CORAA
AI Lab · Tools

CARO 2020 — clause by clause.

All 21 CARO 2020 reporting clauses in one place — what each requires, what to verify before signing, and sample observation language for both applicable and not-applicable cases. Built for the auditor at the desk on a 31-March sign-off.

Source — CARO 2020 (Notification 25 Feb 2020)·Updated 28 May 2026
Sample
Reporting requirement

Report whether (a) the company is maintaining proper records showing full particulars including quantitative details and situation of PPE and intangible assets; (b) PPE is physically verified at reasonable intervals; (c) title deeds of immovable property are held in the name of the company; (d) any revaluation has been done by a Registered Valuer; (e) any proceedings under the Benami Transactions (Prohibition) Act 1988 have been initiated against the company.

What to verify before signing
  • Fixed asset register completeness — qty, location, gross block, depreciation, NBV per asset
  • Physical verification programme — frequency, coverage, discrepancies reconciled
  • Title deeds physically inspected; mortgage / pledge status confirmed
  • Revaluation reports — Registered Valuer credentials, recency, methodology
  • Inquiry of management + check of show-cause notices / proceedings under Benami Act
Sample observation — applicable
(a) The Company is maintaining proper records showing full particulars, including quantitative details and situation, of property, plant and equipment and intangible assets. (b) Property, plant and equipment have been physically verified by the management during the year and no material discrepancies were noticed on such verification. (c) The title deeds of all the immovable properties are held in the name of the Company. (d) The Company has not revalued its property, plant and equipment or intangible assets during the year. (e) No proceedings have been initiated during the year or are pending against the Company as at 31 March 20XX for holding any benami property under the Benami Transactions (Prohibition) Act, 1988.
SA 501Ind AS 16 / AS 10Schedule II Companies Act 2013
On CORAAClause (i) auto-fills from the underlying ledger work — every observation traces back to the transactions that triggered it.
Using this with your audit

From the navigator to the working paper.

This navigator is a reference — what each clause requires and how a typical observation reads. Translating it into an actual signed annexure is where the audit work happens. Two complementary assets:

  • CARO 2020 Checklist template — downloadable Word file, your firm letterhead, all 21 clauses formatted to drop into the audit report annexure.
  • Audit prompt library — five CARO-specific prompts you can use with Claude / ChatGPT to draft clause-by-clause language once the underlying work is done.

And if you’d rather have CARO clauses populate themselves from the ledger work — CORAA’s Reporting hub does exactly that. Each clause flags from the underlying scrutiny + reconciliation + procedures work already done in the engagement. Signed off in a fraction of the time.

Note on scope
CORAA AI Lab is a free practice environment built by CORAA. It is not a certification, not a substitute for any qualification issued by the Institute of Chartered Accountants of India (ICAI), and does not award structured CPE hours. ICAI’s official AI programmes — including AICA Level 1 and AURA — remain the authoritative credentials for AI competency in audit. We recommend using the Lab alongside or in preparation for ICAI’s programmes.
For real client data — built differently
CORAA is the AI engine built for Indian audit — India-hosted, DPDPA 2023 compliant, no training reuse.
Seven hubs covering the whole engagement: Setup → Scrutiny → Reconciliation → Procedures → Working Papers → Findings → Reporting. 164 scrutiny rules across 13 modules. SA 230, 240, 320, 450, 510, 530, 570, 700 baked into the workflow.
India-hosted
Every byte on Indian soil. Azure India regions for all production workloads.
DPDPA 2023 compliant
Data-fiduciary obligations built in by default. Not bolted on after the fact.
ISO 27001:2022 · SOC 2 Type II
Certified and attested. The security baselines enterprise audit committees actually ask for.
No training reuse
Client data never enters any foundation model. Contractual, not aspirational.
See CORAA in 20 minutesExplore the AI ModulesVisit the Trust Centre