ICAI Standard on Assurance Engagements (SAE 3402), Section 143(3)(j) Rule 11(g) of Companies Act, 2013 & RBI Master Direction on IT Governance

Information Systems & SOC

Independent SOC 1, SOC 2, and SOC 3 reporting under SAE 3402 / ISAE 3402, IT General Controls (ITGC) evaluations, RBI IT Governance compliance, and MCA mandatory Audit Trail (Rule 11g edit log) verifications with universal UDIN certification.

CA Due Diligence

Official Portal Filing

State Stamp Advisory

Information Systems & SOC Statutory Advisory

Turnkey Statutory Filing

MCA & Tax Practice

Official Govt of India AuthorityMinistry of Corporate Affairs & MeitY, Government of India

MCA V3 Portal & MeitY Cyber Security (CERT-In)

The official Government of India portal for MCA Rule 11(g) edit log reporting, CERT-In cybersecurity direction compliance (cert-in.org.in), and ICAI UDIN authentication.

Visit Govt Portal

STATUTORY OVERVIEW

Information Systems Auditing & SOC Attestation Services

In modernized business operations powered by Enterprise Resource Planning (ERP) platforms, cloud infrastructure, and fintech integrations, automated system controls underpin the integrity of financial and operational reporting. Governed by the Standard on Assurance Engagements (SAE 3402) issued by the Institute of Chartered Accountants of India (ICAI) and global ISAE 3402 frameworks, our Information Systems Audit practice delivers independent attestation on technology governance, automated business cycle controls, cybersecurity safeguards, and statutory compliance with MCA audit trail regulations and the Digital Personal Data Protection Act, 2023 (DPDP Act).

Statutory & Practice Summary • At-A-Glance

ICAI UDIN Authentication Mandate

Governing Framework

ICAI Standard on Assurance Engagements (SAE 3402), Section 143(3)(j) Rule 11(g) of Companies Act, 2013 & RBI Master Direction on IT Governance

Regulatory Authority

Ministry of Corporate Affairs (MCA), Reserve Bank of India (RBI) & The Institute of Chartered Accountants of India (ICAI) - Digital Accounting and Assurance Board (DAAB)

Professional Assurance

Chartered Accountants Attestation under ICAI Standards & Code of Ethics

DOCUMENTATION MATRIX

Mandatory Documents Checklist

Self-attested scanned copies required

1. Promoters / Partners / Directors KYC

✓Board of Directors / Chief Information Security Officer (CISO) engagement mandate
✓Confidentiality and Data Non-Disclosure Agreement (NDA) with encrypted access protocols
✓Written Management Assertion on system controls under SAE 3402 / ISAE 3402

2. Registered Office & Premises Proof

✓Data Center, Cloud Hosting (AWS, Azure, Google Cloud), and corporate server location certificates
✓Network architecture diagrams and perimeter firewall configuration documents

3. Specific Statutory Declarations & Enclosures

•System Description document detailing software architecture, database layers, and service boundaries
•Accounting software audit trail (edit log) technical parameter logs proving zero admin override under Rule 11(g)
•IT General Controls (ITGC) documentation: User Access, Change Management, and Computer Operations policies
•Privileged Access Management (PAM) logs and quarterly segregation of duties (SoD) user role matrices
•Business Continuity Plan (BCP) and Disaster Recovery (DR) test drill execution reports
•Vulnerability Assessment and Penetration Testing (VAPT) reports conducted by CERT-In empaneled auditors

PROCEDURAL ROADMAP

Step-by-Step Filing & Approval Process

Structured execution roadmap managed by our Chartered Accountants from pre-filing due diligence to certificate allotment.

01Month 1

Scoping & Trust Services Criteria Mapping

Defining system boundaries, identifying user entities, selecting applicable Trust Services Criteria (Security, Availability, Confidentiality), and planning the audit window.

02Months 2 - 3

ITGC & Application Controls Testing

Evaluating change management tickets, testing code deployment approvals, auditing user access de-provisioning, and validating automated ERP business rules.

03Months 4 - 5

Operating Effectiveness & Edit Log Verification

Testing sample populations over a 6-to-12-month period, auditing database logs, and verifying that accounting software audit trails operated without interruption under Rule 11(g).

04Final Month

SOC 1 / SOC 2 Report & UDIN Issuance

Issuing the formal Service Auditor's Report (SOC 1 / SOC 2 Type II) with mandatory ICAI UDIN, providing comprehensive assurance to clients and global enterprise stakeholders.

SOC 1 & SOC 2 (Type I & Type II) Attestation Reports

Practice Scope & Statutory Guidance

For SaaS providers, cloud hosts, third-party payment aggregators, and BPO operations, we issue independent SOC 1 reports (evaluating internal controls over financial reporting under SAE 3402) and SOC 2 reports (evaluating Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy). Our engagements include walkthroughs, design adequacy testing, and periodic sampling across 6-to-12-month operating effectiveness windows.

