Audit Trail in Accounting Software
Bharat Zinzuvadia
The author is member of the Institute. He can be reached at bmzinzuvadia@gmail.com.
Introduction
The Ministry of Corporate Affairs vide a notification No. G.S.R. 205(E) dated 24th March 2021, has amended The Companies (Accounts) Rules, 2014, and a new proviso is added to sub rule (3), which says:
“Provided that for the financial year commencing on or after the 1st day of April, 2021*, every company which uses accounting software for maintaining its books of account, shall use only such accounting software which has a feature of recording the audit trail of each and every transaction, creating an edit log of each change made in the books of account along with the date when such changes were made and ensuring that the audit trail cannot be disabled”.
*The application of this provision is however, now postponed up to 1st April 2022.
This amendment will have a substantial impact on the way the accounting software are developed and used by companies in India.
The use of accounting software for maintaining financial records is common in these days. In fact, many commercial entities use several accounting software for their specific needs.
The amended rules says that “….. every company which uses accounting software for maintaining its books of account……”. It raises a question about what it means by use of accounting software? It also raises the question of what should be included in the books of accounts. Because the rules are applicable without exception to all companies, irrespective of size, nature, and status of the company.
Let us take an example of a One Person Company engaged in a trading business and using a readily available mobile application that gives the details of receivables and payables. The rest of the accounting records are kept in physical notebooks.
Once, it is established that the company uses an accounting software, these provisions become applicable, (considering the mobile application, and accounting software), and therefore, I do not know if in this situation, whether the company has to compulsorily switch over to an accounting software that keeps the audit trails, because rules require the company to use “…accounting software which has a feature of recording audit trail of each and every transaction…” or the word “each and every” will be understood to have a limited reference to those transactions which are currently kept on accounting software (the mobile application in our above example). The second approach appears to be more practical and advisable.
It may also be noted that section 128 of the Companies Act 2013 (the Act) provides for the maintenance of the books of accounts at a registered office or at some other location and it also provide that such records may be kept in electronic form. It does not force a company to keep the accounts in electronic form.
“Nowadays, it is practically impossible to avoid use of accounting software. Almost all companies having active businesses, use accounting software. The question here is whether, that software has a feature of keeping audit trail.”
To ensure that the accounting software has an audit trail feature, in compliance with the requirement of the new provision, the management may consider the following matters:
1. Minimum Information in Audit Trail Report
What would be the minimum information an accounting software should provide as an audit trail report, to render the software, a Companies Act complied accounting software?
2. Effective Date & Penal Consequences
The rules provide that this provision is applicable from 1st April 2022. These rules are prescribed under the provisions of section 128 of the Act. The noncompliance of the provisions of section 128 attracts a penalty, which ranges from fifty thousand to five lakh rupees. The management should also think on, how to deal with a situation when it is evident that the accounting software used by the company does not comply with the new provisions.
3. Diversity and Complexity of Accounting Systems
There is a range of accounting software available ranging from an extremely basic function to a complex one which takes business decisions with the help of AI (Artificial Intelligence). Different accounting software would record the same transaction in different ways by capturing or not capturing the other dimensions of the same transaction, and therefore it would become highly judgmental as to what would constitute and audit trail. For example, SAP, beside capturing the basic details of a transaction, also captures more information on the same transaction, the audit trail of such additional information may or may not be kept. According to the notification, an accounting software is required to capture the audit trail for all details once it is recorded.
4. Controls to Prevent Disabling
The management of the company is to ensure that the accounting software should have a control to ensure that the audit trail feature was prevented from being disabled. Naturally, the audit trail entry cannot be manually changed by the users. The accounting software must capture the trail automatically as the operations are performed. The audit trail feature should be hard coded so that it does not give an option to enable or disable the feature. However, it may not be the case for all accounting software. Where an option is available to change the applicability of the audit trail feature, the management should put in place other controls, to ensure that the audit trail feature remains operative continuously.
