Zoho Books Approvals and Audit Trail: Controls Auditors Expect

Which transactions can need approval in Zoho Books?

Approvals are set per module, so you can control purchasing tightly while leaving low-risk sales documents open. Zoho's help pages list approval support for quotes, sales orders, invoices, retainer invoices, credit notes, sales returns, purchase orders, purchase receives, bills, payments made, vendor credits, transfer orders, inventory adjustments and custom modules.

There are four approval types, chosen per module.

How do you set up an approval workflow?

1. 1Decide which modules need approval and who approves each one, in writing.
2. 2In Zoho Books, open Settings and select the module, for example Purchase Orders.
3. 3Open the Approvals tab and choose Simple, Multi-Level or Custom Approval.
4. 4For multi-level, add approvers for each level and drag the levels into the right order.
5. 5For custom approval, define criteria such as total amount and map each rule to an approver.
6. 6Set notification preferences so approvers and submitters are told about each step.
7. 7Save, then test with a low-value transaction before telling the team.

In multi-level approval, the level 1 approver is notified first by email and in-app, and each later approver only after the previous level approves. Submitters cannot approve their own transactions unless you tick the option that allows it. Leave that off if segregation of duties matters to your auditors.

Approvals also affect automation. With approval switched on for invoices, recurring invoices are approved before they are sent or charged, so check your recurring profiles after you turn approvals on.

How should you design user roles in Zoho Books?

Roles decide who can see and do what. Zoho Books includes Admin, Staff, Timesheet Staff and Staff (Assigned Customers Only), plus a single Super Admin who created the organisation. Staff can use all modules except reports, settings and the accountant module. Only admins can add or edit users.

For most growing companies the default roles are too broad. Create custom roles under Settings > Roles with only the modules and actions each job needs. Segmented access control can restrict records by location, reporting tag or bank account, which suits businesses with branches or separate divisions.

• Keep admins to two or three people, ideally not the same people who raise purchases.
• Separate the person who creates vendors from the person who pays bills.
• Give external accountants their own login, never a shared one.
• Remove leavers on their last day and review the user list every quarter.

What does the Zoho Books audit trail record?

The Activity Logs report records what happened, when, in which module and by whom. You can filter by date range, module, customer or vendor, user and action type (create, update or delete), and there is a filter for changes to personally identifiable information fields. The report can be exported or printed.

Audit Trail goes further. From an activity you can open the versions of a transaction and compare any two side by side, with edited, added and deleted fields highlighted in different colours. Zoho's help page says this version comparison is available for organisations in India, the UK, the UAE, Saudi Arabia, Bahrain and EU countries, and that admin access is needed to view it. If you are elsewhere, check availability for your edition.

Every edit creates a new version, so reviewers can see the before and after values on an invoice or bill without relying on someone's memory.

How does Transaction Locking protect closed periods?

Approvals control new transactions; locking protects old ones. Under Accountant > Transaction Locking you can set lock dates for Sales, Purchases, Banking and Accounts separately or lock everything with one date. A reason is required to lock, change or remove a lock.

Partial Unlock opens a date range for a specific correction, again with a reason, and you can disable it so locked periods can never be changed. Partial unlock is not available to organisations that track inventory items. Lock each month as part of the close, and keep the lock history as evidence for auditors.

What controls do auditors look for in different markets?

Auditors everywhere test the same basics: who can create and approve transactions, whether closed periods can be changed, and whether changes leave a trail. Some markets add specific rules.

• India: the Companies (Accounts) Rules require companies to use accounting software with an audit trail feature that cannot be disabled, recording each change. Your auditor can confirm how this applies to you. Zoho Books supports audit trail for Indian organisations; confirm settings with your auditor.
• UK and EU: GDPR applies to customer and vendor personal data. The PII filter in Activity Logs helps you show who changed personal data fields.
• UAE and Saudi Arabia: tax authorities can review VAT records, so approval and locking around filed VAT periods matters. Zoho lists role-based access for generating, locking and filing UAE VAT returns.
• USA and Canada: most private SMBs are not subject to the same rules as listed companies, but lenders, investors and buyers in due diligence often ask for approval limits, segregation of duties and evidence of review.

What mistakes weaken controls in Zoho Books?

• Giving everyone the Admin role to avoid permission errors.
• Allowing approvers to approve their own transactions.
• Adding approval to every module, so people wait days and find workarounds.
• Never locking periods, or reopening them without recording why.
• Sharing one login between staff, which makes the audit trail meaningless.

Flowpeak designs approval matrices, roles and locking rules in Zoho Books and documents them in a form auditors can follow. We work remotely from Chennai, and can start with a review of your current setup. Pricing is quoted in writing after a free scoping call.

Frequently asked questions