Two separate tests for electronic books
Companies keeping books of account or relevant books and papers electronically should test both access in India and backup location. Rule 3(1) of the Companies (Accounts) Rules, 2014 requires the electronic records to be accessible in India at all times for later reference. The proviso to Rule 3(5) requires daily backup on servers physically in India, including for electronic books kept outside India. The rules allow for records kept outside India, subject to these safeguards and other applicable requirements. The 2022 fourth amendment, G.S.R. 624(E), introduced the daily frequency, continuous accessibility and the overseas-provider disclosure on publication in the Gazette.
Read the applicable text: Companies (Accounts) Rules, 2014, Rule 3, including the 2022 amendments Companies Act, 2013, section 128.
Map the books and actual backup destinations
List each ledger, subledger, branch feed and repository containing relevant papers. For each, record the primary environment, actual backup target, physical location evidence and recovery dependencies. Match the provider's evidence to the production account, dataset and time period. An India billing address or a generic list of available cloud regions is weak evidence of the location of a particular backup.
Reconcile days to completed jobs
Match expected days to successful backups at the India destination. Check retries against the date of the failed job and test whether the retained copy can be restored. Restore selected periods and reconcile ledger counts, totals and linked files. This operational test supports evidence that the records can be read and recovered; Rule 3 does not prescribe a sample size or a technical backup architecture.
Prepare the annual Registrar intimation
Under Rule 3(6), the company intimates the required particulars annually at the time of filing its financial statement. Prepare the provider name, internet protocol address, provider location where applicable and the provider-supplied address when the records are kept on cloud. If the provider is outside India, also capture the name and address of the person in control of the books and other papers in India. Reconcile the filing particulars to current provider and control records and retain the filed acknowledgement.
Handle changes and gaps explicitly
For a migration or vendor exit, preserve records in a form that accurately presents the original information, keep branch information as received and document readability and retrieval. Keep an incident register for any missing daily backups and the corrective action. A later successful job or a filing acknowledgement does not prove historical daily coverage. For financial years beginning on or after 1 April 2023, a company that uses accounting software for its books must use software that records an audit trail for every transaction and a dated log of each change to the books, with an audit trail that cannot be disabled. Keep backup evidence separately.
Six worked illustrations
All facts and amounts are fictional. Calculations illustrate the stated assumptions, not a predetermined legal outcome.
Illustrative example 1: Daily exception count
An October job history has 31 expected calendar dates. It evidences 29 successful India backups on distinct dates and two dates with failures and no successful retry. The unresolved count is two; 29 divided by 31 is 93.55%, an operational metric, not a compliance tolerance.
Illustrative example 2: Two environments, one incomplete
An ERP and evidence repository are both in scope. For a seven-day review, the ERP has seven successful India copies and the repository six. There are 13 of 14 expected dataset-days, but only six days with complete coverage for both.
Illustrative example 3: Overseas primary with verified India backup
The overseas production provider shows ten daily snapshots, but only nine matching India backup destinations for those dates. Verify nine India dataset-days and investigate the missing tenth; a foreign production snapshot alone does not close the gap.
Illustrative example 4: Branch file restore control
A restored dataset contains 9,988 records against 10,000 control records. The shortfall is 12. A green job status is not evidence that those records are retrievable; reconcile source manifests before closing the issue.
Illustrative example 5: Provider migration
For a 12-day cutover check, the old provider supports India backups on days 1–7 and the new provider on days 7–11. There are 11 distinct covered dates and one missing date. The duplicate on day 7 does not fill day 12.
Illustrative example 6: Annual provider particulars
For a cloud provider outside India, the company must report the applicable provider particulars and the name and address of the person in control of the books and other papers in India. A working paper holding four applicable provider categories and the person's name without the address has one unresolved item. Resolve it against current evidence before filing.
Ten-step verification table
| Step | Action | Evidence |
|---|---|---|
| 1 | Identify the electronic records in scope | Systems map for books, supporting papers and branches. |
| 2 | Test ongoing access from India | Access log and evidence of usable display. |
| 3 | Map each primary and backup environment | Production and backup inventory. |
| 4 | Verify physical India location of the copies | Provider and account-specific region evidence. |
| 5 | Compare expected days with actual successful jobs | Day-wise backup report and retry history. |
| 6 | Perform restore and control checks | Restored balances, document counts and exceptions. |
| 7 | Check fidelity of branch and source records | Original branch feeds and migration reconciliation. |
| 8 | Assemble annual provider particulars | Provider confirmations, addresses and network records. |
| 9 | Identify the person in control where required | Current designation and verified India address. |
| 10 | Match financial-statement filing to approved evidence | Filed particulars, acknowledgement and compliance review. |
Sixteen practitioner FAQs
1. Does Rule 3 prohibit an overseas production system?
The rule requires continuous accessibility in India and daily India backups, including when records are kept abroad. Assess any separate rules for the company.
2. Does an Indian vendor office establish backup location?
No. Verify where the specific copies reside.
3. Can remote login in India replace daily backups?
No. It addresses a different requirement.
4. Does weekly backup meet the daily requirement?
No. The Rule 3(5) proviso requires daily backup.
5. Are statutory holidays automatically excluded?
The proviso states a daily requirement without a business-day exception.
6. Does the rule mandate a full rather than incremental backup?
It does not prescribe that architecture. Verify the recoverability of the complete records.
7. Does a second successful job cover a missing earlier day?
No. Reconcile successful runs to the specific days and datasets.
8. Is an edit log the same as a backup?
No. An edit log records changes and cannot restore the books by itself. The separate audit trail obligation applies to companies using accounting software for their books.
9. Can the annual intimation be ignored if the vendor did not change?
Rule 3(6) requires the applicable intimation annually with the financial statement filing.
10. Is the Indian control person's address needed for every provider?
Rule 3(6)(e) applies where the provider is located outside India.
11. Can a billing address substitute for the cloud address?
Use the relevant address supplied by the provider for cloud records.
12. Should branch uploads be edited to match group formatting?
Preserve what was originally received; keep transformed copies separate from the originals.
13. Can a migration use a different format?
Rule 3(2) permits a format accurately presenting the information, with records complete and unaltered.
14. What if the provider manages the restore keys?
Confirm how the company can obtain a usable restoration and document the dependency.
15. Does an acknowledgement prove every backup was made?
No. Keep separate job and restoration evidence.
16. Is a fixed statutory restore-test sample specified here?
No. Select a sample appropriate for the risks and datasets.
Sources
Gazette texts of the Companies (Accounts) Rules, 2014 and amendments; Gazette notification G.S.R. 624(E), 2022; Companies (Accounts) Rules, 2014, Rule 3, including the 2022 amendments Companies Act, 2013, section 128