Regulatory updates

In July 2020, ICAI had issued the Guidance Note on the Companies (Auditor’s Report) Order, 2020 (CARO 2020) to provide detailed guidance to auditors on the reporting requirements of the CARO 2020.

There have been certain amendments to the Schedule III to the Companies Act, 2013 (which include amendments that are in line with the clauses pertaining to the CARO 2020 and various additional disclosure requirements). Therefore, ICAI, in June 2022released an Exposure Draft of the Guidance Note on CARO 2020 (exposure draft). Some of the key changes suggested in the exposure draft include:

1. For evaluating applicability of CARO 2020, total income should be considered as a criteria instead of total revenue, and
2. For evaluating applicability of the CARO 2020 to NBFC companies, definition of Reserves and Surplus has been amended. The revised definition of Reserves and Surplus⁶ for entities following Division III of the Schedule III is now aligned with the definition of Reserves and Surplus for entities following Division II of the Schedule III.

Clause (iii) - Reporting on loans, investments, guarantees, securities and advances in nature of Loan: The exposure draft has recommended the following changes while reporting under clause (iii) of the CARO 2020:

1. Clause 3(iii)(a)(A) and (B)⁷: The exposure draft has introduced changes in the reporting format of clause (iii)(a), relating to granting of loans and advances in the nature of loans. As per the proposed format, the reporting for loans and advances in the nature of loans would be split into secured and unsecured portions. The revised format proposed by the exposure draft is given below:

Clause 3(iii)(c)⁸: Where repayment of principal and payment of interest is not regular, the auditor is required to report in a prescribed format. The exposure draft has now proposed reporting non-payment of principal and/or interest in two separate tabular formats, as given below:

For companies whose principal business is NOT to give loans: Additional column for actual date of payment has been included in the existing format- the revised format is given below:

For companies whose principal business is to give loans:
New format has been proposed for companies whose principal business is to give loans, in which only summarised informationis required to be given pertaining to:

1. No. of cases where repayments were not regular
2. Principal amount outstanding as of the reporting date, and
3. Overdue amount including interest on reporting date

(Name of the entity is not required to be provided by entities whose principal business is to give loans).

The new format introduced by the exposure draft is given below:

Clause 3(iii)(e)⁹: The exposure draft has amended the suggested format for reporting under this clause by adding a column for gross amount of loans/advances in nature of loan granted during the year to those parties where the overdue amount was settled by renewal or extension of a fresh loan.

Accordingly, percentage of loans renewed or extended will be computed as a percentage of total loans or advances in the nature of loans granted during the relevant year to the party where there is a renewal or extension of a loan. Earlier, the requirement was to compute the percentage of loans renewed with respect to the total loans or advances in the nature of loan granted during the year (cumulative amount for all parties).

The revised reporting format proposed by the exposure draft is given below:

Clause (ix)(f) -Reporting on raising of loans against pledge of securities held in subsidiaries, etc.: Auditors are currently required to report the loans raised by a company against a pledge of securities held in its subsidiaries, associates and joint ventures. As per the exposure draft, companies would now be required to disclose the nature and carrying amount of the securities pledged, and cross reference it to the relevant note in the financial statements.

Clause (xix)- Reporting on material uncertainty: Currently, auditors are required to review the liquidity ratios computed by the company and report on whether any material uncertainty exists as on the date of the audit report. However, as per the revised requirements, auditors should now use the financial ratios10 as computed and disclosed by companies in accordance with the requirement of the Schedule III to the Companies Act, 2013, instead of the liquidity ratios for reporting under this clause.

Apart from the aforementioned changes, other changes in the exposure draft are clarificatory in nature and provide reference to the Schedule III disclosures including the fact where the reporting requirement under CARO 2020 is different from that in the Schedule III.

6. As per the revised definition, Reserves and Surplus comprise of:
   1. Capital Reserve,
   2. Retained Earnings,
   3. Securities Premium, and
   4. Other Reserves
7. Clause 3(iii)(a)(A) and (B) requires specific reporting by auditor, where a company has provided loans, advances in the nature of loans, stood guarantee or provided security to any entity.

8. Clause 3(iii)(c) requires reporting by auditor on whether the schedule for repayment of principal and payment of interest has been stipulated and whether the repayments or receipts of principal and interest respectively are regular.
9. Clause 3(iii)(e) requires auditors to report instances of evergreening of loans.

To access the text of the exposure draft, please click here

On 25 July 2022, SEBI had introduced regulations pertaining to the Social Stock Exchange (SSE) by making amendments to the following regulations:

• The SEBI (Issue of Capital and Disclosure Requirements) Regulations, 2018 (ICDR Regulations)² by inserting a chapter on ‘Social Stock Exchange’,
• The SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (LODR Regulations)³ by adding a chapter on ‘Obligations of Social Enterprises’, and
• The SEBI (Alternative Investment Funds) Regulations, 2012 (AIF Regulations)⁴ by introducing changes in relation to social impact fund.

According to the ICDR Amendment Regulations, an SSE means a separate segment of a recognised stock exchange having nationwide trading terminals, permitted to register Non-Profit Organisations (NPOs⁵) and/or list the securities issued by NPOs in accordance with the provisions of the ICDR Regulations. The provisions would apply to:

• NPOs seeking to only get registered with an SSE,
• NPOs seeking to get registered and raise funds through an SSE, and
• For Profit Social Enterprises (FPSE)⁶ seeking to be identified as a Social Enterprise (SE)⁷ under the provisions of the ICDR Regulations.

As per the amendments an SE, which is either registered with or has raised funds through an SSE, should submit an annual impact report to the SSE (the format would be specified by SEBI). The annual impact report must be audited by a social audit firm⁸, employing social auditor(s)⁹.

In this regard, ICAI has been entrusted with the responsibility of being the self-regulatory organisation for regulating the profession of social auditors. Consequently, on 5 August 2022, ICAI released an Exposure Draft (ED) on Compendium of Social Audit Standards (SAS).

Some of the key requirements of the SAS framework discussed in the ED are as follows:

• Applicability: The SAS would apply whenever an independent social audit of an SE is carried out. The framework specifies five elements of a social audit engagement. These are:

1. A three-party relationship involving a social auditor, a responsible party (generally SE), and the intended user
2. Project/programme/intervention to be covered
3. Project monitoring framework
4. Evidence
5. A written report

• Quality control for social auditor: A social auditor/audit firm must establish a system of quality control, including policies and procedures addressing each of the following elements:

1. Leadership responsibilities for quality within the firm
2. Ethical requirements
3. Acceptance and continuance of client relationships and specific engagements
4. Human resources
5. Engagement performance, and
6. Monitoring.

