Meta description: Compliance evidence helps Indian businesses prove filings, payments and controls. Build an audit-ready register with retention rules and checklists.

A GST officer can treat unaccounted goods as supplied and determine the tax payable under Section 35(6) of the Central Goods and Services Tax Act, 2017. A return acknowledgement alone may not save you if the invoice, stock record, payment trail and approval behind it cannot be produced. That is why compliance evidence is not clerical housekeeping; it is the proof that turns “we complied” into a defensible answer.

For an Indian SME, the problem is usually fragmentation: a licence sits in email, a challan with the accountant, and an inspection closure on someone’s phone. This guide shows how to convert that mess into an audit-ready compliance evidence system.

Why compliance evidence matters more than a filing receipt

Compliance evidence is the set of records that proves an obligation was identified, completed correctly, approved, filed or performed on time, and kept for the required period. It includes more than government acknowledgements.

Consider a monthly GST return. A complete evidence pack may contain:

The acknowledgement proves that something was filed. The rest proves that the filing was accurate.

During an audit, due diligence exercise or inspection, the reviewer asks: What rule applied? What did you do? When did you do it? Where is the proof? If the fourth answer needs two days and six WhatsApp messages, the business is not audit-ready.

What counts as strong compliance evidence?

A document is useful evidence only when another person can understand and verify it without relying on the employee who created it. Apply this five-part test to every record.

  1. Identity: Does the record name the legal entity, establishment, GSTIN, licence number or employee population to which it relates?
  2. Period: Does it state the month, quarter, financial year or validity period covered?
  3. Authority: Can you identify the source, preparer, reviewer and approving person?
  4. Integrity: Can you show that the record has not been silently changed after approval or filing?
  5. Traceability: Can the record be connected to the obligation, transaction and government acknowledgement it supports?

A screenshot named final-final-2.png fails this test. A PDF acknowledgement named GSTIN_GSTR3B_2026-07_ARN.pdf, linked to its reconciliation and challan, passes it.

Build six evidence layers

Do not create one giant folder called “Compliance.” Build an evidence pack around each obligation:

Evidence layer | What to keep | Example

Applicability | Rule, threshold and reason it applies | GST registration, factory headcount or FSSAI licence category

Source | Current law, rule, notification or regulator instruction | Gazette notification or official portal advisory

Working papers | Calculation, reconciliation or inspection checklist | Input tax credit reconciliation

Approval | Named review and sign-off | Finance head approval dated before filing

Submission | Filed form, ARN, challan or inspection report | GSTR-3B ARN and payment receipt

Closure | Query response, corrective action and final acceptance | Inspector’s closure letter or portal status

The applicability layer is the most neglected. Without it, teams keep documents for familiar filings but miss obligations triggered by a new state, product line, employee threshold or licence condition. An obligation register identifies what must be done; an evidence register proves that it was done.

Which Indian laws set specific evidence rules?

There is no universal Indian retention period for every compliance record. Each law sets its own records, format, location and retention rules. Central laws may also leave forms and preservation periods to the appropriate Central or State Government. Your evidence register therefore needs a separate legal-basis and jurisdiction field.

GST records: preserve the transaction trail, not only returns

Section 35(1) of the Central Goods and Services Tax Act, 2017 requires a registered person to keep true and correct accounts of production or manufacture, inward and outward supplies, stock, input tax credit, output tax and other prescribed particulars. Rule 56 of the Central Goods and Services Tax Rules, 2017 adds invoices, bills of supply, delivery challans, credit and debit notes, e-way bills and activity-specific records.

Rule 56 is particularly useful for designing digital evidence controls:

Section 36 of the CGST Act requires relevant accounts and records to be retained for 72 months from the due date of the annual return for that financial year. If an appeal, revision, proceeding or investigation is open, keep the relevant records until one year after final disposal or the normal Section 36 period, whichever is later. Do not run a blind “delete after six years” job; the starting point is the annual-return due date, and a legal hold may extend it.

Company records: eight financial years is the floor

Section 128(5) of the Companies Act, 2013 requires every company to keep books of account and the vouchers supporting entries for at least eight immediately preceding financial years. If an investigation is ordered, the Central Government may direct a longer period. The current India Code text of Section 128 also permits electronic books subject to the prescribed manner.

Connect ledger entries with vouchers, invoices, contracts, bank proof and authorisation. Section 128(6), as amended, provides a fine from ₹50,000 to ₹5 lakh for the responsible managing director, finance director, chief financial officer or other board-designated person who contravenes the section. The old imprisonment language was removed in 2020.

Food businesses: shelf life can extend the retention period

Food businesses need operational proof, not merely an FSSAI licence. Part II of Schedule 4 to the Food Safety and Standards (Licensing and Registration of Food Businesses) Regulations, 2011 covers records for processing, production, storage, distribution, food quality, laboratory tests, cleaning, sanitation, pest control and product recall.

FSSAI’s official audit and documentation guidance states that these records should be retained for one year or the shelf life of the product, whichever is longer. A food manufacturer selling a product with an 18-month shelf life therefore should not discard the supporting batch and test records after 12 months.

Keep evidence by batch: raw-material source, incoming inspection, production controls, laboratory result, cleaning log, dispatch traceability and recall action.

Labour records: use the post-November 2025 framework

India’s four labour codes came into force on 21 November 2025, according to the Ministry of Labour and Employment. Old checklists that still present the Factories Act, 1948 and the Payment of Wages Act, 1936 as the operative central framework need review.

