Varmora Granito lacked database audit logs across group for three years

Varmora Granito Limited disclosed database-level audit-trail gaps in fiscal 2024, fiscal 2025 and fiscal 2026. Walker Chandiok & Co LLP reported that direct changes to accounting data were not logged at the database level across the group in fiscal 2026, although the auditors reported no identified audit-trail tampering during their examinations.

What did Varmora Granito’s auditors find about database logging?

Varmora Granito’s auditors found that accounting software lacked database-level audit trails to record direct data changes. For the year ended 31 March 2026, the exception covered the holding company, its subsidiaries, associates and joint venture, while the report said audit trails otherwise operated throughout the year for relevant transactions recorded in the software.

An audit trail, also called an edit log, records changes made in accounting software. The disclosed exception concerned logging at the database level, which relates to direct changes in underlying accounting data rather than changes made through the application. The auditors did not state that direct changes occurred; they stated that such changes would not be logged through the database-level feature.

Walker Chandiok & Co LLP said its fiscal 2026 examination included test checks and work performed by the respective auditors of associates and the joint venture. The firm said it and those other auditors did not come across an instance of audit-trail tampering, apart from the consequential impact of the listed exceptions. That conclusion was reached despite the disclosed absence of database-level logs for direct changes.

How did the audit-trail exception change from fiscal 2024 to 2026?

The database-level exception continued through all three years, but the stated coverage changed between fiscal 2024 and fiscal 2026. Fiscal 2024 identified specific software at the holding company, subsidiary and two associates, while fiscal 2026 described the exception across the holding company, subsidiaries, associates and joint venture.

Fiscal 2024 also included a broader application-level exception at two associates. Audit trails were not enabled for revenue, trade receivables, the general ledger, and property, plant and equipment records. The fiscal 2025 and fiscal 2026 reports did not describe that category-specific associate exception in the same terms, but each retained a database-level exception.

The application-level issues were distinct from the database-level issue. In fiscal 2025, the holding company and subsidiary lacked application-level logging from 1 April 2024 to 4 April 2024; in fiscal 2026, a subsidiary’s application-level feature was not enabled until 27 February 2026. Neither observation removed the continuing fiscal 2026 exception for direct database changes.

Why does the database-level audit-trail gap matter for financial records?

The database-level audit-trail gap matters because Varmora Granito’s restated consolidated financial information combines records from multiple entities. For fiscal 2026, one subsidiary and five associates or joint ventures audited by other auditors had total assets of Rs 115.737 crore and total revenues of Rs 117.326 crore included in the consolidated financial statements.

The limitation affects the ability to review the history of direct changes to accounting data in the software used to maintain books of account. The supplied disclosure does not establish an accounting error, fraud, or manipulated transaction. Instead, the auditors reported using test checks and verification of supporting evidence to obtain reasonable assurance over the restated consolidated financial information.

Varmora Granito reported total assets of Rs 1,509.871 crore at 31 March 2026, compared with Rs 1,589.804 crore at 31 March 2025. Trade receivables were Rs 382.667 crore at 31 March 2026 and Rs 382.215 crore a year earlier. A complete record of direct amendments would be relevant to balances that arise from accounting records, but the report does not quantify any changes made outside the application.

Did the auditors require Varmora Granito to restate its financial figures?

No, the audit-trail observations did not require adjustments to Varmora Granito’s restated consolidated financial information. Walker Chandiok & Co LLP stated in its 4 June 2026 report that the restated information did not require adjustments for the audit-report matters, including the Rule 11(g) observations under the Companies (Audit and Auditors) Rules, 2014.

The restated information covered the years ended 31 March 2024, 31 March 2025 and 31 March 2026. It incorporated retrospective adjustments for changes in accounting policies, material errors and regrouping or reclassification in fiscal 2025 and fiscal 2024 to align those periods with the accounting treatment and classifications used in fiscal 2026. The report did not identify those adjustments as corrections resulting from the audit-trail exceptions.

The auditor’s opinion on components audited by other auditors was not modified in respect of those matters. The report said the restated information was prepared under the Companies Act, 2013, the Securities and Exchange Board of India (Issue of Capital and Disclosure Requirements) Regulations, 2018, and the Institute of Chartered Accountants of India guidance note on reports in company prospectuses. Those requirements did not remove the separately disclosed database-level logging exception.

What would show that the Varmora Granito control gap has closed?

A later auditor statement would need to report that database-level audit trails had been enabled and operated for the relevant accounting software throughout the reporting year. The fiscal 2026 exception identifies the missing mechanism directly: the database-level feature was not enabled to log direct data changes in software used to maintain books of account.

The fiscal 2026 report also links operation with preservation. Subject to the listed exceptions, it said audit trails were preserved by the holding company, subsidiaries, associates and joint venture in accordance with statutory record-retention requirements from the date the audit trail was enabled. Varmora Granito disclosed no timetable or remediation plan for the database-level issue in the 4 June 2026 report.

A separate earlier-period preservation issue remains disclosed. For one discontinued accounting software, application-level audit trails were not preserved from 1 April 2023 to 31 March 2024, an exception reported in fiscal 2025 and fiscal 2026. Enabling logging in a later period would not recreate records that were not retained for that 12-month period.

Conclusion

Varmora Granito’s three-year disclosure identifies a control and auditability limitation, not a reported instance of data tampering or a financial restatement caused by the issue. The scope of entities and software described changed between fiscal 2024 and fiscal 2026, but each year included an exception for database-level logging of direct accounting-data changes.

The next relevant disclosure is a subsequent audit report covering a later financial year. Varmora Granito’s 4 June 2026 auditor report disclosed no remediation timetable, so evidence that the gap has closed would depend on a later statement that database-level audit trails were enabled, operated throughout the year and preserved for the relevant entities and software.