Audit Trail Applicability for Private Companies in 2026
TL;DR
- The edit log duty depends on keeping books in software, not on company size, capital or listing. Section 128(6) sets a fine of ₹50,000 to ₹5 lakh on the managing director, the whole-time finance director, the CFO or the person the Board charged. Logs are kept for at least eight years with daily back-ups on servers in India; LLPs fall outside the Companies Act rule.
Last updated: 22 October 2026
Quick Answer: Yes, the audit trail rule applies to every private company in India that keeps its books of account in accounting software, from 1 April 2023. There is no turnover limit; the only test is whether the company uses accounting software. The statutory auditor reports on compliance under rule 11(g) of the Companies (Audit and Auditors) Rules, 2014.
Many promoters still read audit trail applicability as a question of company size. It is not. Under the proviso to rule 3(1) of the Companies (Accounts) Rules, 2014, every company that maintains books of account in accounting software must comply, whatever its turnover, paid-up capital or listing status.
Which companies must maintain an edit log in their accounting software?
Every company that uses accounting software for its books of account, including one incorporated under an earlier Companies Act, must use only software with the recording feature the rule describes. The proviso to rule 3(1) was inserted by an amendment notified on 24 March 2021 and, after two deferrals, took effect for financial years commencing on or after 1 April 2023. Small companies and one-person companies are covered alongside other private and public companies. A foreign company with a place of business in India keeps books for its Indian business under section 384(3), and the ICAI Implementation Guide on Reporting on Audit Trail applies the reporting to its auditors too.
Is there a turnover limit for audit trail applicability?
No, there is no turnover limit. The proviso to rule 3(1) contains no threshold based on turnover, paid-up capital, net worth or listing status. Internal audit, by contrast, applies only to prescribed classes of company, as explained in internal audit applicability limits for private companies.
A private company below every internal audit threshold still needs an edit log if it uses accounting software. The table below sets out how the rule treats different entities.
| Entity type | Edit log required? | Basis |
|---|---|---|
| Private limited company using accounting software | Yes | Proviso to rule 3(1), Companies (Accounts) Rules, 2014 |
| Small company | Yes | Same proviso; no size exemption |
| One-person company | Yes | Same proviso; no exemption by class |
| Foreign company with a place of business in India | Yes, for its Indian business | Section 384(3) applies section 128; ICAI guidance covers its auditors |
| Section 8 company, including one that runs a school or college | Yes | Same proviso; ICAI guidance confirms its auditors report |
| Company keeping books only on paper | No | Rule is triggered by use of accounting software |
| LLP, partnership firm, sole proprietorship, trust or society | No | Not a company under the Companies Act, 2013 |
What must the accounting software actually do?
Four working requirements apply, and a private limited company should test its software against each of them rather than accept a vendor assurance. Software must record an audit trail of each and every transaction. It must create an edit log of each change made in the books of account, and record the date when each change was made. It must also ensure the audit trail cannot be disabled.
Three practical points follow from the ICAI Implementation Guide:
- Coverage extends beyond the books package. Where sales are recorded in a standalone package and only consolidated entries flow monthly into the main software, the sales package also needs the audit trail feature. Sales invoices form part of the books of account under section 2(13) of the Act.
- Logs must capture who, what and when. User IDs should be assigned to individuals and not shared, so every edit log line names the person behind each change.
- Back-ups must sit in India. Rule 3 requires back-ups of books of account kept in electronic mode to be held in servers physically located in India, on a daily basis.
How long must the audit trail be preserved?
A company must retain the audit trail for a minimum period of eight years, effective from 1 April 2023, the date the Accounts Rules requirement became applicable. Section 128(5) of the Companies Act, 2013 requires the books of account of every company to be kept in good order for not less than eight financial years immediately preceding a financial year. The ICAI Implementation Guide reads the retention duty for audit trails from that section.
Preservation is a separate compliance failure from creation. A company that ran a working edit log through the year but cannot produce the archived log when the auditor asks has not met the rule.
