MCA Audit Trail (Edit Log) Compliance in Tally & ERP: Statutory Auditor Verification

Since financial year 2023-24, every company required to maintain books of account has faced a technical compliance requirement that goes beyond simply keeping accurate records: the accounting software itself must record an audit trail (edit log) of every transaction, and that feature must remain switched on throughout the year, with no facility to disable it. This mandate, under Rule 3(1) of the Companies (Accounts) Rules, 2014, was notified in 2021 but deferred twice before finally taking effect — and it now sits directly in the statutory auditor's reporting scope.

1. What Rule 3(1) Actually Requires

Every company that uses accounting software for maintaining its books of account must use software which:

1. Creates an edit log of each transaction — recording every change made to a transaction, along with the date the change was made, and
2. Ensures the audit trail feature cannot be disabled — the software must not permit any user, including an administrator, to switch off the audit trail once enabled.

This applies to the books of account and any other relevant books/papers maintained in electronic mode, and covers standard accounting software (Tally Prime, Zoho Books, Busy, SAP, and similar ERP systems) provided they support and have this feature correctly configured.

2. Why This Matters — the Compliance Gap Most Companies Don't Realise They Have

The critical, frequently missed nuance is that having audit-trail-capable software is not the same as having audit trail compliance. Two failure modes are extremely common:

• The software supports the feature, but it was not enabled from the start of the financial year. If the audit trail was switched on mid-year (e.g. after the company's accountant became aware of the requirement in month 6 or 7 of the financial year), the company was not compliant for the earlier part of the year, and this gap cannot be retrospectively fixed — the software cannot generate a log for transactions entered before the feature was active.
• Third-party or legacy software genuinely does not support the feature at all, or supports it only in a paid/higher-tier edition that the company was not using. In such cases, the company is technically non-compliant with Rule 3(1) for the period it used non-compliant software, regardless of intent.

3. Statutory Auditor's Reporting Obligation

Statutory auditors of companies (other than certain exempted categories such as banking, insurance, and specific government companies) are required, under the applicable reporting rules governing the auditor's report, to specifically state:

• Whether the company has used accounting software which has a feature of recording an audit trail (edit log),
• Whether that audit trail feature was operated throughout the year for all transactions recorded in the software, and
• Whether the audit trail has been preserved by the company as per the statutory record-retention requirement, and whether the audit trail has not been tampered with.

This means the audit trail question is no longer a background IT-systems issue — it is now an explicit disclosure item in the auditor's report itself, and a "No" or qualified answer here is a visible governance red flag to anyone reading the financial statements (lenders, investors, regulators).

4. Practical Steps to Achieve and Verify Compliance

1. Confirm the accounting software version in use actually supports audit trail. Some older or budget editions of common software (particularly older Tally versions before Tally Prime's audit-trail-enabled releases) do not support this feature at all and require an upgrade.
2. Verify the feature is enabled, not merely available. Availability and activation are different states — check the software's settings/configuration directly, don't assume default activation.
3. Confirm no user (including super-admin accounts) has the ability to disable the audit trail. Some software configurations technically allow disabling by an administrator unless a specific setting is locked — this defeats the entire purpose of the requirement and should be explicitly checked.
4. Preserve the audit trail data per the statutory retention period applicable to books of account (generally eight years under the Companies Act framework) — a company that only retains the current year's live database, without archiving prior years' audit trail data, risks being unable to produce historical audit trail records if required.
5. Raise this specifically with the statutory auditor at the planning stage of the audit, rather than discovering a gap during fieldwork — if a gap exists for part of the year, early identification allows the company and auditor to document the issue clearly rather than it surfacing as an unexpected qualification.

5. What If a Gap Is Found?

If the audit trail was not operational for part of the year, this cannot be cured retroactively for the affected period — the honest and correct approach is for the company to document when the feature was activated, ensure it now runs continuously, and for the auditor to report the factual position (including the gap period) rather than an inaccurate blanket confirmation. Attempting to paper over a genuine gap in the auditor's report is a far more serious governance and professional-liability issue than the underlying gap itself.

Related Advisory Services & Practice Guides

• Access expert statutory assistance for Statutory audit consultation with our senior Chartered Accountants.
• Access expert statutory assistance for Accounting & bookkeeping services with our senior Chartered Accountants.