Audit & PMO

SAP ITGC checklist and audit trail rules for Indian companies

SAP ITGC checklist for Indian companies: the MCA audit trail rule, Rule 11(g), access, change and backup controls, plus the evidence auditors ask for.

LogicMotive SAP 16 Oct 2026 16 min read

LogicMotive blog cover: SAP ITGC checklist and audit trail rules for Indian companies

For financial years starting on or after 1 April 2023, companies that keep books in accounting software must use software that records an audit trail of every transaction. That software must keep an edit log of each change and its date. The audit trail must not be capable of being disabled (proviso to Rule 3(1), Companies (Accounts) Rules, 2014). The statutory auditor reports on it under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014.

This SAP ITGC checklist is for finance and IT heads of companies on SAP ECC or S/4HANA. It covers the legal frame, where SAP keeps its audit trail, the ITGC checks and evidence auditors ask for, a year-end timeline, and common gaps.

Public companies, and private companies not covered by the exemption below, also get an auditor's report on internal financial controls (IFC). In SAP, those controls rest on IT general controls (ITGCs): who can get in, how changes reach production and how the system is run. The two reports are linked. ICAI guidance says that if ITGCs are not effective and the auditor cannot get enough evidence that the audit trail kept working, the audit-trail comment should be modified.

The rules that bring SAP into the audit report

Section 134(5)(e), Companies Act 2013. What it requires: Directors state that they laid down IFC and that these are adequate and were operating effectively. Applies to: Listed companies. Others, except one person and small companies, cover IFC adequacy in the Board's report (Rule 8(5)(viii), Companies (Accounts) Rules 2014)
Section 143(3)(i). What it requires: The auditor reports whether the company has adequate IFC with reference to financial statements, and their operating effectiveness. Applies to: Public companies, and private companies not covered by the exemption below
Proviso to Rule 3(1), Companies (Accounts) Rules 2014. What it requires: Software must record an audit trail of each transaction and an edit log of each change with its date; the audit trail cannot be disabled. Applies to: Financial years starting on or after 1 April 2023
Rule 11(g), Companies (Audit and Auditors) Rules 2014. What it requires: The auditor reports whether the audit trail operated all year for all transactions, was not tampered with, and was preserved as required for record retention. Applies to: Statutory auditors, from FY 2023-24. ICAI notes that reporting on preservation applies from FY 2024-25
Rule 3(5), as amended by G.S.R. 624(E) of 5 August 2022. What it requires: Back-ups of electronic books, including books kept outside India, on servers physically located in India on a daily basis. Applies to: All companies keeping books electronically
Section 128(5). What it requires: Books of account and vouchers kept for at least eight financial years. Applies to: ICAI applies this eight-year minimum to the audit trail from 1 April 2023

The Section 143(3)(i) exemption comes from G.S.R. 583(E) of 13 June 2017. It covers one person companies and small companies. It also covers private companies with turnover below ₹50 Cr in the latest audited financial statements. Those companies must also have borrowings from banks, financial institutions or body corporates below ₹25 Cr at any point in the year. Both tests apply, after a corrigendum of 13 July 2017, and the company must have no filing defaults.

Auditors follow the ICAI Guidance Note on Audit of IFC over Financial Reporting (September 2015) and the Implementation Guide on Reporting on Audit Trail under Rule 11(g) (revised January 2024). The guide's FAQs make five points that matter for SAP:

Direct database changes affect the books, so the audit trail must cover the database level too.
Vendor master data counts as part of the books, and changes to vendor and customer master data need an audit trail.
Every change must be logged, not just the latest one.
A daily backup in India does not replace an audit trail.
Auditors must test the system and cannot rely on management's representation alone.

The audit trail rule has no size exemption. CARO 2020 has no clause on IT controls.

Where SAP keeps its audit trail

SAP has no single audit-trail switch. The evidence sits in several logs, each with its own settings. SAP has also published SAP Note 3042258, "Maintenance of Audit Trail – Statutory Requirement", on the Indian rule (SAP login required).

