Every company that keeps its books in software has, since 1 April 2023, been required to use software that logs every transaction and every change to it, with a date, and that cannot have the logging switched off. Your auditor has to say in the audit report whether that happened. If you run Zoho Books the software side is already done. What is usually not done is the part that generates audit queries: nobody in the company has opened the log, set a lock date, or thought about what happened to the old Tally data. This post is the pre-audit check we run with our own clients, written so a finance head can do it without us.
Zoho Books records an audit trail on every plan, including the free one, and it cannot be disabled, so the Rule 3(1) software requirement is met from the day the organisation is created. The five things to fix before the auditor asks are: review the deletion log, set a transaction lock date at every close, give each person their own login, keep the old system's edit log if you migrated mid-year, and export the log before any subscription ends.
What the rule asks, in one paragraph
The proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 says a company that uses accounting software must use only software that records an audit trail of each transaction, keeps an edit log of every change with the date, and cannot have that feature disabled. Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 makes the auditor report on it. Audit reports for FY 2025-26, being signed this month, are the third year of that paragraph. The Institute's implementation guide tells auditors to check that the trail was on for the whole year, for every transaction, that it was not tampered with, and that the company has kept it as part of the books under Section 128(5), which means eight years.
Zoho Books satisfies the software part outright. The log is on from day one, it is on every plan, and there is no setting anywhere to turn it off. If that were all the rule required, this post would end here. It is not.
Where the log is, and how to read it
Open Reports, choose Activity in the category list on the left, then Activity Logs & Audit Trail. Each row gives the time, the module and record, the action and the user. Use Customise to filter by date range, by module (Invoices, Bills, Journals, Chart of Accounts, Bank Feeds and so on), by customer or vendor, by user, and by action: Create, Update or Delete.
For any record that has been changed more than once, open the record itself and click Audit Trail. Zoho Books keeps every version and lets you put two side by side, with changed fields in yellow, removed data in pink and additions in green. That one screen answers the question the rule was written for: who changed what, and when.
The report exports from the top right. Most auditors are happy with an export run on agreed filters; for a larger audit a view-only user is cleaner than sharing a login.
Five things to fix before the auditor asks
1. Read the deletion log yourself
Run the report for the full financial year with Action set to Delete. For most SMEs it is a short list, and it is where the audit questions come from: a deleted invoice that had a live IRN, a bank line deleted and re-entered with a different date, a journal removed in the month a loan was drawn. Write a one-line reason against each row now. If you cannot explain a deletion in September, the auditor will not be able to either, and the report will say so.
2. Set a lock date at every close
Under Settings > Transaction Locking, lock the period on the day the trial balance goes to the auditor, and note that date. Anything posted after it has to go through an unlock, which the log records under the user's name. Without a lock, a provision dated 31 March can be created on 28 June and the only evidence is a creation timestamp that nobody looks at. With a lock, it cannot happen quietly.
Then run the report from the lock date forward with Action set to Create and look for any transaction dated inside the audited year. Each one needs an explanation, and usually a check of whether the draft financials the board saw already included it.
3. One person, one login
The log records the user who was signed in. If three staff share accounts@, every row under that login is unattributed and the auditor will treat it that way, which means more testing and a weaker report. A separate seat costs less than an extended audit. While you are in Settings > Users & Roles, check who can delete transactions and who can change transaction dates. In a typical SME the honest answer should be one or two people, and neither of them should be the person raising invoices.
4. If you migrated mid-year, keep the old log
A company that moved from Tally to Zoho Books on 1 October has a Zoho Books log that starts on 1 October. The opening balances imported that day carry an October creation stamp. Nothing in Zoho Books can say anything about April to September, so the auditor will ask for the edit log from the old system, and the answer depends on which Tally release was running and whether the feature was on. Whatever the answer, the old data and its log have to be kept for eight years in a form you can still open. A backup file with no licensed copy of the software to read it does not count. This is the point we build into every Tally to Zoho Books migration: the old system's log is exported and filed on the cut-off date, before the licence is allowed to lapse.
5. Export before any subscription ends
The eight-year clock does not stop when a subscription does. If the company ever leaves Zoho Books, export the full Activity Logs report and the organisation data on the last day of use. If the company leaves any other system for Zoho Books, do the same on the way out of that one. Section 128(5) does not care which product held the books.
What happens if it is not done
Two things. The audit report carries a modified Rule 11(g) paragraph naming the period for which the trail did not exist, which a lender or acquirer will read. And Section 128(6) puts the fine, Rs. 50,000 to Rs. 5,00,000, on the managing director, the whole-time director in charge of finance, the CFO, or whoever the board charged with compliance. Not on the accountant, and not on the software vendor.
There is a quieter consequence. In an assessment or an inquiry, a company that cannot show who changed what and when is a company whose books are easier to disbelieve. The log is the cheapest credibility a set of accounts can have.
Want the check done before the audit starts?
We run the five checks above, set the lock date and roles, and hand you a one-page note for the auditor. For companies on our outsourced accounting it is part of the close; for everyone else it is a fixed-fee exercise that takes an afternoon. If you are still on Tally and thinking about moving, the implementation page explains how the audit trail is handled on the way across.
Book the pre-audit checkFrequently Asked Questions
Yes, on the software test. Zoho Books records an audit trail of every transaction and every edit with user and timestamp, on every plan including the free plan, and the feature cannot be disabled. Whether the company complies also depends on the trail existing for the whole year, including any months on a previous system, and on the log being preserved for eight years.
Reports, then Activity in the category list, then Activity Logs & Audit Trail. Filter it by date, module, user and action. For a single record, open it and click Audit Trail to compare versions.
The Zoho Books log from the migration date, and the Tally edit log for the months before it. The audit report will name both products and the period each was used. If the Tally release in use did not have the edit log, or it was not enabled, the report has to say so for those months. Keep the Tally data and its log for eight years in a form that can still be opened.
Under Section 128(6) of the Companies Act, 2013, the managing director, the whole-time director in charge of finance, the Chief Financial Officer, or any other person charged by the board with compliance, with a fine of not less than Rs. 50,000 and up to Rs. 5,00,000.
Sources
- Authority: Ministry of Corporate Affairs. Title: Companies (Accounts) Rules, 2014, Rule 3 (proviso inserted by G.S.R. 205(E) of 24 March 2021, effective FY 2023-24 by G.S.R. 235(E) of 31 March 2022). View Source. Accessed: September 2026.
- Authority: Ministry of Corporate Affairs. Title: Companies (Audit and Auditors) Rules, 2014, Rule 11(g) (inserted by G.S.R. 206(E) of 24 March 2021). View Source. Accessed: September 2026.
- Authority: Institute of Chartered Accountants of India. Title: Implementation Guide on Reporting on Audit Trail under Rule 11(g), Revised 2024 Edition. View Source. Accessed: September 2026.
- Authority: Zoho Corporation. Title: Zoho Books help: Activity Logs & Audit Trail report. View Source. Accessed: September 2026.
Written by CA Karan Shah
Founder of KC Shah & Associates, a Zoho partner CA firm in Mumbai. Runs outsourced accounting for startups and SMEs on Zoho Books, and provides Zoho Books implementation, Tally migration and Virtual CFO services across India.