Audit Trail Rule 2026: The Tally Setting That Can Qualify Your Audit Report and Cost Directors Rs 5 Lakh

In the last week of September, a Bengaluru founder forwarded me one line from his draft audit report: "the feature of audit trail was not enabled at the application level for the accounting software." He thought it was boilerplate. It was not. That single sentence is a reported non-compliance with the audit trail rule under Rule 3(1) of the Companies (Accounts) Rules, 2014, it sits in a public filing, and it can expose the directors and CFO to a penalty of up to Rs 5 lakh under Section 128(6) of the Companies Act, 2013.

FY 2025-26 is the third year this rule has full teeth. The audit reports being signed right now, and filed with AOC-4 by 29 October, carry a mandatory comment from the auditor on whether your edit log was switched on all year. If it was not, the comment is permanent and visible to every lender, investor, and buyer who reads your accounts.

What the audit trail rule actually requires

The audit trail rule lives in a short proviso that the Ministry of Corporate Affairs added to Rule 3(1) of the Companies (Accounts) Rules, 2014. It says that a company using accounting software to maintain its books of account must use software that does three things, every one of them non-negotiable:

1. Records an audit trail of each and every transaction entered in the books.
2. Creates an edit log of every change made to a recorded entry, together with the date on which the change was made.
3. Ensures that the audit trail cannot be switched off or disabled.

The third condition is the one that trips up most companies. Many packages can technically log changes, but the setting is off by default, or an administrator can turn it off. Under the rule, if the log can be disabled, the software does not meet the requirement even on a day when it happens to be on.

The MCA first notified this proviso on 24 March 2021, with effect from 1 April 2021. It then deferred the start date twice, once by the Companies (Accounts) Second Amendment Rules, 2021, and again by a notification dated 31 March 2022, which pushed the start to financial years commencing on or after 1 April 2023. So FY 2023-24 was year one, FY 2024-25 was year two, and FY 2025-26, the year now under audit, is year three.

The companion rule for auditors: Rule 11(g)

Rule 3(1) places the obligation on the company. A second rule places a matching obligation on your auditor. Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 requires the statutory auditor to state in the audit report whether the company has used software with an audit trail feature, whether it operated throughout the year for all transactions, whether it was tampered with, and whether the log has been preserved as required. The auditor cannot skip this comment, and cannot soften it. If the edit log was off for even one month, that fact goes into the report.

The problem: a setting, not a filing

Most compliance failures are a missed form. This one is different, and that is why it catches good companies off guard. There is no return to file and no deadline reminder from the portal. The requirement is a state your software has to be in on every single day of the year. A company can have a diligent CS, a clean AOC-4, and still fail, because someone set up Tally two years ago with the Edit Log option left off.

The people affected are not a niche. Any company that records a sales invoice, a payment voucher, or a journal entry in software is inside the rule. That is nearly every private limited company in the country. The cost of getting it wrong has two parts.

First, the money. Section 128(6) of the Companies Act, 2013 says that if the managing director, whole-time director in charge of finance, chief financial officer, or any other person charged with maintaining the books fails to do so as required, each such person is liable to a penalty that can run up to Rs 5 lakh. Books maintained without a compliant audit trail are, in the regulator's reading, books not maintained as required.

Second, the reputational mark. When the auditor writes under Rule 11(g) that the edit log was not enabled, or could be disabled, that comment becomes part of your filed financial statements. A due-diligence team reading your accounts before a funding round, a bank credit officer, or an acquirer's lawyer all see the same line. For a startup heading into a Series A data room, a reported audit trail failure reads as weak financial hygiene, and it invites questions about whether past numbers could have been edited without a trace.

Who is in, and who is out

The rule is written for companies registered under the Companies Act. The entity type decides whether you are covered, and the size of the company does not buy an exemption.

One point worth clearing up, because it comes up often. The revised small-company threshold (paid-up capital up to Rs 10 crore and turnover up to Rs 100 crore, effective 1 December 2025) gives small companies relief from CARO reporting and from the internal financial controls comment. It gives no relief from the audit trail rule. A two-person startup on a free accounting plan carries the same Rule 3(1) duty as a company with a Rs 500 crore turnover.

What changed, and why FY 2025-26 is the year it bites

Nothing new was notified this year. What changed is enforcement temperature. The ICAI's Auditing and Assurance Standards Board issued its Implementation Guide on Reporting on Audit Trail in March 2023 and revised it in 2024, and it is detailed. It tells auditors to ask for the software's audit trail configuration, to test whether the log ran for the full period, and to check whether it was preserved. Auditors who gave the benefit of the doubt in year one now have a clear standard to apply, and KPMG's September 2025 review of audit trail reporting found that a meaningful share of companies drew a modified or adverse comment in their reports.

The timing matters for a second reason. The audit report for FY 2025-26 is attached to the financial statements filed in Form AOC-4, and for most companies AOC-4 is due by 29 October 2026. The Rule 11(g) comment therefore enters the public record this month. There is no window to fix the year that has closed, but there is a window to stop the same comment repeating next year, and to correct the setup before the auditor finalises the current report.

What you must do now

The fix is practical and most of it can be done in an afternoon. Work through these steps with whoever administers your accounting software.