Change documents (CDHDR, CDPOS). What it records: Changes to business objects such as purchase orders and master records: old and new values, who and when. Where to read it: Change history in the transaction. Default and what to check: Written for objects defined as change document objects. Custom tables and fields are covered only if a developer defined them
Table logging (DBTABLOG). What it records: Changes to entries in tables flagged for logging, mostly configuration. Where to read it: SCU3. Default and what to check: Needs the profile parameter rec/client set for the production client and the log flag on each table. The classic rec/client default is OFF
Security Audit Log. What it records: Logon attempts, transaction starts, RFC calls, changes to user master records and to the audit configuration. Where to read it: SM19/SM20 in older releases; RSAU_CONFIG and RSAU_READ_LOG in current ones. Default and what to check: Off until configured, unless secure-by-default applies (classically rsau/enable = 1; from 7.40, RSAU_CONFIG static settings override the profile). Check filters, file protection and retention
SAP HANA audit log. What it records: Database-level activity. Where to read it: HANA audit policies. Default and what to check: Relevant to direct database changes on S/4HANA

S/4HANA changed some defaults. Under SAP's "secure by default" settings, the Security Audit Log is activated from S/4HANA 1909, and table logging for business-critical tables and the HANA audit log from S/4HANA 2021. They apply to new installations, system copies and conversions, and SAP says they do not cover every setting. Customers can opt out of these defaults (SAP Note 2926224), and settings can change after go-live, so check the values on every system, S/4HANA included.

How the trail gets switched off or bypassed

ICAI's guide suggests auditors consider the setting that turns the audit trail on or off, and who can access it. They may also consider any change to it during the year or before the audit report date. In SAP, check these routes:

Profile parameters. Someone with Basis access sets rec/client to OFF or to a non-production client, or turns off the Security Audit Log. Report RSPARAM shows current profile values; for the Security Audit Log on 7.40 and later, check RSAU_CONFIG.
Table settings. A transport removes a table's log flag. Transported changes are logged only if table logging for transports is also on.
Client and system settings. The production client is opened in SCC4, or the system change option in SE06 is set to modifiable. SAP logs changes to the system change option.
Debug and replace. A user with debugger change access (S_DEVELOP, object type DEBUG, activity 02) can change values while a program runs. SAP records this in the system log, which someone must review.
Direct table edits. SAP deactivated the &SAP_EDIT edit mode of SE16N through SAP Note 1420281, but community posts show how debugger change access switches it back on.
Deletion and archiving. Security Audit Log files stay until someone deletes them; logs written to the database are removed by archiving object BC_SAL. Table logs (BC_DBLOGS) and change documents (CHANGEDOCU) can be archived out of the database, which is fine only if the archive stays readable for eight years.

The SAP ITGC checklist

This checklist groups SAP ITGCs into four areas. The ICAI Guidance Note (para IG 4.7) lists five: data centre and network operations; system software acquisition, change and maintenance; program change; access security; and application system acquisition, development and maintenance.

1. Access to programs and data

New users and role changes are approved before they reach production: Sample of user creations and role assignments with approvals
Leavers are locked by their last working day: HR leaver list matched to SAP lock dates
Each user ID belongs to one person; generic IDs have a named owner: User list by type, with owners
SAP* exists and is deactivated in all clients; default passwords of SAP*, DDIC, EARLYWATCH, TMSADM, SAPCPIC changed; DDIC and EARLYWATCH locked unless needed: Report RSUSR003; value of login/no_automatic_user_sapstar
SAP_ALL sits on one closely held emergency user; SAP_NEW is only temporary after an upgrade: Users holding SAP_ALL or SAP_NEW
Firefighter (emergency) access is time-bound, justified and reviewed after use: Firefighter logs with reviewer sign-off
Business owners review user access at a set interval and removals are actioned: Signed reviews and removal tickets
Password and logon parameters match policy: Values of login/min_password_lng, login/password_expiration_time, login/fails_to_user_lock, and any security policies assigned to users (SECPOL)
Only named Basis staff can change logging or client settings, or debug with change rights, in production: Users with RSAU_CONFIG, SCC4, SE06 (S_CTS_ADMIN) and debug-change access

Segregation of duties (SoD) also belongs here: auditors look for users who can complete a sensitive process alone, such as creating a vendor and paying it. Our post on SAP SoD conflicts auditors flag covers conflict pairs, rulesets and fixes, and how a tool such as AccessIntel tests for them.

