PQR Ltd., a company maintaining its books of account through an ERP-based accounting system is required to comply with the provisions relating to…

Section 143 of the Companies Act, 2013 requires the auditor to report other matters as prescribed under Rule 11 of the Companies (Audit and Auditors) Rules, 2014. As per Rule 11, the auditor is required to report whether the company has used accounting software for maintaining its books of account which has a feature of recording audit trail (edit log) facility and the same has been operated throughout the year for all transactions recorded in the software and the audit trail feature has not been tampered with and the audit trail has been preserved by the company as per the statutory requirements for record retention. In view of above, the auditor is required to ensure that every company maintaining its books of account electronically is required to use accounting software having a feature of recording an audit trail of each and every transaction, creating an edit log of each change made in the books of account when such changes were made. The audit trail should operate throughout the year, and the feature should not be capable of being tampered. The company is also required to preserve the audit trail in accordance with the applicable record-retention requirements. In the present case, the audit trail was not activated for the payroll module, and for the remaining modules it was enabled only from 1 July 2025. Accordingly, the audit trail was not operational throughout the financial year. Further, the absence of logging of direct database-level changes indicates that changes to the books of account may not have been completely captured. The fact that users having administrative access could deactivate the audit trail is also inconsistent with the requirement that the audit trail should not be capable of being disabled or tampered. Accordingly, CA Meera should report the above exceptions under Rule 11, based on the audit evidence obtained. She should also evaluate whether the deficiencies in the audit trail and the ability to disable or tamper it have implications for the reliability of accounting records and the company's internal controls and communicate relevant control deficiencies to those charged with governance in accordance with SA 265.