The quality control policies and procedures should be documented and communicated to the firm’s personnel on a timely basis.

• Understanding the entity and its environment: For establishing an SE’s primacy of social intent, a social auditor should conduct a preliminary review of the entity and its environment. Such a review may include information such as the stated objectives of the project/programme, project monitoring framework¹⁰, programme specific baseline¹¹, mid-line and end-line¹² assessment reports, fund utilisation certificate, alignment of the project outcomes to National/State priorities, NITI Aayog’s Sustainable Development Goals (SDG) India Index Indicators and so on.
• Collection and analysis of data: A social auditor should use various methods such as interviews, questionnaires, Focussed Group Discussion (FGD)¹³ etc. for collecting data on different quantitative and qualitative parameters.The respondents would be the stakeholders of an SE which affect or are affected by the project. Based on the data collected, the social auditor should analyse and interpret it as per the ‘Theory of change and logic model’, explaining the process of intended social impact of the project. The review process should answer the following questions:
  
  1. What was the situation before and what would have happened in the absence of the project?
  2. How much has the project contributed to the changes that are evidenced as compared to pre project interventions?
  3. How much unintended impacts (positive and negative) happened due to the project?
• Materiality: A social auditor should consider materiality while assessing the overall impact of the project/programme. Different quantitative and qualitative factors, such as relative magnitude, the nature and extent of the effect of these factors on the evaluation or measurement of the subject matter, the interests of different stakeholders involved, etc. should be taken into consideration while assessing the materiality threshold.
• Using the work of field level research agency/subject matter experts: In certain cases, a social auditor may need to use the work of assistants/field level research agencies and/or other social auditors and subject matter experts. In such situations, the social auditor should perform relevant procedures to evaluate the appropriateness and adequacy of the work performed and consider their significant findings/assessments, if any, in the context of the specific social audit. A social auditor would continue to be responsible for the overall social audit report of an SE.
• Use of technology: A social auditor should determine the usage and acceptability of technology for meeting the objectives, collecting and verifying evidence as well as validating impact measurements and assessments in case of social audit engagements. The social auditor should consider the extent of usage of IT tools to be deployed for:
  
  1. information database to be maintained at one place for information of all stakeholders, beneficiaries, volunteers, staff,
  2. Data collection process through online surveys, virtual interviews, satellite imagery for monitoring forestry coverage etc., and
  3. Data sorting and visualisation, data analysis, reporting.
• Documentation: Engagement documentation must be prepared on a timely basis, and it should provide a record of the basis for the social audit report, the nature, timing and extent of the audit procedures performed, evidence obtained, significant issues observed, if any, and recommendations made for future improvements. The process of assembling the final engagement file should be completed within a period of 60 days after the date of the social audit report. Also, the retention period should be seven years from the date of the social audit report.
• Reporting – Social audit report: A social auditor must issue a written social audit report containing the findings from the assessment in terms of the impact created, gaps, if any, along with the recommendations for improvement. It should address the social impact assessment covered by the project/programme that the intended users might be interested in. The framework does not require a standardised format for reporting on all social audit engagements. The social audit reports may be tailored to the area specific circumstances.

The framework identifies certain basic elements which the social audit report should include, which are given below:

The ICDR Amendment Regulations mention 16 thematic areas which would qualify as eligible activities for the purpose of establishing primacy of social intent. In this regard, ICAI has prescribed 16 SAS in the ED, each corresponding to a specific area. These are as follows:

The ED would be open for comments up to 13 September 2022.

To access the text of the ICAI ED, please click here

2. The amendments have been issued by the SEBI (Issue of Capital and Disclosure Requirements) (Third Amendment) Regulations, 2022 (ICDR Amendment Regulations)
3. The amendments have been issued by the SEBI LODR (Fifth Amendment) Regulations, 2022 (LODR Amendment Regulations)
4. The amendments have been issued by the SEBI AIF (Third Amendment) Regulations, 2022 (AIF Amendment Regulations)
5. An NPO means a social enterprise, which is any of the following entities:
   • A charitable trust registered under the Indian Trusts Act, 1882
   • A charitable trust registered under the public trust statute of the relevant state
   • A charitable society registered under the Societies Registration Act, 1860
   • A company incorporated under section 8 of the Companies Act, 2013
   • Any other entity as may be specified by SEBI
6. For Profit Social Enterprise’ means a company or a body corporate operating for profit, which is a social enterprise for the purposes of the ICDR Regulations and does not include a company incorporated under section 8 of the Companies Act, 2013
7. An NPO or a FPSE, in order to be identified as an SE, must establish primacy of its social intent. In this regard, SEBI has prescribed 16 thematic areas which would qualify as eligible activities that meets the eligibility criteria specified in the ICDR Amendment Regulations. Additionally, an SE should have at least 67 per cent of its activities, qualifying as eligible activities through one or more of the following:
   • at least 67 per cent of the immediately preceding three-year average of revenues comes from providing eligible activities to members of the target population,
   • at least 67 per cent of the immediately preceding three-year average of expenditure has been incurred for providing eligible activities to members of the target population, and
   • members of the target population to whom the eligible activities have been provided constitute at least 67 per cent of the immediately preceding three-year average of the total customer base and/or total number of beneficiaries.
8. Social audit firm means any entity which has employed social auditors and has a track record of minimum three years for conducting social impact assessment
9. Social auditor refers to an individual registered with a self-regulatory organisation under ICAI or such other agency, as may be specified by SEBI, who has qualified a certification programme conducted by the National Institute of Securities Market (NISM) and holds a valid certificate in this regard
10. Project monitoring framework details the inputs, activities, outputs, outcomes and impact that would aid an auditor’s understanding of the project. Additionally, the auditor should also consider parameters such as inclusiveness, relevance, effectiveness and efficiency, convergence and sustainability of the project for assessing its impact
11. Baseline measurement is required to establish the starting point in any project/programme/project-based activity
12. A mid-line and end-line measurement is the audit conducted respectively during the intervention phase and after the end of that intervention
13. For the purpose of this framework, the FGD constitutes subject matter experts including Non-Governmental Organisations, NPOs, working on the respective thematic areas and actively engaged in social activities as well as beneficiaries.
14. Elements provided in the illustrative social audit report are indicative.

Standard on Auditing (SA) 505, External Confirmations recognises that external confirmations are an integral method of obtaining audit evidence. Over the years, auditors have been using external confirmation procedures for obtaining account balances confirmation from various parties (confirming parties), such as banks, creditors, debtors, third-parties in possession of auditee’s investments/property etc.

