Companies using accounting software are required to use software that records an audit trail of every transaction, including a log of each edit and the date it was made, with that feature enabled and the trail not disabled during the year. The common compliance gap is not that software lacks the feature — most mainstream Indian accounting software has it — it is that the feature exists but was never turned on, or was turned off at some point during the year. An auditor's job is to test which of those is actually true, not to assume compliance because the software is a version that supports the feature.
What the requirement is aiming at
The underlying concern is straightforward: a company's accounting records should show not just the final figures but a history of how entries were created and changed, so that a backdated entry, a deleted transaction or a quietly edited figure leaves a trace. Software that overwrites a transaction with no record of the earlier version defeats that purpose regardless of how good the final figures look.
Regulatory requirement
The specific rule under the Companies Act requires books of account maintained in electronic form to have a feature recording an audit trail of each transaction, including edits, retained as per the statutory retention period, and not disabled during the year under audit. Confirm the current text and any applicable transition timelines directly with the rule as issued — this article is not a substitute for reading it.
Why present and enabled are different questions
Most accounting software sold in India today, across the range a mid-market audit client is likely to use, technically supports an edit log of some form. That answers whether the feature exists in the product. It does not answer whether the specific installation the client is actually running has it switched on, whether it has been on for the full year, or whether an administrator with sufficient access could turn it off without anyone else noticing.
| Question | Answer that satisfies it | What it does not tell you |
|---|---|---|
| Does the software support an audit trail feature? | A statement from the vendor, or the product version and edition | Nothing about whether this client's installation has it turned on |
| Is the feature currently switched on? | A setting visible in the software's administration area, checked directly | Nothing about whether it was on for the full year, or only recently enabled |
| Was it enabled continuously through the audit period, with no gap? | A review of the setting's own change history, if the software logs changes to its own configuration | This is the fact the requirement is actually about |
How to actually test it
- 01Identify the exact software and version in use, not just the product nameThe audit trail feature was added to many products at a specific version. The same product name can mean a version that has the feature and one that does not.
- 02Ask to see the setting directly, in the administration area, rather than accepting a verbal confirmationA verbal "yes, it's on" from client staff is a representation, not evidence. Looking at the actual configuration screen is evidence.
- 03Check whether the setting itself has a change historySome software logs changes to its own configuration, including when the audit trail setting was toggled. If it does, this is the single most direct test of continuous enablement through the year.
- 04Spot-check that edits are actually being captured, not just that the setting is onPick a handful of transactions known to have been edited after initial entry, and confirm the edit history for each one actually exists and is complete. A setting that is on but not functioning correctly is as much of a gap as one that is off.
- 05Ask who has the administrative access needed to disable the settingA feature that can be switched off by a user with routine access is a weaker control than one restricted to a small number of administrators, even if it happens to be on at the time you check.
- 06Confirm retention of the audit trail data itselfAn audit trail that exists but is purged or overwritten after a short period does not satisfy a requirement to retain it for the statutory period.
The most common actual finding in this area is not software that lacks the feature. It is software that has the feature, where it was switched off for part of the year, often because an earlier version was in use before an upgrade, or because an administrator disabled it temporarily during a migration or troubleshooting exercise and never switched it back on.
The reporting responsibility if it isn't enabled
Where the audit trail feature is not in use, was disabled for part of the year, or cannot be confirmed to have operated continuously, this is a reportable matter under the relevant auditor's report requirement, not a point to resolve quietly with management and leave undocumented. The auditor's obligation is to state clearly whether the audit trail feature has been enabled and whether it has operated throughout the year, including whether the audit trail has been preserved as required and whether there has been any instance of the audit trail being tampered with.
- State the finding specifically: which software, which period the feature was or was not enabled for, and the basis for that conclusion.
- Distinguish a gap in enablement from a gap in evidence. Being unable to confirm the setting's history is a different finding from confirming it was off.
- Do not accept a client's remedial action taken after the year end as curing a gap that existed during the year under audit. The reporting is about the year in question.
How we think about this
The audit trail requirement is a good example of a rule that software can satisfy on paper while failing in practice, because the compliance question is about an operational fact — was this switched on, continuously, for this company, this year — rather than a product feature. Lekhya's own working papers maintain a change history by default rather than as a setting that can be turned off, on the view that an audit trail a person has to remember to enable is a weaker control than one that is simply how the system works.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Technology, data & AI in auditData analytics in audit: what full-population testing changesThe rare but material exceptions full-population testing surfaces that sampling cannot, and the judgement about what an exception means that no tool replaces.
- Technology, data & AI in auditChoosing an audit automation vendor: a checklistThe questions that separate a vendor worth trusting with client data from one that merely demos well: security, what's computed versus generated, exit terms, pricing, and India-specific fit.
- Technology, data & AI in auditAI in audit: the risks and limitations auditors should knowHallucination on numeric tasks, where client data actually goes when it reaches a model, and why junior staff over-relying on fluent output is the risk firms underrate most.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.