In a significant move towards transparency and accountability in corporate financial reporting, the Ministry of Corporate Affairs (MCA) introduced crucial amendments through the Companies (Audit and Auditors) Amendment Rules, 2021. One notable change was the insertion of Rule 11(g), which mandates auditors to report on the use of accounting software by company for maintaining its books of account which has a feature of recording audit trail.. This rule aims to ensure that companies maintain the integrity of their financial data and enhance the reliability of their audit processes.

Understanding the requirement

Rule requires companies, for financial years starting on or after April 1, 2023, to

• To use such accounting software for Maintaining its books of account which has a feature of recording audit trail (edit log) facility and ensure same operate throughout the year for all transactions recorded in the software
• Ensure the audit trail feature has not been tampered with and
• the audit trail is preserved by the company as per the statutory requirements for record retention

Auditor are required to review and report on following

• whether the company is using an accounting software which has a feature of recording audit trail,
• whether the audit trail feature is configurable (i.e., if it can be disabled or tampered with)?
• whether the audit trail feature was enabled/operated throughout the year? whether all transactions recorded in the software are covered in the audit trail feature?
• whether the audit trail has been preserved as per statutory requirements for record retention?

Timeline of Applicability

Originally intended for the financial year starting April 1, 2021, the implementation of Rule 11(g) faced deferral twice. The initial deferral was announced through notification G.S.R. 206(E) dated March 24, 2021. Subsequently, in a follow-up notification G.S.R. 248(E) dated April 1, 2021, the applicability was postponed to the financial year beginning on or after April 1, 2022.  This was again deferred and this requirement is finally applicable from April1, 2023 vide Companies (Account) Second Amendment Rules, 2022vide notification G.S.R. 235(E) dated 31st March 2022

Implementing audit trail

The above require companies’ management to implement and auditor to verify same. Following are some aspects which management may consider while implementing audit trail

• Evaluate Existing Accounting Software
  • Conduct a comprehensive assessment of the current accounting software to identify the systems used for input, processing, and output, along with master data relating to maintenance of its books of account, and use only such accounting software which has a feature of recording audit trail of each and every transaction,
  • Map General Ledger (GL) balances with the corresponding system to ensure alignment and completeness in these aspects

• Identification of Manual and Automated Processes
  • Clearly identify manual and automated processes and recording of its information within the accounting system
  • Distinguish between editable and non-editable fields, focusing on those subjects to Rule 11(g) requirements.

• Table and Column Identification
  • Identify the tables and columns within tables which are relevant for books of account  and where edits are allowed and ensure that a log is maintained for all editable fields
  • Consider making critical fields  having various validation check so as  to reduce the likelihood of errors

• Access Controls and Restricted Permissions
  • Restrict access to enable/disable functions to a limited number of authorized personnel.
  • Regularly review access logs to ensure accountability and prevent unauthorized alterations.
  • Ensure log are implemented for all configuration changes and there is clear traceability for them.

• Transaction Log Features
  • Opt for accounting software that, by default, maintains a transaction log for all transactions.
  • Ensure that the system automatically generates logs whenever it goes down and comes back up.

• Independent Audit Reports for Outsourced Processes and softwares
  • For outsourced business processes, obtain independent audit reports related to the audit trail from vendors.In case vendor independent report does not cover same obtain clarification with relevant supporting with respect to same directly .
  • Ensure that the entries posted in the accounting software are supported by complete working forms attached as annexures

• Traceability in Excel-Based Processes
  • For organizations processing information on Excel sheets, establish traceability by maintaining logs for input, processing, and output.
  • Annex all three logs as attachments in the final accounting software

• Capacity Constraints and Data Archiving
  • Address capacity constraints by considering archival and building a data warehouse for records.
  • Evaluate the possibility of reducing the edit function by building various validation check during the long run to minimize data storage requirements

• Dialog with various stakeholders
  • Engage in a dialogue with auditors ,industry peers and regulators to understand the purpose of the law and seek consensus on what constitutes books of account and accounting software.
  • Clearly define areas where audit logs need to be maintained and the level of detail required.
  • Have a dialog with Accounting Software provider to ensure adequate features and adequate implementation and supports.

• Adequate database Relationship management
  • Establish a robust relationship between master data and transactional data to ensure logs are available at both levels
  • Leverage this relationship to reduce the need for extensive edit trails, especially in transaction-heavy scenarios.

• Policy and Training
  • Establish Audit trail policy with clear roles and responsibilities including control for review of log by management and ensuring logs cannot be tampered with.
  • Communicate policy with various stakeholder of company and educate to  ensure it proper implementation and monitoring .

By meticulously addressing these practical aspects, companies can not only comply with Rule 11(g) but also enhance the efficiency and reliability of their accounting processes. It is crucial to view these requirements as opportunities for process optimization and to align with the overarching goals of transparency and accountability in financial reporting. Further these log can enable significant insight on company performance and enable company to optimize on its efficiency.