Paras Healthcare auditors could not verify database audit trails

Paras Healthcare Limited’s auditors could not verify whether database-level audit trails operated throughout the year ended 31 March 2026 in outsourced accounting, payroll and laboratory systems. The limitation covered three system categories, including accounting and payroll software used by Paras Healthcare and two subsidiaries, although the related audit opinions remained unmodified.

What database audit trails could Paras Healthcare auditors not verify?

Paras Healthcare auditors could not comment on whether audit-trail functions for direct database changes were enabled and operated throughout the year ended 31 March 2026 in specified third-party-operated software. An audit trail, or edit log, records changes to data, including who made a change where that information is captured. The disclosure was made under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014, as amended.

For books of account, Paras Healthcare and two subsidiaries used software operated by a third-party service provider. The auditor said the Independent Service Auditor’s Assurance Report, known as a Type 2 report, did not provide information on edit logs for direct database-level changes. The report was issued under International Standard on Assurance Engagements 3000 (Revised), or ISAE 3000 (Revised), which covers assurance engagements other than audits or reviews of historical financial information.

For payroll records of Paras Healthcare and two subsidiaries, and laboratory records used only by Paras Healthcare, the relevant Type 2 reports were absent. The disclosure does not state that the database-level logs were disabled in fiscal 2026. It states that the auditor lacked the external assurance evidence needed to comment on whether the feature was enabled and operated throughout the year.

Which Paras Healthcare systems and entities were affected?

The fiscal 2026 disclosure identified three third-party-operated categories: books of account for Paras Healthcare and two subsidiaries, payroll records for Paras Healthcare and two subsidiaries, and laboratory records used only by Paras Healthcare. The auditor did not name the two subsidiaries, software providers or number of locations covered by the outsourced systems.

The accounting-system exception was limited to direct changes at the database level rather than an assertion that all ordinary transactions lacked an audit trail. For the financial year beginning 1 April 2025, the auditor said Paras Healthcare and its Indian subsidiaries had used accounting software with an audit-trail facility for relevant transactions, except for the stated consequences of the outsourced-system exceptions. The unresolved issue was whether changes made directly in the service provider’s database were recorded.

How did Paras Healthcare’s audit-trail position change over three years?

Paras Healthcare’s disclosure changed from identified audit-trail feature gaps in the years ended 31 March 2024 and 31 March 2025 to a verification limitation for outsourced systems in the year ended 31 March 2026. For the year ended 31 March 2024, database-level logging for direct changes was not enabled in accounting software used by Paras Healthcare and two subsidiaries.

The fiscal 2024 disclosure also covered one subsidiary location where software used from 1 April 2023 to 1 June 2023 did not have an audit-trail facility. The replacement software used from 2 June 2023 did not capture the user identification, or User ID, of the person making changes. Separately, the auditor could not verify outsourced accounting-system logs for one location each of Paras Healthcare and one subsidiary because the service-auditor report lacked information.

For the year ended 31 March 2025, a revenue and inventory system used by Paras Healthcare and two subsidiaries did not have database-level audit trails enabled from 1 April 2024 to 12 May 2024. The auditor also stated that a laboratory-record system used by Paras Healthcare did not log direct database changes. In contrast, fiscal 2026 did not identify a new period of disabled functionality; it recorded missing or incomplete Type 2 assurance evidence for outsourced accounting, payroll and laboratory systems.

Did the audit-trail exceptions modify Paras Healthcare’s audit opinion?

No, the audit-trail exceptions did not modify the audit opinions on the financial statements used in Paras Healthcare’s restated consolidated financial information. The examination report dated 31 August 2026 said the auditor’s reports for the three months ended 30 June 2026 and 30 June 2025, and for the years ended 31 March 2026, 2025 and 2024, expressed unmodified opinions.

The report also said the restated consolidated financial information contained no qualifications requiring adjustments. Rule 11(g) matters, Companies (Auditor’s Report) Order, 2020 observations and emphasis-of-matter paragraphs were disclosed where they did not require corrective adjustments. An unmodified opinion therefore did not eliminate the specific limitation on evidence for database-level direct changes in third-party systems.

What would make Paras Healthcare’s outsourced audit trails verifiable?

For outsourced audit trails to be verifiable, the applicable service-provider Type 2 reports would need to address the existence and operation of logs for direct database-level changes. In fiscal 2026, the accounting-system report lacked that information, while the payroll and laboratory reports were absent. The auditor’s conclusion was therefore an inability to comment, not a finding that the outsourced logs had failed.

Continuous operation and preservation are separate Rule 11(g) considerations. The fiscal 2026 report said audit trails had been preserved under statutory record-retention requirements, other than the consequential impact of the exceptions. Preservation of available records does not establish that all direct database changes were logged, which is why the service-provider assurance evidence remained relevant.

Conclusion

Paras Healthcare’s disclosures show that the nature of the audit-trail issue changed over the three reported years. The years ended 31 March 2024 and 31 March 2025 included systems or periods with disabled, absent or incomplete database-level logging, while the year ended 31 March 2026 centred on the auditors’ inability to verify outsourced-system logs from available Type 2 evidence.

The next relevant disclosure would be whether service-provider assurance reports subsequently address database-level changes in accounting, payroll and laboratory systems. The examination report dated 31 August 2026 said the auditor had not reviewed or audited financial statements after 30 June 2026 and had no responsibility to update its report for later events.