The rule in one paragraph
The Companies (Accounts) Amendment Rules, 2021, notified on 24 March 2021, added a proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014. It says that for financial years commencing on or after 1 April 2023, every company that uses accounting software for its books of account must use only software that records an audit trail of each and every transaction, creates an edit log of each change made in the books along with the date of the change, and ensures that the audit trail cannot be disabled. A companion amendment to the Companies (Audit and Auditors) Rules, 2014, notified the same day, added Rule 11(g), under which the auditor reports on it.
Three limbs, then: an audit trail of every transaction, an edit log with the date of every change, and no way to switch it off. Software that logs deletions but not modifications fails the second; software that lets an administrator pause logging fails the third.
“Books of account” has its meaning under section 2(13) of the Companies Act, 2013: records of money received and spent, sales and purchases, assets and liabilities, and certain cost items. So the rule follows the books wherever they are kept. A sub-ledger in a separate billing system that posts into the general ledger is part of the books; a planning spreadsheet that nobody posts from is not.
Who must comply, and since when
Every company incorporated under the Companies Act that maintains its books in accounting software is covered. The ICAI Implementation Guide confirms there is no exemption for small or medium companies, and none for banks and NBFCs incorporated as companies. One Person Companies and section 8 companies are covered too.
The requirement was first due from 1 April 2021 and was deferred twice. It finally applied to financial years commencing on or after 1 April 2023, so FY 2023-24 was the first year of compliance and of Rule 11(g) reporting; FY 2025-26 audits, being signed now, are the third cycle. Limited liability partnerships and proprietorships are outside these Companies Act rules, though the CGST Rules separately require a log of edited or deleted entries in electronic records (Rule 56).
What the edit log must record, and “cannot be disabled”
The rule's text requires the date of each change. ICAI's guide sets out what management should ensure in practice, and it goes further:
- when changes were made, and who made them;
- what data was changed, so the original and the changed value are both available;
- that the audit trail covers every transaction that changes the books, including master data that feeds them, such as supplier or item masters where those records drive accounting entries;
- that the trail is enabled at the database level where direct database changes are possible;
- that the trail is protected from modification, access to it is restricted and logged, and changes to its configuration are authorised and recorded.
“Cannot be disabled” is about the feature, not about intent. If the software has a setting that can turn the log off, the company needs controls showing it was never turned off, and the auditor needs evidence of that for the whole year. A log that keeps only the latest change, or an error log that users can edit, does not meet the requirement.
Retention and back-ups in India
The audit trail is part of the books of account, so it carries their retention period: at least eight financial years under section 128(5) of the Companies Act, 2013. Rule 3(1) requires books kept in electronic form to remain accessible in India at all times, so they can be used for later reference. Since an amendment in August 2022, Rule 3(5) requires the back-up of books kept in electronic mode, including at a place outside India, to be kept on servers physically located in India on a daily basis.
Two practical consequences follow. When you change software, export and preserve the old system's edit log; a lapsed subscription is not a retention policy. And if your software is hosted abroad, check where the daily back-up and the audit trail sit, and whether you can reach them from India at any time. Finally, make sure the export is readable without the old software: a proprietary backup file that only a lapsed licence can open is not much better than no copy at all.
What the auditor reports under Rule 11(g)
Rule 11(g) asks the statutory auditor to state whether the company has used accounting software with an audit trail (edit log) facility; whether it operated throughout the year for all transactions recorded in the software; whether the audit trail feature was tampered with; and whether the audit trail was preserved as per the statutory requirements for record retention.
| Situation | Why it is reported |
|---|---|
| The feature was enabled part-way through the year | It did not operate throughout the year |
| Direct database changes were not logged | Not all changes to the books were captured |
| Part of the books was kept in a spreadsheet that fed the ledger | Those records had no audit trail |
| A service provider's assurance report did not cover the full year | Insufficient evidence for the whole period |
| The previous system's log was not preserved after a migration | Not preserved for the retention period |
ICAI's guide notes that a modified comment under Rule 11(g) also has to be considered in the auditor's reporting on whether proper books of account have been kept. It is not a footnote; it is a statement about the books, and clients, lenders and investors read it as one. A clean Rule 11(g) paragraph is now part of what good books look like.
