SFC Environmental Technologies audit trails had control gaps

SFC Environmental Technologies Limited disclosed that its accounting-software audit trails had control gaps across FY24, FY25 and FY26. Two subsidiaries had no edit log throughout FY24, one had none throughout FY25, and direct database changes were not logged at database level in FY26, although auditors reported no identified tampering in FY24 and FY26.

What audit-trail control gaps did SFC disclose?

SFC said Tally Prime Edit Log recorded changes within the accounting software, but the edit-log facility was not enabled at database level to log direct data changes in FY25 and FY26. An audit trail, also called an edit log, records changes to accounting entries; database-level logging would cover direct changes made at the database level rather than through the stated software function. For the year ended March 31, 2026, SFC said the holding company, subsidiary companies and associate company incorporated in India used Tally Prime Edit Log and that the feature operated throughout the year.

SFC also said it had been informed that once the edit-log functionality is enabled in Tally Prime Edit Log, even an administrator cannot disable it. That stated safeguard applies to the enabled software feature, while the FY26 disclosure separately identifies the absence of database-level logging for direct data changes. The distinction means full-period operation of the software edit log did not extend to the database-level route described in the auditor comment.

How did edit-log coverage change from FY24 to FY25?

SFC reduced the number of subsidiaries without edit logs throughout the year from two in FY24 to one in FY25, but partial-year and database-level gaps remained. In FY24, ended March 31, 2024, the holding company and two subsidiaries enabled the feature from April 17, 2023, another subsidiary from April 18, 2023, and one subsidiary from June 13, 2023. Two subsidiaries did not have the feature enabled throughout FY24.

In FY25, ended March 31, 2025, SFC said the holding company and four subsidiaries had the feature enabled and operating throughout the year. One subsidiary had the feature enabled from a date reproduced in the disclosure as “between 27, 2024,” without a stated month, and another from December 13, 2024. A further subsidiary did not have the feature enabled throughout FY25; for the periods in which the two partially covered subsidiaries had the feature enabled, SFC said it operated for all relevant transactions recorded in the software.

The FY24-to-FY25 comparison shows a narrower disclosed entity-level gap, rather than evidence that all accounting changes were logged for either year. Entries before the activation dates in FY24 and FY25 were outside the periods for which SFC said the facility operated. Both FY25 and FY26 also retained the stated exclusion for direct database changes, regardless of the wider use of Tally Prime Edit Log at group entities.

Did auditors find tampering or require financial adjustments?

SFC reported that auditors did not identify an instance of audit-trail tampering in FY24 or FY26, and the audit-trail comments did not require corrective adjustments to the restated consolidated financial information. For FY26, auditors said their procedures on the accounting software did not identify tampering and that SFC preserved the audit trail in accordance with statutory record-retention requirements. The same FY26 comment also stated that database-level logging for direct changes was not enabled.

For FY24, auditors similarly said their procedures did not identify an instance of audit-trail tampering, even though two subsidiaries had no enabled edit log throughout the year ended March 31, 2024. SFC said reporting under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014 on preserving the audit trail was not applicable for FY24 because the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 applied from April 1, 2023. The supplied FY25 extract sets out activation dates and the database-level limitation, but does not reproduce an equivalent conclusion on tampering.

SFC said there were no audit qualifications in the auditors’ reports or internal-financial-control reports for the quarters ended June 30, 2026 and June 30, 2025, or for FY26, FY25 and FY22, that required corrective action. The document separately recorded FY24 restatements and reclassifications, including a reduction in revenue from operations to Rs 657.50 crore from Rs 658.39 crore after eliminating an intragroup transaction. It did not state that the audit-trail observations caused that revenue restatement or any reported profit adjustment.

What do the related FY24 restatements show?

SFC’s FY24 restatements show that the audit-trail comments were presented as non-adjusting auditor observations rather than as a stated cause of changed earnings. Restated FY24 profit after tax was Rs 144.17 crore, with no adjustment shown against the audited consolidated figure in the displayed comparison. Total income was restated to Rs 676.74 crore from Rs 677.64 crore, while total expenses were restated to Rs 485.70 crore from Rs 486.60 crore.

SFC also corrected the disclosure of fixed deposits under lien for FY24 to Rs 166.53 crore from Rs 160.30 crore previously reported. The company reclassified trade receivables between current and non-current categories in line with the practice followed for June 30, 2026, while keeping aggregate receivables at Rs 394.51 crore. These corrections are distinct from the FY24, FY25 and FY26 edit-log disclosures because the document does not link them to missing logs or the database-level limitation.

What remains unresolved in SFC’s audit-trail controls?

SFC’s disclosed unresolved control boundary is database-level logging of direct data changes, which was absent in both FY25 and FY26. The FY26 statement that the software feature operated throughout the year depends on Tally Prime Edit Log continuing to be enabled for the holding company, subsidiaries and Indian associate. It does not state that database-level recording had been added by March 31, 2026.

SFC disclosed no plan, timetable or commitment to enable database-level logging. Future disclosures would need to address both the direct-database-change limitation and sustained full-period operation across relevant group entities to remove the specific gaps described for FY24 and FY25. The source supports a reported control position through FY26, but not a stated remediation date beyond that period.

Conclusion

SFC disclosed an improvement in entity-level edit-log coverage from two subsidiaries without logs throughout FY24 to one in FY25, followed by FY26 operation of the software feature across the stated Indian group entities. However, direct database changes remained outside database-level audit-trail logging in FY25 and FY26, so the reported control coverage was not complete.

The next disclosure to watch is whether SFC states that database-level logging has been enabled and whether every relevant entity has full-period coverage after FY26. The supplied information contains no remediation timetable, while the FY26 auditor comment says the enabled audit trail was preserved under statutory record-retention requirements.