Background
The foundation of financial transparency and accountability within corporate entities rests upon robust auditing practices. Among the essential components of auditing is the concept of an audit trail. An audit trail serves as a digital footprint, meticulously documenting each financial transaction and alteration made within a company’s accounting records. This trail not only provides a historical record of financial activities but also acts as a safeguard against fraudulent or erroneous manipulations.
- Section 143(3) of the companies Act, 2013 provides various matter on which auditors are required to report in their auditor’s report.
- Clause(j) of Section 143(3) states that auditor’s report shall also state such matters as may be prescribed.
- Such matters have been prescribed under Rule 11 of the Companies (Audit and Auditors) Rules 2014.
- MCA vide its notification No. GSR 206(E) dated 24 March 2021, has issued Companies (Audit and Auditors) Amendment Rules, 2021 introducing new rule 11(g).
- Correspondingly a proviso to Rule 3(1) of Companies (Account) Rules 2014 has been inserted.
The Rules
Rule 11(g) of the Companies (Audit and Auditors) Rules 2014
“Whether the company, in respect of financial years commencing on or after 1st April 2022, has used such accounting software for maintaining its books of account which has a feature of recording audit trail (edit log) facility and the same has been operated throughout the year for all transactions recorded in the software and the audit trail feature has not been tampered with and the audit trail has been preserved by the company as per the statutory requirements for record retention”
Rule 3(1) of the Companies (Account) Rules, 2014
“Provided that for the financial year commencing on or after the 1st day of April 2023, every company which uses accounting software for maintaining its books of account, shall use only such accounting software which has feature of recording audit trail of each and every transaction creating an edit log of each change made in the books of account along with the date when such changes were made and ensuring that the audit trail cannot be disabled.”
Analysis of the Rules
Q.1 Why two amendments?
Ans. Rule 11(g) Companies (Audit and Auditors) Rules 2014 is applicable on the ‘auditors’, Proviso to Rule 3(1) of Companies (Account) Rules, 2014 is applicable on ‘auditee’.
Q.2 From when the requirement of audit trail will be effective?
Ans. Rule 11(g) if applicable from 1 April 2022. However the applicability of Proviso to Rule 3(1) has been deferred two times i.e. It will be effective from 1 April 2023. Now for F.Y. 2022-23, a problem arises that how can auditor comment on audit trail if there is no requirement to maintain it? So, for that year No comment should be made.
Thus, the effective date from which the auditors are actually required to perform audit procedures and comment upon the audit trail is 1 April 2023.
Q.3 Whether such audit trail feature has to be enabled throughout the year? What if there are no transaction in a part of year, say in starting 6 months, in which no audit trail feature is not enabled?
Ans. The audit trail feature has to be enabled throughout the financial year. The absence of the transactions during any par6 of the year will not be considered as a reason for not enabling audit trail feature.
Q.4 Who has the responsibility of maintaining audit trail?
Ans. The management has the responsibility that the company uses an accounting software which has the following features-
- Records an audit trail of each and every transaction, creating edit log of each change made in the books of account along with the date when such changes were made and
- Ensuring the audit trail is not disabled.
Q.5 Is it necessary that the software should be hosted in India?
Ans. The accounting software may be hosted and maintained in India or outside India or may be on-site or on Cloud or subscribed as SaaS. Further, a company may be using a software which is maintained at a service organization.
Q.6 Under which heading the reporting will be done of audit trail?
Ans. ‘Report on Other Legal and Regulatory Requirements’
Q.7 Suppose an entity maintains a separate software for recording daily sales and consolidated entry is done for monthly sales, then whether audit trail feature is required in that separate software for sales?
Ans. As per Sec 2(13) Books of account shall include such software. Thus, the audit trail feature is required to be enabled in such software also as it is covered under ‘accounting software for maintaining books of accounts’.
Q.8 Whether creation of user would also be required to be recorded under audit trail?
Ans. The provision states that ‘each change made in books of account’ is required to be recorded in edit log. Creation of user does not result in change in books of accounts, however journal entry recorded will. Thus former would not be required to be recorded in edit log but latter would be.
Q.9 Whether Audit Trail requirement will be applicable on foreign company?
Ans. The reporting requirement have been prescribed for audit of financial statements prepared under this act. Accordingly, auditor of all class companies including Section 8 companies or small companies would be required to report on Audit Trail. Further, As per the Companies (Registration of Foreign Companies) Rules 2014, the provisions of Chapter X of the Act shall mutatis mutandis apply to a foreign company. Thus these requirements will also be applicable on audit of foreign company. But its should be noted that these requirement will not be applicable on companies incorporated outside India.
Q.10 Whether these requirement will be applicable on the books of accounts maintained manually?
Ans. The provisions are applicable only to the extent a company maintains its records in the electronic mode by using an accounting software. Thus where books of accounts are entirely maintained manually- the assessment and reporting will not be applicable.
Q.11 Whether these requirements are applicable on consolidated financial statements?