What changes when the books sit in SAP or another ERP?
The ICAI Implementation Guide expects the audit trail to be enabled at the database level, where applicable, so that direct data changes made outside the application screens are logged too. Most ERP packages let an administrator switch logging on or off, so auditors test who holds administrator access and whether every change to the logging configuration was authorised and recorded, a core test in an ITGC audit.
Software hosted on the cloud or run by a service provider, such as an outsourced payroll centre, is covered in the same way. Rule 3(6) of the Companies (Accounts) Rules, 2014 also requires the company to give the Registrar the service provider's name, IP address and location each year when it files its financial statements.
What must the auditor report on the edit log under rule 11(g)?
Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 places a separate reporting duty on the statutory auditor, in the Report on Other Legal and Regulatory Requirements section of the audit report. The auditor states whether the company used accounting software with an audit trail (edit log) facility. Three further assertions follow: whether it operated throughout the year for all transactions recorded in the software, whether the audit trail feature was not tampered with, and whether the trail was preserved as per the statutory requirements for record retention.
The clause text refers to financial years commencing on or after 1 April 2022, but because the company-side rule applied only from 1 April 2023, ICAI guidance treats reporting as starting with financial year 2023-24. For a private company, the practical consequence is that edit log gaps surface in the audit report itself, where lenders and investors read them.
What is the penalty for not maintaining an audit trail?
The audit trail proviso sits in rule 3 of the Companies (Accounts) Rules, 2014, which prescribes the electronic mode for books of account under section 128 of the Companies Act, 2013, so a breach is read as a contravention of that section. Under section 128(6), the managing director, the whole-time director in charge of finance, the Chief Financial Officer or any other person charged by the Board with compliance is punishable with a fine of not less than ₹50,000, which may extend to ₹5 lakh. The Companies (Amendment) Act, 2020 removed the earlier option of imprisonment from 21 December 2020.
A further consequence matters as much to a promoter: the statutory auditor must describe the failure in the audit report, and the Board must explain it under section 134(3)(f); omitting that explanation carries a ₹3 lakh penalty on the company and ₹50,000 on each officer in default under section 134(8).
Does audit trail applicability extend to an LLP?
No. The proviso to rule 3(1) binds companies under the Companies Act, 2013, so it does not reach LLPs, partnership firms, sole proprietorships, trusts or societies. As of 22 October 2026, no matching edit log rule has been found in force under the Limited Liability Partnership Act, 2008.
A GST-registered LLP still has a related duty: where it keeps registers and documents electronically, rule 56(8) of the Central Goods and Services Tax Rules, 2017 requires a log of every entry edited or deleted. Adopting the full company standard, with a trail that cannot be disabled, remains voluntary.
How should a private limited company prepare before the statutory audit?
Preparation is an information systems exercise more than an accounting one. The checks below are information technology general controls, the same points the statutory auditor tests under rule 11(g).
For a manufacturer, a useful sequence is:
- Inventory the software that records transactions feeding the books, including sales, purchase and fixed asset packages, not only the main accounting system.
- Test the edit log on a real correction already made, or in a test company with the same configuration, confirming the log shows the user, the date and time, and the fields changed.
- Lock the configuration so the audit trail feature cannot be disabled, and log any authorised changes to it.
- Check the database layer so direct table changes by administrators are logged, not only entries made through the screens.
- Assign individual user IDs and remove shared logins, so every edit log line names a person.
- Archive the logs on a defined schedule, with back-ups on servers physically located in India.
- Document the controls in a short note the board can hand the statutory auditor before fieldwork begins.
Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, reviews this readiness for manufacturers across Western Tamil Nadu as part of the ERP audit and ITGC work described on its information systems services page. Where access rights are the weak point, its guidance on segregation of duties in SAP access control covers the user-level fixes.
Want your edit log tested before the auditor arrives?
Astral Business Consulting can test whether your ERP and feeder packages log every edit, block switch-off and archive the trail for eight years, before your statutory auditor checks the same points under rule 11(g); share your software set-up with the team.