by your Authorised Dealer (AD) bank. Digital Signature Certificate (DSC): needed by the authorised signatory to submit the form. Bank documents: the Foreign Inward Remittance Certificate (FIRC) and the KYC report on the non-resident investor, both obtained from the AD/remitting bank. 05What Is the Step-by-Step FC-GPR Process? The filing follows the same eight-stage sequence for every round, from the day the money lands to the RBI’s acknowledgement. Receive the funds. The foreign investor remits the investment through banking channels; your AD bank credits the company. Collect the FIRC and KYC. Obtain the FIRC and the investor KYC report from the AD bank — these are foundational documents for the filing. Obtain a valuation certificate. Have a chartered accountant or merchant banker certify the issue price in line with FEMA pricing guidelines. Allot the shares. Pass a board resolution and allot the instruments within 60 days of receiving the funds; update the register of members. Well-run secretarial services keep the resolution, allotment, and registers aligned. Register on FIRMS. Ensure the Entity Master and Business User registrations are complete on the FIRMS portal. Complete the Single Master Form. Log in, select FC-GPR under the SMF, and enter the investment, issue, and foreign-investment details — matching every figure to your supporting documents. Attach documents and submit. Upload the required attachments, sign with DSC,

MGT-7A vs MGT-7: Which Annual Return Form Applies to Your Company? Beyonte Compliances  ·  Annual Return Filing & ROC Compliance info@beyontecompliances.com Home/Blog/ROC Compliance/MGT-7A vs MGT-7 ROC Compliance MGT-7A vs MGT-7Which Annual Return Form Applies to You? The five-step test that decides your form, what each one actually asks for, and what it costs to get it wrong. Filing window: 60 days from your AGM Author  Beyonte Compliances Published  01 September 2026 Category  ROC Compliance In short MGT-7 is the full annual return every company files under Section 92 unless it qualifies for the simplified MGT-7A, which is reserved for OPCs and small companies under Section 2(85) — paid-up capital up to ₹4 crore and turnover up to ₹40 crore, and never a holding, subsidiary, or Section 8 company. Both forms are due within 60 days of the AGM. Filing the wrong one risks rejection; filing neither costs ₹100 a day with no cap, and three straight years of default disqualifies every director on the board. MGT-7A vs MGT-7 is the annual return filing decision that every Indian company must make correctly — because filing the wrong form triggers rejection by the ROC, filing no form triggers penalties of ₹100 per day with no cap, and not filing for three consecutive years triggers director disqualification under Section 164(2) of the Companies Act, 2013. MGT-7 is the full annual return form required for all companies under Section 92. MGT-7A is the simplified, abridged annual return form available exclusively to One Person Companies (OPCs) and small companies as defined under Section 2(85). The distinction is straightforward in principle but creates confusion in practice — particularly for companies that have recently crossed the small company thresholds, companies that are subsidiaries of larger entities, and companies unsure whether their paid-up capital and turnover figures qualify them for the simplified form. Beyonte Compliances provides end-to-end annual return filing services that ensure your company files the correct form, on time, every year. 01What Is MGT-7 and Which Companies Must File It? MGT-7 is the annual return form prescribed under Section 92(1) of the Companies Act, 2013 read with Rule 11 of the Companies (Management and Administration) Rules, 2014. Every company registered under the Companies Act must file an annual return for each financial year, and MGT-7 is the default — all companies file it unless they qualify for the simplified MGT-7A. All public companies, regardless of size — never eligible for MGT-7A. Private companies above the small company thresholds — paid-up capital over ₹4 crore, turnover over ₹40 crore, or both. Holding and subsidiary companies, regardless of their own paid-up capital and turnover — the small company exemption does not extend to them. Section 8 companies and companies governed by a special Act (banking, insurance, applicable NBFCs). In practice this means a trading company with ₹45 crore turnover, a services company with ₹5 crore paid-up capital, or a startup whose funding round pushed paid-up capital above ₹4 crore all file MGT-7, not MGT-7A. The form itself is comprehensive: registered office and business activities, holding/subsidiary/associate particulars, the full shareholding pattern, share transfers and transmissions, debentures and indebtedness, member and debenture-holder details, promoter/director/KMP information, meeting records, remuneration, penalties and compounding, and directorships held elsewhere. Companies with complex shareholding structures benefit from professional secretarial services for MGT-7 preparation. 