Where the software is hosted by a service provider, auditors often rely on an independent assurance report on the provider's controls. ICAI's guide expects that report to cover the audit trail requirements and the company's whole financial year. A report that ends in December for a year that ends in March leaves a gap the auditor has to close some other way, so ask your provider early which period its report will cover.
Tally, ERPNext and other software: what to check
Most widely used accounting packages in India now offer an edit log. The question is not which brand you trust but whether, in your installation, the feature meets all three limbs for the whole year. Check, for whatever you run:
- The edit log is on, and the setting cannot be switched off, or every change to the setting is itself logged.
- Modifications and deletions are both logged, with user, date and time, and the old and new values.
- Master data that drives entries is covered.
- Direct database access is restricted, and logged where it exists.
- The log is retained for eight years and can be exported in a readable form.
- Back-ups are taken daily to servers in India.
Two examples. TallyPrime offers an edit log for this purpose; confirm that the release you run has it enabled for the whole year. For ERPNext, the India Compliance app's audit trail setting can be enabled from Accounts Settings and, once enabled, cannot be disabled. Cloud and desktop installations differ in one respect that matters here. With cloud software the provider controls the database, so direct edits are rarer but you depend on its assurance report; with a desktop or self-hosted installation, anyone with database access can bypass the application, so database-level logging and access control carry more weight. If you are moving between them, our Tally to ERPNext migration guide covers preserving the old log.
When an AI agent posts entries
The rule says nothing about AI, and it does not need to: an entry posted by an agent is an entry in the books, and it must appear in the edit log like any other. Three things change in practice.
Attribution
If an agent posts under a person's login, the edit log will say that person made the change. Give each agent its own user in the accounting software, with permissions limited to what it needs, so the log attributes changes correctly. Never let an agent share a chartered accountant's or a director's credentials.
Approval
The edit log records that a change happened, not whether anyone checked it. For consequential entries, such as journals above a limit, entries to closed periods or changes to supplier bank details, hold the agent's change for a named person before it is posted.
Period locks
Agents work quickly and do not get tired at month end, which makes it easy for one to post into a period the accountant thought was closed. Set and record a lock date at every close, and make entries before it a change that always waits for a named person. The edit log will show back-dated entries, but it is better to stop them than to explain them.
The second record
Keep a record outside the accounting software of the agent's proposal, the rules that were checked, the approver and the outcome, linked to the entry number in the books. The edit log remains the statutory record; the second record shows the control around it, which is what an auditor testing the agent will want to see. See a small firm's journal entry, read by its CA, an illustrative specimen.
A checklist for CFOs and CAs
- List every system that holds any part of the books, including spreadsheets that feed entries, and confirm each has an audit trail that meets the rule.
- Obtain evidence that the edit log was on for the whole year: configuration screenshots with dates, change logs for the setting, vendor assurance reports covering the full period.
- Restrict and log direct database access.
- Set and record a lock date at every period close.
- Preserve the edit log of any system you leave, in a readable export, for eight years.
- Confirm daily back-ups to servers in India, and test a restore.
- Give every AI agent and integration its own user; review their permissions quarterly.
- Review deletions and back-dated edits as part of the close, not only at the audit.
How elan1 handles this
elan1 Work runs ERPNext AI agents with approval and audit trail. Every change an agent proposes passes a rule check and, where your rules ask, a named approver before it is posted, and it is committed by a single writer, so the ERPNext edit log keeps recording every change while elan1 records who proposed it, which rules ran and who approved it. The ledger1 pack configures elan1 Govern for MCA requirements. Alongside the ERPNext edit log, each change leaves a proof record: tamper-evident at L1 Guarded, signed from L2 Attested.
For accounting firms, CA seats are free for every client, so the chartered accountant can read and approve what changes. See AI for chartered accountants, and our guide to AI for chartered accountants in India.