Section 33 of the Occupational Safety, Health and Working Conditions Code, 2020 requires prescribed registers covering matters such as work performed, normal hours, rest days, wages, leave, overtime, attendance, dangerous occurrences and adolescent employment. It also requires wage slips and prescribed returns. The Ministry’s 2026 Compliance Handbook for Employers describes registers of employees, attendance-cum-muster roll, wages, overtime, deductions and dangerous occurrences, with electronic maintenance and annual returns as prescribed.

Jurisdiction still matters. The “appropriate Government” may be the Central Government or a State Government depending on the establishment, and state rules can prescribe the operative form and process. Record the applicable rule set beside each register. Do not copy a Maharashtra factory’s evidence schedule into a Karnataka establishment and assume the forms are identical.

How to create a compliance evidence register

A compliance evidence register is an index, not a dump of documents. One row should represent one obligation for one period or event. Start with these columns:

Field | Purpose

Evidence ID | Stable reference such as GST-GSTR3B-GJ01-2026-07

Legal entity and location | Prevents proof from one unit being reused for another

Obligation | Plain-language name of the filing, payment or control

Legal basis | Act, section, rule, notification and jurisdiction

Trigger or frequency | Monthly, annual, event-based, threshold-based or renewal

Due date and completion date | Shows timeliness

Owner and reviewer | Creates accountability

Evidence links | Working papers, approval, submission and closure

Retention rule | Period, start event and legal-hold override

Status | Missing, in progress, complete, expired or under legal hold

Last verification date | Shows whether the source and link still work

Use links rather than pasting files into the register. For example, a July 2026 GSTR-3B row should link to the reconciliation, approval, return, ARN and challan. Cite Sections 35 and 36 of the CGST Act and Rule 56, and calculate retention from the annual-return due date rather than writing “six years.”

A 30-day plan to become audit-ready

Trying to reconstruct every record since incorporation will stall. Start with current high-risk obligations and work backwards.

  1. Days 1-3: map scope. List every entity, branch, factory, warehouse, state, licence and regulator. Note employee counts, turnover thresholds, products and regulated activities.
  2. Days 4-7: identify obligations. Separate central, state, municipal and sector requirements. Use a regulatory change tracking process so the list stays current.
  3. Days 8-12: rank risk. Prioritise tax, licence, worker safety, payroll and environmental obligations by impact and evidence weakness.
  4. Days 13-18: define evidence packs. Specify the applicability note, working paper, approval, submission and closure proof.
  5. Days 19-23: collect and test. Ask an outsider to retrieve five random packs. More than ten minutes is a failure.
  6. Days 24-27: fix controls. Assign owners, naming rules, access restrictions, retention dates, backups and legal holds.
  7. Days 28-30: run a mock notice. Produce one regulator’s complete response pack within two hours, then close the gaps.

Do not make the CA, CS or EHS consultant the only custodian. Require periodic handover of source files, acknowledgements and working papers. Never backdate or overwrite an incorrect record; correct it transparently and preserve the previous version. GST Rule 56 specifically requires a log of electronic edits and deletions.

Compliance evidence checklist for Indian SMEs

Use this quarterly check with the finance, HR, operations and compliance owners:

This checklist is a control test, not legal advice. Applicability changes with entity type, location, industry, workforce, turnover and licence conditions.

Turn compliance evidence into a repeatable operating habit

The best compliance evidence system is boring: every obligation has an owner, every completion creates the same proof pack, and every retention date has a legal basis. It does not depend on one heroic employee remembering which folder contains the challan.

Start with obligations that can stop operations, create tax exposure or injure workers. Review the register quarterly and whenever the business opens a location, launches a product, crosses a workforce threshold or receives a regulatory update.

Compliance Radar helps identify the compliances and government schemes that apply to your specific business and tracks changes across jurisdictions. It does not replace your source documents or professional adviser; it helps make sure you know which obligations and evidence packs should exist. Check your compliance posture free at complianceradar.in and use the result to build your evidence register in risk order.

Frequently asked questions

What is compliance evidence?

Compliance evidence is verifiable proof that a legal or regulatory obligation was identified, performed, reviewed and completed on time. It includes applicability notes, calculations, approvals, filed forms, payment proof, licences, registers, inspection records and closure communications.

Is a government filing acknowledgement enough evidence?

Usually not. An acknowledgement proves submission, but an auditor may also need the source transactions, reconciliation, calculation, payment trail and approval. The exact pack depends on the Act, rules, regulator and nature of the obligation.

How long must an Indian business keep compliance records?

There is no single period. GST records generally follow the 72-month rule in Section 36 of the CGST Act; company books and supporting vouchers follow the eight-financial-year floor in Section 128 of the Companies Act; specified FSSAI operational records follow one year or product shelf life, whichever is longer. Proceedings, investigations and sector rules may extend these periods.

Can compliance evidence be stored electronically?

Yes, where the applicable law and rules permit it. Electronic storage must still satisfy requirements for accessibility, authentication, integrity, backups and production on demand. GST Rule 56 specifically addresses backups, edit logs, readable production and audit-trail explanations.

Who should own the compliance evidence register?

One internal role should own the register, while operational owners supply evidence for their obligations. Finance may own GST, HR may own labour records, operations may own licences, and EHS may own safety and environmental evidence. A CA, CS or lawyer should review legal accuracy, not remain the sole custodian.

What is the difference between an obligation register and an evidence register?

An obligation register says what must be done, by whom and when. An evidence register says how the business proves that the obligation was completed. Link the two through a stable obligation ID so a reviewer can move from requirement to proof without searching.

How often should compliance evidence be tested?

Test high-risk evidence monthly and the full register at least quarterly. Also run a retrieval test after a system migration, adviser change, new location, licence renewal or major regulatory amendment. The practical standard is simple: a person outside the process should retrieve and understand a sampled pack within ten minutes.