Ans. Yes, it is appliable. However, in reporting on consolidated financial statements the auditor should keep in mind that the reporting is not required on those components which are incorporated outside India.
Q.12 Till how much time the records of audit trail for a particular financial year need to be preserved?
Ans. As per Sec 128(5), the books of account has to be preserved for minimum 8 years. Considering the audit trail to be part of books of accounts, the audit trail will also be required to be preserved for 8 years.
Further it should be noted that reporting on whether or not the audit trail has been preserved will be applicable from second year only i.e. 1 April 2024.
Q.13 Whether there is any requirement to report on audit trail feature in Limited review report?
Ans. Presently there is no requirement prescribed as such under the Companies Act 2013 and the rules made thereunder or any SEBI regulations.
Q.14 Suppose an entity has an accounting software which does not allow changes to data after initial entry. Whether audit trail feature will be required in such case as the purpose of audit trail is already being fulfilled by the accounting software itself?
Ans. Irrespective of the fact whether the already posted journal entry could be edited or not, accounting software used by the company is required to have any audit trail feature.
Q.15 If during a part of financial year, audit trail feature becomes non-functional to some technical glitch, then whether the auditor will modify his opinion in such case also?
Ans. The non-functionality due to technical glitch does not give any exemption to the management regarding the audit trail requirement. Thus auditor would be required to modify his comment in case audit trail feature is non-functional for a part of year.
Q.16 As the audit trail feature may require technical assistance whether auditor can engage IT Expert or specialist?
Ans. Yes, auditor can engage such IT expert or specialist. However, the auditor should comply with SA 620 Using work of an Auditor’s expert. Also it should be noted that the ultimate responsibility for reporting on audit trail feature lies with the auditor only.
Q.17 Whether Materiality concept is required to be applied while reporting on audit trail feature?
Ans. Rule 11(g) states that the audit trail is required for each and every transaction, creating edit log of each and every change made in the books. Thus reporting requirement will be applicable to all transactions irrespective of the amount involved. However, the auditor can apply test checks while performing their audit procedures.
Q.18 Suppose after completion of audit, nothing adverse is found by the auditor regarding financial statements, except the audit trail feature was not enabled throughout the year.
Ans. If the audit trail is not maintained the auditor would need to appropriately modify the comment while reporting under Rule 11(g) even if nothing adverse regarding financial statements is found.
Q.19 If software is not able to retain edit log because of software limitation, what will be reporting on audit trail?
Ans. The auditor would be required to modify his comment on audit trail.
Q.20 Is there any requirement for the auditor to report the effective date of implementation of audit trail in the company.
Ans. There is no requirement as such.
Q.21 Whether audit trail requirements are applicable on banks and NBFC?
Ans. There’s is no exemption as such, thus requirements will mutatis mutandis apply.
Q.22 Whether auditors are required to comment on details of audit trail?
Ans. No
Q.23 Is the audit trail required to be enabled at database level even if the access to database in an ERP is restricted to only one user and the log of such user making any such change is enabled?
Ans. Changes made directly at the database level will impact the books of account and hence audit trail is required to be enabled at the database level also.
Q.24 What if the audit trail of company incorporated in India is maintained outside India?
Ans. Audit Trail requirement are applicable even for accounting software maintained outside India if the company is incorporated in India. Further the amended Rule 3 of the Companies (Account) Rules 2014 requires that ” the backup of books of account and other books and papers of the company maintained in electronic mode including at a place outside India, if any shall be kept in servers physically located in India on a daily basis”.
Accordingly, audit trail records would require daily backup to be maintained in a server physically located in India.
Q.25 Whether date wise voucher listing or an error log will be sufficient replacement of the audit trail?
Ans. A voucher listing may not usually provide information on whether a voucher was changed, how many times it was changed and what changes were made. Hence a mere voucher listing will not be considered as an audit trail.
Similarly an error log will not satisfy the requirements of audit trail. Usually, an error log may not record changes to books of accounts and may not capture when the record was created/changed.
Q.26 Whether books of account maintained in accounting software would include following?
Ans.
i) Master Data- Yes, as usually, in accounting software a payment made to a vendor will not have the complete details in the transaction record will be necessary.
ii) Purchase Order or Sales order- Yes if the entry is linked to the issuance of such order.
iii) Records of PPE- It will attract audit trail requirement
iv) Use of Spreadsheets- Yes if accounting entries get auto posted directly to accounting software from such spreadsheet.
Responsibilities of Auditor-
1. Identify the records and transactions that constitute books of accounts u/s 2(3) of the Act.
2. Identify the accounting software.
3. Ensure such software has audit trail feature and whether enabled throughout the year.
4. Ensure audit trail captures following
-
- When changes were made
- Who made such changes
- What data was changed
5. Ensure audit trail feature is retained as per statutory requirements
6. Ensure controls over maintenance and monitoring of audit trail and its feature are designed and operating effectively throughout the period of reporting
7. Ensure compliance of SA-580 Written Representation and SA-230 Audit Documentation.
Visit my profile- www.linkedin.com/in/manishgoyal8522
Author Bio