2. Program change

Every production change, configuration included, moves by transport from development through quality (STMS): Transport list for the year; test and approval for a sample
Developers cannot import into production, and nobody approves their own change: Users with import rights; sample showing separate builder and approver
The SE06 global setting in production is "not modifiable": Screenshot and SE06 change log
The production client in SCC4 allows no client-specific or cross-client changes: SCC4 settings and change history
Emergency changes are logged and approved after the fact: Emergency change register matched to transports
No direct table edits in production through SE16N edit mode, SM30 on sensitive tables, or debug and replace: Users with these rights; system log and Security Audit Log extracts

SCC4 does not lock "current settings", the customising activities SAP lets users maintain directly in a production client, so control those through access rights.

3. Computer operations

Batch jobs run under technical users, and only authorised staff create or change them: SM37 job list with step users; job administration rights
Failed jobs and interface errors are monitored and resolved: Error logs with tickets
Production is backed up daily to servers in India, and restores are tested: Backup logs; last restore test
Change documents, table logs and Security Audit Log files stay readable for at least eight years: Retention policy; archive index; sample retrieval
Incidents are logged, prioritised and closed with a root cause: Ticket extract for the year
A hosting or support provider's controls report (SOC 2 or SAE 3402) covers the audit trail and the full year: The report, plus evidence for any months it misses

4. Program development and implementation

Projects, upgrades and S/4HANA conversions are tested and signed off by the business before go-live: Test results and go-live approval
Migrated balances and master data are reconciled: Legacy-to-SAP reconciliation signed by finance
Audit-trail settings are rechecked after any upgrade, conversion or system copy: Before and after values of logging parameters
New custom tables holding financial data get logging or change documents: List of custom tables with the log flag

A timeline for an April to March year

October to December, before the interim audit: List systems holding books of account. Run access and leaver reviews. Check logging, SE06 and SCC4. Test a restore. Request your provider's controls report
January to March: Close interim findings. Run the next access review if due. Freeze changes to logging settings unless approved. Reconcile emergency changes to transports
At 31 March: Capture parameter values, SE06 and SCC4 settings, critical-access user lists, the year's transport list and log retention status
April until the audit report is signed: Avoid changes to audit-trail settings, since auditors also consider post-year-end changes. Prepare the management representation on the audit trail

Common findings and quick fixes

rec/client is OFF or excludes the production client: Set it for production, and agree with Basis which tables carry the log flag
Custom tables with financial data are not logged: Set the log flag by transport, or add change documents
Security Audit Log inactive or filters too narrow: Configure critical events and users in RSAU_CONFIG (SM19 on older releases), and name a reviewer
Leavers active, or generic IDs without an owner: Monthly HR-to-SAP reconciliation
SAP_ALL or debug-change access on several dialog users: Role-based access, with emergencies routed through a logged firefighter ID
Logs deleted or archived with no retention plan: Set an eight-year retention policy and test retrieval

These are operating habits more than projects, so whoever provides your SAP AMS and support should own them, and they belong in any SAP AMS transition plan. For an independent check before the auditors arrive, LogicMotive's SAP PMO and ITGC audit support covers the same ground.

Frequently asked questions

Does the MCA audit trail rule apply to SAP?

Yes. It applies to any software used to maintain books of account. ICAI's guide notes that most commonly used accounting software, ERP included, has an audit-trail feature the company can enable or disable, so auditors test the controls around that setting.

Is a daily backup in India enough to meet the audit trail rule?

No. The ICAI guide treats backup and audit trail as separate requirements. The daily backup under Rule 3(5) protects the data, while the audit trail under Rule 3(1) records each change with its date and must stay enabled.

How long should SAP logs be kept?

At least eight financial years. Section 128(5) sets that minimum for books of account, and ICAI applies it to the audit trail from 1 April 2023. Plan retention for change documents, table logs and Security Audit Log files.

Is S/4HANA compliant out of the box?

Not by itself. From S/4HANA 1909 (Security Audit Log) and S/4HANA 2021 (table logging for business-critical tables), SAP applies secure-by-default settings in new installations, system copies and conversions. Customers can opt out, and SAP says the defaults do not cover every setting. Access, change control, retention and log review stay with the company.