However, it has come to the notice of the ICAI that, in recent years, auditors are facing various difficulties in obtaining external confirmations from banks. One of the major concern in this regard is that some banks are using services of third-party vendors to provide confirmations on their behalf to auditors. Use of third-party vendors leads to the risk that the information provided by third-party vendors may not be authentic and complete. Further, it is not clear as to who will be responsible in case there is failure of IT controls at the end of third-party vendors which may impact the integrity of information provided.

These factors raise a question as to who will be held responsible for authenticity and completeness of information provided to auditors, the concerned bank or such third-party vendors. Presently, there is no legal framework/guidelines to deal with these aspects. Thus, auditors are exposed to serious risk, in case they use the confirmation from such third-party vendors as audit evidence.

In this regard, ICAI, vide an announcement dated 7 September 2022 advised the auditors to seek direct confirmation from the concerned banks.

To access the text of the announcement, please click here

In July 2021, ICAI had issued the Audit Quality Maturity Model Version 1.0 (AQMM v1.0), comprising of a set of different Audit Quality Indicators (AQIs) to enable audit firms to self-evaluate their current level of audit maturity, identify areas where they lack and thereby help them in developing a roadmap for upgrading to a higher level of maturity. AQMM was introduced with an aim to move away from the traditional approach of enforced regulation to a more modern self-compliant model for the audit firms.

Initially, AQMM v1.0 was recommendatory and covered certain firms

The ICAI, vide a notification dated 13 September 2022 issued the revised version of the AQMM – Audit Quality Maturity Model Revised Version 1.0 (AQMM Rev v1.0). This is a mandatory evaluation of the audit quality maturity of firms auditing the following class of entities:

1. A listed entity, or
2. Banks other than co-operative banks (except multi-state cooperative banks), or
3. Insurance companies.

However, firms doing only branch audits are excluded from the mandate.

The requirement for mandatory evaluation of AQMM is with effect from 1 April 2023.

Similar to AQMM v1.0, the AQMM Rev v1.0, includes the following dimensions of audit maturity categorised into three sections:

1. Practice Management – Operation,
2. Human Resource Management, and
3. Practice Management – Strategic/Functional.

Each of the aforementioned sections consist of the related AQIs and firm’s maturity rating would be determined based on the score achieved in each section.

It has also been provided that the scores and level arrived at would be subject to review by a peer reviewer alongside the peer review cycle, which falls anytime on or after 1 April 2023. The level, so arrived at, after being reviewed by the peer reviewer should be hosted on the website of the ICAI alongside the details of the peer review certificate.

The firm(s) can get their scores reviewed by an AQMM reviewer⁵ before their peer review cycle falls due. Also, the firms whose last peer review cycle has been completed and not a year has lapsed from the date of the last review, such firms can get their scores reviewed before their next peer review falls due by an AQMM reviewer. However, it has been stated that the subsequent reviews would necessarily be aligned to the peer review cycle and that the period of review in no case would be less than a year.

In this regard, ICAI has also released the Implementation Guide (IG) to the AQMM v1.0. The IG has been issued in the form of various implementation clues, which are practice based.

5. AQMM reviewer is a member of the ICAI and empaneled as a peer reviewer. He/she is appointed by the Peer Review Board for conducting an AQMM review any time before the peer review cycle of the firm falls due.

To access the text of ICAI’s notification, please click here

To access the text of the IG, please click here

To access the text of AQMM Rev v1.0, please click here

In January 2019, ICAI had issued the 12^th edition of the Code of Ethics (Code of Ethics, 2019), coming into effect from 1 July 2020. However, applicability of certain provisions of Volume-I of the Code of Ethics, 2019 (the Code) had been deferred on account of situations prevailing at the given time due to Covid-19. These included provisions relating to:

• Responding to Non-Compliance with Laws and Regulations (NOCLAR),
• Fees - relative size, and
• Tax services to audit clients.

ICAI, vide an announcement dated 29 September 2022 (the amendment) has made the above-mentioned provisions applicable with effect from 1 October 2022 with certain amendments. Some of the significant amendments issued in this regard include:

• Amendment to provisions relating to ‘Responding to Non-Compliance with Laws and Regulations (NOCLAR)’

• Section 260 of the Code specifies the provisions for responding to Non-Compliances with Laws And Regulations (NOCLAR), which is applicable to professional accountants in service. As per the extant requirements, the provisions were applicable to all the employees of listed entities. However, the amendment has now narrowed down the applicability criteria to only senior professional accountants in service⁶, who are in employment of the listed entities. The amendment has also clarified that senior professional accountants in service refer to key managerial personnel.

• Section 360 of the Code guides professional accountants in public practice in assessing the implications of the matter and the possible courses of action when responding to NOCLAR during the course of audit engagements of listed entities.

There are certain amendments with respect to the applicability of Section 360 of the Code, the definition of an ‘audit’ or ‘audit engagement’ and measures to be taken in case of an imminent breach. These are discussed below:

(Source: ICAI announcement dated 29 September 2022 (Applicable date of certain deferred provisions of Volume-I of Code of Ethics, 2019))

Amendment to provisions relating to ‘Fees-relative size’

As per paragraph 410.3 of the Code, when the total fees generated from an audit client by a firm expressing an audit opinion on the financial statements of that client, represents a large proportion of the total fees of that firm, the dependence on that client and concern about losing the client creates a self-interest or intimidation threat (commonly referred to as threats).

Paragraphs 410.3 - R410.6 of the Code prescribe about factors that need to be evaluated while assessing the threats, and actions that can be taken to safeguard against such threats, etc. These provisions are applicable from 1 October 2022, with certain amendments, which are discussed below:

(Source: ICAI announcement dated 29 September 2022 (Applicable date of certain deferred provisions of Volume-I of Code of Ethics, 2019))

Amendment to provisions relating to ‘Tax services to audit clients’

Sub Section 604 of the Code specifies the provisions relating to rendering of tax services to audit clients. As per sub-section 604, providing tax services to an audit client might create a self-review or advocacy threat. In order to mitigate such threats, sub-section 604 of the Code includes requirements that prohibit firms and network firms from providing certain tax services to audit clients in some circumstances.

One such service prescribed in sub-section 604 of the Code includes ‘Assistance in the Resolution of Tax Disputes’, wherein a firm or a network firm has been prohibited from providing services involving acting as an advocate for certain audit clients, before a court in the resolution of a tax matter.

