Your statutory auditor sends a short email in May: "Please share the edit log for FY 2025-26 and confirm the audit trail was never switched off." If your company keeps its books in accounting software, that request comes straight from the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014. Every company using software for its books must use software that records an audit trail of each transaction, keeps an edit log of every change with the date, and does not allow the trail to be disabled.
The rule has applied since 1 April 2023, so FY 2025-26 is the third year auditors are reporting on it. The problems we see in client files now are quieter: a second billing tool with no log, a database fix done by the vendor, an invoice edited after GSTR-1 was filed. This guide covers what the rule requires, what your auditor will check, and how to keep a clean trail without extra work at year end.
What does Rule 3(1) actually say about audit trail?
The proviso was inserted by the Companies (Accounts) Amendment Rules, 2021 (G.S.R. 205(E), dated 24 March 2021). Its start date was pushed back twice, first to 1 April 2022 and then to 1 April 2023. In substance it says that for the financial year commencing on or after 1 April 2023, every company that uses accounting software for its books of account shall use only software that:
records an audit trail of each and every transaction,
creates an edit log of each change made in the books of account, with the date the change was made, and
ensures the audit trail cannot be disabled.
Two words do most of the work. "Books of account" limits the duty to accounting records, not every software setting. "Disabled" means a log an administrator can switch off for a week does not meet the rule.
Which companies does the audit trail rule apply to?
Every company that keeps its books in software. There is no carve-out for small companies, one person companies, Section 8 companies or private limited companies with a single director. Foreign companies are covered too.
LLPs, partnership firms and proprietors fall outside Rule 3(1), because it sits under the Companies Act. They are not free of edit-log duties, though. Rule 56(8) of the CGST Rules says that where registers and documents are kept electronically, "a log of every entry edited or deleted shall be maintained." So a GST-registered partnership running billing software has a similar expectation, just under a different law.
If a company's books are kept entirely by hand, the rule does not bite. The auditor simply reports that fact.
What should an audit trail record?
The rule text itself mentions the change and its date. The ICAI Implementation Guide on reporting under Rule 11(g) (revised 2024 edition) sets out what auditors expect to see in practice:
What changed: creation, modification or deletion, and which transaction it touched.
When: a date and time stamp for each change.
Who: the user ID that made the change.
A log that also stores the old and new value of each edited field is far easier to audit, because nobody has to reconstruct what an entry looked like before. The guide also expects the trail to cover changes made directly at database level, where applicable.
Master data is a grey area that is getting less grey. Creating a user login is a change to the software, not to the books. Changing a customer's GSTIN or a supplier's bank details, on the other hand, affects how transactions are recorded, and the ICAI guidance treats such master changes as within scope. Keep those logged.
What does the auditor report under Rule 11(g)?
Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 asks the statutory auditor to state, in the "Report on Other Legal and Regulatory Requirements" section, whether the company:
used accounting software with an audit trail (edit log) feature,
had it operating throughout the year for all transactions recorded in the software,
did not tamper with the feature, and
preserved the trail as per the statutory requirements for record retention.
The last point only has teeth from the second year onwards, when there is a previous year's trail to preserve. For FY 2025-26, your auditor will want to see that the FY 2023-24 and FY 2024-25 logs still exist and can be opened. If any one of these four points fails, the auditor has to modify that paragraph of the report, and that is visible to anyone reading your filed financials.
A worked example: one edited invoice and what the log shows
Say you run a private limited company that distributes electrical fittings from Ahmedabad. On 27 March 2026 you raise invoice SI/25-26/1184 to a contractor in Pune for goods taxed at 18%:
Taxable value: ₹2,40,000
IGST at 18%: ₹43,200
Invoice total: ₹2,83,200
March GSTR-1 is filed on 10 April with this invoice. On 18 April the customer insists on a 15% discount for a late delivery. An accounts executive opens the original invoice and cuts the taxable value to ₹2,04,000. The software recalculates IGST at ₹36,720 (18% of ₹2,04,000), so the total becomes ₹2,40,720.
Here is what a proper edit log captures:
Date and time | User | Action | Field | Old value | New value |
|---|---|---|---|---|---|
27-03-2026 16:42 | sales.priya | Created | Invoice SI/25-26/1184 | - | ₹2,83,200 |
18-04-2026 11:05 | accounts.ravi | Modified | Taxable value | ₹2,40,000 | ₹2,04,000 |
18-04-2026 11:05 | accounts.ravi | Modified | IGST | ₹43,200 | ₹36,720 |
The edit reduced FY 2025-26 sales by ₹36,000 and output tax by ₹6,480, a total of ₹42,480, three weeks after the year closed. Your books now show ₹36,000 less taxable turnover than the GSTR-1 you filed. When the auditor or a GST officer compares the two, the log explains the gap, and it also shows the correction was done the wrong way.
