MCA audit trail rule: what Rule 3(1) and Rule 11(g) require
Since 1 April 2023, every company in India that keeps its books in accounting software must use software that records an audit trail of every transaction and change, with the date, and that cannot be disabled. The auditor must report on it under Rule 11(g).
By the rung1 team · Published · Updated · 8 min read
What the rule says
The proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 requires every company using accounting software to use only software that has a feature of recording an audit trail of each and every transaction, creating an edit log of each change made in the books of account along with the date of the change, and ensuring the audit trail cannot be disabled. It applies from the financial year beginning 1 April 2023.
What your auditor must report: Rule 11(g)
Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 requires the auditor to state whether the company:
- used accounting software with an audit-trail (edit log) feature,
- had that feature operating throughout the year for all relevant transactions,
- did not tamper with the audit trail, and
- preserved the audit trail as required for record retention.
Why AI and custom changes make this harder
A change to a field, a script or a workflow can alter what gets logged. A change that passes every permission check can still weaken the trail, for example by writing through a path that bypasses the edit log. The risk grows when changes are made quickly by agents or by several people.
A practical checklist for companies
- Confirm your ERP’s audit trail is enabled and cannot be switched off by any role.
- Keep a record of who changed configuration, not just transactions.
- Test every customisation on a copy and confirm the edit log still captures changes.
- Retain logs for at least 8 years, in a form your auditor can read.
- Give your CA read access so the Rule 11(g) review isn’t a scramble in April.
How rung1 checks it
The MCA audit-trail check runs on every change, on a copy of your books, before anyone approves it. It is blocking and can never be skipped. Every change also leaves a hash-chained proof record your CA can read.
Questions people ask
The proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 requires companies using accounting software to record an audit trail of every transaction and change, with the date, that cannot be disabled. It applies from 1 April 2023.
The rule is in the Companies Act framework, so it applies to companies. Proprietorships and partnership firms are not covered by it, though keeping an edit log is still good practice.
Books of account, and so the audit trail, must be preserved for at least 8 years under section 128(5) of the Companies Act, 2013.