Policy Acknowledgment as Audit Evidence: What Makes an Employee Attestation Hold Up in India (2026)

Most companies can say they sent a policy to employees. Far fewer can prove, months later and under questioning, that a specific person accepted a specific version of it on a specific date, and that nobody has altered the record since. That gap between “we circulated it” and “we can prove it” is where policy acknowledgment programs fail audits, disciplinary cases and regulatory inquiries.

This guide is about the second half of acknowledgment: evidence. It looks at what Indian law and regulators actually say about attestation, what the Bharatiya Sakshya Adhiniyam, 2023 expects of an electronic record, and what a record should capture so it holds up. For the mechanics of collecting acknowledgments, see our guides on policy lifecycle management and acknowledgment tracking by industry.

Where Indian rules expect an attestation

For listed companies, an annual attestation is not a good practice. It is written into the SEBI Listing Regulations. The SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, as last amended on 14 July 2026, set out a chain of obligations:

• Regulation 17(5): the board must lay down a code of conduct for all members of the board and senior management, and the code must suitably incorporate the duties of independent directors under the Companies Act, 2013.
• Regulation 26(3): all members of the board and senior management personnel must affirm compliance with that code on an annual basis.
• Schedule V: the annual report must carry a declaration signed by the chief executive officer stating that the board members and senior management have affirmed compliance with the code.
• Regulation 46(2): the code of conduct must be disclosed on the company’s website.

A single CEO declaration in the annual report therefore depends on a set of individual affirmations collected during the year. If asked to substantiate it, the company needs the underlying records, not just the signed summary. Our guide to the mandatory policies for listed companies covers the wider checklist.

Outside listed companies the position is less prescriptive, but the logic is the same. Regulators, auditors, customers doing due diligence and courts all ask the same question about any policy: who was bound by it, and how do you know they accepted it?

What the evidence law asks of an electronic record

Most acknowledgments today are electronic, so the question becomes how an electronic record is proved. Under the Bharatiya Sakshya Adhiniyam, 2023, Section 63 deals with the admissibility of electronic records. Its main points are worth knowing even if you never see the inside of a courtroom, because they describe what a trustworthy record looks like.

Section 63(1) treats computer output as a document, admissible without producing the original, if the conditions in the section are met. Those conditions in Section 63(2) are about the system that produced the record:

• the computer or device was used regularly to create, store or process information for the activity in question, under the lawful control of the person running that activity;
• information of that kind was regularly fed into the system in the ordinary course of the activity;
• the system was operating properly, or if it was not, any lapse did not affect the record or its accuracy; and
• the record reproduces, or is derived from, the information fed into the system in the ordinary course.

Section 63(4) then requires a certificate to be submitted with the electronic record each time it is offered. The certificate in the Schedule to the Act has two parts, one completed by the party and one by an expert. Both ask for details of the device or source the record came from, and both ask for the hash value of the record and the algorithm used to obtain it, with a hash report attached.

This is not legal advice, and how courts apply Section 63 to a given record depends on the facts. The practical lesson is simpler: an acknowledgment record is far easier to defend if the system that holds it is run in the ordinary course of business, logs reliably, and can show that records have not been altered.

Electronic signatures and electronic contracts

Two provisions of the Information Technology Act, 2000, as amended in 2008, matter for acknowledgments that act like an agreement, such as a code of conduct sign-off or a confidentiality undertaking.

Section 3A allows a subscriber to authenticate an electronic record with an electronic signature technique that is considered reliable and is specified in the Second Schedule. A technique counts as reliable if the signature data is linked to the signatory and no one else, was under the signatory’s control when signing, and any later alteration to the signature or to the signed information can be detected. Those conditions are set out in the text of the Information Technology (Amendment) Act, 2008.

Section 10A adds that where the proposal, acceptance or revocation in forming a contract is expressed in electronic form, the contract is not unenforceable solely because electronic means were used. That removes one objection, but it does not by itself prove who accepted what.

Whether an acknowledgment needs a formal electronic signature, or a logged confirmation by an authenticated employee is enough, depends on the document and the risk. A routine acknowledgment of a leave policy and a signed confidentiality undertaking are not the same thing, and your counsel should set the standard for each.

What a defensible acknowledgment record captures

Putting those pieces together, here is what we recommend each acknowledgment record holds. This is our checklist, drawn from the principles above, not a statutory list.

1. Who: the authenticated identity of the employee, tied to a unique employee ID, with the role and entity at that time.
2. What: the exact policy and version, with a version number and effective date, and a fingerprint of the document content so the text can be shown not to have changed.
3. When: a reliable date and time stamp taken by the system, not typed by the user.
4. How: the method of acknowledgment, such as an authenticated in-app confirmation or a signed attestation.
5. What came before: when the policy was assigned, the reminders sent and any escalation, so a missing acknowledgment is explained rather than invisible.
6. Integrity: an audit trail that is tamper-evident, so that any later edit or deletion is detectable.
7. Retention and retrieval: the record is kept for as long as the policy might be relied on, and can be produced quickly for one employee or for a whole population.

Version control is the item most often missing. An acknowledgment is only meaningful if it is bound to one version of the text. Our guide to policy version control and legal risk explains why overwriting a policy file silently can undermine every acknowledgment already collected.

The audit evidence pack

When an auditor or regulator asks about a policy, the quickest way to close the question is a ready pack. For each in-scope policy, be able to produce:

• the approved policy, its approval record and its full version history;
• the list of people it applies to on a given date, and how that list was decided;
• the acknowledgment record for each of them, tied to the right version;
• the list of people who have not acknowledged, with the reminders and escalations sent;
• the date the next review is due and who owns it.

Our policy audit checklist shows how this pack fits into a wider audit preparation routine.

Six ways acknowledgment evidence falls apart

• The checkbox with no version. The employee ticked “I agree”, but the record does not say to what.
• The overwritten document. The policy was edited in place, so the text employees accepted no longer exists.
• The email read receipt. It shows a message was opened, not that the policy was read, understood or accepted.
• No assignment record. Nobody can show who was supposed to acknowledge, so a gap cannot be measured.
• Editable spreadsheets. A tracker anyone can change is a weak record for anything contested.
• A language the employee does not read. A policy delivered in a language the employee cannot follow weakens the acknowledgment. See our guide on multilingual HR policies.

The Code of Conduct and Ethics Policy and Whistleblower and Ethics Policy templates in our library are good starting points. Each can be personalized with your company name and downloaded as a PDF.

How PolicyCentral.ai helps

PolicyCentral.ai records acknowledgments against the exact version of each policy and keeps them in a tamper-evident audit trail. It routes drafts through approval, distributes each version to the specific audience it applies to, delivers it in ten Indian languages, and sends reminders and escalations so gaps are visible and explained. When an auditor asks who accepted what and when, the answer is a report, not a search through inboxes.

If you are preparing for an audit or an annual code of conduct affirmation, request a demo and bring the policy you would find hardest to defend. It is the quickest way to see what a complete evidence record looks like. This guide is for general information and is not legal advice.

Frequently Asked Questions