Sub-section 604 further defines what would be considered as a court. This definition has been amended as below:

(Source: ICAI announcement dated 29 September 2022 (Applicable date of certain deferred provisions of Volume-I of Code of Ethics, 2019))

6. Senior professional accountants in service (‘senior professional accountants’) are directors, officers or senior employees who are able to exert significant influence over, and make decisions regarding, the acquisition, deployment and control of the employing organisation’s human, financial, technological, physical and intangible resources. They refer to the Key Managerial Personnel (KMP) of the entity
7. Audit engagement has been defined as ‘A reasonable assurance engagement in which a professional accountant in public practice expresses an opinion whether financial statements are prepared in all material respects (or give a true and fair view or are presented fairly, in all material respects), in accordance with an applicable financial reporting framework, such as an engagement conducted in accordance with Standards on Auditing. This includes a Statutory Audit, which is an audit required by legislation or other regulation’
8. This includes fees received by the firm for other services rendered through the medium of a different firm or firms in which such member or firm may be a proprietor or partner.
9. This includes audit of government companies, public undertakings, nationalised banks, public financial institutions or where appointments of auditors are made by the Government.

To access the text of the announcement, please click here

To access the text of the detailed provisions (with amendments), please click here

To access the text of the Code of Ethics, 2019, please click here

Standard on Auditing (SA) 230, Audit Documentation prescribes the basic principles of audit documentation that should be complied by auditors while performing audits of financial statements.

In 2013, the Institute of Chartered Accountants of India (ICAI) had issued the ‘Implementation Guide to SA 230, Audit Documentation’ (the IG)³ to provide practical implementation guidance to auditors in the form of various Frequently Asked Questions (FAQs).

Recently, on 15 December 2022, ICAI revised the implementation guide (revised IG) to provide more guidance on the aspect of assembly of the final audit file.

The revised IG (like its earlier version) includes summary of the standard, introduction, FAQs on SA 230, a checklist and also an illustrative working paper format. Some of the key guidance pertaining to the assembly of the final audit file include:

• Assembly of the final audit file after the date of the auditors’ report: SA 230 permits only administrative changes to be made to audit documentation after the date of the auditor’s report, therefore the revised IG advises that all audit documentation should be prepared on a timely basis – i.e. at the time the audit work is performed⁴. When assembling an audit file, an engagement team should ensure that it has a complete and final set of documents that support an auditor’s opinion. The revised IG also provides certain illustrative examples of activities that would be considered as administrative changes that are required to be completed before the final assembly of the audit file.
• Changes to audit documentation which are other than administrative in nature: The revised IG provides guidance on documentation requirements⁵ by an engagement team when changes or additions that are not administrative in nature are made to the audit documentation after the date of the auditor’s report but before the archive date. The revised IG has also provided examples of circumstances that require changes or additions to the documentation that are not administrative after the date of an auditor’s report. In certain cases, an engagement team may discover that, considering the facts and circumstances at the time of the audit, one or more additional audit procedures may have been omitted to be performed. In such situations, when the engagement team is performing procedures and obtaining and documenting evidence after the date of the auditor’s report, the engagement team does not discard any related documentation that previously existed.
• Confidentiality, safe custody, integrity, accessibility and retrievability of documentation: Auditors should comply with the requirements of the Standard on Quality Control (SQC) 1, Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information, and Other Assurance and Related Services Engagements. As per SQC 1, audit firms should establish policies and procedures designed to maintain the confidentiality, safe custody, integrity, accessibility and retrievability of documentation of an engagement. For this purpose, appropriate controls may be designed and implemented to:
  1. Enable determination of when and by whom engagement documentation was created, changed or reviewed
  2. Protect the integrity of the information at all stages of the engagement
  3. Prevent unauthorised changes to the documentation of an engagement
  4. Allow access to the documentation by authorised persons to properly discharge their responsibilities
  For practical reasons, original paper documentation may be electronically scanned for inclusion in engagement files.

3. The implementation guide was subsequently revised in 2018.
4. Timely audit documentation enhances the quality of audit and facilitates the effective review and evaluation of audit evidence obtained and conclusions reached before an auditors’ report is finalised.
5. Such documentation includes:

• An explanation describing what information was added or changed.
• When the evidence was obtained.
• The date the information was added and reviewed
• The name of the person who prepared and reviewed the additional information.
• The circumstances encountered and the reasons for adding the information.
• The new or additional audit procedures performed, audit evidence obtained, and conclusions reached.
• When the conclusions in respect of the new information were approved by the engagement manager, engagement partner and / or engagement quality control reviewer (where applicable).
• The effect on an auditor’s report.

To access the text of the ED, please click here

Globally, there has been an increased focus on sustainability reporting and investments in sustainable businesses. Accordingly, organizations are increasingly reporting on their broader performance and impact. However, with a view to deepen the investor’s trust on the reported information, there is a need to provide assurance on the information reported. In India, presently, there is no authoritative guidance with respect to assurance engagements on sustainability information. Practitioners in India currently refer to the International Standard on Assurance Engagements (ISAE) 3000, Assurance Engagements Other than Audits or Reviews of Historical Financial Information.

In this regard, on 12 September 2022, the Institute of Chartered Accountants of India (ICAI) had released an Exposure Draft on the Standard on Sustainability Assurance Engagements (SSAE) 3000, Assurance Engagements on Sustainability Information (ED). Based on the comments and representations received from different stakeholders, ICAI, on 10 January 2023, has issued the final standard – SSAE 3000, Assurance Engagements on Sustainability Information. Following are some of the key aspects that have been discussed:

