Audit trail: what it means, and what India's MCA edit-log rule asks of you

When a number changes, someone will eventually ask why. An audit trail answers that question without anyone having to remember.

What the MCA rule says

Since 1 April 2023, every company in India that keeps its books in accounting software must use software that:

• records an audit trail (an edit log) of every transaction,
• records each change with the date it was made,
• does not allow the audit trail to be switched off.

Auditors must now report whether the company did this. The audit trail must be kept for as long as the books themselves, which in India is eight years.

Source: Companies (Accounts) Rules, 2014, Rule 3(1) as amended by the Ministry of Corporate Affairs; Companies (Audit and Auditors) Rules, 2014, Rule 11(g).

What a good log entry contains

Check your own log

Beyond accounting

The MCA rule covers books of account. But the same idea helps everywhere a number matters: price lists, credit limits, customer records, approvals. If you can show who changed it and why, audits get shorter and disputes get settled with facts.

Audit trail vs log vs backup

What auditors look for

• That the audit trail feature was on for the whole year, not just at year end.
• That it could not be disabled, and that nobody tampered with it.
• That it covered every system holding books of account, not only the main one.
• That it was kept for the full retention period.

The Institute of Chartered Accountants of India (ICAI) has published guidance for auditors on this rule. It is worth reading with your finance team.

The daily backup rule

A related rule says that companies keeping books electronically must back them up daily on servers physically located in India. If your accounting system runs in the cloud, check where the backups sit.

Source: Companies (Accounts) Rules, 2014, Rule 3(5), as amended in 2022.

Common gaps

• Shared logins. If five people use one account, "who" means nothing.
• Admins can delete logs. A trail that can be edited is not proof.
• Changes made straight in the database, bypassing the application and its log.
• Side systems. Spreadsheets and small tools that feed the books but keep no trail.
• Logs nobody can search. The data exists, but nobody can find one change in time.

How to set up a good audit trail

1. List every system that holds or feeds books of account.
2. Check each one records who, what, when, and before and after.
3. Remove shared logins.
4. Make sure the trail cannot be switched off or edited, even by admins.
5. Store it for the full retention period, with backups in India.
6. Test it: pick a past change and try to explain it from the log alone.

Where else an audit trail pays off

Price lists, credit limits, supplier bank details, discounts and approvals. Fraud often starts with a quiet change to one of these. A complete trail makes such changes visible, and settles disputes with facts instead of memory.

A worked example: one changed credit limit

A customer defaults on a large order. Finance asks how they were allowed so much credit. With a complete audit trail, the answer takes minutes:

1. The log shows the credit limit was raised on 14 October, from ₹20 lakh to ₹35 lakh.
2. It shows who made the change, from which account.
3. It shows the approval: the CFO signed off, under the credit policy rule.
4. It shows the policy version that was live that day.

Without the trail, the same question becomes a week of emails, and the answer is a guess. (The figures above are an example.)

What to switch on in your systems

• Change logs on master data, especially customers, suppliers and bank details.
• Change logs on prices, discounts and credit limits.
• Approval records for anything above a set amount.
• User access logs, so you know who could have made a change.

Most modern ERP systems can log these. They are often switched off to save space. Check yours.

Key terms

• Edit log: the term the MCA rule uses for the audit trail in accounting software.
• Immutable: cannot be changed after it is written.
• Retention period: how long records must be kept.
• Segregation of duties: making sure the person who makes a change is not the one who approves it.

Where Samvrik fits

In Samvrik every action is logged by default: who, what, when, before and after, and under which rule. Assembler adds the approvals, so the "why" is always recorded. The log stays inside your own environment. See how Assembler works.

Common questions