5. Direct Database Access Risks
For any software, the audit trail data is a set of records like other records and therefore the audit trail records are saved in the same data base besides the other records. Any direct modification to the database will not be captured in the audit trail, secondly, the audit trail records itself can be changed once an access to the database is available.
6. Modifications Bypassing User Interface
Any modification in the database, not routed through user interface would not be recorded in the audit trail or audit log.
A. Applicability
Scope: Every company which uses accounting software for maintaining its books of account.
So, the provision is applicable to every company irrespective of size, nature and status except those companies which do not use accounting software. Traditional bookkeeping methods have now been enhanced by computer programs that assist the task with accuracy. Even a very small company involved in simple trading activity would be using mobile applications and other such primary accounting software which provides a basic platform to address their business needs. There could be a situation where though most of the transactions are not kept in accounting software and some to the records are kept in spreadsheet software.
The provision is also applicable to a one person company, small company, dormant company and to a section 8 company beside other companies if it maintains its books of account on accounting software.
The requirement of maintaining the books of accounts on a software which provide audit trails feature was initially applicable from the financial year starting from the 1st April 2021. However, the MCA vide notification No. 247 (E) dated 1st April 2021 has deferred the application up to 1st April 2022.
“The companies must check whether their accounting software comply with this requirement or not. If not, they must upgrade or modify their accounting software to ensure it complies.”
As per the amended rules, this requirement of using an accounting software with audit trail feature, will be applicable from 1st April 2022, and therefore the companies and accounting software developers do have a reasonable time to upgrade their systems.
Another question it triggers is, whether the auditors should consider a situation where the accounting software adopted by the company is not compliant with Companies (Accounts)rules 2014, while drafting his audit report?
The Ministry of Corporate Affairs vide a notification G.S.R. 206(E) dated 24th March 2021, has amended The Companies (Audit and Auditors) Rules, 2014 which provides that, amongst other things to be reported by the auditors under the head “Other Matters to be Included in Auditors Report”, para (g) has been inserted which ask auditor:
“(g) Whether the company has used such accounting software for maintaining its books of account which has a feature of recording audit trail (edit log) facility and the same has been operated throughout the year for all transactions recorded in the software and the audit trail feature has not been tampered with and the audit trail has been preserved by the company as per the statutory requirements for record retention”.
B. What is an Audit Trail?
“Audit trail is primarily used to ensure integrity of electronic data. It is a set of system records generated by an accounting software containing details of operations and modification to a transaction from beginning to end. It is also referred as to audit log. It provides details on the operations on a particular transaction in its chronological order.”
Audit trail is necessary for verification of different elements of the transaction such as existence, completeness, occurrence, and accuracy.
Basically, it contains details such as:
- Details about origin of the records: Date and time stamp.
- Reference or copy of basic records: Documents based on which the transaction is recorded – original and new values.
- Details of approval of transactions: Designation of approving person.
- Details of modification: In the records of transaction – with reasons of change.
- Identification of person involved: User ID.
Some software provide special reports that help the auditors in the verification of the records. However, there is a difference between the reports for the auditors and audit trail. Such reports may or may not fall within the definition of audit trail report.
C. Verification of Software Audit Trail
The verification of audit trail is neither a new area nor a new method of audit, in fact it is part of regular audit exercise. The auditor while conducting verification of different audit assertions, verifies audit trail to ensure existence, completeness, occurrence, accuracy etc. However, the format of audit trail defers when it comes to the electronic data processing environment.
D. Audit Trail of Each Transaction
The notification has specifically clarified that the accounting software should capture audit trail for each transaction to make the software compliant of these rules.
The question of which type, and nature of transactions are to be covered under the system of audit trail generation. This question arises because different accounting software records the transaction in different ways and style. A complex accounting software would capture multiple dimensions of a transaction, whereas a basic accounting software would record the transaction with primary details only.