• Applicability and Effective Date: SSAE 3000 would apply to a sole proprietorship or partnership firm registered with the ICAI on:
  1. A voluntary basis for assurance reports covering periods ending on 31 March 2023, and
  2. Mandatory basis for assurance reports covering periods ending on or after 31 March 2024.
• Parties involved: All assurance engagements would have at least three parties - the responsible party, the practitioner and the intended users. However, depending upon the circumstances of an engagement, there may also be a separate role defined for a measurer/evaluator, or the engaging party, as the case may be. The responsible party is responsible for identifying the underlying subject matter¹. Subject matter refers to the phenomenon that is measured or evaluated by applying criteria The measurer/evaluator uses the criteria²Criteria are the benchmarks used to measure or evaluate the underlying subject matter, so identified to measure or evaluate the underlying subject matter, resulting in subject matter information³ Subject matter information refers to the outcome of the measurement or evaluation of the underlying subject matter against the criteria, i.e., the information that results from applying the criteria to the underlying subject matter . The engaging party agrees the terms of the engagement with the practitioner and the practitioner issues the assurance report for the intended users.
• Scope: There are two kinds of assurance engagements - attestation engagements⁴ An assurance engagement in which a party other than the practitioner measures or evaluates the underlying subject matter against the criteria. A party other than the practitioner also often presents the resulting subject matter information in a report or statement. In some cases, however, the subject matter information may be presented by the practitioner in the assurance report. In an attestation engagement, the practitioner’s conclusion addresses whether the subject matter information is free from material misstatement. The practitioner’s conclusion may be phrased in terms of:
  • The underlying subject matter and the applicable criteria,
  • The subject matter information and the applicable criteria, or
  • A statement made by the appropriate party.
  and direct reporting engagements⁵ An assurance engagement in which the practitioner measures or evaluates the underlying subject matter against the applicable criteria and the practitioner presents the resulting subject matter information as part of, or accompanying, the assurance report. In a direct engagement, the practitioner’s conclusion addresses the reported outcome of the measurement or evaluation of the underlying subject matter against the criteria. . SSAE 3000 would apply only to the attestation engagements (both limited as well as reasonable assurance engagements). SSAE 3000 is an umbrella standard which applies to all assurance engagements on sustainability information. However, in case there is a subject matter information to which a specific assurance standard applies, e.g., Green House Gases (GHG) emissions, SSAE 3000 would apply in addition to the subject matter specific standard. Also, SSAE 3000 should be read in conjunction with the “Framework for Assurance Engagements” issued by the ICAI⁶ In case of any conflicts between SSAE 3000 and the Framework for Assurance Engagements, SSAE 3000 would prevail .
• Understanding the underlying subject matter: The underlying subject matter, so identified by the entity should have the following two characteristics:
  1. It can be measured or evaluated against the relevant criteria, and
  2. It can be subject to procedures to gather information required for supporting the necessary assurance conclusion.
  In order to understand the underlying subject matter and other significant issues, if any, the practitioner should make inquiries of the relevant parties regarding their knowledge of an actual, suspected or alleged intentional misstatement affecting the subject matter information, main findings of the internal audit function (if there is such a function) regarding the subject matter information, and whether an expert has prepared the subject matter information.
• Materiality: The practitioner should consider the appropriate materiality threshold for planning and performing the assurance engagement, determining the nature, timing and extent of procedures, as well as in evaluating that the subject matter information is free from any material misstatement. Various quantitative and qualitative factors which may be considered for determining materiality threshold include, the number of persons or entities affected by the underlying subject matter, the characteristics of the presentation adopted for the subject matter information when the applicable criteria allows for variations in that presentation, and so on.
• Using the work of subject matter experts/another practitioner/internal auditor⁷ If the practitioner plans to use the work of the internal audit function, he/she should also evaluate the extent to which the internal audit function’s organisational status and relevant policies and procedures support the objectivity of the internal auditors and whether it applies a systematic and disciplined approach, including quality control : The practitioner, while using the work of any subject matter expert, another practitioner or the internal auditor should evaluate the necessary competence, capabilities and objectivity level and perform relevant procedures to determine the adequacy of the work so performed for the engagement purpose.
• Documentation: The practitioner must prepare on a timely basis, the engagement documentation which provides a record of the basis for the assurance report, the nature, timing and extent of the procedures performed, evidence obtained, significant matters arising during the engagement, if any, conclusions reached, and the significant professional judgements made in reaching those conclusions. Engagement documentation should be assembled in an engagement file on a timely basis after the date of the assurance report and should be retained for a period of not less than five years from the date of the assurance report.
• Reporting: The practitioner, based on the evaluation of the evidence obtained and conclusions reached, should issue an assurance report⁸ The assurance report should not be dated earlier than the date on which the practitioner has obtained the evidence on which his/her conclusion is based in writing. The report so issued should clearly express the practitioner’s conclusion about the subject matter information. In this regard, SSAE 3000 has specified a list of basic elements that must be included in an assurance report and has also provided the illustrative formats of the assurance reports for reference purpose.

Further, it has been clarified that the assurance report should be signed by the practitioner (i.e., the engagement partner) in his/her personal name. In case a firm has been appointed as the practitioner, the report should be signed in the personal name of the practitioner as well as in the name of the firm. The partner/proprietor signing the assurance report must mention his/her ICAI membership number and also include the registration number of the firm, wherever applicable.

To access the text of SSAE 3000, please click here

On 25 July 2022, the Securities and Exchange Board of India (SEBI) had introduced regulations pertaining to the Social Stock Exchange (SSE)⁹ An SSE means a separate segment of a recognised stock exchange having nationwide trading terminals, permitted to register Non-Profit Organisations (NPOs) and/or list the securities issued by NPOs in accordance with the provisions of the ICDR Regulations. by making amendments to the following regulations:

• The SEBI (Issue of Capital and Disclosure Requirements) Regulations, 2018 (ICDR Regulations)¹⁰ The amendments have been issued by the SEBI (Issue of Capital and Disclosure Requirements) (Third Amendment) Regulations, 2022 (ICDR Amendment Regulations) by inserting a chapter on ‘Social Stock Exchange’
• The SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (LODR Regulations)¹¹ The amendments have been issued by the SEBI LODR (Fifth Amendment) Regulations, 2022 (LODR Amendment Regulations) by adding a chapter on ‘Obligations of Social Enterprises’, and
• The SEBI (Alternative Investment Funds) Regulations, 2012 (AIF Regulations)¹²The amendments have been issued by the SEBI AIF (Third Amendment) Regulations, 2022 (AIF Amendment Regulations) by introducing changes in relation to social impact fund.

As per the amendments introduced, a Social Enterprise (SE)¹³ An NPO or a For Profit Social Enterprise (FPSE), in order to be identified as an SE, must establish primacy of its social intent. In this regard, SEBI has prescribed 16 thematic areas which would qualify as eligible activities that meet the eligibility criteria specified in the ICDR Amendment Regulations. Additionally, an SE should have at least 67 per cent of its activities, qualifying as eligible activities through one or more of the following:
‑   at least 67 per cent of the immediately preceding three-year average of revenues comes from providing eligible activities to members of the target population,
‑   at least 67 per cent of the immediately preceding three-year average of expenditure has been incurred for providing eligible activities to members of the target population, and
‑   members of the target population to whom the eligible activities have been provided constitute at least 67 per cent of the immediately preceding three-year average of the total customer base and/or total number of beneficiaries. , which is either registered with or has raised funds through an SSE, should submit an annual impact report to the SSE. The annual impact report must be audited by a social audit firm¹⁴Social audit firm means any entity which has employed social auditors and has a track record of minimum three years for conducting social impact assessment, employing social auditor(s)¹⁵ Social auditor refers to an individual registered with a self-regulatory organisation under ICAI or such other agency, as may be specified by SEBI, who has qualified a certification programme conducted by the National Institute of Securities Market (NISM) and holds a valid certificate in this regard .