IT General Controls (ITGC) & Automated Business Application Controls

Practice Scope & Statutory Guidance

We evaluate IT governance across four fundamental ITGC pillars: User Access Management (privileged access reviews, multi-factor authentication, segregation of duties), Change Management (code reviews, testing signoffs, deployment pipelines), Computer Operations (batch processing, data backup verification, incident management), and System Development. Additionally, we test automated business logic, tolerance limits, and three-way matching within ERP environments.

MCA Audit Trail (Rule 11g) & RBI IT Governance Compliance

Practice Scope & Statutory Guidance

Under Section 143(3)(j) of the Companies Act, 2013 read with Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014, statutory auditors must report whether the company has operated accounting software featuring a tamper-proof audit trail (edit log) enabled continuously throughout the year with no admin override. We perform technical audit trail verification. For financial entities, we benchmark IT frameworks against the updated RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices.

STATUTORY MATRIX

Statutory Provisions & Regulatory Comparative Matrix

Comparative analysis of governing sections under the new framework alongside legacy statutory references.

Information Systems Assurance Framework	Governing Standard / Statute	Assurance Scope & Target Objective
SOC 1 Report (Type I & Type II)	ICAI SAE 3402 / ISAE 3402	Evaluates internal controls over financial reporting at a service organization (payroll, payment gateways, fund accounting).
SOC 2 Report (Type I & Type II)	AICPA Trust Services Criteria & SAE 3000	Evaluates controls relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy for cloud & SaaS entities.
MCA Audit Trail (Edit Log) Mandate	Section 143(3)(j) read with Rule 11(g)	Mandatory reporting by statutory auditors confirming accounting software operates an untampered audit trail for all entries.
RBI Master Direction on IT Governance	RBI IT Governance Directions, 2023	Mandatory governance, cyber resilience, vendor risk management, and IT strategy oversight for banks and NBFCs.
Digital Personal Data Protection Compliance	DPDP Act, 2023 & Rules	Audit of technical and organizational measures protecting digital personal data against breach or unauthorized processing.

ONGOING GOVERNANCE

Mandatory Post-Registration Compliances

Failing to complete statutory post-incorporation actions carries steep daily penalties. Our CA firm manages continuous compliance:

SOC 1 / SOC 2 Type II ReportAnnual 12-month reporting cycle

Annual SOC Surveillance Audit

Continuous annual renewal of service organization control reports to maintain vendor qualification with enterprise clients.

Independent Auditor's ReportAnnual Financial Statement Close

Statutory Auditor Rule 11(g) Edit Log Attestation

Submitting formal audit trail certification to the statutory auditor confirming accounting software compliance.

CERT-In Portal Incident FormWithin 6 hours of incident notice

CERT-In Cyber Incident Reporting

Mandatory notification of specified cybersecurity incidents to the Indian Computer Emergency Response Team under IT Act regulations.

Companies Act Section 128Minimum 8 Years

Audit Trail Retention Mandate

Preserving tamper-evident database audit trails, database dumps, and modification histories for a minimum of 8 financial years.

FREQUENTLY ASKED QUESTIONS

Statutory FAQs & Practical Guidance

Frequently asked questions and procedural guidance regarding Information Systems & SOC.

What is the difference between a SOC 1 and a SOC 2 report?

A SOC 1 report (under SAE 3402) evaluates internal controls at a service organization that are relevant to its clients' internal control over financial reporting (ICFR)—such as payroll processors, core banking SaaS, and loan servicing platforms. A SOC 2 report evaluates technological and operational controls based on the AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy) for cloud hosts, cybersecurity providers, and B2B software vendors.

What is the difference between a Type I and Type II SOC report?

A Type I report evaluates the suitability of the design of controls as of a single specific point in time (snapshot). A Type II report evaluates both the suitability of the design AND the operating effectiveness of controls over a minimum specified period (typically 6 to 12 months), involving detailed audit testing of samples throughout that operational window.

Can a company use ERP software hosted on third-party cloud to comply with MCA Rule 11(g)?

Yes, provided the cloud ERP software (such as SAP S/4HANA, Oracle Cloud, NetSuite, or TallyPrime Cloud) has the edit log feature activated continuously at the database or application level for all accounting entries, records every change with date, time, and user credentials, prevents administrative disabling or log deletion, and that backup logs are retained in India in accessible form.

What are IT General Controls (ITGC) and why do statutory financial auditors test them?

IT General Controls (ITGC) are foundational technology policies and practices that support the reliable functioning of applications and databases. They cover User Access Management, Change Management, and Computer Operations. Financial auditors test ITGCs because if the underlying IT environment is secure and reliable, the financial data, automated calculations, and reports generated by the ERP can be relied upon with higher confidence.

STATUTORY ADVISORY DESK • PRACTICE INQUIRIES

Statutory Inquiries & Practice Advisory

In strict conformity with ICAI Council Guidelines No. 1-CA(7)/06/2004, professional engagements for Information Systems & SOC are accepted following formal conflict verification and statutory documentation. Contact our registered practice offices for procedural guidance.

Contact Practice Office +91 99140-14949