Similarly, the method and style of recording the audit trail and generating audit trail report would defer in each of the accounting software. Some software simply highlight the changes whereas some software show changes for the given transaction but do not have the facility to generate a report of the audit log. I think MCA or the ICAI should provide a clarification about the form and style of the audit trail feature in an accounting software.
“In the absence of proper guidelines, it would be difficult to determine which transactions should be subjected to the audit log and for which transaction the records of audit trails are not necessary for the compliance of these revised rules.”
E. What Type of Report Should the Accounting Software Provide?
The audit trail or audit log is required to pinpoint the exact person who has initiated or modified the transactions and the basic records or documents supporting the occurrence of the transactions. It should present the details in sequential order of its occurrence.
F. Reporting Requirement in Auditor’s Report
The auditor is asked four questions under para (g) of rule 11:
- Whether the company has used such accounting software for maintaining its books of account which has a feature of recording audit trail?
- Whether such feature has been operated throughout the year for all transactions recorded in the software?
- Whether the audit trail feature has been tampered with?
- Whether the audit trail has been preserved by the company as per the statutory requirements for record retention?
The new reporting requirement under The Companies (Audit and Auditors) Rules, 2014 is applicable with effect from 1st April 2022, and therefore, the auditors, while issuing a report on or after 1st April 2022, must consider the new reporting requirement in the report and accordingly, comment on all four questions.
The audit plan for the verification of the audit trail should include:
1. IT Team Discussions
Discussion with the IT team of the company, about the functioning of the audit trail feature and content of log report (audit trail) among others.
2. System Report Verification
Verification of the report generated from the system and checking that the report provided by the software contains all necessary details to constitute it as a proper audit trail.
3. Continuous Operation Assessment
The auditors have to comment on whether the audit trail feature was in operation throughout the year and all the transactions recorded are subjected to the audit trail module of the software. If the audit trail feature is hard coded and automatic, the answer to this question involves a low audit risk. In case there is an option to enable or to disable this feature, the auditor should test the other controls, in the system to ensure that the feature was in continuous operation through the audit period.
4. Anti-Tampering Evaluation
To answer the third question, whether the audit trail feature has been tampered? This requires knowledge of the ISA audit and a detailed study of the operations of the audit trail function. The possibility of the audit trail feature being tampered also poses a great audit risk, especially in a highly computerized audit environment. The auditor should consider this risk while planning other audit areas.
5. Record Retention Compliance
Auditors require commenting on whether the audit trail records were preserved by the company for period as determined by the Companies’ Act 2013. Since the auditors are specifically asked that “Whether the audit trail has been preserved by the company as per the statutory requirements for record retention”, the auditor is required to comment on preservation of audit trail records of earlier years. Reporting on the audit trail of earlier periods would require the auditors to check the records of all earlier periods. Besides, the auditors should also consider:
- a. Any change or update of the accounting software in past.
- b. Adoption of new software in recent past.
- c. If the company is under investigation under any provision of the Companies’ Act 2013, the records should be kept for that period as well.
G. At Last
The new duty cast on the management to use a software that provides a feature of audit trail and the new duty casted on auditor to report on audit trail are two separate provisions and should be linked with each other.
While preparing the audit report after 1st April 2022, the auditors have to comment on the audit trail feature of the accounting software being used by the company, even though, for the accounting period for which the report is being issued, the management of the company was not bound to maintain audit trail.
So far as it relates to big business houses, which uses well-structured ERP like SAP or MS Dynamics NAV, the new requirement does not pose a big question, as these ERPs are already in compliance with the requirements. It may pose a challenge where the company uses and in-house developed ERP or and ERP where this feature of audit trail was not given an importance for one or another reason.
Some browser-based accounting solutions available in market do have a transaction tracking facility, but they do not provide a log report while other software have not given importance to the audit trail feature though it gives some useful reports for the auditors.