No Audit Trail for Six Months: Reporting Gaps, Suspicious Journals and Unverifiable Data
Finserve Capital Limited is a listed NBFC with a ₹3,400 crore loan book and profit after tax of ₹96 crore; overall materiality is ₹7 crore. Its accounting runs on a cloud ERP, while loans are originated and serviced on a vendor-hosted loan management system (LMS); the ERP is a SaaS product with no local database and the vendor will not give the audit team direct query access.
In April 2026 the team learns that: (i) the ERP's audit trail (edit log) was enabled only on 1 October 2025, after a system upgrade, and was not available from 1 April to 30 September 2025; (ii) in November 2025 the vendor made three direct database changes, recorded only in an email from the vendor's project manager; (iii) analytics on 1.2 million journal entries flagged 47 manual journals posted on 31 March 2026 after 21:00 by one user holding superuser rights - 31 reverse interest income and 16 increase provisions; (iv) the client supplies a 'read-only' CSV of the loan book but cannot confirm that no loan records were deleted, and no reconciliation exists between the LMS and the general ledger.
1. How do you report the audit-trail facts, and what is the effect on your risk assessment and on reliance on automated controls?
Read the worked answer
Reporting. CARO 2020 requires the auditor to state whether the accounting software has an audit trail (edit log) facility and whether it operated throughout the year for all relevant transactions, and whether the audit trail was tampered with. Here the answer is an explicit negative for 1 April to 30 September 2025, naming the period and the cause (the upgrade). The three vendor database changes must be evaluated separately: changes made outside the application are not captured by an application-level edit log, so the report must record that the facility did not operate for those changes. A bare 'yes' would be wrong.
Risk assessment. An IT general control failure of this kind means automated application controls - interest accrual, overdue and NPA classification rules, provisioning logic, user access - cannot be relied on for the affected period. Treat journal-entry manipulation and management override as significant risks, and where the superuser can both post and approve, as a fraud risk under SA 240. Shift the strategy towards substantive testing and computer-assisted techniques, test user access and privileged activity, and evaluate whether the deficiency amounts to a material weakness for reporting under section 143(3)(i) on internal financial controls.
Communication. Report the deficiency to those charged with governance and the audit committee under SA 265, and document the effect on the audit approach.
2. What procedures will you perform on the 47 journals, and what would make you escalate?
Read the worked answer
Start with the population. Extract all manual journals for the year and filter by user, time, account, amount and period; identify the approval workflow and confirm whether the superuser could post without a second approval - a segregation-of-duties failure that is itself reportable.
The 31 interest-income reversals. Recompute interest on the affected loan accounts; check whether the entries were reversed on 1 April 2026 (a reversal the next day is a strong window-dressing indicator); check whether the reversal moved EMI overdue days past the classification threshold; agree borrower statements and the LMS calculation; obtain the rationale from the preparer.
The 16 provision entries. Recalculate the provisioning under the applicable RBI norms and the board-approved policy; check whether the risk function approved them or whether the superuser acted alone; compare with prior-quarter provisioning patterns.
The vendor changes. Obtain the email, the vendor's change log and what each change altered; interview the superuser and the CFO; check whether the changes touched live financial data or configuration.
Escalate if: journals lack support, if one user both posted and approved, if the reversals changed asset classification or avoided an NPA, or if entries were reversed immediately after year end. Those are fraud indicators under SA 240 - report to those charged with governance and the audit committee, evaluate whether the financial statements require adjustment, and consider the effect on the opinion. Document the selection criteria, the complete population, each exception and its resolution.
3. Is the read-only extract sufficient evidence? What do you do about the missing LMS-to-GL reconciliation, and how do you document the analytics?
Read the worked answer
Not sufficient on its own. A read-only CSV is information produced by the entity, and SA 500 requires the auditor to evaluate whether it is complete and accurate before relying on it. 'Cannot confirm no records were deleted' means completeness is unproven, so the extract supports corroboration only, not the primary conclusion on the loan book.
Procedures to establish completeness. Reconcile record counts and the sum of balances in the extract to LMS control totals and to the general ledger; check the loan-account numbering sequence for gaps; obtain the vendor's SOC 1 / ISAE 3402 report, read it and test the complementary user entity controls; request a second extraction at a different date and compare; and, preferably, perform the auditor's own extraction with vendor cooperation and compare it with the client's file.
The missing reconciliation. The absence of an LMS-to-GL reconciliation is the control gap, and it sits over the largest balance in the financial statements. Make the reconciliation a precondition of completion; if management will not build one, build one yourself from loan-level data to the ledger. If the vendor will not cooperate and no alternative evidence exists, the possible effect on the loan book and interest income is material and pervasive, which points to a disclaimer under SA 705 - after first taking the matter to the audit committee.
Documentation (SA 230). Record the source system, the date and identity of the provider of the extract, the completeness checks performed and their results, the analytics script and criteria, the population size, each exception and how it was resolved.