02What Is MGT-7A and Which Companies Can File It? MGT-7A is the abridged annual return introduced through the Companies (Management and Administration) Amendment Rules, 2021, effective from FY 2020–21 onward. It is available to exactly two categories of company. One Person Companies. An OPC under Section 2(62) has a single member, a single director or small board, and no AGM requirement — MGT-7A reflects that simplicity directly. Beyonte Compliances assists entrepreneurs from OPC registration through annual compliance. Small companies under Section 2(85). A private company (never public) meeting both thresholds at once — paid-up capital up to ₹4 crore and turnover up to ₹40 crore. Exceed either one and MGT-7A is no longer available. Holding companies, subsidiaries, Section 8 companies, and companies under a special Act are excluded regardless of size. MGT-7A omits the detailed share transfer schedules, the full debenture and securities disclosures, meeting-by-meeting breakdowns, and detailed penalty and compounding information — asking instead for aggregate shareholding, aggregate indebtedness, and simplified director and member data. For a small company with a simple structure, it can be completed in a fraction of the time MGT-7 takes. 📋 Note Small company thresholds are assessed on the immediately preceding financial year’s figures. If turnover was ₹38 crore in FY 2024–25 (qualifying) but crosses ₹40 crore in FY 2025–26, the company still files MGT-7A for FY 2024–25 but must switch to MGT-7 for FY 2025–26. Reassess eligibility every year — status can move in and out. 03How Has the Annual Return Framework Evolved? The filing framework has simplified substantially over two decades, reflecting a deliberate push to cut compliance load for small businesses while holding larger companies to full disclosure. Pre-2014 — Schedule V under the Companies Act, 1956. The annual return followed the Schedule V format, paper-based for most of its history with electronic filing arriving gradually through MCA21 in the late 2000s. There was no simplified form — a two-shareholder private company disclosed the same detail as a listed conglomerate. 2014–2020 — MGT-7 under the Companies Act, 2013. MGT-7 replaced the old format under Section 92 and Rule 11, improving structure and e-filing, but it remained one form for every company size. The small company concept existed under Section 2(85), yet annual return filing didn’t differentiate by it. A two-person startup and a listed conglomerate once filed the identical form. 2021 to present — the dual-form framework. The Companies (Management and Administration) Amendment Rules, 2021 introduced MGT-7A for OPCs and small companies from FY 2020–21, directly serving the ease-of-doing-business agenda. The 2022 amendment then raised the small company thresholds from ₹2 crore / ₹20 crore to ₹4 crore / ₹40 crore, sharply expanding eligibility. An estimated 70–80% of Indian private companies now

Annual ROC Compliance FY 2024-25 Checklist: AOC-4, MGT-7 Beyonte Compliances  ·  +91 9819 000 45 | +91 9819 000 640 | +91 9819 000 511 info@beyontecompliances.com Home/Blog/Corporate Compliance/FY 2024-25 Checklist Corporate Compliance Annual ROC ComplianceFY 2024-25 Checklist AOC-4, MGT-7 and ADT-1 status, the CCFS-2026 amnesty closing 31 August, and the FY 2025-26 dates you’re already working to. Deadline: 31 August 2026 Author  Beyonte Compliances Published  28 August 2026 Category  Corporate Compliance In short Annual ROC compliance for a private limited company means filing the financial statements in AOC-4, the annual return in MGT-7 or MGT-7A, and the auditor appointment in ADT-1, each within a window measured from the annual general meeting. For FY 2024-25 those windows closed last year — what matters now is whether yours were met. If any filing is still outstanding, the Companies Compliance Facilitation Scheme, 2026 lets you clear it for ten per cent of the accumulated additional fees, and it closes on 31 August 2026. Annual ROC compliance for a private limited company means filing the financial statements in AOC-4, the annual return in MGT-7 or MGT-7A, and the auditor appointment in ADT-1, each within a window measured from the annual general meeting. For FY 2024-25 those windows closed last year. What matters now is whether yours were met. If any FY 2024-25 filing is still outstanding, there is a reason to act this week rather than next. The Companies Compliance Facilitation Scheme, 2026 lets defaulting companies clear pending annual filings for ten per cent of the accumulated additional fees, and it closes on 31 August 2026. After that the full charge of ₹100 per day per form resumes, calculated from the original due date rather than from the end of the scheme. 