Failed Projects, Contracts and Official Sources
ERP audit trail (edit log) under the Companies Act: what to configure and test
How Rule 3(1) of the Companies (Accounts) Rules applies to ERP since 1 April 2023, what the auditor reports under Rule 11(g), daily back-ups in India and what to test.
Since the financial year beginning 1 April 2023, every company that keeps its books of account in accounting software must use software that records an audit trail of each and every transaction, creates an edit log of each change with the date it was made, and ensures the audit trail cannot be disabled. This is the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014, inserted by an amendment of March 2021 whose start date was deferred until 2023. For an ERP, the requirement covers more than the accounting module: any part of the system that creates or changes entries in the books, such as sales, purchase, inventory valuation and payroll postings, has to be covered. The statutory auditor reports on it every year. This guide explains what to configure and test when you choose or implement an ERP.
This guide belongs to why ERP projects fail and how to avoid it. It is general information; your statutory auditor and company secretary should confirm your approach.
The rules in brief
| Provision | What it requires | Who it applies to |
|---|---|---|
| Rule 3(1) proviso, Companies (Accounts) Rules, 2014 | Accounting software with an audit trail of every transaction, an edit log with dates, and an audit trail that cannot be disabled | Every company using accounting software for its books, from 1 April 2023 |
| Rule 3(5), Companies (Accounts) Rules, 2014 | Back-ups of books of account and other books and papers kept electronically, on servers physically located in India, on a daily basis | Every company keeping books electronically |
| Rule 3(6), Companies (Accounts) Rules, 2014 | Intimation to the Registrar of details of the service provider and, for cloud, the server location, as part of annual filing | Companies keeping books electronically, particularly on a service provider's systems |
| Section 128(5), Companies Act, 2013 | Books of account and relevant papers preserved for at least eight financial years | Every company |
| Rule 11(g), Companies (Audit and Auditors) Rules, 2014 | Auditor reports whether the software had the audit trail feature, whether it operated throughout the year for all relevant transactions, whether it was tampered with, and whether it was preserved as required | Statutory auditors of companies |
Check current wording on the MCA website; the Institute of Chartered Accountants of India has issued an implementation guide on reporting under Rule 11(g), available from ICAI.
The rule applies to companies. LLPs, partnership firms and proprietorships are not covered by Rule 3(1), but a reliable edit log is still good practice for GST and income-tax scrutiny.
Why ERPs are harder than simple accounting software
In a small accounting package, the audit trail is often one setting. In an ERP:
- Many modules post to the books. A change to a sales invoice, a goods receipt, a stock revaluation or a payroll run may create or change journal entries.
- Masters affect transactions. Changing an item's tax rate or a customer's GSTIN changes future entries; changes to masters should be logged too.
- Database-level access exists. Administrators or the vendor may be able to change data directly in the database, bypassing the application's log.
- Integrations write data. Bank feeds, e-commerce connectors and data imports post entries; they must be logged like manual entries.
- Several systems may form the books. If payroll or billing runs in a separate tool and posts summaries to the ERP, auditors may consider whether those tools are also part of the books.
What to configure and test
| Test | What good looks like |
|---|---|
| Edit a posted sales invoice | Log shows old and new values, user, date and time |
| Delete or cancel a voucher | Deletion is logged, or deletion is blocked and only reversal allowed |
| Change a master (item, customer, tax rate) | Change is logged with user and timestamp |
| Try to switch the audit trail off as administrator | Not possible, or the attempt is itself logged and reported |
| Import data in bulk | Each imported entry is logged with the import source |
| Integration posting (bank feed, marketplace) | Entries identified by integration user |
| Database-level changes by the vendor or admin | Prevented, or logged by database auditing, with a process to review them |
| Year-end and period locking | Locked periods cannot be changed without a logged, approved unlock |
| Export of the audit trail | Log can be exported and retained for the statutory period |
| Back-up location | Daily back-up on servers in India confirmed in writing |
Add these to the ERP selection and contract checklist and to user acceptance testing.
Cost of compliance: what to budget (illustrative)
| Item | Illustrative cost |
|---|---|
| Audit trail feature | Usually included in compliant software; some vendors put advanced logging in higher tiers |
| Extra storage for logs | Small for most MSMEs; may push you into a higher storage tier |
| Database auditing for on-premise ERP | Database edition or tool licence, plus IT time |
| Partner days to configure and test logging | 1–3 days, ₹12,000–₹36,000 |
| Auditor's additional procedures | Part of the audit fee; varies |
| Archive of logs after leaving a vendor | Export and storage; see SaaS contract guide |
These are modest next to the cost of a qualified audit report or rework. Put them into your TCO.
When you switch ERP
- Export the full audit trail from the old system before access ends.
- Keep it, with the books, for at least eight financial years.
- Make sure the new system's audit trail is on from the first entry, including opening balances.
- Document the cut-over so the auditor can follow the trail across both systems.
See also hidden ERP costs, which include keeping the old system read-only.
FAQ
Does a cloud ERP meet the "servers in India" back-up requirement automatically?
Not automatically. Ask the vendor where daily back-ups are stored and get it in writing. Hosting in an India region and back-ups in India are separate questions.
Can the vendor's support staff change our data?
They may have technical access. The contract and the vendor's controls should limit and log such access, and your auditor may ask about it.
Are spreadsheets used alongside the ERP covered?
If entries in the books depend on spreadsheets (for example, manual journals prepared offline), the posting into the ERP is logged, but the spreadsheet is not. Keep supporting workings and approvals.
Sources
- Ministry of Corporate Affairs — Companies Act, 2013 and Companies (Accounts) Rules, 2014
- Institute of Chartered Accountants of India — implementation guide on Rule 11(g) reporting
- e-Gazette of India — amendment notifications to the Companies (Accounts) Rules
- India Code — text of the Companies Act, 2013
