1. What Must Be Logged - Legal Standard

As per RBI Cyber Security Framework, SOX 404, and now Companies Act Rule 3 proviso, every override must log 7 fields:

Who + When + What + Before Value + After Value + Why + Who Approved. If any field missing, audit fails.

New Indian Law - Mandatory since 1st April 2023:

Every company which uses accounting software must use only such accounting software which has a feature of recording audit trail of each and every transaction, creating an edit log of each change made... and ensuring that the audit trail cannot be disabled

Proviso to Rule 3(1), Companies (Accounts) Rules 2014 as amended in 2021. The trail must be retained for 8 years and cannot be modified or deleted.

Failure to maintain audit trail = violation of Sec 128. Penalty INR 25,000 to INR 5 lakh and auditor must qualify report under Rule 11(g).

2. Why Courts Treat Non-Logging as Fraud

SEC and Indian regulators apply this doctrine: "If override is not logged, it is presumed to be fraudulent."

Under SOX Section 404, SOX defines internal control as a process. The SEC has held:

• Inadequate documentation of controls = violation of Sections 13(b)(2)(A) and 13(b)(2)(B) of Securities Exchange Act because incentives were not appropriately documented and manufacturer had inadequate internal controls
• Failure to disclose internal control issues to investors and auditors is fraud. In SEC v Quality Services Group (2014), CEO and CFO were charged with fraud for knowing of significant internal control issues with inventory practices and failing to disclose them and misrepresenting their evaluation of ICFR

3. Detailed Case Laws

A. Banking / RBI Cases - India

1. RBI vs Bandhan Bank - Aug 2025 - Rs 44.70 Lakh Penalty
The most direct case on your point. RBI imposed penalty specifically for:

"Payment of commissions to certain employees and failure to record audit trails or log access"

RBI inspection found bank allowed overrides for commission payments without maintaining access logs. Held as deficiency in regulatory compliance. This is now a template penalty used for all banks.

2. ICICI Bank / PNB Nirav Modi Case (2018) - SWIFT Override
Punjab National Bank employees issued LoUs in SWIFT bypassing CBS. SWIFT messages had no audit trail linking to CBS. No log of who authorized override, no maker-checker log. CBI chargesheet held this as criminal breach of trust + failure of audit trail under RBI's 2016 Cyber Security Circular which mandates logging of all privileged access. Result: Rs 14,000 crore fraud.

3. RBI Circular on Cyber Security Framework 2016 & 2023 Master Direction on IT Governance
Mandates: All privileged activities must be logged, logs must be immutable, and reviewed daily. Failure = penalty under Banking Regulation Act. This is basis for Bandhan penalty.

B. Corporate / Companies Act Cases

4. Satyam Computers Ltd Scam 2009 - The Origin Case for India
Ramalinga Raju and team overrode SAP controls to create fake invoices, fake fixed deposits. Admin user created super-user IDs that bypassed maker-checker and edit logs were disabled in accounting software. SFIO report: "Management override without audit trail was the single reason fraud continued for 7 years". Led to Section 134(3)(n) - Directors' responsibility for internal financial controls, and now Rule 3 audit trail.

5. Parekh Aluminex Ltd - SEBI Order WTM/MPB/ISD-FAC/57/2018 dt 31 Oct 2018
SEBI debarred auditors for 5 years for failing to detect siphoning where management overrode bank balance confirmations. SEBI held:

Auditors could also not rely on bank audits as they are mandated to conduct audit independent

Reason: Company had overridden bank statements, auditors failed to ask for audit trail of overrides. Shows liability extends to auditor if override log not checked.

C. US SOX Cases - Applied as Persuasive Precedent in India by SFIO/SEBI

6. Enron (2001) and WorldCom (2002) - Management Override
Executives overrode controls to hide debt. No log. Result: SOX Act 2002 passed. Section 404 requires CEO/CFO certification that ICFR evaluated. Failure to log override = material weakness.

7. SEC vs Manufacturer - Sales Incentive Case (No Penalty but Violation Found)
SEC settled with manufacturer for inadequate internal controls where sales incentives offered to largest customers at quarter-end were not documented. Violation of internal controls even without fraud, because override of pricing was not logged.

4. Liability Breakdown if You Fail to Log

Supreme Court 2026 update: In digital fraud cases, Supreme Court has now held banks must compensate victims if investigation finds loss occurred due to failure of due diligence. Non-logged override = failure of due diligence per se.

5. What Auditors Check Now (From 2023-24 Audit Reports)

Under Rule 11(g) - Auditors must report:

1. Was audit trail enabled for whole year?
2. Was it tampered with?
3. Were all overrides logged with user ID and timestamp?
4. Did management override audit trail itself?

If answer is No to any, they issue Qualified Opinion - which triggers SEBI and MCA notice.

Best Practice to Comply:

1. Immutable log - WORM storage, no edit/delete feature
2. Dual control for super-user - Any override needs second person approval logged
3. Daily exception report of all overrides reviewed by Audit Committee
4. Retain 8 years