01What Does Annual ROC Compliance Cover? Four filings form the core of the annual cycle, and all of them hang off the date of the annual general meeting rather than the financial year end. AOC-4. The audited financial statements, filed under Section 137 of the Companies Act, 2013 within thirty days of the AGM. MGT-7 or MGT-7A. The annual return under Section 92, filed within sixty days of the AGM. One Person Companies and small companies use the abridged MGT-7A. ADT-1. Intimation of the auditor’s appointment under Section 139, filed within fifteen days of the AGM. DIR-3 KYC. Director KYC, which from 2026 operates on a three-year cycle rather than annually. Around these sit event-based filings, board meetings under Section 173, statutory registers and minutes. A retainership arrangement exists precisely because the annual forms are the visible part of a calendar that runs continuously underneath them. 02What Were the FY 2024-25 Due Dates? Annual ROC compliance for FY 2024-25 ran to the dates below, assuming a 31 March 2025 year end and an AGM held on the last permitted day. MCA then extended them twice. Filing Original due date Relief granted AGM 30 September 2025 None AOC-4 30 October 2025 Extended to 31 January 2026 without additional fees MGT-7 / MGT-7A 29 November 2025 Extended to 31 January 2026 without additional fees ADT-1 15 October 2025 None The extensions came through MCA General Circular No. 06/2025 dated 17 October 2025 and General Circular No. 08/2025, and were granted largely because companies were adapting to revised e-forms on the MCA V3 portal. Read the relief carefully: it waived the additional fees, not the obligation. Any filing made after 31 January 2026 attracts the additional fee computed from the original due date in October or November 2025, not from the end of the extension. 03Is Your FY 2024-25 Filing Still Pending? Then the most valuable thing on this page is the date 31 August 2026, when CCFS-2026 closes. It is the cheapest route back into annual ROC compliance that a defaulting company will get. CCFS-2026 was notified by MCA General Circular No. 01/2026 dated 24 February 2026 under Section 460 read with Section 403 of the Companies Act, 2013. It allows a defaulting company to file pending annual returns and financial statements on payment of only ten per cent of the additional fees otherwise due, which is a ninety per cent reduction in the penalty exposure. It opened on 15 April 2026 and was originally to close on 15 July 2026; General Circular No. 03/2026 dated 8 July 2026 extended it to 31 August 2026. The scheme covers AOC-4 in all its variants, MGT-7 and MGT-7A, and ADT-1, and there is no restriction on which year the pending filing relates to, so FY 2024-25 and every earlier pending year can be cleared in the same window. Inactive companies can also use it to take dormant status in Form MSC-1 at half the normal fee, or to strike off in Form STK-2 at a quarter. No separate application is required; the reduced fee is calculated at the payment stage on MCA V3. LLPs are outside the scheme. ⚠ Important After 31 August 2026 the additional fee of ₹100 per day per form resumes in full, and it is computed from the original due date, not from the close of the scheme. A company with AOC-4 and MGT-7 pending since October and November 2025 is therefore carrying roughly ten months of accrued fees on each form, and there is no upper limit on the charge. If your filings are outstanding, the difference between acting this week and acting next month is measured in tens of thousands of rupees, and continued default carries director disqualification behind it. 04What Changed for DIR-3 KYC in 2026? Director KYC stopped being an annual filing. The Companies (Appointment and Qualification of Directors) Amendment Rules, 2025, notified as G.S.R. 943(E) on 31 December 2025 and in force from 31 March 2026, replaced the yearly intimation with a three-year cycle. Two practical changes follow. The due date moved from 30 September to 30 June of the relevant year, and the cycle runs on three consecutive financial years anchored to the year in which the DIN was allotted or the last year in

Beyontecompliances Company Secretary Practice CORPORATE COMPLIANCE The Audit Trail Requirement for Companies: What Rule 3(1) Demands and What Your Auditor Must Report A requirement with no size exemption, an eight-year retention period, and a remark that goes on the public record. Beyonte Compliances • 18 August 2026 • India The audit trail requirement for companies is one of the few obligations under the Companies Act framework that carries no exemption for size, turnover or class. A two-founder private company in its first year is bound by it on exactly the same terms as a listed group. Any company whose accounts live on a computer is within it, which today means effectively all of them, and it has bound financial years starting on or from 1 April 2023. What makes it worth a founder’s attention is not the rule itself but its enforcement mechanism. Compliance is not assessed by an inspector who may or may not visit. It is assessed by your own statutory auditor, who is separately required to report on it in the audit report, and that report is filed with the Registrar and sits on the public record. A software shortcoming becomes a permanent, publicly visible remark on the company’s accounts. This article sets out what the rule requires, who it reaches, what the auditor must say, and how long the records must survive. 