The audit trail rule and your fixed asset register

What the rule says

The requirement comes from the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014, inserted by the Companies (Accounts) Amendment Rules, 2021. After two deferrals, it applies from 1 April 2023. In substance, every company that uses accounting software for maintaining its books of account must use only such software as has a feature of:

• recording an audit trail of each and every transaction,
• creating an edit log of each change made in the books of account, along with the date when such changes were made, and
• ensuring that the audit trail cannot be disabled.

The auditor's side is Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014. The auditor's report states whether the company has used accounting software for maintaining its books of account which has a feature of recording audit trail (edit log) facility, whether it has operated throughout the year for all relevant transactions recorded in the software, whether the audit trail feature has been tampered with, and whether the audit trail has been preserved by the company as per the statutory requirements for record retention.

Section 128(5) of the Companies Act, 2013 requires books of account to be preserved for at least eight financial years immediately preceding the current year. Rule 3(5) of the Accounts Rules, as amended in 2022, also requires the back-up of books of account and other relevant books and papers maintained in electronic mode to be kept on servers physically located in India on a daily basis.

The Institute of Chartered Accountants of India has issued an Implementation Guide on reporting under Rule 11(g), which auditors use when planning this work. Read it, or ask your auditor which parts of it they will apply to you.

Is the fixed asset register in scope?

This is the practical question for finance teams, and it does not have a single answer. The rule applies to accounting software used for maintaining books of account. The general ledger in your ERP or accounting package is clearly in scope. Whether a separate fixed asset system is in scope depends on what it does and how your auditor views it.

Consider your own setup:

• If the fixed asset system computes depreciation, disposal gains and losses, or other figures that are posted to the ledger, it is creating the records behind entries in the books of account. Expect your auditor to ask whether it has an audit trail, and to want evidence that it operated throughout the year.
• If the register is only a listing and every figure is calculated and entered in the accounting software, the auditor may focus on the accounting software alone. But a spreadsheet register used as the basis for depreciation entries still raises the question of how changes to it are controlled.
• If the system is hosted by a vendor, the auditor may ask about the vendor's controls over the audit trail, and about where data and back-ups are stored.

Whatever your conclusion, document it, and agree it with your auditor at the planning stage rather than at the signing stage.

Why spreadsheets struggle here

A spreadsheet can record a lot, but it does not meet the description of an audit trail that cannot be disabled. Anyone with access can change a cost or a useful life, overwrite last year's figures or delete a row, and there is no reliable log of who changed what and when. Version history in a cloud spreadsheet helps, but it is not designed as an audit trail of each transaction, and it can usually be bypassed by copying the file.

That does not mean every company using a spreadsheet register is in breach; scope is a judgement, as above. It does mean that a spreadsheet register whose figures feed the books is hard to defend under Rule 11(g), and that this is a good reason to consider moving the register off Excel. The Excel migration guide covers how to make that move.

What a useful audit trail records

An audit trail is not just a list of logins. For fixed assets, the useful questions are about the master data and the transactions:

• Who made the change, from which user account
• When, with date and time
• What changed: the record, the field, the old value and the new value
• Why: a reason, especially for changes to cost, useful life, residual value, method, put-to-use date and location
• Which transaction it belongs to: an addition, a transfer, a disposal, a depreciation run, a reversal

The fields that matter most are those that change figures in the books: cost, put-to-use date, useful life, residual value, method, and the posting of depreciation runs. A change to any of these after a period has been closed should be rare, approved and visible.

Controls around the audit trail

Rule 11(g) asks whether the audit trail was tampered with. Auditors therefore look at controls around it as well as the feature itself:

1. No switch. There should be no setting that turns the audit trail off, for any user, including administrators.
2. Restricted direct database access. Changes made directly to the database bypass the application. Who has that access, and is it logged?
3. Integrity checks. Some systems seal or hash audit records so that alteration can be detected.
4. Retention. The audit trail should be kept for as long as the books themselves.
5. Back-up location. Daily back-ups in India, in line with Rule 3(5).
6. Access reviews. Periodic review of who has rights to change master data, approve transactions and administer the system.

Preparing for the auditor's questions

Expect requests along these lines:

• A list of software used to maintain the books, and your assessment of which are in scope
• Evidence that the audit trail was enabled from the first day to the last day of the year
• A sample of edit logs for specific transactions the auditor selects
• The access rights to the system and to its database
• Back-up arrangements and the location of the servers

The fixed asset PBC list covers the rest of the year-end file.

How FixedAsset Pro handles the audit trail

In FixedAsset Pro, every change records who, when, the old value, the new value and the reason. The log is sealed every 15 minutes: each row gets a SHA-256 digest and each seal chains to the previous one, and a daily check verifies the chain and raises a critical exception if it breaks. The trail cannot be switched off. Changes made to the database outside the application are detected and listed separately. Read-only auditor roles, access reviews and user-access reports are included (Audit and Compliance). The same audit engine runs in the desktop edition on your own server. Depreciation journals can be exported or sent to your ledger through the integration options.

These are controls and evidence for your auditor. FixedAsset Pro does not certify compliance with Rule 3(1) or Rule 11(g); whether your arrangements meet them is for your management and auditor to conclude.

This article is general information as at October 2026, not legal advice. Scope and compliance under the Companies (Accounts) Rules and Rule 11(g) depend on your systems and facts; check with your auditor.