The ICAI has been entrusted with the responsibility of being the self-regulatory organization for regulating the profession of social auditors. Consequently, on 5 August 2022, ICAI had released an Exposure Draft (ED) on Compendium of Social Audit Standards (SAS).

Based on the comments and feedback received from various stakeholders, ICAI, on 14 January 2023 released the final version of the SAS (the standards). ICAI has prescribed total 16 standards, each corresponding to a specific thematic area (as suggested by SEBI) which would qualify as eligible activities for the purpose of establishing primacy of social intent. Subsequently on 4 February 2023, ICAI has issued the Framework for SAS (framework) which provides basic principles for social audit of projects/programs/project-based activities and provides guidance on matters relating to preparation of social audit report. The key requirements prescribed by the framework and the SAS issued by ICAI are as follows:

Applicability: The framework is applicable to engagements conducted by the social auditor, such as social audit (i.e., social impact assessment of a project/program of SEs), impact assessment (under the Companies (Corporate Social Responsibility Policy) Amendment Rules, 2021 and other similar assignments¹⁶Any other engagement(s) conducted by other auditor of an organisation e.g., statutory audit, internal audit, tax audit will not be under the scope of this Framework.

• A three-party relationship involving a social auditor, a responsible party (generally SE), and the intended user
• Project/programme/intervention to be covered
• Project monitoring framework
• Evidence
• A written report.

Planning, conducting and documenting social audit engagements: The framework lists down the considerations for a social auditor while planning the audit, including understanding the entity and its environment, the responsibility of the social auditor when it uses the work of a field level research agency and/or subject matter expert and other matters. It also prescribes the steps for fieldwork process, which includes data collection and sampling and documentation of the work done.

A system of quality control: A social auditor/audit firm should establish a system of quality control which must include policies and procedures addressing each of the following elements:

1. Leadership responsibilities for quality within the firm,
2. Ethical requirements,
3. Acceptance and continuance of client relationships and specific engagements,
4. Human resources,
5. Engagement performance, and
6. Monitoring.

The quality control policies and procedures should be documented and communicated to the firm’s personnel on a timely basis.

Communication with TCWG: The social auditor should communicate with Those Charged With Governance (TCWG) in a timely manner on matters such as the following:

• The roles and responsibilities of the social auditor with respect to the social audit
• An overview of the planned scope, timing of the social audit
• Communicate timely observations arising from the social audit that are significant/relevant to the project/programme
• Deficiencies in internal control for programme implementation/management that the auditor has identified and in the social auditor’s judgement are of sufficient importance to merit their respective attentions.

Materiality: A social auditor should consider materiality while assessing the overall impact of the project. Materiality should be considered in the context of various quantitative and qualitative factors, such as relative magnitude, the nature and extent of the effect of these factors on the evaluation or measurement of the subject matter, the interests of different stakeholders involved, and so on.

Use of technology: A social auditor should determine the usage and acceptability of technology for meeting the objectives, collecting and verifying evidence as well as validating impact measurements and assessments in case of social audit engagements.

Reporting – Social audit report: A social auditor needs to issue a written social audit report containing the findings from the assessment in terms of the impact created, gaps, if any, along with the recommendations for improvement. It should address the social impact assessment covered by the project that the intended users might be interested in. While the framework does not require a standardised format for reporting on all social audit engagements (i.e., social audit reports may be tailored to the area specific circumstances), it identifies certain basic elements which the social audit report should include.

Social audit standards: The amended ICDR Regulations prescribe 16 thematic areas which would qualify as eligible activities for the purpose of establishing primacy of social intent. Consequently, ICAI issued 16 SAS, each corresponding to a specific area. These are as follows:

The standards provide guidance on three key aspects:

1. Objective and scope
2. Process of social audit, including parameters related to collection of data, audit evidence and metrics for evaluation of a project/programme
3. Assessment of challenges and limitations.

Effective date: The standards and framework are effective from the date of their hosting on the ICAI website, i.e., standards are effective from 14 January 2023, and the framework is effective from 4 February 2023.

To access the text of the framework, please click here

To access the text of the standards, please click here

On 24 March 2021, the Ministry of Corporate Affairs (MCA) issued certain amendments to the Companies (Accounts) Rules, 2014 (the Accounts Rules) and the Companies (Audit and Auditors) Rules, 2014 (the Audit Rules) with regard to audit trail of transaction recorded in an accounting software (audit trail).

As per Rule 3(1) of the Accounts Rules, every company which uses an accounting software for maintaining its books of account, should use only such an accounting software which has the following features:

• Records an audit trail of each and every transaction
• Creates an edit log of each change made in the books of account along with the date when such changes were made, and
• Additionally, companies must ensure that the audit trail is not disabled.

Companies are required to comply with the audit trail requirements from 1 April 2023. Further, Rule 11(g) of the Audit Rules read with Section 143(3) of the Companies Act, 2013 prescribes the reporting responsibility of the auditors with regard to audit trail. In this regard, an auditor is required to provide his/her comments in the auditor’s report stating that the company has used such an accounting software for maintaining its books of account which has a feature of recording audit trail facility. Auditors should also comment on whether:

• The audit trail feature has been in operation throughout the year, for all the transactions recorded in the software
• The audit trail feature has not been tampered with, and
• The audit trail has been preserved by the company as per the statutory requirements for record retention.

Auditors are required to report on the audit trail requirement with effect from 1 April 2022. With a view to provide guidance on the reporting requirements and procedures that auditors should adopt while discharging their reporting responsibilities on the audit trail features, on 28 March 2023, ICAI issued an Implementation Guide on Reporting under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 (IG). The key guidance provided by the IG is given hereunder:

