Books of account compliance under the Companies Act means the company maintains records in proper form, on an accrual basis and double-entry system, giving a true and fair view of its state of affairs, kept at the registered office or another approved location, and accessible for the prescribed retention period. A more recent requirement, applicable to companies using accounting software to maintain their books, is that the software must have a feature recording an audit trail of each transaction, creating an edit log of every change made, and that this feature must be operated throughout the year, not merely available. Auditors need to test that the feature is actually enabled and that the log has not been disabled or tampered with during the year, and the exact rule reference and effective dates should be confirmed against the current Companies Act rules before being cited in a report.
What "proper books of account" means
The Companies Act sets out several conditions for books of account to be treated as properly maintained. These are foundational and rarely contested in a mid-market audit, but worth confirming explicitly rather than assuming.
- Records are kept on accrual basis and according to the double-entry system of accounting.
- Records give a true and fair view of the state of affairs of the company, including that of its branch offices.
- Records explain the transactions effected both at the registered office and at any branch.
- Books are kept at the registered office, or at another place within India as the board decides, with the required filing of that decision where applicable.
- Where books are kept in electronic form, they remain accessible in India, usable for subsequent reference, and are retained in the original format or a format that reproduces the record accurately.
The audit trail requirement
A rule under the Companies Act requires companies using accounting software for maintaining their books of account to use software which has a feature of recording an audit trail of each and every transaction, creating an edit log of each change made in the books of account along with the date when such changes were made, and ensuring that the audit trail cannot be disabled. This requirement, and the dates from which it has applied, have been subject to deferral and clarification over successive years, so the auditor should confirm the current effective position directly against the rule text rather than relying on a remembered date.
Regulatory requirement
The audit trail requirement is set out in rules made under the Companies Act and has carried its own reporting consequence in the auditor's report. Confirm the current rule text, its effective date, and the exact wording of the required reporting statement before relying on anything in this article.
Why this is a testing problem, not a yes/no question
Most mainstream accounting software used by Indian mid-market companies now ships with an audit trail or edit-log feature available. The compliance gap is rarely that the feature does not exist in the software; it is that the feature exists but was not enabled for the full year, was enabled only for some modules, or was technically capable of being switched off by someone with administrator access, which defeats the point of an immutable log.
| Check | Why it matters | How to test |
|---|---|---|
| Feature enabled from the start of the financial year | A log that starts in month nine leaves seven months of transactions with no edit history | Check the software's configuration history or change log for the date the feature was turned on |
| Enabled across all modules used to record transactions | Some packages allow the feature to be enabled per module; a company might enable it for the general ledger but not for inventory or payroll sub-ledgers | Review module-level settings, not just a global toggle |
| Cannot be disabled by a user | A feature that can be switched off by an administrator provides no assurance for periods it was off | Check the vendor's documentation and the user access rights for administrator-level configuration changes during the year |
| Log actually retained and accessible | An audit trail that exists but has been purged or is not retrievable is functionally absent | Request an export of the edit log for a sample of transactions and confirm it is complete and legible |
| Covers deletions as well as edits | A log that records edits but not deletions misses the most sensitive kind of change | Test by tracing a deleted voucher, if any exist, through the log |
Testing steps
- 01Identify every system used to maintain books of accountA company may run its core ledger in one package and payroll or inventory in another. The requirement applies to whichever system is used to maintain the books, so each system in the chain needs to be assessed, not just the primary ERP.
- 02Confirm the audit trail feature is switched on, with evidenceAsk for a screenshot or configuration export showing the feature enabled, and ask when it was enabled. Do not accept a verbal confirmation alone.
- 03Pull a sample edit log and reconcile it to known changesPick a handful of vouchers known to have been amended during the year and confirm each amendment appears in the log with a date and user, not just the fact that a log exists.
- 04Assess whether the feature could be disabledReview user access rights for any user who could switch the feature off, and check whether any such action occurred during the year through the system's own configuration history.
- 05Form a conclusion for the auditor's reportWhere applicable, the auditor's report carries a specific statement on whether the audit trail feature was enabled and operated throughout the year, and whether it has been preserved as required. Draft this statement only after the testing above, and check the current required wording against the rule text in force.
A client switching on the audit trail feature the week before the audit starts, so that a screenshot can be produced, is not compliance for the year. Always ask when the feature was enabled and corroborate the date independently rather than accepting the current configuration state as proof of the full-year position.
How we think about this
Whether a feature is switched on, whether it covers every module, and whether a sampled edit actually appears in the log are all checks a system can verify directly rather than a person inferring them from a conversation with the IT team. Deciding what to do about a gap, such as whether a mid-year activation is a reportable deficiency given the company's facts, is where the auditor's judgement belongs.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- CARO & Companies ActCARO 2020 reporting checklist for statutory auditorsThe topic areas CARO reporting covers, what evidence each one needs, and how the clauses fit together across the audit file.
- CARO & Companies ActSecretarial compliance checklist for a statutory auditorBoard meeting frequency, statutory registers and ROC filing timeliness, read as evidence of compliance culture rather than a secretarial checklist in its own right.
- CARO & Companies ActCARO statutory dues clause: testing approachHow to test timely deposit of statutory dues for CARO reporting, handle disputed dues disclosure, and avoid redoing work already done in the GST and payroll sections.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.