The cleaner route is to leave the original invoice alone and issue a credit note under Section 34 of the CGST Act, dated when the discount was agreed. Whether that discount can reduce taxable value for GST depends on the conditions in Section 15(3), so check those before you pass it. The audit trail did its job here. It did not stop the mistake; it made it visible.
What gaps do auditors find most often?
After two reporting seasons, the same patterns keep showing up in audit files:
Gap | Why it matters | What to do |
|---|---|---|
A separate billing, POS or payroll tool without a log feeds summary entries into the main ledger | Sales invoices are books of account, so the feeder software is in scope too | List every system that creates entries and confirm each one logs edits |
Excel sheets auto-posting into the ledger | The ICAI guide treats a spreadsheet that feeds entries directly as accounting software | Post from the spreadsheet as a journal you enter, or move the working into the software |
Vendor or IT team corrects data directly in the database | Changes outside the application may not reach the log | Ask the vendor in writing how database changes are logged |
Software migrated mid-year | The trail must cover the full year across both systems | Archive the old system's log before the licence lapses |
Cloud software with no service organisation report | The auditor may be unable to comment on tampering | Request the vendor's SOC 2 or similar report, or a written confirmation of how the log is protected |
How long must you keep the audit trail, and where?
The audit trail forms part of the books of account, so Section 128(5) of the Companies Act applies: books must be kept for at least eight financial years immediately preceding the current one. The trail clock started on 1 April 2023, which means the FY 2023-24 log has to survive until at least the end of FY 2031-32.
Two related rules also apply to electronic books. Rule 3(5) of the Companies (Accounts) Rules requires a daily backup of electronically kept books on servers physically located in India, even when the main server is abroad. Rule 3(6) requires the company to intimate the Registrar every year, with its financial statements, of the service provider's details when books are kept on a third party's server. If your software is cloud-hosted, ask the vendor where backups sit and keep their answer on file.
Under Section 128(6), the managing director, the whole-time director in charge of finance, the CFO or any other person the board has charged with compliance can be fined between ₹50,000 and ₹5,00,000 for contravening the section. A missing audit trail is a books-of-account failure, so it sits within that exposure.
A year-end audit trail checklist
Run this in March, not in May when the auditor asks:
Map your systems. Write down every tool that creates or changes an accounting entry: billing, POS, payroll, e-commerce settlements, the main ledger.
Confirm the log was on all year. Export a sample of edits from April, a middle month and March for each system.
Check who can change settings. Admin rights should sit with one or two people, and nobody should be able to turn the log off.
Review edits to closed periods. Filter the log for changes made after GST returns were filed or after the year closed. Each should have a reason.
Lock the year. Once the books are final, freeze the period so later changes need a deliberate reopening.
Preserve old logs. Confirm the FY 2023-24 and FY 2024-25 trails can still be opened, including for any software you have stopped using.
Collect vendor paperwork. Backup location in India, service organisation report, and how database-level changes are handled.
Where hisabkitab fits in
hisabkitab keeps an audit trail on entries in the books, supports multiple users with roles so you control who can edit what, and lets you freeze a period once it is closed. The edit log fills itself as people work, and a frozen period stops a "quick fix" to last year's invoice. If billing, POS and branch transfers run in the same software, you also avoid the feeder-system gap in the table above.
For CA firms, the CA module gives one login across all client companies, with roles, audit trail and freeze per client, which makes the Rule 11(g) walkthrough faster when you audit or review several companies each season. If you are moving from desktop software mid-year, the Tally Connector syncs Tally data to the cloud; keep the old system's log archived for the months before the switch. You can see the full feature list on the accounting software features page. Confirm the settings with your auditor before relying on them.
The ICAI's Implementation Guide on Reporting on Audit Trail is the best single reference if you want the auditor's view in detail.
Frequently asked questions
Is audit trail mandatory for private limited companies?
Yes. The Rule 3(1) proviso applies to every company that keeps its books in accounting software, including private limited companies, OPCs, small companies and Section 8 companies.
Does the audit trail rule apply to LLPs?
No, Rule 3(1) is a Companies Act rule. LLPs and firms that are GST-registered still have to keep a log of edited or deleted entries under Rule 56(8) of the CGST Rules when records are electronic.
Is Excel enough for audit trail compliance?
No. Plain Excel has no tamper-proof edit log, and a spreadsheet that posts entries directly into your ledger is treated as accounting software by the ICAI guide.
How long should the audit trail be kept?
At least eight financial years under Section 128(5), counted from FY 2023-24 when the rule started. Logs from software you no longer use must also be preserved.
What happens if the audit trail was disabled for part of the year?
The auditor has to qualify or modify the Rule 11(g) statement in the audit report, and the responsible officers face the Section 128(6) penalty exposure. Fix the setting immediately and document the period affected.
Want an audit trail that builds itself while your team works? Start a free trial or compare plans.