• Scope of applicability: The requirement to implement and maintain an audit trail is applicable to all companies which prepare their financial statements as per the provisions of the Companies Act, 2013⁴This implies that the audit trail feature would also apply to Section 8 companies and a foreign company as defined in the 2013 Act.. Further, this feature would apply for both standalone as well as consolidated financial statements.Auditors of the companies which are within the scope of applicability would be required to report on whether the auditee companies have complied with the stated requirements. For the purpose of reporting on this clause in the consolidated financial statements, auditors would need to assess the matters reported by the auditors of subsidiaries, associates and joint ventures that are Indian companies. While making such assessments, auditors of the holding company should apply the principles of Standard on Auditing (SA) 600, Using the Work of Another Auditor.
• Absence of compliance due to different applicability dates: Companies are required to comply with the audit trail feature from 1 April 2023, however, auditors are required to report on the audit trail feature of the management from 1 April 2022. Therefore, there is likely to be a scenario for the financial year 2022-23 where in the absence of compliance requirement for the companies, auditors would not be able to report under the Audit Rules.
• Preservation of audit trail: The management should retain the records pertaining to audit trail as per the statutory requirements for record retention i.e., a period of eight years from the date of applicability of the audit trail requirement in the Account Rules i.e., from 1 April 2023.
• What is an ‘audit trail feature in an accounting software’: The IG defines and provides key considerations pertaining to an accounting software and the audit trail requirement. This is given as below:
  1. Accounting software: The definition and other features of an accounting software are given as below:
     1. Accounting software is a computer program or system that enables recording, maintenance and reporting of books of account and relevant ecosystem applicable to business requirements. The functionality of such accounting software differs from product to product. As every organisation employs multiple software for accounting, operations and other requirements like consolidation, collection of data, etc. the guide emphasises that only the accounting software which is relevant for maintaining books of account should be considered for enabling of audit trail.
     2. Accounting software may be hosted and maintained in India or outside India
     3. Accounting software may be on the premise or on a cloud or subscribed to as Software as a Service (SaaS) software or maintained at a service organisation.
     4. In scenarios wherein the accounting software is supported by service providers, the independent auditor’s report of the service organisation should be considered to ensure compliance with audit trail requirements.
     For ease of reference for the practitioners and the companies, the IG has provided the illustrative list of accounting software used by the companies.
  2. Audit trail: Audit trail is a visible trail of evidence enabling one to trace information contained in statements or reports back to the original input source. Audit trails are a chronological record of the changes that have been made to the data. Any change to data including creating new data, updating or deleting data that must be recorded. Records maintained as audit trail may include the following information:
     1. When changes were made i.e., date and time (timestamp)
     2. Who made the change i.e., user ID
     3. What data was changed i.e., data/transaction reference; success/failure
  Audit trails may be enabled at the accounting software level depending on the features available in such software or the same may be captured directly in the database underlying such accounting software.

• Management’s responsibility: It is the primary responsibility of the management of the company using an accounting software to ensure that an audit trail is effectively implemented as per the requirements stipulated in the Accounts Rules. The key points for implementation and maintenance of an audit trail feature include the following:
  1. Identify what constitutes books of account
  2. Identify the software
  3. Ensure the software has audit trail feature
  4. The audit trail should capture changes to each and every transaction
  5. There should be controls to ensure that changes to the configurations of the audit trail feature are authorised and logs of such changes should be maintained.
  6. The audit trail feature should always be enabled at database level, controls should be implemented for the same.
  7. The audit trail should be protected from any modification.
  8. There should be controls to ensure that periodic backups of the audit trails are taken and archived
  9. There should be controls over maintenance and monitoring of audit trail and its feature, to ensure they are designed and operating effectively throughout the period of reporting.
  10. There should be controls to ensure that User IDs are assigned to each individual and that User IDs are not shared.
  11. There should be controls to ensure that access to the audit trail (and backups) is disabled or restricted and access logs should be maintained, whenever the audit trails have been accessed.
• Responsibility of the auditor: Auditors are required to comment on whether the company is using an accounting software which has a feature of recording audit trail. Additionally, the auditor should report on whether the audit trail feature is configurable, whether it operated throughout the year, whether all transactions in the software are covered in the audit trail feature, whether the audit trail feature has been preserved for record retention. Some of the key responsibilities of the auditor includes the following:
  1. The auditor’s responsibility under the Audit Rules is restricted to transactions which have been recorded in the accounting software and subsequent changes made thereto
  2. With regard to the auditor’s procedures to verify a company’s compliance with the requirements of maintaining an audit trail, it needs to perform the following key procedures:
     1. Assess on a test basis, whether the audit trail has been configured and enabled for the identified
     2. The software configuration that controls enabling or disabling of the audit and access to such configuration.
     3. Changes to the audit trail configuration during the period of audit and management’s review mechanism for such changes
     4. Completeness and accuracy of audit trail or edit logs
     5. Testing that management has performed to assess the completeness and accuracy of the audit trail
     6. Evaluate the management’s approach regarding identification of accounting software considered for the purposes of maintenance of audit trail
     7. Inquire with the management on how they evaluated changes that are required for the maintenance of audit trail as part of changes or upgrades to the accounting software
     8. Consider involvement of specialists or experts to assist in evaluation of management controls and configurations in the accounting software with regard to audit trail
     9. Reviewing the independent auditor’s report of the service organisation in scenarios where the company’s accounting software is supported by service providers
     10. Inquire and understand from the management regarding the procedures implemented to preserve the records as per the statutory record retention period.
  3. Reporting considerations: The auditor is expected to evaluate the reporting implications by giving due consideration to SA 250, Consideration of Laws and Regulations in an Audit of Financial Statements .
  4. Special considerations in case of fraud: In scenarios wherein the occurrence of an error or fraud cannot not be established due to lack of maintenance, availability or retrievability of audit trails, the auditor should consider performing an assessment of risk of material misstatements due to fraud. Professional judgement should be applied while determining reporting implications under the audit report, including under CARO.
  5. Reporting on internal financial controls: An auditor should state in his/her audit report whether the company has adequate internal financial controls with reference to financial statements in place and the operating effectiveness of such controls. Where the feature of audit trail has not operated throughout the year, the auditor may need to appropriately modify his/her comment while reporting under Rule 11(g) depending upon further testing/examination. However, it should be noted that mere non-availability of audit trail does not necessarily imply failure or material weakness in the operating effectiveness of internal financial controls over financial reporting.
  6. Written representations: Auditors should obtain written management representation- the IG has provided an illustrative management representation letter.
  7. Audit documentation: The auditor should comply with the requirements of SA 230, Audit Documentation to document the work performed on the audit trail.

To access the text of the IG, please click here

On 24 March 2021, the Ministry of Corporate Affairs (MCA) issued the Companies (Audit and Auditors) Amendment Rules, 2021, notifying certain changes to Rule 11¹ Other matters to be included in auditors report of the Companies (Audit and Auditors) Rules, 2014 (the Audit and Auditors Rules). Rule 11(g) was introduced, which specified that auditors should report on the use of accounting software by companies having audit trail (edit log) feature. Consequently, in March 2023, ICAI issued the Implementation Guide on Reporting under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 (the implementation guide). Based on the feedback and queries received from different stakeholders, in February 2024, ICAI has issued a revised Implementation Guide on Reporting under Rule 11(g) (the revised implementation guide). The revised implementation guide comprises of detailed guidance on various aspects of the reporting requirement as well as includes a new section on Frequently Asked Questions (FAQs). Some of the important FAQs include:

• Definition of books of account: The FAQs have clarified that the following would be considered as ‘books of account’ maintained in an accounting software and accordingly, an audit trail for the same should be maintained.