01 — The RuleWhat Is the Audit Trail Requirement for Companies Under Rule 3(1)? The obligation sits in the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014, made under Section 128 of the Companies Act, 2013 and notified by the Ministry of Corporate Affairs. For financial years commencing on or after 1 April 2023, a company that uses accounting software to maintain its books of account may use only software that carries a specific set of capabilities. The audit trail requirement for companies rests on three capabilities, stated together in the rule. The software must record an audit trail of each and every transaction. It must create an edit log of each change made in the books of account, along with the date on which that change was made. And it must ensure that the audit trail cannot be disabled. The third of these is what converts the requirement from a feature into a control: a log that an administrator can switch off provides no assurance about the period during which it was off. A definitional point matters more than it first appears. The rule attaches to software used for books of account, and books of account is itself a defined expression under the Act. Where a company runs several systems, and records falling within that definition are maintained in more than one of them, each such system comes within scope. A billing platform, an inventory system or a payroll application that feeds entries into the ledger is not automatically outside the requirement simply because nobody thinks of it as accounting software. Establishing the full inventory of in-scope systems is the first task in any audit trail services review we carry out. 02 — Who’s CoveredWhich Entities Does the Requirement Apply To? All of them, provided the accounts are kept electronically, and no size threshold applies. The table below sets out the position for the entity types we are most often asked about. Entity Type Covered? Position Private limited company Yes No exemption by size, turnover or capital; applies from the first financial year Small company Yes The small company relaxations elsewhere in the Act do not extend to this requirement One person company Yes Covered on the same terms as any other company Dormant company Yes Dormant status affects filing obligations, not the manner of keeping books Section 8 company Yes Charitable object makes no difference to the requirement Foreign company Yes Covered in respect of books maintained for its Indian operations LLP, firm, proprietorship, trust, society No Governed by other statutes; the Companies (Accounts) Rules do not reach them The exclusion of limited liability partnerships is genuine and often useful, but it should not be read as permanent planning. A business that converts from an LLP into a private limited company acquires the obligation on conversion, and it acquires it for the software it is already using. Where a conversion is contemplated, the audit under the LLP Act position and the post-conversion position are worth considering together rather than sequentially. 03 — Five TestsWhat Must the Software Actually Do to Comply? Five tests decide whether software meets the audit trail requirement for companies, and vendor marketing material will rarely answer all five. They are worth putting to a vendor in writing. Is the logging a built-in feature of the software itself? A log maintained manually, in a separate register or spreadsheet, does not satisfy the rule regardless of how carefully it is kept. Does it capture every change, not merely the creation of entries? The requirement is an edit log of each change made in the books, which means modifications and deletions as well as original entries. Is the date of each change recorded? The rule states this expressly, and a log without reliable dating cannot demonstrate when the books were altered. Can any user, including an administrator, disable the feature? If the answer is yes, the software does not meet the requirement as drafted, whatever its other capabilities. Does the logging extend to changes made directly at the database, bypassing the application? Where the books can be altered by that route, application-level logging alone will not capture it. 📋 Note — Where accounting software is hosted or supported by an external service provider, the company remains responsible for compliance. Management and the auditor may look to an independent assurance report obtained by that provider as evidence about the controls it operates, but the obligation itself does not transfer. This is worth confirming in the contract with any cloud accounting vendor rather than assuming it from a compliance page on their website. 04 — Rule 11(g)What Does Your Auditor