1. Find the setting and switch it on. In TallyPrime it is the Edit Log feature, available from Release 3.0 onward; in Zoho Books, QuickBooks, and most cloud ledgers it is an audit trail or activity log that is on by default but can be verified in settings. Confirm it is enabled at the company level, not just for one user.
2. Confirm it cannot be disabled. Check that an administrator cannot turn the log off mid-year. If your package allows that, the software fails the third test of Rule 3(1) regardless of whether anyone actually used the switch. Ask the vendor for written confirmation of the behaviour.
3. Cover every book, not just the main ledger. If you keep a payroll register, an inventory module, or a billing tool that feeds the accounts, each of those is part of your books and each needs a trail. A trail on Tally alone does not cover sales booked in a separate invoicing app.
4. Get the vendor's audit trail statement. For hosted software (and for anything run through a service provider), ask for a written confirmation or an independent service auditor's report describing the audit trail controls. Your auditor will ask for it.
5. Preserve the log for 8 years. Section 128(5) requires books to be kept for at least eight financial years, and the audit trail is part of the books. Do not let a software migration or a subscription lapse wipe the history. Export and back up the logs when you switch systems.
6. Brief your auditor early. Give your statutory auditor access to the configuration and a sample of edit logs before the report is drafted. A clean trail, shown early, is the difference between a clean comment and a scramble in the last week of October.
7. Record it at the board. Note in the board meeting that approves the accounts that the company has reviewed and confirmed audit trail compliance. It shows the directors applied their mind, which matters if a penalty question is ever raised.

The deeper implication

According to CS Sapna Malpani, the audit trail rule marks a shift in what compliance means for a private company. For a decade the job was to file the right form on time. This rule asks a harder question, whether the numbers behind the form can be trusted, and it hands the auditor a duty to say so in public. A company that treats its books as a document it can quietly revise has nowhere to hide once the edit log is on and preserved.

The forward view is that this comment will start to carry weight outside the regulator's office. Lenders and investors read audit reports, and a repeated Rule 11(g) failure is an easy red flag to screen for. Over the next two or three filing cycles, a clean audit trail record will quietly become part of how a well-run company is recognised, the same way a clean ROC filing history already is.

How the audit trail rule compares with provisions people confuse it with

Readers often mix up the audit trail rule with two neighbours. It is worth separating them, because the triggers and the consequences are different.

The internal financial controls comment under Section 143(3)(i) is about whether your control framework works; it applies with carve-outs for certain private companies. The audit trail rule has no such carve-out. CARO 2020 reporting under Section 143(11) adds a long list of auditor comments and exempts small companies and most private companies below a threshold, while the audit trail comment under Rule 11(g) applies to every company whose accounts are audited. In short, a company can be outside CARO and outside the internal controls comment and still owe a full audit trail duty. Treat the three as separate checks, not one.

Sources and references

• MCA, Companies (Accounts) Rules, 2014, proviso to Rule 3(1) and the deferral notification dated 31 March 2022 (Companies (Accounts) Second Amendment Rules, 2022): mca.gov.in
• Section 128, Companies Act, 2013 (books of account, preservation and penalty), India Code: indiacode.nic.in
• ICAI, Auditing and Assurance Standards Board, Implementation Guide on Reporting on Audit Trail under Rule 11(g) (Revised 2024): eirc-icai.org
• MMJC, Requirement of accounting software having audit trail w.e.f. 1 April 2023: mmjc.in
• KPMG in India, Trends in audit trail reporting (September 2025): assets.kpmg.com
• Taxmann / Taxguru, Audit Trail Compliance under Rule 3(1) and Rule 11(g): a practitioner's guide: taxguru.in

Frequently asked questions

What is the audit trail rule for companies in India?

The audit trail rule is the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014. It requires every company that keeps its books of account in accounting software to use software that records an audit trail of each transaction, creates an edit log of every change with the date of the change, and cannot have that trail switched off. It applies to financial years commencing on or after 1 April 2023, so FY 2025-26 is the third year it is in force.

Does the audit trail rule apply to small companies and startups?

Yes. There is no size exemption. A private limited company, a one-person company, a small company, and a newly incorporated startup all carry the same duty as a large listed company. The relief that small companies get from CARO 2020 and from the internal financial controls comment does not extend to the audit trail rule, so a two-person startup on a basic accounting plan must still keep its edit log on and preserved.

What is the penalty for not maintaining an audit trail?

Books kept without a compliant audit trail are treated as books not maintained as required under Section 128 of the Companies Act, 2013. Under Section 128(6), the managing director, the whole-time director in charge of finance, the chief financial officer, or any other person responsible can each face a penalty of up to Rs 5 lakh. Beyond the money, the auditor must report the failure under Rule 11(g), which places a qualified or modified comment on your public financial statements.

What must the auditor report about the audit trail under Rule 11(g)?

Under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014, the auditor states whether the company used accounting software with an audit trail feature, whether the feature operated throughout the year for all transactions, whether it was tampered with, and whether the log has been preserved as required. If the log was off for part of the year or could be disabled, the auditor reports that, and the comment stays on the record.

How long must the audit trail be preserved?

The audit trail is part of the books of account, so Section 128(5) of the Companies Act, 2013 applies. Books must be kept for at least eight financial years, which means the audit trail logs must be retained for the same period. A company that migrates to new software should export and back up the historical logs rather than lose them in the switch.

Does the audit trail rule apply to LLPs?

No. An LLP is governed by the Limited Liability Partnership Act, 2008, not by the Companies (Accounts) Rules, 2014, so the Rule 3(1) audit trail requirement does not apply to it. Proprietorships and partnership firms are also outside the rule. The moment a business is a company registered under the Companies Act, however, the duty attaches regardless of its size.

Our edit log was off for part of FY 2025-26. Can we still fix it?

You cannot change the year that has closed, and the auditor will report the gap for FY 2025-26. What you can do is switch the feature on now, confirm it cannot be disabled, preserve the logs, and brief your auditor so that the comment does not repeat next year. Correcting the setup before the current report is finalised, and recording the fix at your board meeting, is the sensible next step.