Get an AMS health check

An AMS health check is an independent review of how your SAP is supported today: ticket data and SLAs, backlog, documentation, and the change, access, logging and backup practices that auditors test as ITGCs. You get a written view of what to fix and whether to fix the current arrangement or go to market.

What you provide: a ticket export, your current contract and SLA schedule, an overview of your SAP systems and releases, and your last audit observations on IT controls. We will confirm the exact scope with you before work begins.

Sources

Implementation Guide on Reporting on Audit Trail under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 (Revised 2024 Edition), The Institute of Chartered Accountants of India, resource.cdn.icai.org (accessed Oct 2026)
Implementation Guides (AASB listing), The Institute of Chartered Accountants of India, icai.org (accessed Oct 2026)
Guidance Note on Audit of Internal Financial Controls Over Financial Reporting (announcement, 14 September 2015), The Institute of Chartered Accountants of India, icai.org (accessed Oct 2026)
The Companies Act, 2013 (sections 128(5), 134(5)(e) and 143(3)(i)), India Code, indiacode.nic.in (accessed Oct 2026)
Rule 8, Companies (Accounts) Rules, 2014 (rule text, including non-applicability to one person and small companies), CA2013, ca2013.com (accessed Oct 2026)
Companies (Accounts) Fourth Amendment Rules, 2022, G.S.R. 624(E) dated 5 August 2022 (notification number and date; amended rule text quoted in source 1), CA Virtual / Webtel, cavirtual.webtel.in (accessed Oct 2026)
MCA favorably revisits exemption notification relating to private companies (text of G.S.R. 583(E) table), Vinod Kothari Consultants, vinodkothari.com (accessed Oct 2026)
Corrigendum S.O. 2218(E) dated 13 July 2017 to G.S.R. 583(E) (notification text), Simpliance, simpliance.in (accessed Oct 2026)
The Companies (Auditor's Report) Order, 2020, DPNC Global, dpncindia.com (accessed Oct 2026)
SAP Note 3042258, Maintenance of Audit Trail – Statutory Requirement, SAP for Me (login required), me.sap.com (accessed Oct 2026)
The story resumes – Secure By Default for SAP S/4HANA 2021, SAP Community (Bjoern Brencher, SAP), community.sap.com (accessed Oct 2026)
Concept (change documents), SAP Help Portal, help.sap.com (accessed Oct 2026)
Logging Database Tables, ABAP Keyword Documentation 7.50, SAP Help Portal, help.sap.com (accessed Oct 2026)
REC/CLIENT Parameter in the System Profile, SAP Help Portal, help.sap.com (accessed Oct 2026)
The Security Audit Log (NetWeaver 7.4), SAP Help Portal, help.sap.com (accessed Oct 2026)
Preparing the Security Audit Log, SAP Help Portal, help.sap.com (accessed Oct 2026)
Scenarios for Using the Security Audit Log, SAP Help Portal, help.sap.com (accessed Oct 2026)
Setting the System Change Option, SAP Help Portal, help.sap.com (accessed Oct 2026)
Client Control, SAP Help Portal, help.sap.com (accessed Oct 2026)
Protecting Special Users, SAP Help Portal, help.sap.com (accessed Oct 2026)
Protective Measures for Special Profiles, SAP Help Portal, help.sap.com (accessed Oct 2026)
Profile Parameters for Logon and Password (Login Parameters), SAP Help Portal, help.sap.com (accessed Oct 2026)
Displaying Field Values at Runtime (ABAP Debugger), SAP Help Portal, help.sap.com (accessed Oct 2026)
ABAP Tricks for Functionals, Trick #1: Edit Table Values in S/4HANA using SE16 Debug Edit, SAP Community (member post), community.sap.com (accessed Oct 2026)
Activate &SAP_EDIT in SE16N (SAP ECC 6.0), SAP Community (member post with moderator warning), community.sap.com (accessed Oct 2026)
Archiving Table Change Logs (BC-DWB-CUS), SAP Help Portal, help.sap.com (accessed Oct 2026)
Archiving Change Documents (BC-SRV-ASF-CHD), SAP Help Portal, help.sap.com (accessed Oct 2026)

LogicMotive SAP

SAP & ERP consulting team, Pune