Books of Account, the Audit Trail Rule and Where Your Data Must Live
Since 2022 and 2023, Indian company law has had things to say not only about what you record but about how the software records it and where the backup sits. These are the obligations most likely to be discovered at an audit rather than in advance, because nothing in day to day operation signals that they are being breached.
- What section 128 of the Companies Act requires, and for how long
- The audit trail obligation and how your auditor reports on it
- Daily backup on servers physically located in India
- What all of this means for choosing an accounting system
What has to be kept, where, and for how long
Section 128 of the Companies Act 2013 requires every company to prepare and keep at its registered office books of account and relevant papers giving a true and fair view, on the accrual basis and on the double entry system, including for branches. Books may be kept at another place in India by board resolution with intimation to the Registrar in Form AOC-5 within seven days of the board's decision, filed electronically through the MCA portal, and may be kept in electronic mode as prescribed.
Retention is not less than eight financial years immediately preceding the current one, or the whole period for a younger company, under section 128(5). The books have to be kept in good order together with the vouchers relevant to the entries in them, and the Central Government may require a longer period where an investigation is ordered. Directors have a right of inspection during business hours.
Section 128 itself is unchanged as at August 2026.
The obligation, and how it is reported on
The proviso to rule 3(1) of the Companies (Accounts) Rules 2014 requires every company that uses accounting software for maintaining its books of account to use only software that has a feature of recording an audit trail of each and every transaction, creating an edit log of each change with the date of the change, and ensuring that the audit trail cannot be disabled.
Three points that are routinely got wrong:
It applies from FY 2023-24, not earlier
The requirement was inserted in 2021 and then deferred twice. It first applied for financial years commencing on or after 1 April 2023. Content that says 2021-22 or 2022-23, or that describes it as deferred, is out of date.
It is reported under rule 11(g), not CARO
The auditor's statement about the audit trail sits in the report on other legal and regulatory requirements under rule 11(g) of the Companies (Audit and Auditors) Rules 2014, not in the Companies (Auditor's Report) Order. That distinction matters because rule 11(g) has no small company or CARO-style exclusions at all. Its own text refers to financial years commencing on or after 1 April 2022, but the company-side obligation in rule 3(1) of the Companies (Accounts) Rules 2014 was deferred to 1 April 2023, which is why FY 2023-24 was the first substantive reporting year.
Nobody is exempt on size
There is no exemption for small companies, one person companies, section 8 companies, private companies or dormant companies. What is genuinely out of scope is different: limited liability partnerships and other non-corporate entities, foreign companies incorporated outside India, and companies that maintain books wholly manually. An Indian subsidiary of a foreign parent is in scope.
The auditor has to state whether the software has the feature, whether it operated throughout the year for all transactions, whether it was tampered with, and whether the trail has been preserved in accordance with statutory record retention. Preservation runs with the eight-year books retention period, so trails for FY 2023-24 have to survive to FY 2031-32. No further relaxation or deferral had been notified as at August 2026, so the requirement continues to apply for financial years commencing on or after 1 April 2023.
The 2022 amendment most systems still fail
The Companies (Accounts) Fourth Amendment Rules 2022, G.S.R. 624(E) dated 5 August 2022, did three things that matter to anyone choosing a cloud accounting system.
| Requirement | What it means in practice |
|---|---|
| Electronic records must remain accessible in India at all times | The earlier drafting was less absolute. A system that is reachable from India but whose records are only retrievable via a foreign parent's process is a question worth asking. |
| Backup of electronic books must be taken on servers physically located in India, on a daily basis | This replaced a 'periodic' requirement and removed the ability to back up outside India. A cloud accounting product hosted outside India needs a documented daily Indian backup alongside it. This is the single most commonly breached item on this page. |
| Where the service provider is outside India, intimate annually to the Registrar the name and address of the person in control of the books in India | A filing obligation that follows from using an overseas provider, and one that is easy to overlook because nothing prompts it. |
What this means for system selection
The audit trail requirement and the India backup requirement together are selection criteria, not accounting policy. Before adopting an accounting system, establish that the audit trail feature exists, that it cannot be turned off, that the log is retained for eight years rather than rolled off, and that a daily backup lands on a server in India. Retrofitting any of these is far more expensive than choosing for them.
Personal data in the finance function
The Digital Personal Data Protection Act 2023 was operationalised by rules notified in the Gazette of 13 November 2025, with commencement phased from that date. The Data Protection Board machinery took effect immediately. Consent manager registration follows on 13 November 2026. The substantive obligations, including notice, consent, security safeguards, breach intimation, retention and erasure, and the rules on transfers outside India, follow on 13 May 2027.
For an outsourced finance function the structure is usually that the client is the data fiduciary and the provider is a data processor, engaged under a contract that obliges the processor to implement reasonable security safeguards. The client remains answerable to the individual regardless of the outsourcing, which is why the contract and the safeguards are the client's problem as much as the provider's. Penalties run to substantial figures for security failures.
The operative point for planning is that the compliance deadline for finance and human resources systems is in 2027, but the Board's enforcement powers switch on before that.
Where to go next
Accounts Outsourcing
Back to the main page: what we run, how a handover works, and how to reach us.
What an Outsourced Finance Function Actually Covers
Where the boundary sits between bookkeeping, controllership and finance leadership, what a handover looks like in practice, and the three failure modes that make outsourced finance go wrong.
The Compliance Calendar: Withholding, Goods and Services Tax, and What Changed
The monthly, quarterly and annual filing rhythm an outsourced finance function actually runs, with the 2025 and 2026 changes that break an older calendar: new section numbers, new form numbers, a rebuilt rate structure, and corrections that now have to be made upstream of the summary return.
Paying Suppliers: the MSME Payment Rule and What It Costs
The disallowance that turns a late supplier payment into a tax cost with no way back, the revised classification thresholds, the half-yearly return, and how to build accounts payable so the rule does not bite.
Choosing a Reporting Framework: Ind AS, AS, and the New Rules for LLPs and Firms
Which framework applies to your entity and why it is rarely a choice, the road map thresholds, and the change that gives limited liability partnerships and other non-corporate entities a prescribed format for the first time.
Send an enquiry
The quickest useful check we can do is on your accounting system: audit trail present, not disableable, log retained, daily backup in India. It takes very little time and it is the thing most likely to be a problem.
Position as at 16 September 2026. Reviewed every six months.
This page is general information, not professional advice. Indian financial reporting and tax compliance moved substantially between September 2025 and June 2026. The Income-tax Act 2025 replaced the 1961 Act on 1 April 2026 and renumbered every section and every form; the goods and services tax rate structure was rebuilt on 22 September 2025; the small company definition changed on 1 December 2025; and prescribed financial statement formats began to apply to limited liability partnerships and other non-corporate entities. Take professional advice before acting on anything on this page. We are happy to be that adviser, but we do not act on a web page, ours or anyone else's, without one.