• Master data: Vendor/customer master data complements the transaction record and provides further information pertaining to books of account
• Purchase order/sales order: Purchase order/sales order or contracts are used by companies as control/governance mechanism to establish the contractual obligations of the parties. Where the terms of such purchases or sales are agreed at the time of receipt or at the time of booking the invoice and thus depending upon the likely interface/input to the ‘books of account’, one may conclude it to be part of accounting software requiring existence of an audit trail feature
• Records of Property, Plant and Equipment/intangible assets: Property, plant and equipment /intangible assets register may be classified as accounting software, if the same provides direct and auto feed to the accounting software² Auto feed to books of account by a PPE register would be in terms of depreciation, profit or loss on sale of property, plant and equipment/intangible assets, etc..
• Use of spreadsheets: End-user computing tools, like spreadsheets, may be classified as accounting software if the same provides direct and auto feed to the accounting software.

• No exemptions from audit trail requirements: In case a company maintains its books of account in electronic mode, then it is required to comply with the requirements of Rule 3 of the Companies (Accounts) Rules, 2014³ Rule 3 of the Companies (Accounts) Rules, 2014 inter alia requires every company which uses accounting software for maintaining its books of account to include a feature of recording audit trail of each and every transaction. It also requires the software to create an edit log of each change made in the books of account, whether or not the underlying journal entry can be edited or not. This is applicable from 1 April 2023 (Accounts Rules). This requirement is applicable to all companies and no exemption is available for the small and medium companies or for banks and Non-Banking Finance Companies (NBFCs)
• No requirement to report on audit trail in the limited review report: The revised implementation guide has clarified that currently, there is no requirement prescribed under the Companies Act, 2013 or any of the SEBI Regulations for the auditors to report on the audit trail feature of accounting software while issuing their limited review report
• Use of specialist/expert or reliance on information system audit report by the auditor: It has been specified that the auditor may consider involvement of a specialist or expert in the field of information technology to assist in evaluation of management controls and configurations in the accounting software regarding audit trail. However, while doing so, the auditor must comply with the requirements of SA 620, Using the Work of an Auditor’s Expert. Similarly, where accounting software is provided by a service provider, the auditor may consider using independent auditor’s report on service organisation (for example, SOC 1/SOC 2/ SAE 3402) for compliance with audit trail requirements⁴ It has been further clarified that if the SOC or SAE report of the service organisation does not cover the full reporting year, then the auditor would need to modify the reporting under clause 11(g) of the Audit and Auditors Rules. While doing so, statutory auditor of the company is required to comply with the requirements of SA 402, Audit Considerations Relating to an Entity Using a Service Organisation. However, the ultimate responsibility for reporting on audit trail would remain with the statutory auditor only.
• Implication of audit trail feature not operational throughout the year: The revised implementation guide has clarified that in case there are no transactions during any part of the year, it would not be considered as a reason for not enabling the audit trail feature. Similarly, technical glitches in the accounting software during any part of the financial year due to which audit trail feature remains non-functional does not give any exemption to the management regarding their responsibility. Consequently, if the audit trail feature remains non-functional during any part of the year, the auditor would need to appropriately modify reporting under Rule 11(g) of the Audit and Auditors Rules⁵ It has also been clarified that reporting on the audit trail feature is independent of any adverse findings by the auditor . It would also have an impact on reporting under Section 143(3)(b)⁶ The auditor’s report should state whether proper books of account as required by law have been kept by the company, so far as appears from the examination of those books and proper returns and Section 143(3)(h)⁷ The auditor’s report should state any qualification, reservation or adverse remark relating to the maintenance of accounts and other matters connected therewith of the 2013 Act.
• Applicability of materiality concept for reporting on audit trail: Rule 11(g) of the Audit and Auditors Rules states that audit trail is required for each and every transaction, creating an edit log of each change made in the books of account. Thus, reporting would apply for all the transactions, irrespective of the amount involved. Reporting on audit trail is a factual reporting. Auditor’s reporting is based on test checks which would require application of the concept of materiality for the purpose of sample selection
• Requirement to comment on details of audit trail logs: As per Rule 11(g) of the Audit and Auditors Rules, the auditor needs to comment only on the below aspects:

• Whether the company has used such accounting software for maintaining its books of account which has a feature of recording audit trail (edit log) facility
• Whether the audit trail has operated throughout the year for all transactions recorded in the software
• Whether audit trail feature has not been tampered with, and
• Whether audit trail has been preserved by the company as per the statutory requirements for record retention.

Thus, there is no requirement for auditors to comment on the details of audit trail logs.

• Log of all changes: In case of multiple changes made in the books of account, the log of entire chain of changes should be maintained. Retaining only the last/latest changes will not serve the purpose of compliance with audit trail requirements. In a situation where only the last/latest changes are maintained, the auditor would need to appropriately modify the reporting under Rule 11(g) of the Audit and Auditors Rules
• Reporting on accounting software outside India: Audit trail requirements are applicable even for accounting software maintained outside India if the company is incorporated in India. In case the auditor is relying on the work of another auditor, then audit trail feature requirement should form part of SOC/SAE report

• Requirement of audit trail to remain accessible in India at all times: There may be a situation wherein the audit trail is recorded at back-end on a server/cloud maintained outside India.

Rule 3 of the Accounts Rules requires companies to maintain a daily back-up of books of account⁸ This includes other books and papers of the company maintained in electronic mode (including at a place outside India), to be kept in servers physically located in India. Since audit trail would fall under the definition of books of account, a daily backup of the audit trail would also be required to be maintained in a server physically located in India.

To access the text of the revised implementation guide, please click here

On 7 February 2024, ICAI issued the following revised Standards on Auditing (SAs):

• SA 800 (Revised), Special Considerations – Audits of Financial Statements Prepared in Accordance with Special Purpose Frameworks
• SA 805 (Revised), Special Considerations – Audits of Single Financial Statements and Specific Elements, Accounts or Items of a Financial Statement
• SA 810 (Revised), Engagements to Report on Summary Financial Statements

(Together referred to as the ‘revised standards’)

The key changes in the revised standards is:

• Auditors should consider the requirements of SA 700 (Revised), Forming an Opinion and Reporting on Financial Statements , while forming their opinion
• Auditors should also address specific considerations relating to issues such as going concern, key audit matters, other information, etc. while forming their opinion.

Effective Date: The revised SAs would be applicable to audits/engagements for financial years beginning on or after 1 April 2024. The extant SA 800, SA 805 and SA 810 would continue to apply to audits/engagements for the financial year 2023-24.

To access the text of the revised SAs, please click here